Anti-Interdiction on the Librem 14

• About
• Latest Posts

David Hamner

Latest posts by David Hamner (see all)

• Easy App Development: Text Forwarding - January 22, 2024
• Retain Your Control and Customize Everything with Modular Software - January 22, 2024
• Nasty Software - December 18, 2023

Whether you face extreme threats or want some extra peace of mind, you might want to be able to detect if someone tampers with your laptop when it’s out of your possession. Anti-interdiction can be particularly handy when traveling and for the initial delivery.

Manual Setup

Following this procedure will allow you to verify your laptop has not been used or modified, even if it’s left unattended for a lengthy time. You’ll need a Librem Key and some glitter nail polish. On the software side, your Librem 14 will need to be running PureBoot. For those that selected the coreboot bootloader at checkout, switching to PureBoot is straightforward.

Switching to PureBoot

If you are already running PureBoot with a paired Librem Key, you can skip onto the hardware preparation section. Keep in mind PureBoot requires a separate /boot partition formatted as ext4. If you’re running PureOS, we default to this boot setup, but other distros may need custom partitioning. To verify your boot partition is valid, run:

lsblk -f | grep /boot

You should see an ext4 filesystem.

Make sure your laptop is charging and connected to the internet for the PureBoot upgrade and run the following:

mkdir ~/updates
cd ~/updates
wget https://source.puri.sm/coreboot/utility/raw/master/corebootutil.sh -O corebootutil.sh
sudo bash ./coreboot_util.sh

This will prompt you for your root password, enter it, and select 1 to use a pre-built pureBoot image. It should auto-detect you’re using a Librem 14; Press enter.Select 2 to Install PureBoot. Enter ‘Y’ to continue.You can update the serial number or use the extracted value. Enter ‘Y’ again to start the upgrade process.Flashing will take a few min to complete. Once you see this message, you can attach the Librem Key and reboot. 

PureBoot will start up and begin the pairing process of your new Librem Key and BIOS. Press “Enter” to continue.You can enter custom information, Like your email and your name, if you’d like. This also gives you the option to export your newly generated keys to a USB. If you plan to sign emails with these keys, this is a good idea.The pairing will take about 3 min.

After a reboot, you’ll need to generate your new HOTP/TOTP secrets, select the defaults and follow the onscreen setup directions to complete the pairing.

Hardware Preparation

To verify the hardware is unmodified, apply glitter nail polish to at least the 4 outside screws. This will take a few hours to dry. Once completely dry, photograph the unique patterns on each of the screws. These will be used as a reference to compare and validate visually that the chassis is untampered with. Store the photos in a safe place like a password manager.If you’d rather skip the setup, we ship Librem 14s with these same Anti Interdiction services as an option at checkout. In addition, you’ll get tamper-evident tape on the surrounding laptop packaging within the box and separate shipping for the Librem Key and Laptop. On the software side, your Librem Key will come preloaded with a custom PIN. We will also discuss a customized threat model coordinated over encrypted email.

Purism Products and Availability Chart

	Model	Status	Lead Time
	Librem Key (Made in USA)	In Stock ($59+)	10 business days	Learn More Buy Now
	Librem 5	In Stock ($699+) 3GB/32GB	10 business days	Learn More Buy Now
	Librem 5 COMSEC Bundle	In Stock ($1299+) Qty 2; 3GB/32GB	10 business days	Learn More Buy Now
	Liberty Phone (Made in USA Electronics)	Backorder ($1,999+) 4GB/128GB	Estimated fulfillment early November	Learn More Buy Now
	Librem 5 + SIMple (3 GB Data)	In Stock ($99/mo)	10 business days	Learn More Buy Now
	Librem 5 + SIMple Plus (5 GB Data)	In Stock ($129/mo)	10 business days	Learn More Buy Now
	Librem 5 + AweSIM (Unlimited Data)	In Stock ($169/mo)	10 business days	Learn More Buy Now
	Librem 11	In Stock ($999+) 8GB/1TB	10 business days	Learn More Buy Now
	Librem 14	Backorder ($1,370+)	Estimated fulfillment date pending	Learn More Buy Now
	Librem Mini	Backorder ($799+)	Estimated fulfillment November	Learn More Buy Now
	Librem Server	In Stock ($2,999+)	45 business days	Learn More Buy Now