README — GETTING STARTED WITH THE CI SHIELD PLAYBOOK

COUNTER-INTELLIGENCE SHIELD PLAYBOOK CLASSIFIED - CELL INTERNAL USE ONLY 
VERSION: 1.0 
RELEASE DATE: October 2025


WHAT THIS IS AND WHAT IT IS NOT

This Playbook is a framework. It is not a doctrine. Every team operates in a different environment with different resources, different threats, and different people. Treat these documents as a starting point — then adapt them to your actual situation.

The procedures work. The principles work. The specific tools may not. That is intentional. Your team chooses its stack. Your Watchdog approves the modifications. The job never changes. Protect the team.
HOW TO USE THESE DOCUMENTS

The Narrative Blueprint

Fill this out first. Every member completes their own before the first drill. Global anchors cannot change once set. Sphere narratives can evolve but only through Watchdog approval. This document stays local to each member unless the Watchdog needs to correlate drift.

The Probe Log

Every member maintains their own. Log locally. Report summary codes to the Watchdog for Tier 2+. Never paste full entries into group channels. Full detail goes private. The tree tells you when to escalate.

The Decoy Calendar

Coordinating happens quarterly. Fill this out during your planning session. Mark execution status after each item. Log drift as it appears. Checkpoints keep stories aligned without looking like a meeting.

The Decision Tree

Print it. Keep it accessible. Do not improvise escalation. Follow the branches. The tree exists so stress does not force bad decisions.

The Script Library

Team builds this together during your first session. Everyone writes their own deflections. Everyone rehearses their own delivery. Adapt to your voice, but keep the structure. Improvisation under pressure fails — training wins.

The Emergency Cards

Store separately from the other documents. Accessible only by Watchdog and Team Lead. These are for emergencies only. Using them unnecessarily erodes discipline. Not using them when needed breaks the team.

The Blank Templates

Every team fills these differently. Do not compare across teams. Use your own. Rotate quarterly or when the Watchdog flags pattern exposure.
TOOLING OPTIONS — WEIGH YOUR CHOICES

This section lists options with honesty about trade-offs. Your team selects based on your threat model, budget, and comfort level.

Encrypted Messaging

End-to-end encrypted messaging is non-negotiable for operational traffic. Popular options carry risks that matter:

Some require phone numbers as identifiers. Some allow metadata collection even with encrypted content. Some are proprietary with closed audit trails. Some are open-source and community-audited.

Evaluate honestly. Does your adversary control the infrastructure? Can they compel provider cooperation? Is phone-number identification a liability in your situation? Your answers determine what you choose.

Tor Network

Tor routes traffic through volunteer relays, masking origin IP addresses. Strong for clearnet anonymity. Weak point: exit nodes. Many exit nodes are controlled by state actors. Traffic leaving the network decrypts at the exit. Anything unencrypted passes in the clear.

Use case: Clearnet access when you need location masking. Do not rely on Tor for anything that touches the exit node in plaintext.

I2P

I2P does not touch the clearnet directly. It creates a separate overlay network. Garlic routing bundles multiple messages with one route in and one out. No exit nodes exist because traffic stays within the I2P ecosystem.

Use case: File sharing, hosting services, internal team coordination where you do not need clearnet access. Superior to Tor for peer-to-peer and dark-net services within the network itself.

LoRa (Long Range Low Bandwidth)

LoRa radios communicate over miles without cellular infrastructure. Very low bandwidth — text only. Encryption is essential. Frequencies vary by country; check your regulations.

Use case: Long-distance team comms when conventional infrastructure is unavailable or compromised. Works offline. Leaves no digital trail outside radio range.

Dead Drops

Physical data exchange. No electronic signature. Still effective because there is nothing to intercept digitally. Modern twist: geolocation beacons marking drop sites. AirTags or similar devices provide time-limited retrieval windows.

Risk: The beacon broadcasts location. If discovered, it reveals the drop site. Rotate beacons. Use time-limited activation. Never leave identifying materials at the drop itself.

Other Considerations

Faraday pouches for device isolation. Hardware wallets for cryptocurrency if financial anonymity is required. Burner devices for high-risk operations. Power banks for extended field deployment. Physical key storage with split custody.

Your team decides what you need. Write it in the Readiness Checklist when you conduct your inventory.

OPERATIONAL PRINCIPLES THAT NEVER CHANGE

The Watchdog Changes, The Job Never Does

Rotate the position monthly. Keep the function constant. Aggregation, evaluation, escalation.

Second Person Voice Throughout

You build the cell. You train the squad. You protect the team. The article uses this voice because it is yours. The Playbook works the same way. You follow the procedure. You make it real.

Consistency Over Perfection

A boring decoy repeated perfectly beats an interesting story told inconsistently. Adversaries exploit contradictions. Give them none.

Drift Monitoring Is Mandatory

Stories mutate as they spread. Some mutations help. Most hurt. Log every drift. Correct quickly through trusted contacts, not publicly.

Resurface Planning Starts Before Going Dark

Lockdown without an exit plan is surrender. Define resurface criteria before you trigger the card. The team votes on standing down. Fear prolongs darkness longer than threats do.

Every Member Is a Sensor

Detection happens first. Evaluation comes after. Sensing without correlation is just paranoia with a filing system. Correlation requires the team you built.
SECURITY NOTE ON THIS DOCUMENT

Store encrypted. Local storage preferred. Do not cloud-sync unless using E2EE cloud with keys you control. After deployment, wipe the working copy. Keep only one live instance per member.

If the document is compromised, rotate all narratives immediately. That is what the quarterly refresh exists for.


FINAL WORD

You killed the lone wolf. You built the team. Now you protect them.

The Counter-Intelligence Shield acknowledges you cannot control the world around you. You can control the story the world tells about you. Sensors watch. Evaluation decides. Redirect turns energy into cover. Reinforce makes fiction the only reality anyone remembers.

Your team handles the inside truth. The Shield handles the outside lie. Together, the people who know you stop being a liability and become an asset.

The Watchdog changes. The job never does. Protect the team.