Operational Playbook
Step-by-step field instructions, legal boundaries, and evidence standards for all 18 bounty action types. Know before you go.
Target Takers
- Citadel members comfortable walking public spaces
- Anyone with a smartphone and ~2 hours
- Benefits: every resident in mapped areas
Deliverables
- Geo-tagged photos of each camera/sensor
- Camera count per block or zone
- Type identification (CCTV, LPR, facial-rec)
- Notes on operator (public vs. private)
Why It Matters
Public mapping creates accountability pressure. Cities with exposed surveillance maps have seen contract cancelations (Portland 2020 facial recognition ban) and public defunding votes. What's documented can be challenged.
Logistics
- Downtown cores, transit hubs, government buildings
- Daylight hours for clear photo evidence
- 2–4 hour window per zone
- Submit via citadel bounty completion form
- Photographing from public sidewalks/streets
- Documenting cameras visible from public space
- Publishing photos and maps publicly
- Discussing findings with press/officials
- Trespass on private property to photograph
- Tamper with or touch any camera equipment
- Block entrances or create a scene
- Photograph inside buildings without consent
Target Takers
- Citadel members comfortable asserting rights calmly
- Pairs or groups (buddy system strongly recommended)
- Benefits: all citizens — establishes norms
Deliverables
- Video of the recording session
- Written incident report if confronted
- Documentation of any illegal stop attempts
- Location and badge numbers if relevant
Why It Matters
Right-to-record is well established in all 50 states, yet violations happen daily. Consistent, documented assertion of these rights builds precedent and forces accountability. Glik v. Cunniffe (1st Cir 2011) and many cases since affirm this is a 1st Amendment right.
Logistics
- Public spaces: parks, sidewalks, transit, city halls
- During police activity or public government functions
- Keep a safe distance — 8–10 feet minimum from active scenes
- Recording police in public — federal right
- Refusing to show ID in stop-and-identify states unless detained
- Calmly stating "I am exercising my First Amendment right"
- Continuing to film after warnings
- Interfere with police activity
- Get within arm's reach of an arrest scene
- Obstruct pedestrian or vehicle traffic
- Argue aggressively or physically resist
Target Takers
- Citadel members with trusted business relationships
- Tech-comfortable members for website setup
- Benefits: local businesses and their customers
Deliverables
- Signed canary statement from each participating business
- Public URL where canary is hosted and updated monthly
- Network registry of participating merchants
Why It Matters
A warrant canary is a statement like "We have not received any secret government orders." When it disappears, you know something happened. Companies like Apple and others use this technique — a citadel network bringing this to Main Street businesses makes a real transparency layer.
Logistics
- Approach local merchants you trust (restaurants, shops, clinics)
- Monthly update cadence — canary must be actively maintained
- Host on a public, accessible URL
- Publishing truthful statements about absence of orders
- Informing customers about a business's transparency policy
- Ceasing to publish when a canary can no longer be signed
- Disclose specifics of any actual government order (illegal)
- Publish false canaries or fabricated statements
- Pressure businesses into signing
Target Takers
- Any U.S. citizen or permanent resident
- Beginners welcome — process is designed to be accessible
- Benefits: the public; documents become public record
Deliverables
- Submitted FOIA request (copy of letter + confirmation)
- Agency tracking number
- Any documents received in response
- Summary of what was found or refused
Why It Matters
FOIA requests exposed NSA PRISM (Snowden's docs confirmed), ICE facial recognition contracts, and NYPD's Stingray cell tracker program. Systematic requests from citadels create a continuous accountability pipeline that no single journalist can sustain.
Logistics
- Federal: FOIA.gov, agency portals (FBI, DHS, DOJ)
- State: MuckRock.com automates most states
- Response time: 20 business days federal, varies by state
- Appeal any wrongful denial within 90 days
- Requesting any non-exempt federal records
- Appealing denials through administrative channels
- Suing agencies that miss deadlines (FOIA gives this right)
- Publishing all documents you receive
- Request records protected by national security exemptions (Exemptions 1, 3)
- Misrepresent your identity or purpose to get fee waivers
- Harass agency FOIA officers
Target Takers
- Entire citadel coordinating together
- Best with 3–10 members filing simultaneously
- Benefits: targeted accountability campaigns amplify pressure
Deliverables
- 10+ FOIA requests filed on same topic within 48 hours
- Tracking spreadsheet of all request numbers
- Summary report of blitz campaign + findings
Why It Matters
Volume matters. Coordinated blitzes stress-test agency compliance, create a paper trail of suppression patterns, and are harder to dismiss as "one activist." Groups like Demand Progress have used FOIA blitzes to expose entire surveillance contract networks.
Logistics
- Coordinate target and template within citadel first
- File within same 24–48 hour window for maximum impact
- File via FOIA.gov, agency portals, or MuckRock in bulk
- Multiple citizens filing separate valid FOIA requests
- Coordinating filing strategy within your group
- Publishing all received records
- File duplicate requests from same person (wastes resources)
- File frivolous requests with no genuine public interest purpose
- Impersonate organizations to claim fee waivers
Target Takers
- Members comfortable with document analysis
- Spreadsheet/research skills helpful
- Benefits: local government accountability and taxpayers
Deliverables
- Database of surveillance tech contracts found
- Vendor names, contract values, technologies involved
- Summary report with key findings
- Any red-flag contracts flagged for follow-up FOIA
Why It Matters
Government surveillance contracts are often hidden in plain sight — buried in procurement databases. The ACLU found cities buying Clearview AI, Palantir, and Axon products without public knowledge by reviewing public contract data. This is legal open-source intelligence work.
Logistics
- USASpending.gov, city/county procurement portals
- State transparency websites (varies by state)
- No deadlines — this is ongoing research work
- Budget 8–20 hours for a thorough audit
- Accessing all publicly posted procurement records
- Publishing findings and analysis
- Filing FOIA for any contract redacted in public records
- Access secured government databases without authorization
- Publish private vendor employee information
- Make claims beyond what documents actually show
Target Takers
- Members willing to take a 2–4 hour training course
- Calm, methodical observers (not activists — neutral role)
- Benefits: everyone at public gatherings who might face police contact
Deliverables
- Completed NLG-style training documentation
- Field notes from deployment
- Any documented rights violations (badge numbers, times)
- After-action report
Why It Matters
Police misconduct at public events drops significantly when legal observers are present. The National Lawyers Guild has trained thousands of observers who've documented mass arrest violations and enabled successful lawsuits. Your presence is a deterrent before it's evidence.
Logistics
- Public meetings, city council hearings, protests, demonstrations
- Wear clearly visible ID (green NLG hat is standard)
- Always operate in pairs minimum
- NLG.org for training resources and chapter contacts
- Observing and documenting public police activity
- Recording all actions (check state audio laws)
- Remaining at the scene as long as legal
- Noting badge numbers and officer actions
- Interfere with arrests or police commands
- Provide legal advice (you are not counsel unless licensed)
- Follow police into restricted zones
Target Takers
- Any citadel member
- Host a community workshop or do door-to-door
- Benefits: residents in your area get their data removed from brokers
Deliverables
- Number of people helped and brokers contacted
- Data brokers targeted (Spokeo, Whitepages, BeenVerified, etc.)
- Photos or testimonials from participants
Why It Matters
Data brokers sell personal information — address history, relatives, purchase patterns — to anyone who pays. Helping neighbors mass opt-out reduces their exposure to stalkers, scammers, and government data purchases that sidestep warrant requirements.
Logistics
- Community center, library, or door-to-door
- Tools: DeleteMe, Kanary, or manual opt-out guides
- Time per person: 30–60 min for full opt-out sweep
- Filing opt-out requests on behalf of consenting individuals
- CCPA rights (California residents can demand deletion)
- Publishing guides and how-to information
- Submit opt-outs for people without their consent
- Access broker accounts that aren't yours
- Make legal claims about broker obligations you can't verify
Target Takers
- Members with operational security knowledge
- Minimum 5 attendees required
- Benefits: every participant gains practical privacy skills
Deliverables
- Workshop agenda and materials
- Attendance record (headcount + photos)
- Topics covered: device hygiene, movement patterns, communication security
Why It Matters
Knowledge is the most scalable counter-surveillance tool. One trained person can teach 10 others who each teach 10 more. Privacy workshops in corporate and activist communities have shifted entire organizational cultures toward operational security.
Logistics
- Private space — member home, rented room, or library meeting room
- 2–3 hour format works best
- Resources: EFF's Surveillance Self-Defense (ssd.eff.org)
- Teaching all legal privacy and security techniques
- Distributing EFF guides and similar educational materials
- Explaining how encryption and secure communication works
- Instruct how to defeat law enforcement investigations illegally
- Teach techniques specifically to evade lawful process
- Demo anything involving unauthorized network access
Target Takers
- Any citadel member comfortable speaking publicly
- 3+ members for maximum impact (coordinated group):
- Benefits: council record, local media, elected officials hear you
Deliverables
- Written testimony prepared and submitted for record
- Video of testimony (council meetings are usually recorded)
- Link to official meeting minutes where testimony appears
Why It Matters
City councils have voted to ban facial recognition technology in multiple cities (San Francisco, Boston, Baltimore) partly driven by coordinated public comment campaigns. Your 3-minute testimony goes into the official public record and can be cited in future legal challenges.
Logistics
- Find agenda items: city council website or legistar.com
- Sign up for public comment the day of (often via form)
- 3 minutes is standard — prepare and rehearse your statement
- Bring copies of testimony to hand to council members
- All lawful public comment at public meetings (1st Amendment)
- Coordinating what multiple people will say
- Recording public meetings on your own device
- Wearing organizational symbols or shirts
- Disrupt meeting proceedings or shout down speakers
- Exceed your allotted time after warnings
- Threaten or intimidate council members
Target Takers
- Members with data analysis or software skills
- Can be done solo or as a team project
- Benefits: exposes discriminatory or invasive algorithmic systems publicly
Deliverables
- Documented methodology for the audit
- Dataset of test inputs and outputs showing patterns
- Written report with findings, impact assessment
- Published report (even a blog post counts)
Why It Matters
NIST and ProPublica's audit of COMPAS (recidivism AI) revealed racial bias that influenced criminal sentencing. MIT Media Lab studies showed facial recognition error rates of 35% for dark-skinned women vs 1% for light-skinned men. Audits create the evidentiary basis for regulation.
Logistics
- Target publicly accessible AI systems (facial recognition APIs, hiring tools)
- Use free API tiers or public interfaces for testing
- Budget 20–80 hours depending on scope
- Document everything — methodology is as important as results
- Testing any publicly accessible service within their TOS
- Publishing findings about discriminatory outputs (1st Amendment)
- Academic-style research documentation and publication
- Violate a service's Terms of Service to obtain data
- Access private APIs without authorization
- Use real personal data of non-consenting individuals as test inputs
Target Takers
- Members with communication and organizing skills
- Whole citadel for maximum reach
- Benefits: corporate behavior change, investor pressure, public awareness
Deliverables
- Campaign brief: target company, specific demands, tactics
- Evidence of campaign execution (letters, posts, press)
- Any response received from the company
- Impact report after 30 days
Why It Matters
Amazon ended Rekognition sales to law enforcement after employee pressure and public campaigns. IBM exited the facial recognition market entirely after shareholder and public pressure campaigns. Microsoft limited police use after similar campaigns. Corporate accountability works when organized systematically.
Logistics
- Tactics: open letters, social media pressure, shareholder proposals, customer boycotts
- Target: companies selling surveillance tech to governments
- Timeline: plan for at least 30–60 day campaign arc
- Boycotts, peaceful picketing, public pressure
- Publishing factually accurate criticism of companies
- Filing shareholder proposals (if you own stock)
- Contacting advertisers, investors, and partners
- Make false statements of fact about companies (defamation)
- Coordinate stock trading for market manipulation
- Threaten or harass individual employees
Target Takers
- Any citadel member with good community relationships
- Interview-style skills helpful
- Benefits: community members whose experiences get documented and amplified
Deliverables
- 10+ documented community testimonials (written or video)
- Summary report of patterns observed
- Any discriminatory surveillance patterns identified
Why It Matters
Data from community audits in Chicago's South Side led directly to the Ordinance on Surveillance Oversight passed in 2021. Documented community impact transforms abstract policy debates into human stakes. Stories move people; statistics inform them.
Logistics
- Door-to-door canvassing, community centers, local events
- Consent forms required for recorded interviews
- Anonymize participants who request it
- Conducting voluntary interviews with informed consent
- Publishing testimonials with participant permission
- Documenting your own neighborhood's conditions
- Record individuals without clear consent
- Publish identifiable information of people who asked to be anonymous
- Trespass on private property for data collection
Target Takers
- Members with IT or cybersecurity backgrounds
- Minimum: basic understanding of passwords, 2FA, phishing
- Benefits: the organization you audit gets hardened against real threats
Deliverables
- Written audit report with findings and recommendations
- Evidence of permission/scope agreement before audit
- Confirmation of at least 3 implemented improvements
Why It Matters
Small businesses and nonprofits are the most common breach victims and least protected. Strengthening community digital infrastructure reduces surveillance vectors — a local nonprofit using Signal instead of unencrypted SMS is one fewer surveillance tap point for federal agencies.
Logistics
- Approach trusted local businesses or nonprofits
- Get written scope agreement before any testing
- Tools: EFF's SAFETAG framework (free, designed for orgs)
- Budget 4–8 hours for a basic audit
- Auditing systems you have explicit written permission to test
- Reviewing public-facing configurations and open ports
- Providing advisory recommendations in a written report
- Test any system without explicit written authorization
- Exploit vulnerabilities — document and report them only
- Access private data even if a vulnerability makes it possible
Target Takers
- Any citadel member comfortable explaining Bitcoin basics
- Bring someone who's done it before if possible
- Benefits: local merchant gains censorship-resistant payment channel
Deliverables
- Merchant name + business type
- Wallet or POS setup completed (BTCPay, Zeus, Strike)
- Photo of QR code or confirmation of first transaction
- Any marketing materials provided (flyers, sticker)
Why It Matters
Bitcoin acceptance creates financial privacy — cash-equivalent transactions without surveillance capitalism's transaction graph. El Salvador's adoption showed that even small merchants benefit from censorship-resistant payments. Every merchant onboarded strengthens the parallel economy's infrastructure.
Logistics
- Target small local businesses: cafes, shops, markets
- Best tools: BTCPay Server (self-sovereign), Strike (easiest), Zeus
- Book 1–2 hour appointment with merchant for setup
- Leave behind a simple "how to receive Bitcoin" cheat sheet
- Bitcoin is legal tender-adjacent in the US — merchants can accept it
- Helping set up legal Bitcoin payment infrastructure
- Educating merchants about tax reporting obligations
- Advise merchants to conceal Bitcoin income from taxes (illegal)
- Set up wallets in the merchant's name without their direct involvement
- Handle their private keys
Target Takers
- Any member comfortable teaching or presenting
- Minimum: read EFF's Surveillance Self-Defense first
- Benefits: neighbors, students, community members — anyone who attends
Deliverables
- Event flyer or announcement
- Attendance photo (minimum 5 people)
- Handout or slide deck used
- Attendee feedback (even informal)
Why It Matters
The single highest-leverage thing a citadel can do is multiply its own knowledge. One skilled member teaching 20 neighbors creates 20 more people who can protect themselves and teach others. Privacy literacy is the foundation of everything else on this list.
Logistics
- Libraries, community centers, cafes — anywhere with space
- 1.5–2 hours is the right length; anything longer loses people
- Topics: device security, secure messaging, browser hygiene, VPN basics
- Teaching all legal privacy tools and techniques
- Recommending privacy-respecting apps and services
- Discussing how surveillance systems work (from public info)
- Teach techniques to evade lawful legal process
- Provide advice specifically designed to facilitate criminal activity
Target Takers
- Members familiar with SecureDrop, Signal, legal whistleblower protections
- NOT for beginners — requires knowing the subject matter
- Benefits: individuals who've witnessed wrongdoing get safe pathways to report
Deliverables
- Resource guide created (with links, contacts)
- SecureDrop instance listed (Freedom of the Press Foundation directory)
- At least 3 people connected to appropriate resources
Why It Matters
Whistleblowers exposed NSA mass surveillance (Snowden), Secret Service misconduct, VA patient data coverups. They need infrastructure: secure comms, legal contacts, psychologically safe pathways. Building that infrastructure at the community level is the work before the disclosure.
Logistics
- Resources: Freedom of the Press Foundation, whistleblower.org, GAP (Government Accountability Project)
- SecureDrop.org — anonymous journalist-source tool
- Attorneys: National Whistleblower Center for referrals
- Providing information about legally protected whistleblowing channels
- Connecting people to nonprofit organizations and attorneys
- Explaining how SecureDrop and anonymous submission systems work
- Encourage disclosure of classified information (Espionage Act risk)
- Promise legal immunity you cannot guarantee
- Accept leaked documents yourself — connect to lawyers first
Target Takers
- Members with basic networking or Linux knowledge
- Access to a rooftop or exterior wall recommended
- Benefits: neighborhood gains decentralized, ISP-independent communication
Deliverables
- Node deployed and connected to mesh network
- Photo of hardware installation
- Network reachability test screenshot
- Node address or ID in the network
Why It Matters
During Puerto Rico's 2017 hurricane, Althea mesh networks enabled communication when centralized ISPs failed. NYC Mesh has over 900 nodes providing ISP-independent internet. Decentralized infrastructure removes the single point of control (and surveillance) that centralized ISPs represent.
Logistics
- Networks to join: NYC Mesh, Althea Network, LibreMesh, Meshtastic
- Hardware: Ubiquiti radios ($80–150), Raspberry Pi, TP-Link routers
- Setup time: 4–8 hours including outdoor antenna installation
- Coordinate with neighboring nodes for coverage planning
- Operating unlicensed WiFi in Part 15 ISM bands (2.4/5GHz)
- Sharing your own internet connection with neighbors
- Running a node on property you own or with owner permission
- Install hardware on buildings without owner permission
- Operate high-powered transmitters without FCC license
- Re-sell internet service without ISP agreement compliance
Claim a bounty from the board, execute the action, upload your evidence, and get paid in Bitcoin.