1.Mobile Security Risks: A Primer for Activists, Journalists and Rights Defenders
2.Digital Security and Privacy for Human Rights Defenders
3.Dear Journalists at Vice and Elsewhere, Here Are Some Simple Ways Not To Get Your Source Arrested
4.Data Security 101 for Journalists
5.Worried about surveillance online? - Tactical Technology Collective
6. A Guardian guide to metadata
- Computer security millionaire John McAfee’s surreal flight from Belizean law enforcement came to an end this week when he was detained (and then hospitalized) in Guatemala, as has been widely reported. A piece of the story that hasn’t been included in much of the reporting is how authorities figured out that McAfee — who was wanted for questioning in the shooting death of his neighbor — had fled Belize for Guatemala. McAfee’s location was exposed after he agreed to let two reporters from Vice Magazine tag along with him. Proud to finally be in the thick of a story rife with vices — drugs, murder, prostitutes, guns, vicious dogs, a fugitive millionaire and his inappropriately young girlfriend — they proudly posted an iPhone photo to their blog of Vice editor-in-chief Rocco Castoro standing with the source of the mayhem in front of a jungly background, saying, “We are with John McAfee right now, suckers.”
Data Security 101 for Journalists
"Security is the chief enemy of mortals." - Shakespeare
As the story of former General and CIA Director David Petraeus has unfolded, we continue to get surprising insights into the digital breadcrumbs that led to his surprise resignation. His downfall was brought about by a growing trail of electronic records held by today's top commercial service providers few people realize even exists. This is fascinating given his position as the U.S. chief spook, where one would expect he would understand the associated risks of today's information ecosystem. However, there are serious lessons to be learned for journalists who face the same daily risks about data protection, secure communication, and shielding confidential sources.
In hindsight, we now know Petraeus used monumentally poor technology to cover his tracks. Since he was trying to hide an affair by operating outside the boundaries of the CIA's institutional security protocols, he had to depend on his own personal security knowledge. The general may be a master tactician and military leader of men and machines, but information security was not his bailiwick. Using a shared email account as the cyber-equivalent of a Cold War-era "dead drop," may have seemed clever and modern, given that known terrorist groups used the same method. Petraeus and his mistress, Paula Broadwell, likely felt there was security through obscurity.
But in the digital world, it is remarkably poor cover. Every login or access to a digital email account is logged and can be correlated to other accesses, from home broadband to hotel WiFi connections. It's the searching and correlating of those records that doomed the general and his biographer.
Kurt Opsahl of the Electronic Frontier Foundation told the Wall Street Journal: "If the director of central intelligence isn't able to successfully keep his emails private, what chance do I have?"
We have the Technology
The fact is the tools and practices do exist to greatly increase the chances, if one takes the time to understand the risks and the remedies.
Journalists operating in risky theaters or striving to be vigilant about their data have to learn a lot about this increasingly complex ecosystem. As more things move to "the cloud," we have less physical control over our data and even less understanding of the security risks.
Core to the problem is that digital data remains unencrypted and completely accessible to staff and law enforcement on the vast majority of common service providers, such as Google, Yahoo and Microsoft. This is the tradeoff we have for the use of these "free" services. They are free to use, but it means these companies are also free to index, search and profile your email and data for marketing info. It also means it's easily searched and accessed by law enforcement.
In a post-9/11 world, the threshold is significantly lower for law enforcement to subpoena information from online providers, without a judge's approval. Logs of access are detailed and kept for months. Depending on the service provider, even deleted or half-finished work can persist in searchable form.
Unless one is vigilant, leakage is rampant, revealing information about identity, location, recipients and devices. For journalists, there are a number of tools that can address these issues. There is no silver bullet here. The same way there is not one single tool that will build a house from scratch, there is a significant toolset conscientious users should be aware of.
Anonymity
For maintaining anonymity, Tor is a popular tool that taps volunteer computers on the Internet to serve as a three-hop proxy for all your web-surfing activity. Through clever encryption techniques and providing a stripped-down, secure version of the Firefox web browser, your surfing activity appears to come from another computer on the Internet which cannot be traced back to you. Because your web traffic is obfuscated through multiple hops, it is considerably slower than conventional browsing. Therefore, it's only recommended for occasional use from hostile network environments or for bypassing content filtering restrictions.
Encryption
For journalists keeping documents and contact information from prying eyes, there are many excellent choices for scrambling data. Mac users already have some tools shipped with the operating system. Apple's MacOS sports the FileVault 2 system for allowing for full-disk encryption of a Mac hard drive, which disallows all access without first entering a password. The Mac has some other interesting options for creating smaller repositories of encrypted data. The standard "Disk Utility" program can create a secure "volume" that contains strongly encrypted information in it, and acts like a removable drive.
For Windows or Mac users, the excellent free open-source TrueCrypt can scramble an entire hard drive, a portion of a disk, or just one file. TrueCrypt can also be used in combination with a removable USB drive, which provides additional physical security on the go. For most of these encryption technologies, the AES-256 standard is the most widely used, and provides adequate security for the near future.
When it comes to email or individual snippets of transmitted data, public key cryptography allows users to encrypt messages with one key, and the recipient to decrypt with another. This allows for very sophisticated scenarios that provide military-grade encryption through the use of the commercial PGP system (from Symantec) or the open-source GnuPG alternative available for most every computer system (GnuPG.org; GPGTools for MacOS X; GPG4win for Windows). Unfortunately, the great security provided by public key cryptography also makes it complex to use. PGP/GPG has been around for decades, but has not gained popularity since most users don't perceive the need for extra security and want convenient email access. One webmail provider, Hushmail, supports the PGP system and allows you to access your encrypted mail through a web browser.
To be completely safe, however, users should use a mail server and client that runs using the IMAP or POP3 mail protocol, and read messages locally on their own computer.
There also may be a reason to stick with your BlackBerry -- its enterprise systems have end-to-end encryption that is very secure, even if parent company RIM has seen its fortunes fall to Apple and Samsung in recent years.
Secure channels
There is another risk that needs accounting for -- securing the communications channel from a user's device to remote servers holding important information. More and more, Internet services are providing this themselves. Gmail is one of the few free email services that allows users to encrypt all communication over the secure HTTPS protocol (though the email messages themselves are still in the clear when stored on its server). This prevents snooper and interlopers from watching your email traffic, especially important when using open WiFi access points at Starbucks or McDonald's. Facebook just recently announced it would secure all connections with HTTPS, starting with North American users.
Not all sites support HTTPS for user content, so an easy way to secure the channel from your device while using WiFi is through the use of a virtual private network (VPN). Many corporations and news organizations already run VPN access for employees, but private citizens can also tap into private VPNs through providers like WiTopia.
It's important to note the distinction between a VPN and secure web browsing like Tor. A VPN will encrypt all network traffic into and out of your computer. Tor, on the other hand, is only for web traffic coming from its special browser.
Mobiles and tablets
Increasingly, users are demanding secure communications from their mobile devices and tablets. There are some interesting solutions for secure mobile multimedia messaging.
For the popular iOS platform, the Onion Browser provides a way to use Tor anonymous browsing from an iPhone or iPad (99 cents). For Android, the free Orbot and Orweb apps provide the same function.
In a nod to the "Mission Impossible" TV series, a number of apps are touting encrypted end-to-end messaging with self-destructing data. Silent Circle is the brainchild of legendary PGP creator Phil Zimmerman, and allows any two mobiles (with iOS or Android) to communicate securely using text, photos or video ($20 per month subscription).
Wickr's motto is "Leave No Trace," and the free iOS app supports text, picture, audio or video messages, with a built-in self-destruct timer. It's even clever enough to make cheating the system (i.e., trying to take a screen capture of an imminently self-destructing image) difficult.
Digital literacy is complex, and assessing digital security risks is even harder. The rapid progression of devices, operating systems and standards, with more and more services in the cloud, makes it hard to figure out.
So for most users, security is not a big concern -- until the one time it is, and it's too late.
At the very least, journalists should be aware of the tools at their disposal and deploy them in the right amounts as the situations warrant.
Related Reading
> Mobile Security Survival Guide Helps Journalists Understand Wireless Risks by Melissa Ulbricht
> SaferMobile Helps Protect Your Cell Phone Data From Threats by Melissa Ulbricht
Andrew Lih is a new media journalist, and associate professor at the University of Southern California's Annenberg School of Communication and Journalism where he directs the new media program. He is the author of The Wikipedia Revolution: How a bunch of nobodies created the world's greatest encyclopedia, (Hyperion 2009, Aurum UK 2009) and is a noted expert on online collaboration and journalism. He is a veteran of AT&T Bell Laboratories and in 1994 created the first online city guide for New York City (www.ny.com). He holds degrees in computer science from Columbia University, where he also helped start the journalism school's new media program in 1995. His multimedia reporting and photography of China and the 2008 Beijing Summer Olympics has appeared in the Wall Street Journal.
http://www.pbs.org/mediashift/2012/12/data-security-101-for-journalists341.html
----------------------
Dear Journalists at Vice and Elsewhere, Here Are Some Simple Ways Not To Get Your Source Arrested
With that posting, they went from chroniclers of vices to inadvertent narcs. They left the metadata in the photo, revealing McAfee’s exact location, down to latitude and longitude. McAfee tried to claim he’d manipulated the data — a claim that Vice photographer backed up on Facebook in a posting he’s since deleted — but then capitulated, hired a lawyer, and tried to claim asylum in Guatemala. Guatemalan authorities instead detained McAfee for entering the country illegally. All of which was dutifully reported by the Vice reporters, with no mention of their screw-up. Mat Honan at Wired excoriated Vice for its role in events:
And they have the resources to do it better. Vice is a $100 million operation.This was deeply stupid. People have been pointing out the dangers of inadvertently leaving GPS tags in cellphone pictures for years and years. Vice is the same publication that regularly drops in on revolutions and all manner of criminals. They should have known better.
It was indeed deeply stupid. Journalists are professional dealers in information but many are terrible about protecting it. While willing to go to jail to protect their sources, journalists may wind up leaving them exposed instead through poor data practices. In a New York Times editorial last year, Chris Soghoian, now chief technologist at the ACLU, warned that “secrets aren’t safe with journalists” explaining that “ the safety of anonymous sources will depend not only on journalists’ ethics, but on their computer skills.”Then, it followed up this egregiously stupid action with a far worse one. Vice photographer Robert King apparently lied on his Facebook page and Twitter in order to protect McAfee. Like McAfee, he claimed that the geodata in the photo had been manipulated to conceal their true location. …But the coverup, as always, is worse than the crime. In claiming the geodata had been manipulated when it had not, Vice was no longer just documenting. Now it was actively aiding a fugitive wanted for questioning in the murder investigation of his neighbor Gregory Faull, who was shot dead at his own home.
There are three very basic things journalists should be doing to shield their sources:
- Scrubbing metadata from photos, documents and other files.
- Resisting the desire to save copies of everything.
- Encrypting communications.
1. Scrubbing metadata.
“All files — photos, Word docs, PDFs — include some kind of metadata: author, location created, device information,” says Soltani. If you leave the metadata attached, you run the risk of exposing private information about the person who gave you the file, or, in the case of Vice, the location of the person trying to keep his location under wraps.
Before you share a Word doc with the world that a source sent you, run it through a scrubber. Otherwise, it may reveal where the doc was created, who authored it and anyone who has ever made changes to it. There’s Doc Scrubber for Microsoft Word.
- For PDF docs, use a tool like Metadata Assistant. Or use Adobe Acrobat’s “Examine Document” tool which will scan the doc for hidden information.
- For photos, think about turning off geotagging on your phone or digital camera so that the information doesn’t get included in the first place. You’ll usually do that in your phone’s “Location Settings.” Instructions here.
- You can run your photos through a metadata scrubber. Or, if you don’t care much about the resolution, you can just take a screenshot of the photo and use that metadata-free version.
2. Resisting the desire to save copies of everything.
We live in a time when it’s easy to save everything, meaning we’ve all become digital hoarders. Why delete an email or chat when you can just archive it? It could come in handy later. Or it could come back to bite you later.
- “Disable chat logs in whatever program you’re using, Gmail or Skype,” says Soltani. In Gmail, that means switching chats to “off the record.” In Skype, it means turning off the feature that automatically saves your chats to anywhere you log in. (Added privacy bonus: That could keep your boss from winding up getting his hands on a sexy chat you had on your home computer.)
- If you need to keep a record of a chat, save it as a Word file on your own computer, and encrypt it.
- “Don’t keep emails around for years and years,” says Soltani. “Practice better data hygiene.”
- Soltani says journalists and sources might consider setting up temporary email accounts to communicate about a story, and then to delete the accounts after the story’s complete. He compares it to using a burner cell phone.
This may be the most labor intensive of the recommendations from computer security professionals, but if it’s important that your communications with someone not be compromised, it’s worth it. This means your emails will appear as gibberish to anyone you don’t want reading them. Had David Petraeus and Paula Broadwell encrypted their emails to one another rather than saving them in a drafts folder, their exposing themselves to each other wouldn’t have been exposed to the world. “This allows you to communicate securely and protects your messages if your account is compromised,” says Soltani.
- For chat, consider using Adium’s OTR.
- Use a Virtual Private Network or create your own SSL.
- Take 10 minutes to set up SMime or PGP for Gmail so that the emails you send from whichever provider you use are encrypted. The only limitation here: you need to get the person you’re communicating with to enable encryption as well.
- Rather than calling someone from your landline or cell phone, use Skype or Silent Circle.
A journalist’s job is to bring information to light. Using these tools, you’ll retain some control over which information gets lit.
------------
Mobile Security Risks: A Primer for Activists, Journalists and Rights Defenders
Activists, rights defenders, and journalists use mobile devices and communications for reporting, organizing, mobilizing, and documenting. Mobiles provide countless benefits -- relatively low cost, increased efficiencies, vast reach -- but they also present specific risks to rights defenders and activists.
Additionally, information about other mobile uses, such as your photos or video, your data, the Internet sites you visit from your phone, and your physical location, are stored on your device and often logged by your mobile network. (The above graphic shows a schematic overview of the layers of the mobile networks to give you sense of the different elements that make up communications between two phones.)How much is this putting you at risk? This Overview will help you evaluate your level of risk in regard to your mobile communications.
Part I describes security vulnerabilities associated with mobile phone technology and the risks they pose to you - the information held by your mobile network operator (MNO or operator), the information stored on your phone, and the risks related to unauthorized use.
Part II discusses common phone capabilities - voice, SMS/text messaging, web browsing, mobile email, mobile photos and video, and smartphone apps. We describe the safety risks these pose for you and give you tips on how to minimize them.
How to use this overview
We use little pictures/icons in this guide to make it easier for you to follow.
This icon connotes techniques that you can implement yourself to increase your safety as you use a mobile device.
Watch out for this icon. There are many areas of vulnerability, both on mobile device and network levels, that you should be aware of. Many of these are hard to protect against. Use caution! Part I: General Mobile Risks
This section describes general characteristics associated with mobile phone technology - the information held by your mobile network operator, the information stored on your phone, and the risks unauthorized use of this information may pose to you.
Your mobile service is operated by your mobile network operator. As it manages your communication, it is also able to record certain types of messages you send, as well as information about your communication activities and your device. Note that none of these risks is easy to mitigate. The motto here is: The more you know, the more you can make smart choices regarding your mobile communications. Network records
Network records are vulnerable if you suspect you are being surveilled by someone who could access them. This might be via the legal system (a subpoena, or formal legal demand), an informal government request, or through a corrupt employee of the network operator.
- Any communication your phone has with the mobile network - whether placing or receiving a call, sending a message, browsing the web or just remaining connected - includes identifying information about the phone and the SIM card. There are two numbers that are important
- The IMEI is a number that uniquely identifies the phone - the hardware.
- The IMSI is a number that uniquely identifies the SIM card.
Security Risks
When your phone is switched on, the network knows your location, triangulated from the cell towers nearby that record your phone’s signal. Your location might be accurate to as much as a few meters in a densely populated area but only to a few hundred meters in a rural area with few cell towers. If you make or receive a call or send or receive a text message, your location at that time is stored in network records. Note that this is a function of the mobile network, not any nefarious surveillance. All networks triangulate your signal. This is important to remember as this information can be used against you!Monitoring/Eavesdropping
- The contents of your text messages are visible in plain text and also stored in network records.
- Text messages (and emails if sent unencrypted) with certain keywords can be blocked and the sender singled out.
- Calls can be monitored and recorded by network personnel, and recordings may be passed (legally or illegally) to someone outside the operator. Your calls may be listened to during or after the call.
- Internet traffic can be monitored and recorded. Network operators can see what websites you access and may also see data you send and receive. Again, this information can be recorded for later use and may be passed on to someone else outside the operator.
- Any unusual encrypted communication (to anything other than widely used websites such as Gmail, for example) may appear suspicious to the network operator. For example, simply sending encrypted text messages over a mobile network can arouse suspicion and single you out.
Disrupted access
- Your mobile communication relies on service from the mobile network operator. It is easy for your operator to disrupt or disable your service.
- Governments can request that mobile operators shut down all or parts of their network - for example, during elections or to stem protest action.
- Your mobile number or the IMEI or IMSI numbers associated with your services may be selectively disabled.
- Specific websites you are trying to access via your mobile phone may be blocked.
|
Physical and Remote Access to Your Phone
Mobile phones are easily lost, stolen, or taken from you. It is therefore important for you to understand what an attacker might learn when your phone is taken from you.
Security Risks
Data on the Phone and SIM Card
If someone else has your phone, it is easy to link your personal identity to your device and all sensitive and compromising data on the phone through SIM registration, IMEI, and IMSI numbers. Consider the following ways that you may be storing sensitive information on your phone:
- The phone’s address book can store your contacts (names, telephone number, email, etc), and anyone with access to your phone can see these contacts.
- The phone stores your call history - who you called and received calls from, and the time calls were made.
- The phone stores SMS text messages you have sent or received as well as draft messages. It is possible to recover messages even if you have deleted them from the phone memory.
- Any applications you use, such as a calendar or to-do list, store data on the phone or on a memory card.
- Photos you have taken using the phone camera are stored on the phone or memory card. Most phones store the time the photo was taken and may also include location information and the make and model of the phone.
- If you use a web browser on your phone, your browsing history (sites visited), and bookmarks may be stored.
- If you use an email app, your emails, like any other application data, may be stored on the phone.
- All of this data that is stored is not easily destroyed or wiped permanently and can be recovered with data forensics methods. Other people might be able to recover data even if it appears deleted to you.
Unauthorized use, either because someone has taken possession of the phone, or because compromising software has been installed, is a risk for any type of phone.
- For many phones, it is possible for an attacker to gain unauthorized access remotely if the attacker can install an application on the device. To do this, an attacker might trick you into downloading a file from the Internet or open an infected MMS, or take advantage of having temporary physical access to the device.
- Phone theft is another way to get access to the device. If your phone is ever out of your possession for an extended period of time and is returned to you, use it with extreme caution.
- While a PIN code might slow a thief down, there are many ways to get around entering the PIN to access data. It’s best not to rely on it to protect you.
- Unauthorized use allows an attacker to impersonate you to contacts who identify you by your phone number or email address.
- With readily available software, a full phone image (a copy of all your data and activity records) can be made for subsequent analysis.
- Unauthorized use can include making expensive calls.
|
Part II: Specific Mobile Use Risks
This section describes risks of using your mobile phone for specific types of communication, media capture, and data storage -- voice, SMS/text messaging, web browsing, mobile email, mobile photos and video, and smartphone apps.Voice: This Call May Be Recorded...
Voice is used for person-to-person calling and personal voicemail (if available), but can also be part of an automated system. For example, Interactive Voice Response (IVR) systems might operate a hotline for reporting incidents of police corruption.Security Risks
All voice communications can expose you, whether it is by simple eavesdropping by someone physically near to you or by tracking call recipients and times at the network level. Here are some risks to consider and ways to minimize these risks.Eavesdropping/Recording calls
- As with any conversation, you could be overheard or recorded by someone nearby.
- Your conversation could be eavesdropped or recorded by an app installed on your phone without your knowledge.
- Voice calls are encrypted between the handset and the cell tower. However, various sophisticated attacks are possible against mobile networks, particularly older standards (the GSM standard, still the predominant standard in the world, is more vulnerable than 3G). For example, hardware that impersonates a GSM base station is commercially available.
Persistent Records
- The details of your call (whom you called, at what time, for how long) are stored by the network even if the content is not. Unless you have taken specific precautions, you and the person you call are using phones that have been linked to you by both the IMEI number (the handset identifier) and the IMSI (the SIM card identifier).
- Voicemail messages are stored by the mobile network operator and should not be considered secure, even when protected by a personal PIN.
- Interactions with an Interactive Voice Response (IVR) system are only as secure as the system itself. Be sure that the organization or entity running the system is trustworthy, technically competent, and will not allow your calls to be monitored or recorded.
- Any phone use reveals your location to the network operator. The stored record of your activity (calls, texts, data use) places you in a particular place at a particular time.
|
SMS/Text Messaging
Like voice, SMS, also referred to as text messaging, can be used between individuals - for conveying short information, getting someone to call you back, or just keeping in touch. Automatic systems for one-to-many texting are also useful, for example, in mobilizing a large group or getting news out. Many-to-one/data collection systems are also popular to help aggregate incident reports, solicit opinions, or collect some kinds of routine data.
Security Risks
- SMS messages are sent in plain text. They are not encrypted, so the content is not hidden or disguised in any way. Anyone who intercepts the messages (with the help of the mobile network operator or by listening for traffic in a particular network cell) can read your SMS
- Mobile network operators keep records of SMSs sent through their network. This includes details of date and time sent, details about the sender and recipient, as well as the unencrypted contents of the message.
- Sent or received messages stored on a phone or SIM are vulnerable if the phone or SIM is lost or stolen.
- It is possible for mobile apps to access sent and received text messages that are stored on your phone.
|
Web Browsing
The mobile web isn’t just for browsing, although looking for information or news reports is one of its main uses. If you are using the web version of an online service such as Gmail, Twitter, Facebook), or if you are blogging or tweeting from your phone, you may also be using the mobile web. Certain smartphone apps also use the web to send or receive data.Security Risks
- Unless you are using HTTPS (you can tell by looking at the site address - it should begin with https:// and not just http://), your traffic is not encrypted. A curious attacker on the network can use a packet sniffing tool to see:
- What sites you are accessing
- Content you are uploading/downloading
- Some mobile web browsers don’t support HTTPS at all, meaning your account credentials (user name and passwords) and any queries are transmitted in the clear and unencrypted all the time.
- Your web access sessions are recorded, with time and date, by the mobile network operator.
- Unless you are using a traffic anonymizing service like>Tor, the network operator can see both the source (your phone) and destination (the website you are visiting) of all your browsing. This information may also be logged (stored) by the network operator.
- Some mobile web browsers - notably Opera Mini - route the pages you see through their server to optimize them for mobile viewing. Even if your connection to the page is secure, they see data you send and receive in plain text.Opera Mini on the iPhone has the same problem. Older versions of Opera Mini (prior to Opera Mini Basic v.3) also send data in plain text between their server and the website you are browsing.
- If you use the browser on your phone to save passwords to websites you use often, remember that anyone with physical access to your phone can potentially see those passwords and access these same websites on your behalf.
- Remember that websites, as well as the Internet service provided by your mobile network, can be unavailable at times. This could be because of technical problems or a malicious attack.
|
Mobile Email
Mobile email can be accessed in two ways.- Through your phone’s browser using a webmail provider (Gmail, Hotmail and Yahoo, for example). Everything we’ve said about secure web browsing above also applies to email access through your phone browser.
- Using a dedicated email app that you might install or that might come pre-installed on the phone. The way these apps work can vary quite a bit and so can their security.
Security Risks
|
Photos, Video and MMS
Security Risks
- The date and time you took a photo or video are saved as part of the descriptive information for each media item. The phone model may also be saved. This descriptive information is called EXIF data.
- Location information may also be saved as part of EXIF data.
- If you upload photos or videos to a website (Twitter, Facebook, Flickr, YouTube, your blog), the descriptive information may be preserved. Anyone viewing your media could see where, when, and with what phone you created it. Some sites strip this information off during the upload process (at the time of writing, Facebook was one that did), but it’s never worth relying on this.
- If you send photos or video as an email attachment, the descriptive information is always preserved.
- MMS, like SMS, can be intercepted and viewed by the network operator. Information about your phone (identifying numbers, location) is also available to the network operator
- Although mobile viruses and malicious mobile software are rare, there are cases where MMS has been used to install these on unsuspecting feature phones.
- Phones with cameras can pose a surveillance risk. If someone has unauthorized remote access to the phone, the camera can potentially be remotely activated to take pictures without a user’s knowledge.
|
Security for Smartphones
Security Risks
- Be very wary of open public WiFi networks - the kind that do not require a password, for example in coffee shops or hotels. It is very easy for an attacker on the same network to collect anything sent in plain text. It is also easy to eavesdrop HTTPS connections (a “man-in-the-middle” attack).
- WiFi networks that require a WEP key (you’ll see this when you connect) are also not very secure, and should be avoided.
- Smartphones with always-on Internet connectivity and GPS make you easier to track accurately.
- Apps can easily have malicious code hidden within them that collect and transmit your personal information without your knowledge.
|
To listen to an audio recording of this piece, click here. Thank you to Ashiyan Rahmani-Shirazi (@ashiyan) for the sound recording.
====
Digital Security and Privacy for Human Rights Defenders
Digital Security
Human rights defenders are increasingly using computers and the Internet in their work. Although access to technology is still a huge issue around the world, electronic means of storing and communicating information are getting more and more common in human rights organisations. However, governments are also developing the capacity to manipulate, monitor and subvert electronic information. Surveillance and censorship is growing and the lack of security for digitally stored or communicated information is becoming a major problem for human rights defenders in some countries.In response to requests from human rights defenders for support in this area Front Line has developed a manual on Digital Security and Privacy for Human Rights Defenders (PDF version in English, Spanish and Vietnamese..
In collaboration with the Tactical Technology Collective Front Line has also developed a package of tools and guides called Security in-a-Box.Front Line has also organised hands-on training workshops for human rights defenders from many countries among others: Belarus, Burma, Democratic Republic of Congo, Guatemala, India, Iraq, Jordan, Morocco, Russia, Syria, Tibet, Tunisia, United Arab Emirates, Vietnam, Western Sahara, Yemen, Zimbabwe. Front Line trained trainers from many countries for more effective follow-up on digital security issues. Front Line is also consulting HR organisations in addressing digital security challenges. And is helping implementing security strategies through the Security Grants Program.
Please see the following resources for further information in relation to digital security:
- Security in-a-Box toolkit
- Digital Security and Privacy for Human Rights Defenders manual
- Anonymous Blogging with Wordpress and Tor (also version in: Chinese, French) by Global Voices Advocacy
- Blog for a Cause!: The Global Voices Guide of Blog Advocacy (also version in: Chinese, Spanish, French) by Global Voices Advocacy
- Handbook for Bloggers and Cyber-Dissidents (also version in: French, Chinese - Circumvent Censorship chapter, Chinese - Blog Anonymously chapter) by Reporters Without Borders
- Everyone's Guide to By-Passing Internet Censorship (also version in: Russian and Burmese) by CiviSec
- Protektor Manual a guide on using security related software on Windows, Mac OS and Linux.
- meet ONO the robot hero of Survival in the Digital Age, an animation series about digital security, online privacy and access to information.
- "Peif, the Pet Expert on Internet Filtering" - educational cartoon on digital security and online censorship.
Link to campaign:
--------------------------------------
Worried about surveillance online?
https://alternatives.tacticaltech.org/#
A collection of our tips and how to's on alternatives
If you're worried about the privacy of your online activities, be they website browsing, chats, voice calls, emails or cloud storage, there's no need to fear. For several years, software developers and privacy advocates have been inventing new tools and tactics for ordinary citizens, journalists, activists and human rights defenders to secure their online activities and control the information they share.No IT tool or resource is perfect, nor can they guarantee you 100% privacy or information security online. Furthermore, you should only use tools which correspond to your own analysis of which information you need to keep private, which varies from person to person. All the same, it is recommendable to use Free and Open-Source software tools, since their security credentials and weaknesses can be independently verified, and you can therefore rely on the technology itself, rather than just what the developer says, and while they may not guarantee 100% information security, they can make surveillance or invasion of privacy much more difficult.
The following is a short list of alternative tools and platforms that will help keep your private information more secure. We've also provided links to step-by-step hands-on guides for their installation and use, where possible.
If you'd like to learn more, you should take a look at:
Browser
Mozilla Firefox - Secure web browser
Some popular browsers, such as
Safari, or Internet Explorer, are not open source, meaning that their
code cannot be analysed and the security they claim to offer can't be
independently verified by the community. Others browsers are partially
open source, such as Google Chrome, could still be used to gather
information about your activities by linking them to your Google
account.
Mozilla Firefox is a free, open-source web browser which was developed by a non-profit organisation which has a commitment to protecting user privacy. Furthermore, its privacy features can be enhanced through a number of add-ons.
Mozilla Firefox is a free, open-source web browser which was developed by a non-profit organisation which has a commitment to protecting user privacy. Furthermore, its privacy features can be enhanced through a number of add-ons.
Tor Browser Bundle - Anonymous and secure web browser
Whenever you visit a website or
communicate (such as via email) through a web browser, traces of your
activities are left behind in the form of your IP address, which is like
the postal address of your computer, as well as through other means
such as the cookies that may be sent to your browser. This means that
many websites can track your visit and build a profile of you based on
your activities.
If you want your browsing activities and location to be anonymised, we recommend you use Tor Browser. Tor is designed to increase the anonymity of your activities on the Internet. It disguises your identity and protects your on-line activities from many forms of Internet surveillance, by directing your internet traffic through a network of proxies. Tor can also be used to bypass Internet filters.
If you want your browsing activities and location to be anonymised, we recommend you use Tor Browser. Tor is designed to increase the anonymity of your activities on the Internet. It disguises your identity and protects your on-line activities from many forms of Internet surveillance, by directing your internet traffic through a network of proxies. Tor can also be used to bypass Internet filters.
Search
DuckDuckGo
Many popular web search engines, such
as Google or Bing, collect and aggregate data about your web searches
and may pass them on to third parties. They may also link them to any
other services you use from the same provider, such as your Google Mail,
Google Plus, Microsoft Outlook or Skype accounts, creating a detailed
profile of your online activities.
Duck Duck Go is a web search engine which does not pass on search requests to third parties, or store any information about users.
Duck Duck Go is a web search engine which does not pass on search requests to third parties, or store any information about users.
Email Provider
RiseUp
Many commercial email providers, such
as Google or Yahoo, collect a huge amount of user information which can
be handed over to third parties from advertising companies to
governments. Furthermore, some do not offer users an encrypted
connection (known as HTTPS or SSL) by default, meaning that emails are
sent in 'plain text' and readable by malicious hackers, Internet Service
Providers, and others with access to the networks as they travel
between users' devices and the email provider's servers.
Riseup is a collective organization dedicated to providing private and secure email and hosting services for individuals and organisations committed to political and social justice.
Although Riseup is a secure email service managed by trustworthy advocates of Internet privacy and security, an unusual email service may attract unwarranted attention. It might make more sense in some situations, to blend in by using a popular email service in your country. The goal is to make this decision without compromising your minimum security requirements.
Riseup is a collective organization dedicated to providing private and secure email and hosting services for individuals and organisations committed to political and social justice.
Although Riseup is a secure email service managed by trustworthy advocates of Internet privacy and security, an unusual email service may attract unwarranted attention. It might make more sense in some situations, to blend in by using a popular email service in your country. The goal is to make this decision without compromising your minimum security requirements.
Email Client
Mozilla Thunderbird with Enigmail and GPG
Mozilla Thunderbird is a free and
open source email client for receiving, sending and storing emails. You
can manage multiple email accounts through a single program. Enigmail
and GnuPG will give you access to authentication, digital signing and
encryption to ensure the privacy and security of your email
communication.
Collaboration Online
Crabgrass
Social networking sites and online
collaboration platforms such as those provided by Facebook and Google
are major sources of information for governments or other individual
engaging in large- or small-scale surveillance and intelligence
gathering, which may invade your privacy.
Crabgrass is an online platform designed for social networking, group collaboration and network organizing. Its group collaboration tools include private wikis, task lists, file repository, and decision making tools.
Crabgrass is an online platform designed for social networking, group collaboration and network organizing. Its group collaboration tools include private wikis, task lists, file repository, and decision making tools.
Video Chat
Jitsi
Some voice and video chat services,
store logs of your calls and chats and may hand them over to third
parties from advertising companies to governments. In the case of
Microsoft's Skype, this has been a relatively regular practice.
Jitsi is a free, open source software tool which allows for encrypted text chats with OTR form XMPP, Google Talk, Facebook. Yahoo, AIM, ICQ and many other accounts. Furthermore, it facilitates encrypted voice and video calls when used voice and video call accounts, such as Google Talk.
Jitsi is a free, open source software tool which allows for encrypted text chats with OTR form XMPP, Google Talk, Facebook. Yahoo, AIM, ICQ and many other accounts. Furthermore, it facilitates encrypted voice and video calls when used voice and video call accounts, such as Google Talk.
Private Chat
Adium and OTR
Adium is a free and open source
client that lets you organize and manage your different Instant
Messaging (IM) accounts using a single interface. The Off-the-Record
(OTR) plug-in designed for use with Pidgin ensures authenticated and
secure communications between users that also use Off-the-Record
plugins.
Adium - We will be publishing a Adium Hands-on guide shortly
Pidgin and OTR
Many instant messaging service
providers, such as Google (Gtalk), Facebook (Facebook Chat), Yahoo (Y!
Messenger), and others, store logs of your conversations with your
contacts and could hand them over to third parties from advertising
companies to governments. It's recommendable to use these chat accounts
with an IM client which allows you to encrypt your chats, so that they
can only be read by their intended recipients.
Pidgin is a free and open source client that lets you organize and manage your different Instant Messaging (IM) accounts using a single interface. The Off-the-Record (OTR) plug-in designed for use with Pidgin ensures authenticated and secure communications between users that also use Off-the-Record plugins.
Pidgin is a free and open source client that lets you organize and manage your different Instant Messaging (IM) accounts using a single interface. The Off-the-Record (OTR) plug-in designed for use with Pidgin ensures authenticated and secure communications between users that also use Off-the-Record plugins.
Private Chat - Mobile
Gibberbot
Gibberbot is a free and open source
application for Android devices, created by the Guardian Project, that
lets you organize and manage your different Instant Messaging (IM)
accounts using a single interface. It uses Off-the-Record (OTR) software
which ensures authenticated and secure communications between clients
including Gibberbot, ChatSecure, Jitsi, and Pidgin. Gibberbot can also
add a layer of anonymity and protect your communications from many forms
of Internet surveillance by connecting through Orbot, which allows your
smartphone's internet traffic to be routed through the Tor network.
ChatSecure
iOS
ChatSecure is a free open source
messaging application for iOs devices that allows users to exchange
messages using the Off-the-Record encryption protocol. It is compatible
with XMPP (Gtalk, Jabber) and AIM accounts.
Private Call - Mobile
RedPhone
Specifically targeted groups, such as
human rights defenders, journalists, and activits, may be subjected to
'tapping' of their calls by adversaries with direct or indirect access
to the celular phone network.
RedPhone is a Free and Open-Source Software application that encrypts voice communication data sent between two devices that run this application. However it also becomes easier to analyze the traffic it produces and trace it back to you, through your mobile number. RedPhone uses a central server, which is a point of centralization and thus puts RedPhone in a powerful position (of having control over some of this data).
RedPhone is a Free and Open-Source Software application that encrypts voice communication data sent between two devices that run this application. However it also becomes easier to analyze the traffic it produces and trace it back to you, through your mobile number. RedPhone uses a central server, which is a point of centralization and thus puts RedPhone in a powerful position (of having control over some of this data).
OStel.co
Open Secure Telephony Network (OSTN)
and the server provided by the Guardian project, ostel.co, when used
with the CSipSimple app, currently offers one of the most secure means
to communicate via voice. When using CSipSimple, you never directly
communicate with your communication partner, instead all your data is
routed through the Ostel server. This makes it much harder to trace your
data and find out who you are talking to. Additionally, Ostel doesn't
retain any of this data, except the account data that you need to log
in.
Worried about surveillance online?
A collection of our tips and how to's on alternatives
If you're worried about the privacy of your online activities, be they website browsing, chats, voice calls, emails or cloud storage, there's no need to fear. For several years, software developers and privacy advocates have been inventing new tools and tactics for ordinary citizens, journalists, activists and human rights defenders to secure their online activities and control the information they share.No IT tool or resource is perfect, nor can they guarantee you 100% privacy or information security online. Furthermore, you should only use tools which correspond to your own analysis of which information you need to keep private, which varies from person to person. All the same, it is recommendable to use Free and Open-Source software tools, since their security credentials and weaknesses can be independently verified, and you can therefore rely on the technology itself, rather than just what the developer says, and while they may not guarantee 100% information security, they can make surveillance or invasion of privacy much more difficult.
The following is a short list of alternative tools and platforms that will help keep your private information more secure. We've also provided links to step-by-step hands-on guides for their installation and use, where possible.
If you'd like to learn more, you should take a look at:
Browser
Mozilla Firefox - Secure web browser
Some popular browsers, such as
Safari, or Internet Explorer, are not open source, meaning that their
code cannot be analysed and the security they claim to offer can't be
independently verified by the community. Others browsers are partially
open source, such as Google Chrome, could still be used to gather
information about your activities by linking them to your Google
account.
Mozilla Firefox is a free, open-source web browser which was developed by a non-profit organisation which has a commitment to protecting user privacy. Furthermore, its privacy features can be enhanced through a number of add-ons.
Mozilla Firefox is a free, open-source web browser which was developed by a non-profit organisation which has a commitment to protecting user privacy. Furthermore, its privacy features can be enhanced through a number of add-ons.
Tor Browser Bundle - Anonymous and secure web browser
Whenever you visit a website or
communicate (such as via email) through a web browser, traces of your
activities are left behind in the form of your IP address, which is like
the postal address of your computer, as well as through other means
such as the cookies that may be sent to your browser. This means that
many websites can track your visit and build a profile of you based on
your activities.
If you want your browsing activities and location to be anonymised, we recommend you use Tor Browser. Tor is designed to increase the anonymity of your activities on the Internet. It disguises your identity and protects your on-line activities from many forms of Internet surveillance, by directing your internet traffic through a network of proxies. Tor can also be used to bypass Internet filters.
If you want your browsing activities and location to be anonymised, we recommend you use Tor Browser. Tor is designed to increase the anonymity of your activities on the Internet. It disguises your identity and protects your on-line activities from many forms of Internet surveillance, by directing your internet traffic through a network of proxies. Tor can also be used to bypass Internet filters.
Search
DuckDuckGo
Many popular web search engines, such
as Google or Bing, collect and aggregate data about your web searches
and may pass them on to third parties. They may also link them to any
other services you use from the same provider, such as your Google Mail,
Google Plus, Microsoft Outlook or Skype accounts, creating a detailed
profile of your online activities.
Duck Duck Go is a web search engine which does not pass on search requests to third parties, or store any information about users.
Duck Duck Go is a web search engine which does not pass on search requests to third parties, or store any information about users.
Email Provider
RiseUp
Many commercial email providers, such
as Google or Yahoo, collect a huge amount of user information which can
be handed over to third parties from advertising companies to
governments. Furthermore, some do not offer users an encrypted
connection (known as HTTPS or SSL) by default, meaning that emails are
sent in 'plain text' and readable by malicious hackers, Internet Service
Providers, and others with access to the networks as they travel
between users' devices and the email provider's servers.
Riseup is a collective organization dedicated to providing private and secure email and hosting services for individuals and organisations committed to political and social justice.
Although Riseup is a secure email service managed by trustworthy advocates of Internet privacy and security, an unusual email service may attract unwarranted attention. It might make more sense in some situations, to blend in by using a popular email service in your country. The goal is to make this decision without compromising your minimum security requirements.
Riseup is a collective organization dedicated to providing private and secure email and hosting services for individuals and organisations committed to political and social justice.
Although Riseup is a secure email service managed by trustworthy advocates of Internet privacy and security, an unusual email service may attract unwarranted attention. It might make more sense in some situations, to blend in by using a popular email service in your country. The goal is to make this decision without compromising your minimum security requirements.
Email Client
Mozilla Thunderbird with Enigmail and GPG
Mozilla Thunderbird is a free and
open source email client for receiving, sending and storing emails. You
can manage multiple email accounts through a single program. Enigmail
and GnuPG will give you access to authentication, digital signing and
encryption to ensure the privacy and security of your email
communication.
Collaboration Online
Crabgrass
Social networking sites and online
collaboration platforms such as those provided by Facebook and Google
are major sources of information for governments or other individual
engaging in large- or small-scale surveillance and intelligence
gathering, which may invade your privacy.
Crabgrass is an online platform designed for social networking, group collaboration and network organizing. Its group collaboration tools include private wikis, task lists, file repository, and decision making tools.
Crabgrass is an online platform designed for social networking, group collaboration and network organizing. Its group collaboration tools include private wikis, task lists, file repository, and decision making tools.
Video Chat
Jitsi
Some voice and video chat services,
store logs of your calls and chats and may hand them over to third
parties from advertising companies to governments. In the case of
Microsoft's Skype, this has been a relatively regular practice.
Jitsi is a free, open source software tool which allows for encrypted text chats with OTR form XMPP, Google Talk, Facebook. Yahoo, AIM, ICQ and many other accounts. Furthermore, it facilitates encrypted voice and video calls when used voice and video call accounts, such as Google Talk.
Jitsi is a free, open source software tool which allows for encrypted text chats with OTR form XMPP, Google Talk, Facebook. Yahoo, AIM, ICQ and many other accounts. Furthermore, it facilitates encrypted voice and video calls when used voice and video call accounts, such as Google Talk.
Private Chat
Adium and OTR
Adium is a free and open source
client that lets you organize and manage your different Instant
Messaging (IM) accounts using a single interface. The Off-the-Record
(OTR) plug-in designed for use with Pidgin ensures authenticated and
secure communications between users that also use Off-the-Record
plugins.
Adium - We will be publishing a Adium Hands-on guide shortly
Pidgin and OTR
Many instant messaging service
providers, such as Google (Gtalk), Facebook (Facebook Chat), Yahoo (Y!
Messenger), and others, store logs of your conversations with your
contacts and could hand them over to third parties from advertising
companies to governments. It's recommendable to use these chat accounts
with an IM client which allows you to encrypt your chats, so that they
can only be read by their intended recipients.
Pidgin is a free and open source client that lets you organize and manage your different Instant Messaging (IM) accounts using a single interface. The Off-the-Record (OTR) plug-in designed for use with Pidgin ensures authenticated and secure communications between users that also use Off-the-Record plugins.
Pidgin is a free and open source client that lets you organize and manage your different Instant Messaging (IM) accounts using a single interface. The Off-the-Record (OTR) plug-in designed for use with Pidgin ensures authenticated and secure communications between users that also use Off-the-Record plugins.
Private Chat - Mobile
Gibberbot
Gibberbot is a free and open source
application for Android devices, created by the Guardian Project, that
lets you organize and manage your different Instant Messaging (IM)
accounts using a single interface. It uses Off-the-Record (OTR) software
which ensures authenticated and secure communications between clients
including Gibberbot, ChatSecure, Jitsi, and Pidgin. Gibberbot can also
add a layer of anonymity and protect your communications from many forms
of Internet surveillance by connecting through Orbot, which allows your
smartphone's internet traffic to be routed through the Tor network.
ChatSecure
iOS
ChatSecure is a free open source
messaging application for iOs devices that allows users to exchange
messages using the Off-the-Record encryption protocol. It is compatible
with XMPP (Gtalk, Jabber) and AIM accounts.
Private Call - Mobile
RedPhone
Specifically targeted groups, such as
human rights defenders, journalists, and activits, may be subjected to
'tapping' of their calls by adversaries with direct or indirect access
to the celular phone network.
RedPhone is a Free and Open-Source Software application that encrypts voice communication data sent between two devices that run this application. However it also becomes easier to analyze the traffic it produces and trace it back to you, through your mobile number. RedPhone uses a central server, which is a point of centralization and thus puts RedPhone in a powerful position (of having control over some of this data).
RedPhone is a Free and Open-Source Software application that encrypts voice communication data sent between two devices that run this application. However it also becomes easier to analyze the traffic it produces and trace it back to you, through your mobile number. RedPhone uses a central server, which is a point of centralization and thus puts RedPhone in a powerful position (of having control over some of this data).
OStel.co
Open Secure Telephony Network (OSTN)
and the server provided by the Guardian project, ostel.co, when used
with the CSipSimple app, currently offers one of the most secure means
to communicate via voice. When using CSipSimple, you never directly
communicate with your communication partner, instead all your data is
routed through the Ostel server. This makes it much harder to trace your
data and find out who you are talking to. Additionally, Ostel doesn't
retain any of this data, except the account data that you need to log
in.
A Guardian guide to metadata
A very useful, and easy to use guide to understand just how much of data we (inadvertently, unknowingly) share when we use web based social media, browse sites and even just email.
------------------
