I'd like to create a website with a very radical political message. It won't be unethical (encouraging violence, etc) but I feel the points I plan to list in it will definitely make me a lot of enemies.
How hard would it be to protect my identity from anyone finding out who I am? I know domains always have a $10/year option for privatizing your registration information but is there any other protection I should think about having?
Minimising the attack vectors by not registering a domain, not registering hosting, not using a credit card linked to your name, not openly giving out your IP and email address, not using Google Analytics, and not discussing your new project openly will each reduce the chance of your identity being discovered.
To understand how to set up a website anonymously, you must first appreciate that your identity might be obtained via:
The simplest and best way to eliminate many of these things being used to identify you is this:
Don't register a domain or pay for hosting at all.
Instead, register with a free blogging platform such as Tumblr or WordPress.com, who give you a subdomain when you sign up (i.e. yoursite.theirbrand.com). Many human rights bloggers and campaigners choose this option because the main thing they have to worry about then is protecting their email and IP address.
You can protect your IP address to a degree using a VPN such as HideMyAss whenever connecting to the Internet, or by using the Tor network. You should turn the VPN or Tor connection on before registering for any services and while using them.
A search for 'anonymous email' will provide you with an address you can use to sign up to services anonymously.
Be aware that some free blog providers will delete blogs that might be deemed offensive. Read their terms and conditions before signing up and take backups of your content if it's important to you.
If, for some reason, you have to register a domain and buy hosting, consider the following ways of safeguarding your information:
Register the domain using an anonymous registration service (not the same as domain privacy), as mentioned in this question.
Use an anonymous hosting service that allows you to register under a pseudonym and without providing a postal address, such as Anonymous Speech.
Consider using hosting and registration services that support pre-paid methods that don't link your identity to the payment method (i.e. cash). As ever, be careful about sending cash by post.
Think about registering a domain in a country outside of your own nation's jurisdiction and hosting your site somewhere else too. This doesn't prevent requests for information being sent to hosting providers, but it can add an extra barrier.
Each of these items alone will not protect your identity from someone determined to discover it, but together they will make it harder to find out who you are.
If you use Google Analytics -- even on a hosted platform like tumblr -- you should know that it's possible to do a 'reverse Google Analytics ID lookup' by putting your site's URL into services such as eWhois and Statsie to find out what other websites you're tracking with the same Google Analytics account. This could potentially unmask you if you're not protecting your identity on other websites you run.
For that reason, avoid using Google Analytics or any third-party service that might be used to identify you. Blog using a basic theme and no add-ons, widgets, or additional third-party scripts that require registration elsewhere.
If you're going to blog under an alias, make sure you've never used that alias for anything else. Aliases you've used in forums years ago ('runningWithScissors') have a habit of showing up in search engine results.
Also consider not telling anyone else what you're doing. There's no point in taking steps to mask your identity online if you're willing to give it away freely offline.
The Whois privacy is barely a protection - most registrars will surrender your personal details at the first request. Well, perhaps at the second. Anyway, the point is, they are generally unwilling to take risk and get under fire so they won't bother to investigate who is right and who is wrong for a client that perhaps only brings $5/month of revenues.
Your one option includes registering under fake name with fake address details. That will have the risk of you losing your domain name one day if they decided to validate your personality and contact details by calling your phone or mailing to your address.
A more reliable and a long-term option includes registering an offshore company and running your site in its name. There are ways of keeping the list of owners (or at least the list of beneficiaries) very private so that even investigations at the government level may turn empty. The "$10/year" however won't cut it, you'll need a few thousands per year to make this work. Good news, there are service companies which will do this for you so you won't even have to fly to another country.
Use a Hidden Service on the Tor-network with a .onion-domain. Unless you give out personal details yourself, it's impossible to trace back to you.
The whois protection is good enough as far as I know. Obviously this is true for normal people. If police or similar will require your data, they will take them easily.
There is a blogger, writer and scientist in the UK who went by the nom de plume of Belle de Jour - because she wrote about being a practicing prostitute. She wrote a book (and some more later) and her book was made into two TV series. She remained completely anonymous for a very long time before she was outed.
The way she did it is detailed here.
The advice is a little different to the above because it talks about how to set things up in terms of business structures and accountants so you can't be found out. It also talks about how somebody who knew her worked out and created a page on his blog that was a Googlewhack. Only somebody else who worked it out and searched for specific terms would go to the page so he got early warning and could get a message to her.
You might want to consider getting a separate hosting plan altogether for this purpose. With shared hosting, for example, it's trivial to do a lookup and see what your server neighbors are. Lots of sites can live at a given IP address, so this obviously doesn't pinpoint you, but it starts narrowing the list.
There are companies around that purport to provide anonymous web hosting, but you'll have to do your own research on that.
