Free operating systems
The keystone. If client-side scanning can be imposed by the operating system itself, the only real counter is to control that OS. That’s true on the phone (GrapheneOS) and on the computer (Linux). Don’t underestimate this: as long as you stay on Windows, macOS or a Google Android, you don’t truly control your machine.
What it's for
A fully de-Googled Android, installed on a Pixel phone: mobile sovereignty.
Why it matters
It’s the structural defence par excellence against an OS or app store that would scan you.
Google services in an optional sandbox, per-app network permissions, isolated profiles,
auto-reboot that purges keys from memory, a duress PIN that wipes the phone. So respected for
security that it’s used by spyware targets.
For whom & when
Exposed profiles, but also any citizen willing to buy a Pixel to take back control of their
phone.
Install & use
Get a compatible Google Pixel phone (it’s the only supported hardware, for security
reasons).
On a computer, go to grapheneos.org/install and follow the web installer (a few clicks,
no terminal needed).
For your apps, install the free F-Droid store; add sandboxed Google Play only if needed.
- Set a long passphrase (not a 4-digit PIN) and learn the “Lockdown” mode.
What it's for
A free operating system for your computer, replacing Windows or macOS. It comes in many
flavours, called “distributions.”
Why it matters
It’s many people’s blind spot: they encrypt their messages but keep a Windows that streams
telemetry to Microsoft nonstop (whose “Recall” feature tried to screenshot the screen
continuously), or a macOS that reports the apps you launch. Linux doesn’t spy on you, it’s free,
it revives old computers, and it finally makes you master of your machine. It’s easier than its
reputation: modern distributions look like Windows or macOS.
For whom & when
Anyone can make the switch. To start, Linux Mint (closest to Windows) or Fedora;
Debian for stability. No need to wipe anything: you can test first, then install
alongside your current system.
Install & use
Not sure which distribution? Answer the distrochooser.de/fr quiz, which points you to
the right one for your needs.
Try it without installing anything, right in your browser, at distrosea.com.
Once convinced, download the distribution’s image and create a bootable USB (with Ventoy or
Balena Etcher).
Boot from the USB to try the system “live,” then run the install. Enable the disk encryption
it offers.
What it's for
A system that boots from a USB stick, routes all traffic through Tor and leaves no trace
when shut down.
Why it matters
On shutdown, everything is forgotten: it’s “amnesic.” Ideal for sensitive, one-off work on a
computer that isn’t yours, leaving nothing behind.
For whom & when
Whistleblowers, journalists, sources. The reference tool for high-risk work.
Install & use
Download Tails from tails.net and follow the wizard to create the USB stick.
- Reboot the computer from that USB. Use it, then shut down: everything vanishes.
What it's for
Two niche systems: Qubes compartmentalises your PC into sealed virtual machines; postmarketOS
runs Linux on old phones.
Why it matters
Qubes isolates each activity (work, banking, risky browsing) in its own compartment: a
compromise doesn’t reach the rest. postmarketOS extends the life of phones abandoned by their
maker.
For whom & when Expert users with a very high threat model.
iPhone: Lockdown Mode
On iPhone, iPad and Mac, Apple offers Lockdown Mode, designed for people who may be targeted by sophisticated spyware. It blocks most attachments in Messages, FaceTime calls from people you haven’t called recently, some complex web technologies, wired connections while the device is locked, and the installation of configuration profiles. Everyday use becomes less convenient: that is the price of a smaller attack surface. Turn it on in Settings > Privacy & Security > Lockdown Mode, separately on each device, after installing the latest update.
Harden your device
Even without switching OS, you gain a lot: install apps via F-Droid (free store) or Aurora Store, replace Google services with microG, create separate profiles, cut needless network permissions, disable automatic cloud backup and the advertising ID.