<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: privacy-engineering
description: >-
  Privacy engineering with GDPR/CCPA/HIPAA compliance, Data Protection Impact
  Assessments (DPIAs), privacy-preserving tools (Signal, Cryptomator, VeraCrypt),
  operational security, Firefox hardening, privacy threat modeling, and data
  minimization strategies.
domain: cybersecurity
subdomain: privacy-engineering
tags:
  - gdpr
  - ccpa
  - hipaa
  - dpia
  - opsec
  - signal
  - veracrypt
  - firefox-hardening
  - data-minimization
  - privacy-by-design
version: "1.1"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1557", "T1040", "T1119"]
  nist-csf: ["PR.DS-1", "PR.DS-2", "PR.DS-5", "PR.IP-6"]
  frameworks: ["GDPR", "CCPA", "HIPAA", "NIST Privacy Framework"]
---
<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->

---
name: privacy-engineering
description: >
  Privacy engineering, data protection, and operational security.
  Triggers: GDPR, CCPA, HIPAA, DPIA, privacy by design, Signal, VeraCrypt,
  Cryptomator, Firefox hardening, Betterfox, dns-blocklists, anonymization,
  de-identification, PrivateBin, Yopass, threat modeling, operational security,
  secure messaging, OpSec, k-anonymity, differential privacy, LINDDUN.
domain: cybersecurity
subdomain: privacy-engineering
tags:
  - gdpr
  - ccpa
  - hipaa
  - dpia
  - opsec
  - privacy-by-design
  - anonymization
  - signal
  - veracrypt
  - cryptomator
  - firefox-hardening
  - dns-privacy
  - linddun
  - threat-modeling
  - secret-sharing
version: "1.1"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  nist-csf:
    - PR.DS (Data Security)
    - PR.AC (Access Control)
    - PR.IP (Information Protection)
    - ID.GV (Governance)
    - DE.CM (Continuous Monitoring)
  regulations:
    - GDPR (EU 2016/679)
    - CCPA/CPRA (California)
    - HIPAA/HITECH (US Healthcare)
    - ePrivacy Directive (EU 2002/58/EC)
---

# SKILL: Privacy Engineering

## When to Use

Activate this skill when the operator asks about:
- **Regulatory compliance** — GDPR, CCPA/CPRA, HIPAA/HITECH, DPIAs, lawful basis, breach notification, data subject rights
- **Privacy tools** — Signal configuration, Firefox/Betterfox hardening, Cryptomator vaults, VeraCrypt volumes, DNS blocklists, PrivateBin, Yopass
- **Operational security** — threat modeling for privacy, adversary-tier controls, LINDDUN analysis, metadata protection, compartmentalization
- **Data protection** — anonymization, de-identification, k-anonymity, l-diversity, t-closeness, differential privacy, Privacy by Design (PbD)
- **Privacy architecture** — data flow mapping, ROPA, purpose limitation, storage limitation, cross-border transfers

## Prerequisites

- NERF core identity and mode system (see `CLAUDE.md`)
- `[MODE: PRIVACY]` activates automatically via keyword triggers
- Reference files in `references/` contain detailed procedures and configurations

## Quick Reference

| Task | Command / Action | Reference |
|---|---|---|
| Signal sealed sender | Settings > Privacy > Advanced > Sealed Sender > Allow from anyone | `references/privacy-tools.md` |
| Signal disappearing default | Settings > Privacy > Default Timer (set globally) | `references/privacy-tools.md` |
| Signal username setup | Settings > Profile > Username → Privacy > Phone Number > Nobody | `references/privacy-tools.md` |
| Firefox hardening | Drop Betterfox `user.js` into Firefox profile directory | `references/privacy-tools.md` |
| Firefox ETP strict | `browser.contentblocking.category = strict` | `references/privacy-tools.md` |
| Firefox disable telemetry | `datareporting.policy.dataSubmissionEnabled = false` | `references/privacy-tools.md` |
| Firefox HTTPS-only | `dom.security.https_only_mode = true` | `references/privacy-tools.md` |
| Firefox disable disk cache | `browser.cache.disk.enable = false` | `references/privacy-tools.md` |
| Cryptomator new vault | GUI → Add Vault → Create New Vault → pick cloud folder → set password | `references/privacy-tools.md` |
| VeraCrypt create (CLI) | `veracrypt --text --create /path --size 500M --encryption AES --hash SHA-512` | `references/privacy-tools.md` |
| VeraCrypt mount | `veracrypt --text --mount /path/to/container /mnt/vc --password pass` | `references/privacy-tools.md` |
| VeraCrypt dismount all | `veracrypt --text --dismount` | `references/privacy-tools.md` |
| HaGeZi Pro blocklist | `https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/adblock/pro.txt` | `references/privacy-tools.md` |
| DPIA trigger check | High risk = large-scale processing, systematic monitoring, sensitive data | `references/regulatory-compliance.md` |
| GDPR breach notification | 72 hours to supervisory authority (Art. 33) | `references/regulatory-compliance.md` |
| HIPAA safe harbor | Remove 18 specified identifiers | `references/regulatory-compliance.md` |
| Threat model framework | 5 questions: protect what, from whom, how likely, consequences, burden | `references/operational-security.md` |
| LINDDUN analysis | L-I-N-D-D-U-N on data flow diagrams | `references/operational-security.md` |

## Workflow

### 1. Identify Privacy Domain

Determine which area the operator's query falls into:

| Domain | Load Reference | Key Frameworks |
|---|---|---|
| Tool configuration | `references/privacy-tools.md` | Signal, Firefox, Cryptomator, VeraCrypt, DNS, PrivateBin/Yopass |
| Regulatory compliance | `references/regulatory-compliance.md` | GDPR, CCPA/CPRA, HIPAA, DPIAs, PbD, anonymization standards |
| Threat modeling / OpSec | `references/operational-security.md` | 5-question framework, LINDDUN, adversary tiers, anti-patterns |

### 2. Load Reference Material

Read the appropriate `references/` file for detailed procedures:

```
references/
├── privacy-tools.md          # Signal, Firefox, Cryptomator, VeraCrypt, DNS, secret sharing
├── regulatory-compliance.md   # GDPR, CCPA, HIPAA, DPIAs, PbD, anonymization
└── operational-security.md    # Threat modeling, LINDDUN, adversary tiers, OpSec
```

### 3. Apply Privacy Engineering Principles

For every engagement:
- **Threat model first** — define adversary before selecting controls (see `references/operational-security.md`)
- **Proportionate controls** — match security burden to actual risk level
- **Data minimization** — collect only what's needed for stated purpose
- **Privacy as default** — maximum privacy without requiring user action
- **Metadata is content** — protect metadata alongside message/file content

### 4. Execute Domain-Specific Workflow

**For tool configuration:** Follow step-by-step procedures from `references/privacy-tools.md`. Include the Privacy Stack Deployment chain for full-stack setups.

**For regulatory questions:** Reference specific articles/sections from `references/regulatory-compliance.md`. Include DPIA execution steps when processing triggers Art. 35 criteria.

**For threat modeling:** Apply the 5-question framework and LINDDUN taxonomy from `references/operational-security.md`. Map adversary tier to control selection.

### 5. Flag Anti-Patterns

Every response should flag relevant anti-patterns documented in references:
- Overshooting threat model (max controls without proportionate risk)
- Pseudonymization ≠ anonymization (GDPR Recital 26)
- Public tool instances for high-value secrets
- Identity cross-contamination across contexts

## Verification

After providing guidance, verify:
- [ ] Threat model identified before tool/control recommendation
- [ ] Specific regulation articles cited where applicable (e.g., GDPR Art. 35, HIPAA §164.514)
- [ ] Anti-patterns flagged for the specific scenario
- [ ] Controls proportionate to adversary tier
- [ ] Privacy implications tagged per NERF protocol (`PRIVACY` background layer)
- [ ] Reference file loaded for detailed procedures when needed

---
v1.1 | Validated: 2026-03-13
