Anti-Interdiction on the Librem 14
Latest posts by David Hamner (see all)
- Easy App Development: Text Forwarding - January 22, 2024
- Retain Your Control and Customize Everything with Modular Software - January 22, 2024
- Nasty Software - December 18, 2023
Whether you face extreme threats or want some extra peace of mind, you might want to be able to detect if someone tampers with your laptop when it’s out of your possession. Anti-interdiction can be particularly handy when traveling and for the initial delivery.
Manual Setup
Following this procedure will allow you to verify your laptop has not been used or modified, even if it’s left unattended for a lengthy time. You’ll need a Librem Key and some glitter nail polish. 
On the software side, your Librem 14 will need to be running PureBoot. For those that selected the coreboot bootloader at checkout, switching to PureBoot is straightforward.
Switching to PureBoot
If you are already running PureBoot with a paired Librem Key, you can skip onto the hardware preparation section. Keep in mind PureBoot requires a separate /boot partition formatted as ext4. If you’re running PureOS, we default to this boot setup, but other distros may need custom partitioning. To verify your boot partition is valid, run:
lsblk -f | grep /boot
You should see an ext4 filesystem.
Make sure your laptop is charging and connected to the internet for the PureBoot upgrade and run the following:
mkdir ~/updates
cd ~/updates
wget https://source.puri.sm/coreboot/utility/raw/master/corebootutil.sh -O corebootutil.sh
sudo bash ./coreboot_util.sh
This will prompt you for your root password, enter it, and select 1 to use a pre-built pureBoot image. 
It should auto-detect you’re using a Librem 14; Press enter.
Select 2 to Install PureBoot. Enter ‘Y’ to continue.
You can update the serial number or use the extracted value. Enter ‘Y’ again to start the upgrade process.
Flashing will take a few min to complete. Once you see this message, you can attach the Librem Key and reboot. 
PureBoot will start up and begin the pairing process of your new Librem Key and BIOS. Press “Enter” to continue.
You can enter custom information, Like your email and your name, if you’d like. This also gives you the option to export your newly generated keys to a USB. If you plan to sign emails with these keys, this is a good idea.
The pairing will take about 3 min.
After a reboot, you’ll need to generate your new HOTP/TOTP secrets, select the defaults and follow the onscreen setup directions to complete the pairing.
Hardware Preparation
To verify the hardware is unmodified, apply glitter nail polish to at least the 4 outside screws. 
This will take a few hours to dry. Once completely dry, photograph the unique patterns on each of the screws. 
These will be used as a reference to compare and validate visually that the chassis is untampered with. Store the photos in a safe place like a password manager.
If you’d rather skip the setup, we ship Librem 14s with these same Anti Interdiction services as an option at checkout. In addition, you’ll get tamper-evident tape on the surrounding laptop packaging within the box and separate shipping for the Librem Key and Laptop. On the software side, your Librem Key will come preloaded with a custom PIN. We will also discuss a customized threat model coordinated over encrypted email.
Purism Products and Availability Chart
| Model | Status | Lead Time | ||
|---|---|---|---|---|
 | Librem Key (Made in USA) | In Stock ($59+) | 10 business days | |
 | Librem 5 | In Stock ($699+) 3GB/32GB | 10 business days | |
| Librem 5 COMSEC Bundle | In Stock ($1299+) Qty 2; 3GB/32GB | 10 business days | |
| Liberty Phone (Made in USA Electronics) | Backorder ($1,999+) 4GB/128GB | Estimated fulfillment February | |
| Librem 5 + SIMple (3 GB Data) | In Stock ($99/mo) | 10 business days | |
| Librem 5 + SIMple Plus (5 GB Data) | In Stock ($129/mo) | 10 business days | |
| Librem 5 + AweSIM (Unlimited Data) | In Stock ($169/mo) | 10 business days | |
 | Librem 11 | In Stock ($999+) 8GB/1TB | 10 business days | |
 | Librem 14 | Backorder ($1,370+) | Estimated fulfillment December | |
 | Librem Mini | Backorder ($799+) | 10 business days | |
 | Librem Server | In Stock ($2,999+) | 45 business days |
Recent Posts
Related Content
- PureOS Crimson Development Report: October 2024
- The Case for Free/Libre and Open-Source Software: Enhancing Security and Privacy in the Digital Age
- RIP RSA AES: The Immediate Need of Quantum-Resistant Cryptography
- PureOS Crimson Development Report: September 2024
- True Choice for Smartphone Privacy and Security
