Drill Library

Same four-element structure for every drill. Honest adversary framing.

DRILL 1: ACCIDENTAL GEOTAG
Objective: Detect and neutralize a metadata leak in 60 seconds.
Setup: Actor posts a photo with EXIF intact to the core channel.
Execution: Group spots it, deletes, verifies deletion, runs clean-slate if viewed externally.
Success: Detected by a non-designated member within 60s. Deleted within 2 minutes.

DRILL 2: COMPROMISED DEVICE
Objective: Verify wipe and comms-shift speed.
Setup: Member sends panic signal on surface channel, powers device off.
Execution: 15 minutes to rotate shared credentials and shift to failsafe.
Success: Rotation under 15 minutes, no info-flow interruption.

DRILL 3: DATA BROKER CAMPAIGN (QUARTERLY, NOT OPTIONAL)
Objective: Reduce every member's broker footprint.
Setup: Each member lists broker sites they appear on.
Execution: Coordinated opt-outs over 72 hours.
Success: Five documented removal attempts with receipts, per member.

DRILL 4: WORKPLACE PROBE
Objective: Deflect employer curiosity without burning cover.
Setup: Confederates play colleagues probing about off-hours life.
Execution: Defender holds surface persona.
Success: No contradictions, no accidental operational disclosure.

DRILL 5: MISSING COMMS CHECK
Objective: Correct response to a silent member.
Setup: One member goes dark unannounced.
Execution: Lost-contact protocol — alternates, intervals, extraction at 2 hours.
Success: Protocol followed exactly, no panic escalation.

DRILL 6: VENDOR REQUEST
Objective: Respond to a subpoena or service ToS change.
Setup: Simulated notice to one member.
Execution: Triage call in 30 minutes, migration plan in 48 hours.
Success: No panic-driven decisions, matrix documented.

DRILL 7: SOCIAL ENGINEER
Objective: Verbal deflection under pressure.
Setup: Attacker asks increasingly specific personal questions.
Execution: Defender deflects, code word to exit if needed.
Success: Cover held, exit clean, no disclosure even joking.

DRILL 8: PHYSICAL TAIL
Objective: Spot surveillance during movement.
Setup: One member tails the group on a normal route.
Execution: Detection turns; on spotting, silent signal, break contact, disperse.
Success: Tail identified in 3 cycles, rally within 30 minutes.

DRILL 9: BREACH INJECTION (CANARY CANONICAL)
Objective: Catch an insider threat or active compromise.
Setup: Red team attempts a phish. Planted material carries
a member-specific canary detail.
Execution: Squad detects, isolates, reports. If the material
spreads, the canary names the path.
Success: Threat caught before success. Origin traced.

DRILL 10: TOTAL BLACKOUT
Objective: Operate with digital comms cut.
Setup: Announced blackout, analog only.
Execution: Exchange one message via dead drop or physical
meetup. NOTE: this is a storm-outage drill, not a siege
fantasy. Mesh radio and shortwave are optional adaptation
notes, not standard kit.
Success: Message delivered, understood, zero digital trace.

HOW TO RUN THE LIBRARY
One drill per week. Rotate variables — time, place, personnel
— so nobody pattern-matches. AAR within 24 hours, every time.
Log results in the tracker. Increase difficulty as scores
plateau: shorter windows, more confounders, layered scenarios.
FILE 4: Offboarding Protocol (offboarding.txt)
OFFBOARDING — NEVER LEAVE A MAN BEHIND

Mechanical, within 24 hours. Non-negotiable regardless of
reason for departure:
1. Core channel access revoked
2. Shared credentials rotated by remaining members
3. Unit-provisioned hardware wiped, verified by two members
4. Their canary variant of the SOP retired and reissued
5. Watch assignments reassigned at next rotation

Human, at the same time. Equally non-negotiable:
6. Help securing their own independent systems — they
   leave with hardened devices, not stripped ones
7. Documented transfer of shared responsibilities
8. Exit conversation: honest closure, what worked, what
   didn't
9. Friendship continues with boundaries — they no longer
   know unit business, members don't discuss ops with them

Why both halves matter: a sloppily offboarded ex-member is
a threat vector who resents you. A well-offboarded one is
an ally outside the perimeter. And if offboarding is
brutal, current members hide problems and delay their own
departures past the point of safety.

DECISION MATRIX  
Decided while calm, applied while not:
- Three unintentional slips: training, no penalty
- One intentional breach: immediate offboarding, no vote
- Reckless or concealed compromise: investigate first
- Refusal to train: offboarding, terms were explicit