Safe Communication

Contents

1.Mobile Security Risks: A Primer for Activists, Journalists and Rights Defenders
2.Digital Security and Privacy for Human Rights Defenders
3.Dear Journalists at Vice and Elsewhere, Here Are Some Simple Ways Not To Get Your Source Arrested
4.Data Security 101 for Journalists
5.Worried about surveillance online? - Tactical Technology Collective  

6. A Guardian guide to metadata
  1. Data Security 101 for Journalists

     "Security is the chief enemy of mortals." - Shakespeare
    As the story of former General and CIA Director David Petraeus has unfolded, we continue to get surprising insights into the digital breadcrumbs that led to his surprise resignation. His downfall was brought about by a growing trail of electronic records held by today's top commercial service providers few people realize even exists. This is fascinating given his position as the U.S. chief spook, where one would expect he would understand the associated risks of today's information ecosystem. However, there are serious lessons to be learned for journalists who face the same daily risks about data protection, secure communication, and shielding confidential sources.
    In hindsight, we now know Petraeus used monumentally poor technology to cover his tracks. Since he was trying to hide an affair by operating outside the boundaries of the CIA's institutional security protocols, he had to depend on his own personal security knowledge. The general may be a master tactician and military leader of men and machines, but information security was not his bailiwick. Using a shared email account as the cyber-equivalent of a Cold War-era "dead drop," may have seemed clever and modern, given that known terrorist groups used the same method. Petraeus and his mistress, Paula Broadwell, likely felt there was security through obscurity.
    But in the digital world, it is remarkably poor cover. Every login or access to a digital email account is logged and can be correlated to other accesses, from home broadband to hotel WiFi connections. It's the searching and correlating of those records that doomed the general and his biographer.
    Kurt Opsahl of the Electronic Frontier Foundation told the Wall Street Journal: "If the director of central intelligence isn't able to successfully keep his emails private, what chance do I have?"

    We have the Technology

    The fact is the tools and practices do exist to greatly increase the chances, if one takes the time to understand the risks and the remedies.
    Journalists operating in risky theaters or striving to be vigilant about their data have to learn a lot about this increasingly complex ecosystem. As more things move to "the cloud," we have less physical control over our data and even less understanding of the security risks.
    Core to the problem is that digital data remains unencrypted and completely accessible to staff and law enforcement on the vast majority of common service providers, such as Google, Yahoo and Microsoft. This is the tradeoff we have for the use of these "free" services. They are free to use, but it means these companies are also free to index, search and profile your email and data for marketing info. It also means it's easily searched and accessed by law enforcement.
    In a post-9/11 world, the threshold is significantly lower for law enforcement to subpoena information from online providers, without a judge's approval. Logs of access are detailed and kept for months. Depending on the service provider, even deleted or half-finished work can persist in searchable form.
    Unless one is vigilant, leakage is rampant, revealing information about identity, location, recipients and devices. For journalists, there are a number of tools that can address these issues. There is no silver bullet here. The same way there is not one single tool that will build a house from scratch, there is a significant toolset conscientious users should be aware of.

    Anonymity

    torss.jpg
    For maintaining anonymity, Tor is a popular tool that taps volunteer computers on the Internet to serve as a three-hop proxy for all your web-surfing activity. Through clever encryption techniques and providing a stripped-down, secure version of the Firefox web browser, your surfing activity appears to come from another computer on the Internet which cannot be traced back to you. Because your web traffic is obfuscated through multiple hops, it is considerably slower than conventional browsing. Therefore, it's only recommended for occasional use from hostile network environments or for bypassing content filtering restrictions.

    Encryption

    For journalists keeping documents and contact information from prying eyes, there are many excellent choices for scrambling data. Mac users already have some tools shipped with the operating system. Apple's MacOS sports the FileVault 2 system for allowing for full-disk encryption of a Mac hard drive, which disallows all access without first entering a password. The Mac has some other interesting options for creating smaller repositories of encrypted data. The standard "Disk Utility" program can create a secure "volume" that contains strongly encrypted information in it, and acts like a removable drive.
    For Windows or Mac users, the excellent free open-source TrueCrypt can scramble an entire hard drive, a portion of a disk, or just one file. TrueCrypt can also be used in combination with a removable USB drive, which provides additional physical security on the go. For most of these encryption technologies, the AES-256 standard is the most widely used, and provides adequate security for the near future.
    When it comes to email or individual snippets of transmitted data, public key cryptography allows users to encrypt messages with one key, and the recipient to decrypt with another. This allows for very sophisticated scenarios that provide military-grade encryption through the use of the commercial PGP system (from Symantec) or the open-source GnuPG alternative available for most every computer system (GnuPG.org; GPGTools for MacOS X; GPG4win for Windows). Unfortunately, the great security provided by public key cryptography also makes it complex to use. PGP/GPG has been around for decades, but has not gained popularity since most users don't perceive the need for extra security and want convenient email access. One webmail provider, Hushmail, supports the PGP system and allows you to access your encrypted mail through a web browser.
    To be completely safe, however, users should use a mail server and client that runs using the IMAP or POP3 mail protocol, and read messages locally on their own computer.
    There also may be a reason to stick with your BlackBerry -- its enterprise systems have end-to-end encryption that is very secure, even if parent company RIM has seen its fortunes fall to Apple and Samsung in recent years.

    Secure channels

    There is another risk that needs accounting for -- securing the communications channel from a user's device to remote servers holding important information. More and more, Internet services are providing this themselves. Gmail is one of the few free email services that allows users to encrypt all communication over the secure HTTPS protocol (though the email messages themselves are still in the clear when stored on its server). This prevents snooper and interlopers from watching your email traffic, especially important when using open WiFi access points at Starbucks or McDonald's. Facebook just recently announced it would secure all connections with HTTPS, starting with North American users.
    Not all sites support HTTPS for user content, so an easy way to secure the channel from your device while using WiFi is through the use of a virtual private network (VPN). Many corporations and news organizations already run VPN access for employees, but private citizens can also tap into private VPNs through providers like WiTopia.
    It's important to note the distinction between a VPN and secure web browsing like Tor. A VPN will encrypt all network traffic into and out of your computer. Tor, on the other hand, is only for web traffic coming from its special browser.

    Mobiles and tablets

    Increasingly, users are demanding secure communications from their mobile devices and tablets. There are some interesting solutions for secure mobile multimedia messaging.
    For the popular iOS platform, the Onion Browser provides a way to use Tor anonymous browsing from an iPhone or iPad (99 cents). For Android, the free Orbot and Orweb apps provide the same function.
    In a nod to the "Mission Impossible" TV series, a number of apps are touting encrypted end-to-end messaging with self-destructing data. Silent Circle is the brainchild of legendary PGP creator Phil Zimmerman, and allows any two mobiles (with iOS or Android) to communicate securely using text, photos or video ($20 per month subscription).
    Wickr's motto is "Leave No Trace," and the free iOS app supports text, picture, audio or video messages, with a built-in self-destruct timer. It's even clever enough to make cheating the system (i.e., trying to take a screen capture of an imminently self-destructing image) difficult.
    Digital literacy is complex, and assessing digital security risks is even harder. The rapid progression of devices, operating systems and standards, with more and more services in the cloud, makes it hard to figure out.
    So for most users, security is not a big concern -- until the one time it is, and it's too late.
    At the very least, journalists should be aware of the tools at their disposal and deploy them in the right amounts as the situations warrant.

    Related Reading

    > Mobile Security Survival Guide Helps Journalists Understand Wireless Risks by Melissa Ulbricht
    > SaferMobile Helps Protect Your Cell Phone Data From Threats by Melissa Ulbricht
    Andrew Lih is a new media journalist, and associate professor at the University of Southern California's Annenberg School of Communication and Journalism where he directs the new media program. He is the author of The Wikipedia Revolution: How a bunch of nobodies created the world's greatest encyclopedia, (Hyperion 2009, Aurum UK 2009) and is a noted expert on online collaboration and journalism. He is a veteran of AT&T Bell Laboratories and in 1994 created the first online city guide for New York City (www.ny.com). He holds degrees in computer science from Columbia University, where he also helped start the journalism school's new media program in 1995. His multimedia reporting and photography of China and the 2008 Beijing Summer Olympics has appeared in the Wall Street Journal.


    http://www.pbs.org/mediashift/2012/12/data-security-101-for-journalists341.html

    ----------------------
     Dear Journalists at Vice and Elsewhere, Here Are Some Simple Ways Not To Get Your Source Arrested 
    Computer security millionaire John McAfee’s surreal flight from Belizean law enforcement came to an end this week when he was detained (and then hospitalized) in Guatemala, as has been widely reported. A piece of the story that hasn’t been included in much of the reporting is how authorities figured out that McAfee — who was wanted for questioning in the shooting death of his neighbor — had fled Belize for Guatemala. McAfee’s location was exposed after he agreed to let two reporters from Vice Magazine tag along with him. Proud to finally be in the thick of a story rife with vices — drugs, murder, prostitutes, guns, vicious dogs, a fugitive millionaire and his inappropriately young girlfriend — they proudly posted an iPhone photo to their blog of Vice editor-in-chief Rocco Castoro standing with the source of the mayhem in front of a jungly background, saying, “We are with John McAfee right now, suckers.
    With that posting, they went from chroniclers of vices to inadvertent narcs. They left the metadata in the photo, revealing McAfee’s exact location, down to latitude and longitude. McAfee tried to claim he’d manipulated the data — a claim that Vice photographer backed up on Facebook in a posting he’s since deleted — but then capitulated, hired a lawyer, and tried to claim asylum in Guatemala. Guatemalan authorities instead detained McAfee for entering the country illegally. All of which was dutifully reported by the Vice reporters, with no mention of their screw-up. Mat Honan at Wired excoriated Vice for its role in events:
    This was deeply stupid. People have been pointing out the dangers of inadvertently leaving GPS tags in cellphone pictures for years and years. Vice is the same publication that regularly drops in on revolutions and all manner of criminals. They should have known better.
    And they have the resources to do it better. Vice is a $100 million operation.
    Then, it followed up this egregiously stupid action with a far worse one. Vice photographer Robert King apparently lied on his Facebook page and Twitter in order to protect McAfee. Like McAfee, he claimed that the geodata in the photo had been manipulated to conceal their true location. …
    But the coverup, as always, is worse than the crime. In claiming the geodata had been manipulated when it had not, Vice was no longer just documenting. Now it was actively aiding a fugitive wanted for questioning in the murder investigation of his neighbor Gregory Faull, who was shot dead at his own home.
    It was indeed deeply stupid. Journalists are professional dealers in information but many are terrible about protecting it. While willing to go to jail to protect their sources, journalists may wind up leaving them exposed instead through poor data practices. In a New York Times editorial last year, Chris Soghoian, now chief technologist at the ACLU, warned that “secrets aren’t safe with journalists” explaining that “ the safety of anonymous sources will depend not only on journalists’ ethics, but on their computer skills.”
    There are three very basic things journalists should be doing to shield their sources:
  2. Scrubbing metadata from photos, documents and other files.
  3. Resisting the desire to save copies of everything.
  4. Encrypting communications.
Technologist Ashkan Soltani walked me through some simple tools for doing this. They’re not foolproof, but they’ll make it a little less likely that your blog post will wind up sending the person you’re profiling to jail (unless that’s your intent).

1. Scrubbing metadata.
“All files — photos, Word docs, PDFs — include some kind of metadata: author, location created, device information,” says Soltani. If you leave the metadata attached, you run the risk of exposing private information about the person who gave you the file, or, in the case of Vice, the location of the person trying to keep his location under wraps.
  • Before you share a Word doc with the world that a source sent you, run it through a scrubber. Otherwise, it may reveal where the doc was created, who authored it and anyone who has ever made changes to it. There’s Doc Scrubber for Microsoft Word.
  • For PDF docs, use a tool like Metadata Assistant. Or use Adobe Acrobat’s “Examine Document” tool which will scan the doc for hidden information.
  • For photos, think about turning off geotagging on your phone or digital camera so that the information doesn’t get included in the first place. You’ll usually do that in your phone’s “Location Settings.” Instructions here.
  • You can run your photos through a metadata scrubber. Or, if you don’t care much about the resolution, you can just take a screenshot of the photo and use that metadata-free version.
Some photo-hosting services do you the favor of scrubbing metadata. Facebook, Twitter and Instagram all have this privacy-protective measure in place.
2. Resisting the desire to save copies of everything.
We live in a time when it’s easy to save everything, meaning we’ve all become digital hoarders. Why delete an email or chat when you can just archive it? It could come in handy later. Or it could come back to bite you later.
  • “Disable chat logs in whatever program you’re using, Gmail or Skype,” says Soltani. In Gmail, that means switching chats to “off the record.” In Skype, it means turning off the feature that automatically saves your chats to anywhere you log in. (Added privacy bonus: That could keep your boss from winding up getting his hands on a sexy chat you had on your home computer.)
  • If you need to keep a record of a chat, save it as a Word file on your own computer, and encrypt it.
  • “Don’t keep emails around for years and years,” says Soltani. “Practice better data hygiene.”
  • Soltani says journalists and sources might consider setting up temporary email accounts to communicate about a story, and then to delete the accounts after the story’s complete. He compares it to using a burner cell phone.
3. Encrypting your communications.
This may be the most labor intensive of the recommendations from computer security professionals, but if it’s important that your communications with someone not be compromised, it’s worth it. This means your emails will appear as gibberish to anyone you don’t want reading them. Had David Petraeus and Paula Broadwell encrypted their emails to one another rather than saving them in a drafts folder, their exposing themselves to each other wouldn’t have been exposed to the world. “This allows you to communicate securely and protects your messages if your account is compromised,” says Soltani.
  • For chat, consider using Adium’s OTR.
  • Use a Virtual Private Network or create your own SSL.
  • Take 10 minutes to set up SMime or PGP for Gmail so that the emails you send from whichever provider you use are encrypted. The only limitation here: you need to get the person you’re communicating with to enable encryption as well.
  • Rather than calling someone from your landline or cell phone, use Skype or Silent Circle.
***
A journalist’s job is to bring information to light. Using these tools, you’ll retain some control over which information gets lit.

 ------------

Mobile Security Risks: A Primer for Activists, Journalists and Rights Defenders

Posted by SaferMobile on May 10, 2011

Activists, rights defenders, and journalists use mobile devices and communications for reporting, organizing, mobilizing, and documenting.  Mobiles provide countless benefits -- relatively low cost, increased efficiencies, vast reach -- but they also present specific risks to rights defenders and activists.



Additionally, information about other mobile uses, such as your photos or video, your data, the Internet sites you visit from your phone, and your physical location, are stored on your device and often logged by your mobile network. (The above graphic shows a schematic overview of the layers of the mobile networks to give you sense of the different elements that make up communications between two phones.)How much is this putting you at risk?  This Overview will help you evaluate your level of risk in regard to your mobile communications.
Part I describes security vulnerabilities associated with mobile phone technology and the risks they pose to you - the information held by your mobile network operator (MNO or operator), the information stored on your phone, and the risks related to unauthorized use.
Part II discusses common phone capabilities - voice, SMS/text messaging, web browsing, mobile email, mobile photos and video, and smartphone apps. We describe the safety risks these pose for you and give you tips on how to minimize them.

How to use this overview

We use little pictures/icons in this guide to make it easier for you to follow.

This icon connotes techniques that you can implement yourself to increase your safety as you use a mobile device.

Watch out for this icon.  There are many areas of vulnerability, both on mobile device and network levels, that you should be aware of. Many of these are hard to protect against.  Use caution!

Part I: General Mobile Risks

This section describes general characteristics associated with mobile phone technology - the information held by your mobile network operator, the information stored on your phone, and the risks unauthorized use of this information may pose to you.
Your mobile service is operated by your mobile network operator.  As it manages your communication, it is also able to record certain types of messages you send, as well as information about your communication activities and your device. Note that none of these risks is easy to mitigate.  The motto here is: The more you know, the more you can make smart choices regarding your mobile communications.

Network records

Network records are vulnerable if you suspect you are being surveilled by someone who could access them. This might be via the legal system (a subpoena, or formal legal demand), an informal government request, or through a corrupt employee of the network operator.
  • Any communication your phone has with the mobile network - whether placing or receiving a call, sending a message, browsing the web or just remaining connected - includes identifying information about the phone and the SIM card. There are two numbers that are important
    • The IMEI is a number that uniquely identifies the phone - the hardware.
    • The IMSI is a number that uniquely identifies the SIM card.

Security Risks

When your phone is switched on, the network knows your location, triangulated from the cell towers nearby that record your phone’s signal. Your location might be accurate to as much as a few meters in a densely populated area but only to a few hundred meters in a rural area with few cell towers.  If you make or receive a call or send or receive a text message, your location at that time is stored in network records. Note that this is a function of the mobile network, not any nefarious surveillance. All networks triangulate your signal.  This is important to remember as this information can be used against you!

Monitoring/Eavesdropping
  • The contents of your text messages are visible in plain text and also stored in network records.
  • Text messages (and emails if sent unencrypted) with certain keywords can be blocked and the sender singled out.
  • Calls can be monitored and recorded by network personnel, and recordings may be passed (legally or illegally) to someone outside the operator. Your calls may be listened to during or after the call.
  • Internet traffic can be monitored and recorded. Network operators can see what websites you access and may also see data you send and receive. Again, this information can be recorded for later use and may be passed on to someone else outside the operator.
  • Any unusual encrypted communication (to anything other than widely used websites such as Gmail, for example) may appear suspicious to the network operator. For example, simply sending encrypted text messages over a mobile network can arouse suspicion and single you out.

Disrupted access

  • Your mobile communication relies on service from the mobile network operator.  It is easy for your operator to disrupt or disable your service.
  • Governments can request that mobile operators shut down all or parts of their network - for example, during elections or to stem protest action.
  • Your mobile number or the IMEI or IMSI numbers associated with your services may be selectively disabled.
  • Specific websites you are trying to access via your mobile phone may be blocked.
  •  

safetyiconProtect Yourself

  • As much as possible, avoid linking your identity to your phone number. Buy prepaid SIM cards, if at all possible avoid registering the SIM in your name, and buy a cheap, low-tech phone that you don’t mind throwing out if necessary. 
  • Take your battery out of your phone during and when traveling to and from group meetings to avoid cell phone triangulation and location tracking.
  • Avoid sending text messages with sensitive information, or use mobile Internet-based messaging with encryption instead.
  • Note strange behaviour like SMS non-delivery or frequently dropped calls. If necessary, change your SIM card.
  • If you have a smartphone, consider using an encrypted Voice Over IP (VOIP) application for your phone calls. VOIP is used by Internet phone services like Skype and Google Voice.
  • Always try to have an alternative if you are unable to access one or more services or the entire network. Carry SIM cards for other mobile network operators, and if possible, carry more than one phone. Have a backup meeting place agreed ahead of time if you suspect your specific line or the entire mobile service may be disrupted
  • Lastly, avoid giving out your actual mobile phone number at all costs, including putting it on fliers or press releases. If you need to publish a phone number, use Skype In, Google Voice, or purchase an inexpensive voicemail-only number.  For example, Skype Online Numbers can be purchased from Skype, for instance: http://www.skype.com/intl/en-us/features/allfeatures/online-number/ - you get a public number, and then it can forward on to your mobile phone. The cost for this is $18 USD for 3 months.

Physical and Remote Access to Your Phone


Mobile phones are easily lost, stolen, or taken from you. It is therefore important for you to understand what an attacker might learn when your phone is taken from you.

Security Risks


Data on the Phone and SIM Card

If someone else has your phone, it is easy to link your personal identity to your device and all sensitive and compromising data on the phone through SIM registration, IMEI, and IMSI numbers.  Consider the following ways that you may be storing sensitive information on your phone:
  • The phone’s address book can store your contacts (names, telephone number, email, etc), and anyone with access to your phone can see these contacts.
  • The phone stores your call history - who you called and received calls from, and the time calls were made.
  • The phone stores SMS text messages you have sent or received as well as draft messages. It is possible to recover messages even if you have deleted them from the phone memory.
  • Any applications you use, such as a calendar or to-do list, store data on the phone or on a memory card.
  • Photos you have taken using the phone camera are stored on the phone or memory card. Most phones store the time the photo was taken and may also include location information and the make and model of the phone.
  • If you use a web browser on your phone, your browsing history (sites visited), and bookmarks may be stored.
  • If you use an email app, your emails, like any other application data, may be stored on the phone.
  • All of this data that is stored is not easily destroyed or wiped permanently and can be recovered with data forensics methods. Other people might be able to recover data even if it appears deleted to you.
Unauthorized use

Unauthorized use, either because someone has taken possession of the phone, or because compromising software has been installed, is a risk for any type of phone.
  • For many phones, it is possible for an attacker to gain unauthorized access remotely if the attacker can install an application on the device. To do this, an attacker might trick you into downloading a file from the Internet or open an infected MMS, or take advantage of having temporary physical access to the device.
  • Phone theft is another way to get access to the device. If your phone is ever out of your possession for an extended period of time and is returned to you, use it with extreme caution.
  • While a PIN code might slow a thief down, there are many ways to get around entering the PIN to access data. It’s best not to rely on it to protect you.
  • Unauthorized use allows an attacker to impersonate you to contacts who identify you by your phone number or email address.
  • With readily available software, a full phone image (a copy of all your data and activity records) can be made for subsequent analysis.
  • Unauthorized use can include making expensive calls.

safetyiconProtect Yourself

  • Delete messages, photos/videos, and call records to deter an unsophisticated attacker, but remember that deleted data can sometimes be recovered from the phone.
  • Don’t use the phone book if you can keep numbers in a safe place without it. Don’t store numbers and names together.
  • Do not use explicitly identifying information for contacts, including names, nicknames, or contact icons/pictures.
  • Check the settings on the phone to see if can be set to NOT store call logs and outgoing SMS.
  • If you have a smartphone, enable remote wipe or ‘poison pill’ functionality. This allows you to remotely erase data on the phone if it has been stolen. You will need to download an app and/or configure remote wipe through an online service.  There are more details in this article: http://www.pcmag.com/article2/0,2817,2352755,00.asp
  • Lock your phone using various available options to block calls and physical access.
  • Always use removable memory/external storage for sensitive media and data, and remove it whenever the phone is not with you.

Part II: Specific Mobile Use Risks

This section describes risks of using your mobile phone for specific types of communication, media capture, and data storage -- voice, SMS/text messaging, web browsing, mobile email, mobile photos and video, and smartphone apps.

Voice: This Call May Be Recorded...

Voice is used for person-to-person calling and personal voicemail (if available), but can also be part of an automated system. For example, Interactive Voice Response (IVR) systems might operate a hotline for reporting incidents of police corruption.


Security Risks

All voice communications can expose you, whether it is by simple eavesdropping by someone physically near to you or by tracking call recipients and times at the network level. Here are some risks to consider and ways to minimize these risks.

Eavesdropping/Recording calls

  • As with any conversation, you could be overheard or recorded by someone nearby.
  • Your conversation could be eavesdropped or recorded by an app installed on your phone without your knowledge.
  • Voice calls are encrypted between the handset and the cell tower. However, various sophisticated attacks are possible against mobile networks, particularly older standards (the GSM standard, still the predominant standard in the world, is more vulnerable than 3G). For example, hardware that impersonates a GSM base station is commercially available.

Persistent Records

  • The details of your call (whom you called, at what time, for how long) are stored by the network even if the content is not. Unless you have taken specific precautions, you and the person you call are using phones that have been linked to you by both the IMEI number (the handset identifier) and the IMSI (the SIM card identifier).
  • Voicemail messages are stored by the mobile network operator and should not be considered secure, even when protected by a personal PIN.
  • Interactions with an Interactive Voice Response (IVR) system are only as secure as the system itself. Be sure that the organization or entity running the system is trustworthy, technically competent, and will not allow your calls to be monitored or recorded.
  • Any phone use reveals your location to the network operator. The stored record of your activity (calls, texts, data use) places you in a particular place at a particular time.

safetyiconProtect Yourself

  • Use a basic phone, without apps, rather than a smartphone.
  • If you must use a smartphone, use an encrypted VOIP application instead of calling through the mobile network.
  • Buy your phone and SIM card without identifying yourself, if possible in your country, and change both regularly. Use a prepaid SIM card.
  • Consider making sensitive reports from public phones, or, if you feel you are recognizable, asking someone else to do it.
  • Delete call logs (understanding that they may be able to be retrieved even if deleted by someone with specialized knowledge and forensic tools).
  • Be careful how you store contacts in your address book - be aware that your phone or SIM may be stolen and call records associated with callers and receivers.
  • A virtual phone number such as Skype Online Numbers (“Skype In”) or Google Voice provides one level of protection by de-linking the caller and you and by allowing you not to expose your mobile number.  However, using Skype In or Google Voice for calls places some trust in Skype, Google, or whichever service you choose. This might not be a good idea in some countries where these services might be compromised.


SMS/Text Messaging

Like voice, SMS, also referred to as text messaging, can be used between individuals - for conveying short information, getting someone to call you back, or just keeping in touch. Automatic systems for one-to-many texting are also useful, for example, in mobilizing a large group or getting news out. Many-to-one/data collection systems are also popular to help aggregate incident reports, solicit opinions, or collect some kinds of routine data.


Security Risks

  • SMS messages are sent in plain text. They are not encrypted, so the content is not hidden or disguised in any way. Anyone who intercepts the messages (with the help of the mobile network operator or by listening for traffic in a particular network cell) can read your SMS
  • Mobile network operators keep records of SMSs sent through their network. This includes details of date and time sent, details about the sender and recipient, as well as the unencrypted contents of the message.
  • Sent or received messages stored on a phone or SIM are vulnerable if the phone or SIM is lost or stolen.
  • It is possible for mobile apps to access sent and received text messages that are stored on your phone.

safetyiconProtect Yourself

  • Keep the content of your messages to a minimum - expect that it can be read, and that the reader will know the date and time it was sent as well as the location of the sender.
  • If you must use text messaging, do so from a basic phone and not a phone with apps.
  • Set SMS storage to very low or none. Turn off the option to save outbound messages. Delete messages regularly.
  • Consider using an encrypted messaging app instead of SMS. Many of these apps require a data connection, and you will need a phone on which apps can be installed. There are several encrypted messaging apps that run on Java phones and many for smartphone operating systems like Android, iPhone OS (iOS), and Blackberry. Which one works for you will depend on your phone’s operating system. Note that many encrypted messaging apps require that both the sender and receiver use the same app (and therefore the same kind of phone), so this strategy probably works best for small group communications.
  • If you are setting up an SMS messaging system for mass-texting SMS to recipients, make sure your servers and infrastructure are secure. If you are sending SMSs in to a system run by another organization, evaluate their security precautions as best you can, and especially check how they plan to share your data. Ushahidi, for example, can be set up to make all incoming reports publicly available on the Internet. This may be helpful for disseminating disaster information widely, but could be problematic in a situation of political upheaval.


Web Browsing

The mobile web isn’t just for browsing, although looking for information or news reports is one of its main uses. If you are using the web version of an online service such as Gmail, Twitter, Facebook), or if you are blogging or tweeting from your phone, you may also be using the mobile web. Certain smartphone apps also use the web to send or receive data.



Security Risks

  • Unless you are using HTTPS (you can tell by looking at the site address - it should begin with https:// and not just http://), your traffic is not encrypted. A curious attacker on the network can use a packet sniffing tool to see:
    • What sites you are accessing
    • Content you are uploading/downloading
  • Some mobile web browsers don’t support HTTPS at all, meaning your account credentials (user name and passwords) and any queries are transmitted in the clear and unencrypted all the time.
  • Your web access sessions are recorded, with time and date, by the mobile network operator.
  • Unless you are using a traffic anonymizing service like>Tor, the network operator can see both the source (your phone) and destination (the website you are visiting) of all your browsing. This information may also be logged (stored) by the network operator.
  • Some mobile web browsers - notably Opera Mini - route the pages you see through their server to optimize them for mobile viewing. Even if your connection to the page is secure, they see data you send and receive in plain text.Opera Mini on the iPhone has the same problem. Older versions of Opera Mini (prior to Opera Mini Basic v.3) also send data in plain text between their server and the website you are browsing.
  • If you use the browser on your phone to save passwords to websites you use often, remember that anyone with physical access to your phone can potentially see those passwords and access these same websites on your behalf.
  • Remember that websites, as well as the Internet service provided by your mobile network, can be unavailable at times. This could be because of technical problems or a malicious attack.

safetyiconProtect Yourself

  • Use HTTPS for sensitive browsing, and make sure that all the pages you see, from the login page onward, are encrypted. Look for a padlock icon or https:// in the address line to indicate that your are browsing securely. Note that some mobile browsers hide the address bar.
  • If available for your phone, use Tor to anonymize the source and destination of your browsing. At the moment, the only official mobile client for Tor is Orbot on Android - see instructions here
  • If you use Opera Mini as your mobile browser, make sure you have the latest version. Also, familiarize yourself with how security works for this browser and remember that by using it, you are allowing Opera Software to see browsing you do over https in plain text.
  • Be aware of changes to familiar sites. Even with HTTPS, there have been cases where a fake site has been put up to impersonate a real log-in page to steal account passwords. If you suspect anything, abandon a potentially compromised account and get a new one.
  • If certain sites are commonly blocked but suddenly become available, be wary. There could be a greater degree of surveillance of these sites.
  • Avoid relying on just one site or one mobile network. If you have multiple SIM cards and multiple secure email accounts, you are more likely to be able to communicate even if one network operator or website is down.


Mobile Email

Mobile email can be accessed in two ways.
  • Through your phone’s browser using a webmail provider (Gmail, Hotmail and Yahoo, for example). Everything we’ve said about secure web browsing above also applies to email access through your phone browser.
  • Using a dedicated email app that you might install or that might come pre-installed on the phone. The way these apps work can vary quite a bit and so can their security.


Security Risks





  • If you access your email through the phone’s browser and do not use HTTPS, your message is sent in plain text and can be read by the mobile network operator and potentially by malicious attackers on the open Internet.






  • Even if you use HTTPS, the network operator can see the site you are accessing, as well as the date and time of the transaction, your location at the time, and identifying information about your phone. This information may also be logged/stored.





  • Email headers - email addresses of the sender and recipient, email subject - are never encrypted even when using an encrypted email protocol like PGP.






  • The recipients of your email may have security vulnerabilities on their side, and the message content and your identity may be revealed by them.





  • safetyiconProtect Yourself

    • When accessing your email through a webmail service, use HTTPS throughout the transaction. If possible, use Tor as well.
    • If you are using a smartphone, consider using open PGP email. PGP is a data encryption protocol widely used around the world for encrypting e-mail messages and securing files.
    • There are also PGP webmail services, but note that because these store your private key on the server, they are less secure. Use only if you trust the provider’s security, and are aware of the circumstances in which they may be forced to hand over your email to law enforcement. More information on PGP security is available on RiseUp.net and in this article by Bruce Schneier.  
    • Since your subject line is not encrypted when using PGP-enabled email, keep your subject line generic, and consider switching between several email addresses if you don’t want anyone watching your communication to notice a pattern.
    • Talk to the recipients of your correspondence about their security practices, and, if you feel they may not know enough to protect themselves, consider communicating a different way.



    Photos, Video and MMS

    Security Risks

    • The date and time you took a photo or video are saved as part of the descriptive information for each media item. The phone model may also be saved. This descriptive information is called EXIF data.
    • Location information may also be saved as part of EXIF data.
    • If you upload photos or videos to a website (Twitter, Facebook, Flickr, YouTube, your blog), the descriptive information may be preserved. Anyone viewing your media could see where, when, and with what phone you created it. Some sites strip this information off during the upload process (at the time of writing, Facebook was one that did), but it’s never worth relying on this.
    • If you send photos or video as an email attachment, the descriptive information is always preserved.
    • MMS, like SMS, can be intercepted and viewed by the network operator. Information about your phone (identifying numbers, location) is also available to the network operator
    • Although mobile viruses and malicious mobile software are rare, there are cases where MMS has been used to install these on unsuspecting feature phones.
    • Phones with cameras can pose a surveillance risk. If someone has unauthorized remote access to the phone, the camera can potentially be remotely activated to take pictures without a user’s knowledge.

    safetyiconProtect Yourself

    • If possible, securely upload images and video to a website rather than sending an MMS.
    • Unless you really need MMS functionality on your phone, check the settings to see if it can be disabled.
    • MobileActive.org has a step-by-step guide on how to check for and remove identifying data from images.
    • Turn off geotagging in phone settings, and also consider turning off all location services. For smartphones there is a guide here.
    • If the site you are uploading media to allows it, go through your account settings and disable display of any additional information about your images.
    • If you have access to a PC or can email your images to a trusted contact as a first step, use an EXIF data stripping program like Exifer. There’s a generally useful guide on the Picasa forums.


    Security for Smartphones

    Security Risks


    • Be very wary of open public WiFi networks - the kind that do not require a password, for  example in coffee shops or hotels. It is very easy for an attacker on the same network to collect anything sent in plain text. It is also easy to eavesdrop HTTPS connections (a “man-in-the-middle” attack).
    • WiFi networks that require a WEP key (you’ll see this when you connect) are also not very secure, and should be avoided.
    • Smartphones with always-on Internet connectivity and GPS make you easier to track accurately.
    • Apps can easily have malicious code hidden within them that collect and transmit your personal information without your knowledge.

    safetyiconProtect Yourself

    • Don’t do anything sensitive on an open WiFi network, and be wary on WEP or WPA (not WPA2) networks as well.  Check on your WiFi connection on the phone as to what kind of a network it is.
    • At all times when you don’t need WiFi connection, turn it off! In particular, make sure your phone is not set to connect automatically to open networks.
    • Turn off location tracking unless you really need it.
    • Don’t install unneccesary apps on a phone that you want to use for secure communication.
    • Consider installing a suite of tools for more secure communications. For example, for Android phones, see the GuardianProject's suite of tools at
      https://guardianproject.info/apps. All apps are free and open source. (Disclosure: We at MobileActive.org work with the GuardianProject on SaferMobile and other projects.)

    To listen to an audio recording of this piece, click here. Thank you to Ashiyan Rahmani-Shirazi (@ashiyan) for the sound recording.

    ====

    Digital Security and Privacy for Human Rights Defenders

    Digital Security

    Human rights defenders are increasingly using computers and the Internet in their work. Although access to technology is still a huge issue around the world, electronic means of storing and communicating information are getting more and more common in human rights organisations. However, governments are also developing the capacity to manipulate, monitor and subvert electronic information. Surveillance and censorship is growing and the lack of security for digitally stored or communicated information is becoming a major problem for human rights defenders in some countries.
    In response to requests from human rights defenders for support in this area Front Line has developed a manual on Digital Security and Privacy for Human Rights Defenders (PDF version in English, Spanish and Vietnamese..
    In collaboration with the Tactical Technology Collective Front Line has also developed a package of tools and guides called Security in-a-Box.
    Front Line has also organised hands-on training workshops for human rights defenders from many countries among others: Belarus, Burma, Democratic Republic of Congo, Guatemala, India, Iraq, Jordan, Morocco, Russia, Syria, Tibet, Tunisia, United Arab Emirates, Vietnam, Western Sahara, Yemen, Zimbabwe. Front Line trained trainers from many countries for more effective follow-up on digital security issues. Front Line is also consulting HR organisations in addressing digital security challenges. And is helping implementing security strategies through the Security Grants Program.
    Please see the following resources for further information in relation to digital security:
    Please also see following graphical resources:


     --------------------------------------

    Worried about surveillance online?

    https://alternatives.tacticaltech.org/# 

    A collection of our tips and how to's on alternatives

    If you're worried about the privacy of your online activities, be they website browsing, chats, voice calls, emails or cloud storage, there's no need to fear. For several years, software developers and privacy advocates have been inventing new tools and tactics for ordinary citizens, journalists, activists and human rights defenders to secure their online activities and control the information they share.
    No IT tool or resource is perfect, nor can they guarantee you 100% privacy or information security online. Furthermore, you should only use tools which correspond to your own analysis of which information you need to keep private, which varies from person to person. All the same, it is recommendable to use Free and Open-Source software tools, since their security credentials and weaknesses can be independently verified, and you can therefore rely on the technology itself, rather than just what the developer says, and while they may not guarantee 100% information security, they can make surveillance or invasion of privacy much more difficult.
    The following is a short list of alternative tools and platforms that will help keep your private information more secure. We've also provided links to step-by-step hands-on guides for their installation and use, where possible.
    If you'd like to learn more, you should take a look at:

    Browser

    Mozilla Firefox - Secure web browser

    Some popular browsers, such as Safari, or Internet Explorer, are not open source, meaning that their code cannot be analysed and the security they claim to offer can't be independently verified by the community. Others browsers are partially open source, such as Google Chrome, could still be used to gather information about your activities by linking them to your Google account.
    Mozilla Firefox is a free, open-source web browser which was developed by a non-profit organisation which has a commitment to protecting user privacy. Furthermore, its privacy features can be enhanced through a number of add-ons.

    Tor Browser Bundle - Anonymous and secure web browser

    Whenever you visit a website or communicate (such as via email) through a web browser, traces of your activities are left behind in the form of your IP address, which is like the postal address of your computer, as well as through other means such as the cookies that may be sent to your browser. This means that many websites can track your visit and build a profile of you based on your activities.
    If you want your browsing activities and location to be anonymised, we recommend you use Tor Browser. Tor is designed to increase the anonymity of your activities on the Internet. It disguises your identity and protects your on-line activities from many forms of Internet surveillance, by directing your internet traffic through a network of proxies. Tor can also be used to bypass Internet filters.

    Email Provider

    Email Client

    Mozilla Thunderbird with Enigmail and GPG

    Mozilla Thunderbird is a free and open source email client for receiving, sending and storing emails. You can manage multiple email accounts through a single program. Enigmail and GnuPG will give you access to authentication, digital signing and encryption to ensure the privacy and security of your email communication.

    Collaboration Online

    Crabgrass

    Social networking sites and online collaboration platforms such as those provided by Facebook and Google are major sources of information for governments or other individual engaging in large- or small-scale surveillance and intelligence gathering, which may invade your privacy.
    Crabgrass is an online platform designed for social networking, group collaboration and network organizing. Its group collaboration tools include private wikis, task lists, file repository, and decision making tools.

    Video Chat

    Jitsi

    Some voice and video chat services, store logs of your calls and chats and may hand them over to third parties from advertising companies to governments. In the case of Microsoft's Skype, this has been a relatively regular practice.
    Jitsi is a free, open source software tool which allows for encrypted text chats with OTR form XMPP, Google Talk, Facebook. Yahoo, AIM, ICQ and many other accounts. Furthermore, it facilitates encrypted voice and video calls when used voice and video call accounts, such as Google Talk.

    Private Chat

    Adium and OTR

    Adium is a free and open source client that lets you organize and manage your different Instant Messaging (IM) accounts using a single interface. The Off-the-Record (OTR) plug-in designed for use with Pidgin ensures authenticated and secure communications between users that also use Off-the-Record plugins.
    Adium - We will be publishing a Adium Hands-on guide shortly

    Pidgin and OTR

    Many instant messaging service providers, such as Google (Gtalk), Facebook (Facebook Chat), Yahoo (Y! Messenger), and others, store logs of your conversations with your contacts and could hand them over to third parties from advertising companies to governments. It's recommendable to use these chat accounts with an IM client which allows you to encrypt your chats, so that they can only be read by their intended recipients.
    Pidgin is a free and open source client that lets you organize and manage your different Instant Messaging (IM) accounts using a single interface. The Off-the-Record (OTR) plug-in designed for use with Pidgin ensures authenticated and secure communications between users that also use Off-the-Record plugins.

    Private Chat - Mobile

    Gibberbot

    Gibberbot is a free and open source application for Android devices, created by the Guardian Project, that lets you organize and manage your different Instant Messaging (IM) accounts using a single interface. It uses Off-the-Record (OTR) software which ensures authenticated and secure communications between clients including Gibberbot, ChatSecure, Jitsi, and Pidgin. Gibberbot can also add a layer of anonymity and protect your communications from many forms of Internet surveillance by connecting through Orbot, which allows your smartphone's internet traffic to be routed through the Tor network.

    ChatSecure

    iOS
    ChatSecure is a free open source messaging application for iOs devices that allows users to exchange messages using the Off-the-Record encryption protocol. It is compatible with XMPP (Gtalk, Jabber) and AIM accounts.

    Private Call - Mobile

    RedPhone

    Specifically targeted groups, such as human rights defenders, journalists, and activits, may be subjected to 'tapping' of their calls by adversaries with direct or indirect access to the celular phone network.
    RedPhone is a Free and Open-Source Software application that encrypts voice communication data sent between two devices that run this application. However it also becomes easier to analyze the traffic it produces and trace it back to you, through your mobile number. RedPhone uses a central server, which is a point of centralization and thus puts RedPhone in a powerful position (of having control over some of this data).

    OStel.co

    Open Secure Telephony Network (OSTN) and the server provided by the Guardian project, ostel.co, when used with the CSipSimple app, currently offers one of the most secure means to communicate via voice. When using CSipSimple, you never directly communicate with your communication partner, instead all your data is routed through the Ostel server. This makes it much harder to trace your data and find out who you are talking to. Additionally, Ostel doesn't retain any of this data, except the account data that you need to log in.

    Worried about surveillance online?

    A collection of our tips and how to's on alternatives

    If you're worried about the privacy of your online activities, be they website browsing, chats, voice calls, emails or cloud storage, there's no need to fear. For several years, software developers and privacy advocates have been inventing new tools and tactics for ordinary citizens, journalists, activists and human rights defenders to secure their online activities and control the information they share.
    No IT tool or resource is perfect, nor can they guarantee you 100% privacy or information security online. Furthermore, you should only use tools which correspond to your own analysis of which information you need to keep private, which varies from person to person. All the same, it is recommendable to use Free and Open-Source software tools, since their security credentials and weaknesses can be independently verified, and you can therefore rely on the technology itself, rather than just what the developer says, and while they may not guarantee 100% information security, they can make surveillance or invasion of privacy much more difficult.
    The following is a short list of alternative tools and platforms that will help keep your private information more secure. We've also provided links to step-by-step hands-on guides for their installation and use, where possible.
    If you'd like to learn more, you should take a look at:

    Browser

    Mozilla Firefox - Secure web browser

    Some popular browsers, such as Safari, or Internet Explorer, are not open source, meaning that their code cannot be analysed and the security they claim to offer can't be independently verified by the community. Others browsers are partially open source, such as Google Chrome, could still be used to gather information about your activities by linking them to your Google account.
    Mozilla Firefox is a free, open-source web browser which was developed by a non-profit organisation which has a commitment to protecting user privacy. Furthermore, its privacy features can be enhanced through a number of add-ons.

    Tor Browser Bundle - Anonymous and secure web browser

    Whenever you visit a website or communicate (such as via email) through a web browser, traces of your activities are left behind in the form of your IP address, which is like the postal address of your computer, as well as through other means such as the cookies that may be sent to your browser. This means that many websites can track your visit and build a profile of you based on your activities.
    If you want your browsing activities and location to be anonymised, we recommend you use Tor Browser. Tor is designed to increase the anonymity of your activities on the Internet. It disguises your identity and protects your on-line activities from many forms of Internet surveillance, by directing your internet traffic through a network of proxies. Tor can also be used to bypass Internet filters.

    Email Provider

    Email Client

    Mozilla Thunderbird with Enigmail and GPG

    Mozilla Thunderbird is a free and open source email client for receiving, sending and storing emails. You can manage multiple email accounts through a single program. Enigmail and GnuPG will give you access to authentication, digital signing and encryption to ensure the privacy and security of your email communication.

    Collaboration Online

    Crabgrass

    Social networking sites and online collaboration platforms such as those provided by Facebook and Google are major sources of information for governments or other individual engaging in large- or small-scale surveillance and intelligence gathering, which may invade your privacy.
    Crabgrass is an online platform designed for social networking, group collaboration and network organizing. Its group collaboration tools include private wikis, task lists, file repository, and decision making tools.

    Video Chat

    Jitsi

    Some voice and video chat services, store logs of your calls and chats and may hand them over to third parties from advertising companies to governments. In the case of Microsoft's Skype, this has been a relatively regular practice.
    Jitsi is a free, open source software tool which allows for encrypted text chats with OTR form XMPP, Google Talk, Facebook. Yahoo, AIM, ICQ and many other accounts. Furthermore, it facilitates encrypted voice and video calls when used voice and video call accounts, such as Google Talk.

    Private Chat

    Adium and OTR

    Adium is a free and open source client that lets you organize and manage your different Instant Messaging (IM) accounts using a single interface. The Off-the-Record (OTR) plug-in designed for use with Pidgin ensures authenticated and secure communications between users that also use Off-the-Record plugins.
    Adium - We will be publishing a Adium Hands-on guide shortly

    Pidgin and OTR

    Many instant messaging service providers, such as Google (Gtalk), Facebook (Facebook Chat), Yahoo (Y! Messenger), and others, store logs of your conversations with your contacts and could hand them over to third parties from advertising companies to governments. It's recommendable to use these chat accounts with an IM client which allows you to encrypt your chats, so that they can only be read by their intended recipients.
    Pidgin is a free and open source client that lets you organize and manage your different Instant Messaging (IM) accounts using a single interface. The Off-the-Record (OTR) plug-in designed for use with Pidgin ensures authenticated and secure communications between users that also use Off-the-Record plugins.

    Private Chat - Mobile

    Gibberbot

    Gibberbot is a free and open source application for Android devices, created by the Guardian Project, that lets you organize and manage your different Instant Messaging (IM) accounts using a single interface. It uses Off-the-Record (OTR) software which ensures authenticated and secure communications between clients including Gibberbot, ChatSecure, Jitsi, and Pidgin. Gibberbot can also add a layer of anonymity and protect your communications from many forms of Internet surveillance by connecting through Orbot, which allows your smartphone's internet traffic to be routed through the Tor network.

    ChatSecure

    iOS
    ChatSecure is a free open source messaging application for iOs devices that allows users to exchange messages using the Off-the-Record encryption protocol. It is compatible with XMPP (Gtalk, Jabber) and AIM accounts.

    Private Call - Mobile

    RedPhone

    Specifically targeted groups, such as human rights defenders, journalists, and activits, may be subjected to 'tapping' of their calls by adversaries with direct or indirect access to the celular phone network.
    RedPhone is a Free and Open-Source Software application that encrypts voice communication data sent between two devices that run this application. However it also becomes easier to analyze the traffic it produces and trace it back to you, through your mobile number. RedPhone uses a central server, which is a point of centralization and thus puts RedPhone in a powerful position (of having control over some of this data).

    OStel.co

    Open Secure Telephony Network (OSTN) and the server provided by the Guardian project, ostel.co, when used with the CSipSimple app, currently offers one of the most secure means to communicate via voice. When using CSipSimple, you never directly communicate with your communication partner, instead all your data is routed through the Ostel server. This makes it much harder to trace your data and find out who you are talking to. Additionally, Ostel doesn't retain any of this data, except the account data that you need to log in.
    -------------------------

    A Guardian guide to metadata
     
    A very useful, and easy to use guide to understand just how much of data we (inadvertently, unknowingly) share when we use web based social media, browse sites and even just email.
    ------------------