Hide Digital Footprint from Agencies (Air-Gapped Setup)
A properly air-gapped computer has no active network connection, but it does not make a person or their activity untraceable. I can help you build lawful data isolation that limits remote access and malware exposure. I can’t advise on hiding activity from government agencies or evading a lawful investigation.
If your concern is privacy, the useful goal is to reduce unnecessary data exposure, not to promise invisibility. An isolated computer can protect sensitive files from many network-based threats. It cannot erase records held by online services, undo information already shared, or remove risks from people, devices, and files that cross its boundary.
What an air gap does, and what it cannot do
An air gap is a separation between a computer and networks. A strong setup has no usable network path, while a weaker setup may only have networking switched off in software. Neither design is a guarantee against compromise, tracking, or lawful access to information stored elsewhere.
I use “air gap” to mean a dedicated computer that does not connect to the internet or a local network. Its value is limited to the data and tasks kept on it. If you sign into an online account on another device, that service may still retain records under its own policies and legal duties.
An air gap can reduce exposure to remote attacks, cloud syncing, and routine network traffic. It does not conceal your identity or activity from every observer. A file can carry harmful code, a peripheral can have its own electronics, and a person can move information across the boundary.
For that reason, I treat isolation as one security control in a wider plan. If your goal is lawful privacy, first reduce unnecessary collection on internet-connected devices: review app permissions, account settings, backups, and data retention. Do not assume that an isolated computer changes records already held by others.
Plan the boundary before buying equipment
A boundary is the set of devices, people, and procedures that control what enters or leaves the isolated system. Planning it first helps prevent accidental connections and unclear transfer rules. Write down the data, users, peripherals, and approved transfer needs before you choose hardware.
Start with a short inventory:
- What information must be stored or processed?
- Who needs access, and who approves that access?
- Which printers, scanners, keyboards, or other peripherals are required?
- Must files enter or leave the system? Why, and how often?
- Where will the computer and removable media be stored?
- How will you patch software and recover data?
This step is more important than choosing a particular operating system. A machine used for a narrow task is easier to secure than one that also browses, syncs files, and accepts unplanned devices.
NIST Special Publication 800-53 Revision 5 offers relevant control references. AC-4 covers information-flow enforcement, AC-19 covers access control for mobile devices, MP-7 covers media use, and PE-3 covers physical access. These are security controls, not an air-gap certification or proof that a system cannot be compromised.
Choose hardware with fewer paths
For stronger practical separation, select hardware without Wi-Fi, Bluetooth, cellular, or Ethernet capability when possible. Physically absent network hardware is a clearer boundary than a radio that is merely switched off in software. Some systems may contain hidden or dormant interfaces, so check the exact model and configuration.
If you already own a computer, ask a qualified technician to inspect it and remove optional network hardware where feasible. Do not rely on firmware settings alone. Also account for shared peripherals: a printer, dock, or storage device can connect the isolated system to other equipment or carry files between systems.
Build and check the isolated computer
A secure build uses a supported operating system, a small set of required applications, and controls that match the system’s purpose. Keep a written record of setup choices, update methods, and recovery steps. A disconnected computer still needs maintenance and a plan for safe updates.
Configure the system
- Survey it. List network interfaces, firmware features, connected peripherals, room access, power needs, and all data flows.
- Install supported software. Use a supported operating system and install only necessary applications. Apply updates using an approved, documented process.
- Reduce unused features. Disable or remove unneeded services and interfaces. Do not disable required safety, security, or audit controls.
- Encrypt stored data. Enable full-disk encryption and keep recovery material separate from the computer. Limit access to people who need it.
- Record the setup. Note the system’s clock method, update method, approved peripherals, and recovery procedure.
Full-disk encryption protects stored data when the device is powered off or otherwise locked, subject to its configuration and recovery process. It does not stop someone from accessing files during an active session or protect against every form of malware.
Check network interfaces
Use both a physical inspection and operating-system checks. Commands can reveal interfaces known to the system, but they cannot prove that every radio is absent or that no other path exists.
On Linux, these checks can help list network interfaces and radio status:
ip link
nmcli radio all
rfkill list
On Windows PowerShell, list network adapters:
Get-NetAdapter
You can also inspect wireless interfaces with:
netsh wlan show interfaces
On macOS, list network hardware ports with:
networksetup -listallhardwareports
Treat the results as a diagnostic aid, not a certification. Compare them with the physical inspection and the device’s documented hardware. Check again after repairs, configuration changes, or hardware additions.
Control every file transfer
A transfer is any movement of information into or out of the isolated system. Removable media is a common route, so treat each transfer as a possible path for malware or accidental disclosure. Use a written approval and inspection process rather than ad hoc copying.
A controlled workflow should specify who may approve a transfer, which media are allowed, what files are needed, and how custody is recorded. Assign clearly labeled media to a defined direction or use a controlled transfer station. Scan and authorize files before import, and record the file purpose and media custodian.
| Situation | Safer approach | Main limitation |
|---|---|---|
| A needed document must enter | Approve the file, inspect it on a designated system, scan it, and log the transfer | Scanning cannot guarantee a file is harmless |
| A report must leave | Review and approve its contents, then use the defined export route | Exported data may reveal sensitive details |
| Media changes hands | Record who held it and when; store it securely | Logs depend on accurate human practice |
| A software update is needed | Use a documented, approved update method | Update media and packages can still carry risk |
Do not use unapproved USB devices, undocumented transfer routes, or covert storage. These practices weaken the boundary and can create safety, compliance, or legal problems.
Illustrative installation scenarios
These examples are hypothetical planning cases, not reports of specific incidents. They show how the same controls can fit different lawful needs. The right design depends on the data, users, and transfer needs, so validate it against your organization’s rules and applicable law.
Personal records kept offline
A homeowner wants to keep copies of sensitive personal documents away from routine cloud sync. I would first identify which records truly need an offline copy, choose a dedicated computer, and limit access to named users. I would then document backups and recovery, because isolation is not a substitute for a usable backup.
If a document must be added, the owner would use an approved transfer process and record what was moved. This reduces casual exposure but does not change what an online bank, employer, or government service may already hold.
Small office handling restricted files
A small office needs one workstation for a narrow task that does not require network access. I would map the approved users and peripherals, secure the room, and keep transfer media under controlled access. The office would also name who approves imports and exports and how often the setup is reviewed.
The key design choice is not a hidden computer or an obscure location. It is a documented boundary that staff can follow and an access process that can be checked.
Maintain and test the boundary
An air gap is not a one-time installation. People add devices, replace parts, and move files. Schedule reviews to confirm that access, software support, media handling, and backups still match the plan.
Test the process with harmless sample files. Confirm that approvals happen, scans are recorded, media custody is clear, and recovery steps work. Check the network boundary after changes and document any residual risks, including supply-chain issues, malicious peripherals or firmware, human error, and information revealed through approved transfers.
When retiring media, use an approved organizational sanitization process suitable for the device and data. Keep recovery material separate, but make sure authorized users can still retrieve it when needed. A control that cannot be operated or recovered safely may lead people to bypass it.
Conclusion
A dedicated offline computer can reduce network exposure when its hardware, transfer routes, physical access, and maintenance are all controlled. It cannot make activity untraceable or erase records held by outside services. Define the lawful privacy goal, document the boundary, and test the real workflow rather than relying on a hidden location or a disabled setting.
Frequently asked questions
Does an air-gapped computer hide my activity from government agencies?
No. It limits network connections to that computer, but it does not make a person untraceable or remove records held by services, employers, or other parties.
Is turning off Wi-Fi enough to create an air gap?
No. Software settings are weaker than physically absent or disconnected network hardware. Inspect the device and check its interfaces.
Can an air-gapped computer still get malware?
Yes. Files, removable media, peripherals, and software updates can carry malicious code across the boundary.
Should I use a USB drive to transfer files?
Only if your approved process allows it. Use controlled media, inspect files, and record the transfer. Avoid unapproved devices and informal copying.
Do I need to update an offline computer?
Yes. Use a documented update process that meets your organization’s security requirements and records what was installed.
Does full-disk encryption make the computer safe?
No. It helps protect stored data when the system is off or locked, but does not prevent all access or malware risks.
How often should I check the boundary?
Set a schedule based on the data and your organization’s rules. Recheck after repairs, configuration changes, or added hardware.
Can a hidden storage location replace access controls?
No. Use locks, limited access, and custody records. Concealment alone is not a reliable security control.
What is the biggest risk in a small air-gapped setup?
There is no single universal risk. Common concerns include unsafe file transfers, accidental connections, weak physical access, and poor recovery planning.
Which NIST controls are relevant?
NIST SP 800-53 Rev. 5 includes AC-4, AC-19, MP-7, and PE-3 as relevant control references. They guide security planning but do not certify an air gap.
(This article was written by one of our staff writers, Richard Montclair. Visit our Meet the Team page.)
