Privacy for web service operators (activism & journalism)

Question

I'm planning to develop and operate a web service that might agitate a certain authoritarian government (not in G20, not known for its good human-rights record).

I'd like to prevent any kind of leak of my personal information. However, since the target audience of my web service will be regular citizens of this authoritarian government running an onion service is not practical. (Also, it will just be a Reddit-like entertainment website with a political twist, meant for mainstream consumption. Tor is a no-no.) Because of this, I will use public cloud providers and public domain registrars. I will be paying for these services using my personal credit card.

What kind of precautions should I take to prevent revealing my identity while managing a web service running on a popular cloud provider and registered on a popular domain registrar?

I'm only aware of the WHOIS protocol. Are there any other technical or legal "loopholes" the aforementioned government can exploit to access my identity? The consequences of such a leak will be serious for me, people close to me, and everyone else that will be involved in this project.

Answer 1

To be honest, it really depends on the amount of rage you create.

You want to create a clearweb service which hosts entertainment content not in favor of the government.

Precautions I would suggest on the fly:

• Use a WHOIS privacy provider, if not already included with your domain purchase
• Reduce the risk of exposing your origin IP by using services like Cloudflare (in case these are not blocked already)
• Prepare for an intrusion into your service (anonymize IP addresses in logs for your service & managements tools as soon as possible, reduce storing PII to bare minimum)
• Buy domain & hosting from the same vendor to avoid spreading around your data
• Choose providers without an office in the country, as those may be legally required to provide your data to authorities
• Consider using more anonymous forms of payments, like cryptocurrency or gift cards

Your threat actors are members or supporters of the government.

As for their options:

• The authoritarian government likely has a large amount of money and people dedicated to deal with people like you
• In case your platform grows, they may pay multiple people to research your identity and location.
• Depending on impact and urgency, options like bribe or blackmail against employees of your providers are on the table and the data provided to the service might get into their hands.
• Hacker groups may be paid to attack your service
• They probably have access to telecommunication in that country. This means very likely the first option is blocking local BGP resolution of your site IP. The majority of your users (not using a VPN or proxy) will no longer be able to visit your site.