OPSEC in Practice: Bitcoin vs. The Surveillance State

All right. Hello, everybody. Thanks for stopping by. We have 30 minutes. Actually, we have 26 minutes, so we're already behind. We have three people here who think differently about privacy and tackle it from their own angle, so I’ll keep this intro pretty short.

​

Here’s where we are today. The Samourai case and the Tornado Cash case made one thing very clear in recent times: building privacy tools in and around Bitcoin is now something that governments are actively looking to prosecute in most of the world. Financial privacy is no longer something you can expect to be given. It is something you have to actively defend.

​

The premise for this panel is pretty simple. In 2026, what is the state of play? What actually works? What should you be doing? What should you maybe not be doing? And where are we losing ground? Rather than read everyone’s bios, I’m going to let each of you introduce yourself briefly. Let us know who you are and why this fight matters to you. Naomi, we’ll start with you.

​

My name is Naomi Brockwell. I’m president of the Ludlow Institute. We are a 501(c)(3) that focuses on freedom through technology. We mainly focus on decentralized tech and privacy tech, and on trying to proliferate tools that can give people back their freedom.

​

I’m in this fight because I see the surveillance state ballooning, and I think we have a limited window of time to actually get tools into people’s hands before there is a giant power grab. If that happens, we will lose all that freedom. Privacy is the foundation of a free society, and if we lose it, we’re screwed. So that’s why I’m in this battle.

​

I’m Seth For Privacy. I’m chief operating officer at Cake Wallet. We’re trying to make Bitcoin privacy, along with privacy coins, really achievable, simple, and straightforward. As you mentioned, if your financial privacy falls apart, all of your other human rights very rapidly deteriorate after that. So we’re trying to solve the financial privacy side and make it something that is not just for nerds by nerds, but something the average person can actually leverage.

​

I’m OpnState. I’m an anonymous nym. I used to be a banker, and then I got disillusioned after the financial crash. I saw the corruption from within, and I really hated what I was seeing. I wanted to make a difference in the world, so I applied to work in government on policy and legislation. I figured that was where I could actually make a difference.

​

When I joined the government, the first thing I was asked to do was write AML legislation. My heart just slumped, but I still did it for seven years because I wanted somebody like me to do the AML regulation in my country instead of somebody else. After a while, I couldn’t take it anymore. I had to speak up. I saw the subversion of state sovereignty by global standard-setting bodies, and I said, screw this, I’m going to put on a mask and do a couple of podcasts. That’s why I’m here today, to raise awareness of what’s happening within governments.

​

I want to start with the state of play because things are moving quickly. Advice you hear around podcasts and conferences can get stale pretty quickly. So I want to take a quick snapshot of where we’re at. OpnState, you mentioned that you worked inside government on policy. What’s the single biggest thing coming down the pipe in the next 12 months that people in this room should be aware of when it comes to their privacy?

​

Can I go for two? Let’s see how long you take with the first one.

​

The bad news is that regulators are usually two to three years behind. Two or three years ago, we saw the emergence of decentralized finance and non-custodial solutions: non-custodial wallets, hosted wallets, DeFi protocols, smart contracts. Regulators are now wise to this. When I was in government just a few months ago, I saw initiatives focused on hardware wallets, hosted wallets, DeFi protocols, smart contracts, and non-custodial solutions. That is the target for anti-money laundering regulation this year. I would not be surprised to see a pretty heavy ban hammer come down and squash privacy there.

​

But the biggest issue is not just bad news. There is also terrible news. The terrible news comes on the tax side. There is a new initiative called the Crypto Asset Reporting Framework. It is set up by the OECD, a global standard-setting body, so you don’t have any say in what it does. It requires crypto companies to record your personal data and the data on all of your transactions, send it to the state, and have it shared with other countries for tax purposes. It is completely going to squash privacy.

​

They want to implement this for DeFi, decentralized finance, and non-custodial solutions. There is actually a Wayback Machine FAQ you can look at. This is exactly what they want to do. It’s coming, and it’s horrible. We need to push back, or at least be aware that it is coming.

​

Naomi, Seth, what about you? What in the last 12 or 13 months has altered how you approach your own privacy?

​

I have some counterpoints. You talked about how they are going after DeFi and want to apply these things to DeFi. The whole value proposition of DeFi is that there is no choke point to go after. When things are truly decentralized, that is the solution here. We’re not asking for permission, and we never expected governments would agree with this stuff forever. We knew this was coming, which is why we have been building out all kinds of decentralized infrastructure so they can’t dictate what we do with our finances. We just don’t recognize their moral authority in being able to make those choices for us.

​

I see the coming battle too, and I think we should be prepared for it. But I also don’t think we should be overwhelmed and think we can’t win. We can absolutely win. It’s about building that underground railroad of tools that allow our freedom, even when authoritarian regimes come down and tell us we can no longer do with our money what we want to do. We have to remember the power that is in this tech and lean into it.

​

I’ve done some work on the legislative side too. I helped write a bill that was released in the House on Thursday, federal privacy legislation that basically says if the government wants to do a search, they need a warrant. That’s really simple, and I thought we had a Fourth Amendment that already said that. Apparently we need a bill to define what a search is, because for a long time governments have been carving out all kinds of areas where they say, this isn’t a search, we’re just querying Google’s database. That’s not a search, so we don’t need a warrant. Or they say, we’re just querying our own database that we filled with all the data we bought from data brokers. That’s not a search.

​

The bill basically defines search. It says that a meaningful investigation of personal information is a search, and you need a warrant. You need judicial oversight. I hope people will reach out to their representatives and say, please sign on and be a co-sponsor of the Surveillance Accountability Act. As far as I can see, the third-party doctrine carve-out that governments are currently operating under is absolutely atrocious for privacy. The carve-outs get larger and larger every year, and we are ballooning toward that panopticon. We have to rein that in quickly.

​

I’ll double down on that optimism. We can build tools where it doesn’t matter if they make regulation. That’s the whole reason self custody matters. That’s the whole reason open source tools matter. If Cake Wallet goes away tomorrow, it’s open source. You could go build it yourself if you have to. If all the app stores remove it, you can still sideload it. We have no server infrastructure you rely on. You can run your own node. If every other node goes down, you can still use it.

​

The entity can be attacked, yes. But building tech in a way that is actually freedom tech, decentralized whenever possible, open source, and empowering the individual, is the way we push back.

​

The important thing to keep in mind when regulation is coming is that we often have windows to build. They come in bursts, where we have a more open environment, where we can build in the open and accelerate more rapidly. We can do it in a way where we don’t necessarily have to be anonymous. But that will not always be true. It has not always been true, and we have gone through fits and starts in the Bitcoin space.

​

Building open source, always doing self custody, and doing decentralization whenever possible and necessary is the way we fight back. Even when they crack down, which will probably happen in most countries, it’s just a matter of time, the tools are there and you can use them no matter what they try to do to stop you.

​

Tornado Cash is a fantastic example. Despite sanctions, indictments, and people going to jail who ran it, guess what was still being used the entire time? Tornado Cash. They never actually stopped people from being able to use it, regardless of the U.S. government leveraging all of its power to try to prevent that. That was a great example of how we can build tools that resist oppression.

​

Thank you for the optimism, because I don’t have any from my end. Developers really have to be careful here. I got a call just a few months ago from a regulator in my country. That person was the head of the department. She was asking me specifically how contributors in GitHub control a smart contract. Smart contracts are for Ethereum and not Bitcoin, but the principle holds. They are really drilling down into the details now. They are getting into the nitty-gritty. So if you are developing an app and it is freedom tech, make sure you do it right. Use a nym through your contributions, and start protecting yourself. That’s how we’re going to push forward.

​

We’ve covered policy changing quickly and becoming very aggressive toward privacy tech. But as you said, the tech already exists. It might not be perfect, but taking a snapshot of 2026, what are the most viable privacy tools available to end users right now that they can use when interacting with Bitcoin? Seth, if you had to pick one?

​

The one I’ll go with, and the one I’ve been pressuring other developers and people building Bitcoin wallets to implement, is payjoin. It’s a simple technology, but one that drastically improves privacy when you are actually spending Bitcoin.

​

When you go to spend Bitcoin and the wallet you are paying supports payjoin, you and the person you are paying work together to create the transaction. You both contribute inputs, which sounds scary, but they get the right amount at the end of the day and you get everything back as change, just like normal. What it does is hide the sender, receiver, and amount in the transaction. We can do it in a way where it can just be the default.

​

If you use Cake Wallet and you have a Bitcoin wallet with any Bitcoin in it, you can use payjoin today. If any other Cake Wallet user pays you, you don’t have to do anything extra. You don’t have to say you want to use this or go through 12 steps to activate it. You can just use it. The SDK for developers is ready and usable. All we really need is for people to want it and for developers to implement it.

​

If you are using a wallet that does not support payjoin v2 for Bitcoin right now, go yell at your local developer. Tell them it’s time. Tell them you want better privacy on Bitcoin. It’s one of the few tools where you don’t have to think about it, make a conscious choice, or take extra steps. It should become the default between wallets.

​

Where can people access that right now?

​

Unfortunately, only Cake Wallet and Bull Bitcoin, which is another self-custodial wallet by fantastic people.

​

Good on you guys for actually implementing privacy tools. Thank you.

​

It is nice as a selling point for Cake Wallet that we are one of the only ones that actually supports payjoin, but it is much more effective if you can use any Bitcoin wallet and I can be using Cake Wallet and we both benefit from the privacy that is provided. The goal is definitely that everyone uses it. For now, Cake Wallet.

​

Naomi, what about you?

​

I am loath to point to specific tech. Be careful of thinking that any one piece of privacy tech is going to be a panacea. A lot of people don’t realize that to make use of any of these tools, including privacy coins or anything else, you need to know how to use the internet privately.

​

You really need to start integrating privacy hygiene into your daily internet usage. It’s a whole spectrum. I encourage people to start with things outside the crypto realm. If you’re still on Gmail, just get off of that. Not only are you using something that is analyzed and flagged, with your data sent to governments around the world and thousands of entities profiling you, but it’s also a liability if you want to use privacy tools.

​

If you use these privacy tools, but then leak things back to an email provider that could be subpoenaed without a warrant at any given time, and you didn’t use that email provider privately, all of your crypto interactions are out there, fair game. You’ve left all these breadcrumbs for governments and other entities to piece together your activity.

​

Start with your general privacy hygiene. Get off Gmail is my number one point for all of you. Stop using the competition. If you are not supporting the email providers that are trying to protect our privacy, you are actively contributing to their competitors and pricing them out of the market. Choose the future you want to see in the world, and make choices that respond to your values.

​

I’m going to piggyback on that. Privacy is a state of mind. I’m sitting at these conferences, looking at people in the row in front of me, and I can read all their emails. How many people here have a privacy screen on their phone? Six or seven people at most. The person behind you can read what you’re doing: all the emails, all the texts. It’s your phone.

​

Privacy starts at the analog level. When you go to your house at night, you close your blinds. You don’t want people watching into your house. It’s the same thing for your phone. Get a privacy screen. It’s five or six bucks. Privacy is a mindset. If we make things a little bit more difficult for the surveillance state, we’re going to win.

​

It’s not about hiding either. We all have important things to protect, and information is power. Make a choice about how much power you are willingly giving to other people who will use it against you. You can spend six dollars on something that helps you reclaim that power. It’s about ownership of our data and being able to live the life of our choosing. It’s not about hiding.

​

One thing that has been a bugbear of mine for years around Bitcoin privacy, and unfortunately is still only trending in the wrong direction, is the creeping effect of KYC and the proliferation of it as the normal way most people buy Bitcoin. I understand why. It is well publicized and the easiest route to get started. They make it very easy for you to buy Bitcoin.

​

Unfortunately, the flip side is that you have to give away all of your personal information. You probably have to give a selfie, or even a video of yourself, your passport information, where you live, and all of that information is tied to every single purchase of Bitcoin you make. It is difficult to sway people away from it because the alternatives, as bullish as I am on them personally, are never as easy as smashing buy in Strike. Is using no-KYC options to obtain your Bitcoin still viable in 2026?

​

Yes, definitely. It has actually gotten much better over the years. Something like RoboSats, for example, which is a Lightning-first, peer-to-peer, no-KYC exchange, lets you buy Bitcoin from other bitcoiners with good privacy, and you don’t give up your ID.

​

It all seems very daunting at first because it’s abnormal. But think about the first time you got into Bitcoin and signed up for Coinbase and bought Bitcoin. Did that feel normal or easy? Probably not. It has gotten easier over the years, but anything you are new to feels daunting and difficult until you actually do it. Then it becomes second nature.

​

It’s something you need to get comfortable with and actually do to understand how simple it is. As Naomi said with email, as long as we continue to fund and feed the KYC surveillance state and use these exchanges, we remove funding from people trying to build no-KYC alternatives. When you use something like RoboSats, Bisq, or Hodl Hodl, you are helping fund a better future. There are good monetization models in there for the people building the technology that supports it. Those tools get better, and they get easier to use.

​

I really think one day it will be easier to buy peer-to-peer, no-KYC than it will be to buy on an exchange, because the whole KYC system is a nightmare to use. It’s a huge user experience hurdle. We can avoid that entirely using no-KYC tools. It has gotten better, it is usable today, and you really just have to try it. Don’t be scared. Try it. You’ll survive, and once you try it, you’ll realize how easy it really is.

​

There are a few online options to buy Bitcoin with no KYC, but I’m a big proponent of the analog method as well. There is a Bitcoin meetup in every city in the United States. There are bitcoiners all over the world. It doesn’t matter where you are. I’m in a very small country, and there is a Bitcoin meetup there.

​

You can go there. You can bring some cash. Somebody can buy Bitcoin from an exchange and transfer it to you. That’s an easy way of getting Bitcoin face to face. You get to know people you can trust, and you get to connect. You are building the network that will strengthen you.

​

We forget that what happens on our phone is increasingly important in our lives, but it is still just a digital piece of tech. Our real lives are person to person. You and I can talk to each other on the analog front. That’s the power of Bitcoin. It allows you to buy Bitcoin from somebody in front of you. That’s amazing.

​

As an anecdote, you can see how easy and common it is to buy no-KYC coins. Every time China bans Bitcoin again, you see the hashtag skyrocket in China. There is such capital flight from that country, and you see people take to mining. Mining is a great way to get fresh coins. If you go to pools, you can buy fresh coins from other people. Take a look at different pools where you can purchase coins. That’s another way to get involved.

​

I want to move us on to something Naomi alluded to earlier, treating privacy as more of a holistic approach. There is no one silver-bullet tool that is going to make you instantly private. I’m keen to know what you do generally in your privacy, not necessarily strictly with Bitcoin, that the average bitcoiner who entered in the last couple of years probably does not do. What practices are routine for you as privacy advocates that you can impart to the audience as a step forward?

​

Privacy is a state of mind, and that starts in our everyday lives, like closing the blinds at night in your house. Another thing is pushing back whenever you can and knowing your rights. When you go to the airport and they have face-scanning devices, opt out. You are able to opt out. They might push back, but if you stand your ground, you’ll board that plane.

​

Those machines where you put your arms up, I’ve never been in one. I’ve opted out every single time, and I’ve been flying multiple times a year for the last 12 or 13 years, however long they’ve had them. Have principles. Care about your privacy. Make the extra effort. It’s not easy. They will argue, complain, and try to convince you, but stand your ground. Once you get that state of mind, everything starts falling into place: the way you use the internet, the way you buy your Bitcoin. It all starts making sense, and it is worth the effort.

​

There are few privacy tools that actually make your life easier at the same time, but there are some. One of those is email aliases. That sounds weird and strange when you first try it, but if you use an iPhone and have iCloud Plus, you can use email aliases today. You’ll get the Hide My Email pop-up above your keyboard. It creates an email alias that sends the email to your inbox.

​

When that email address gets leaked in the inevitable hack of practically every entity out there, you can just disable that email alias. You won’t get spam or phishing to it. It doesn’t matter that it was leaked because it was not your core email address.

​

If you use Proton Mail or the Proton suite, Proton Pass can do email aliasing. When you create a new login, it creates the alias for you. You don’t need to think about it. It automatically figures out what to name it and does the work for you. It improves your life because when your email attacks come, and they always will, you just toggle off the email alias and go on with life. It’s maybe a minor one, but it improves your life and helps your privacy at the same time.

​

If people in your world knew the things I did, it would seem pretty wild, and I would say don’t start there. I have some pretty inconvenient and strange privacy practices. For the average person, start with the lowest-hanging fruit. What browser are you using? Get off Chrome and go to Brave. What search engine are you using? Get off Google. If you’re on Gmail, get off Gmail. There are alternatives like Proton.

​

If you are sending SMS or Instagram DMs, get off them. Use something like Signal. SimpleX is an interesting tool as well. Start with the lowest-hanging fruit and go for those first.

​

Some of the things I do can get crazy. I have GrapheneOS phones, so I’m not using iOS or standard Android. I have multiple profiles. A lot of people don’t realize their apps can see each other inside a single profile. Your banking app knows that you have that crypto app installed. They can also talk to each other if they mutually agree to do so within a profile. I separate apps across profiles if there are any I don’t want communicating.

​

Think about the risk profile. Does my banking app know that I have a crypto app? What does that do to my credit score? What does that do to my risk of being de-banked? Those are the kinds of things you start to implement down the line. But first, get off Gmail, get off Google Chrome, and stop using Google Search. These are basic, easy things.

​

This stuff can make your life easier. A lot of people don’t realize that if you switch to Brave, you stop seeing YouTube ads. You don’t have to pay for YouTube Premium. Brave blocks the ads for you. It makes your life better and makes the bandwidth quicker because you’re not seeing all these ads pop up. Switch to something like Brave and block the ads. Immediate life improvement right there.

​

We have just a couple of minutes left. There is obviously a wealth of information and many different services and tools. Where can people go to learn about the different alternatives? Are there specific websites or YouTube channels where people can get started and learn more about improving their privacy?

​

I have a nonprofit called Ludlow Institute. We have over 700 free videos. If there is a topic you want to learn about, like aliases, VoIP numbers, or anything else, you can search for it, and that content is all free. We have a newsletter that goes out weekly giving people tips and letting them know about the latest legislation coming down the pipeline that they should be aware of. You can sign up for that as well.

​

Also go to Surveillance Accountability and find out about this bill to reestablish Fourth Amendment protections in the digital age. Please support this initiative.

​

For me, one of the best blog posts I’ve ever written was one I didn’t think would be that useful. I just said that if I were to do my privacy journey over again, this is the order I would do it in, what I would tackle first, and the tools I would use from the ground up. I wrote it on a 30-minute whim and threw it out there, and it has been by far the one people find most useful.

​

When you first get started in privacy, it can feel terrifying. Where do I start? Why should I do this? What tools should I use? I tried to keep it super simple: ten things, with options. The primary one is the main one I use, but there are other options as well. That’s on sethforprivacy.com, my personal blog, and that post is pinned at the top. It’s a good place to get started.

​

There is a ton of other content out there. Naomi has obviously been making it for years. There are good podcasts and videos. If you want to learn, you can learn about anything out there, and there are really good people making content today on privacy.

​

I’ve got nothing to add to those great resources. Please go visit them. The only thing I’ll add is that if you are not in control of your life, if you are not taking charge, someone else is. At the end of the day, nobody else is better to care for you than you. If you vote every four years and think things are going to get better, you are giving away some of your sovereignty. Get rid of Spotify. Listen to your old CDs. Buy some vinyl. Read some paper books. Start going analog and taking control of your own life.

​

I just want to round us out by saying that those are great recommendations. I also want to signpost people to support the Samourai developers who have been wrongfully imprisoned for writing privacy software. Help raise awareness. We are supporting a campaign to get them a presidential pardon because they are currently locked up behind bars. Please support that. Thank you to everybody who has been on the panel.

​

Please support them and give them money. They are millions of dollars in debt. They could not even afford to go to the appeal process because it would have cost millions more. They could not raise the funds. Please support them and help their initiative, because this is a precedent-setting case that is going to affect all of us well beyond the financial sphere. This is going to destroy privacy, so please support them.

​

Thank you all.