Not all politicians can/know how to operate anything more complex than an email account.

By the way, are you a fellow Tunisian? I'm kind of surprised because I've never run into a Tunisian on HN :p

Yes I'm Tunisian, I only know of a couple active people around here, but there is a ton of readers.

I see, that's great to hear. I don't live in Tunisia, so I'm not familiar with the Tunisian tech scene. Judging by your Twitter feed, it seems to be really active, which is awesome!

I just need to find the time to filter that data and publish something.

At least in the global south, most of radical activists groups have strong "no-internet policies" for any type of secret, and no cellphones ones for their work. They have learned with their own history what they can or can't do, learned how to deal with IRL infiltration, and even learned how to communicate without any kind of contact or even agreements between groups. To survive and act against dictatorships or invading armies is not easy, they had to be smart.

But still, because travelling is expensive and networking today is a need for some of those groups or collectives, they can communicate with each other talking about their resolutions or activities, which are not secret (as I already said, it's assumed there can be a IRL infiltrate) but they are also not public.

You can see SMTP and mailing lists as a huge security risk, and they are, it's just not very common to see people that assume the opposite around here.

I see it as sticking posters in the street. There is no reasons to use Facebook or Google Groups for most of the Riseup (public) Lists users, not because they want something secret and hidden, but because they don't want to play with some companies rules and appreciate to be a part of a network run by volunteers more than to use profitable fake-free services.

Because it makes sense, not because it is more or less secure.

So what are the types of services one should use?

> The guerrilla must move amongst the people as a fish swims in the sea.

It's better to create false identities that are seemingly legit and fully fleshed out, for example: with back stories, and utilize regular services as a normal person would. The key is disconnecting your own identity from the false one. Rather than trusting your security to a 3rd party service that makes a name for themselves on helping people trying to hide their identity, thereby attracting scrutiny.

That being said there are ways to use encryption services in a way to protect your communication but the bar for doing so is very high and most people will either make mistakes or get lazy. Fortunately services like Whatsapp and to a lesser extant Signal are so popular that you could easily blend in using them, while still having high-quality data encryption. Although they both use phone phone numbers for authentication and the device itself is always a weak-link which is why the identity part is so critical.

thegrugq posted an article a long time ago about how CIA agents in Lebanon [1] got caught because they used burner phones in a way that was unlike the way anyone else used cell phones, if I remember correctly: they were turned off the device most of the time except to make a few calls to other phones that were similarly not used often - not in the way normal people make calls. So anyone in control of the mobile operators would be able to ID potential evasive behaviour an zero-in on those devices/people for extra scrutiny.

That type of behavioural analysis that applies to real life can even more easily give you away in the digital world. Which is why it's important to not stand out from the crowd by using services like Riseup when your entire goal is privacy.

[1] http://grugq.github.io/blog/2013/03/12/anonymity-is-hard/