Digital Security

for Journalists
(and Activists, Govt. Officials, etc.)

Pranesh Prakash

Policy Director (and Resident Geek)

Centre for Internet & Society

 

 

 

 

CC-BY-SA 4.0
(copy, share, adapt: sharing is caring)

no proprietary software or standards were used in the making of this slideshow

Journalists & Activists

Source Confidentiality Matters.

 

Sources trust you: you owe them a duty

So you need to protect information on who you're communicating with.

Often, no legal protection.

Journalists & Activists

Confidentiality of internal communications matters.

 

Investigative journalism is impossible otherwise.

Your communications with your editor, with colleagues.

(Imagine the Panama Paper leaks)

Journalists & Activists

Confidentiality of Research Matters.

 

Again, investigative journalism is impossible otherwise.

But sometimes the information is in the public, so this may not be true in your case.

 

You requirements may vary with time, with project, with story.

At Stake

Identities

 

 

Communicated Information

 

 

Secondary Research + Stored Data

It depends. But potentially:

Location + IP Address + E-mail address (& Subject) + Phone number + MAC ID + IMEI, etc. + URLs (DNS + HTTP) + Timestamps + correlation

 

cleartexts

 

(from Telco, ISPs, WiFi hotspot/OTA, web service, MITM, etc.)

What all can they have access to?

Your phone is a surveillance device

 

Your ISP is a surveillance provider

 

FB/Google are spyware

Privacy comes at a cost

(usually at the cost of convenience, but sometimes at the cost of security or of privacy too)

Solution?

No one simple solution!

 

Think about your security practices.

 

Encourage at-risk sources, colleagues to be security-conscious (and not just wrt tech!)

 

Also: Use phone calls and SMS (and your phone, even if just for Internet) as little as possible in sensitive matters. It is much harder to communicate anonymously using your phone.

 

Realize that security technologies are tools and not solutions.

Tech Solution?

Good Hygiene

 

{Traffic, End-to-End, Device-Level} Encryption

 

Free/Open Source Software

 

Open Standards

 

Decentralized Solutions

 

Federated Networks

Non-Solution?

For end-to-end encryption (meaning the decryption happens at the your/the source's end, and that intermediary can't read it), the source will also have to be using the same encryption as you, and potentially the same software.  

This means, this won't happen.  So generally, you'll need to figure out what the source is comfortable doing, what their security risks are, and how best to secure your communications with them. It's always a trade-off.

 

Security is not only about "ultra-secure" tools, but about applying the best practices to a given circumstance. Many times the tools may not befit the circumstances.

 

Don't fetishize the tools. They're just tools.

Skype (video/voice/desktop)

WebRTC (using browser/phone app)

1. Jitsi Meet (https://meet.jit.si)

2.  Talky.io (https://talky.io) (recommended)

3. Appear.in (https://appear.in)

 

 

Video livestreaming

Web: Rhinobird.tv (https://rhinobird.tv)

 

WebRTC

It just works.

 

  

Anonymity

Keep your identities separate! 

Compartmentalize using

• Separate devices (never on together in the same place!)
• Separate internet connections / phone numbers
• Separate OSes and browsers
• Separate accounts (e-mail, social network, etc)

 

Weak anonymity is easy. Strong anonymity is difficult.  Truly untraceable anonymity if a well-resourced police department or intelligence agency is after you: next to impossible.

 

For a good guide to paranoia and tradecraft, read the grugq's blog, esp. this presentation.

Transport Security + Anonymity

Against ISP / WiFi

• Encrypted Proxy Service ("VPN") (weak anonymity, security till VPN, so hides content from ISP but is not end-to-end)
  • Bitmask (Linux, Android, w/ Win, OSX coming soon)
  • Complex / software-only, i.e., not a service:
    • WireGuard (Linux-only, using your own provider)
    • sshuttle

 

• Anonymizing Networks (Tor / I2P) (strong anonymity, hides content from ISP, but security is not end-to-end)
  • Tor Browser Bundle (Linux+OSX+Win) / Orbot+Orfox (Android)
  • TAILS / Whonix / Qubes OS / Subgraph OS (alpha)

General Hygiene

• Set a lock-screen with a passcode!
• Use Free and Open Source Software
  • Linux (even my parents find Ubuntu easy to use)
    • When need be, use TAILS /
      QubesOS / Whonix
  • Android (e.g., CopperheadOS)
  • FOSS on Mac/Windows
• Physically secure your devices
• Use full-disk encryption
  • Linux (dm-crypt), MacOS (FileVault), Windows (BitLocker).
  • Android (v5+), iOS (v8+).

Passphrase Hygiene

Use a password manager (pass / LastPass / KeePass / Browser)

Long master password / passphrase using phrases in Hindi/Tamil/etc. / WebPassGen / Diceware

Don't reuse passwords!

Test password strength using telepathwords & zxcvbn

Use multi-factor authentication wherever available (but don't tie your real identity to a pseudonymous account!)

Make sure you keep an eye on what you've authorized using your {Google, Facebook, Twitter, etc.} credentials

Never share your passwords, except through secure mechanisms like a group password manager. Don't ever respond to e-mails asking for password.

Good sources for info on passwords: Ars Technica, AgileBits blog. 

Browser Hygiene

Use Brave, Firefox, or Chromium

Essential Extensions/Add-ons

Password Manager (inbuilt, or add-on)

uBlock Origin (FF & Chromium & Safari)

HTTPS Everywhere (FF & Chromium & FF for Android)

uMatrix (FF & Chromium, not for beginners)

NoScript (FF-only, I use it w/ default "allow")

"Private Browsing" mode only deletes stuff (browser history, cookies, etc.) once you close the browser.

Browser Hygiene

 

If anonymity is needed in addition to security, then use the Tor Browser Bundle (PPA)
(and don't use any of your regular usernames, and don't visit HTTP sites since many exit nodes do sniff traffic)
 

(While TBB is easy to use, I would recommend using TAILS over TBB if greater security is desired.)

 

Anonymity does NOT work without identity segregation.

E-mail Hygiene

 

Attachments

 

Only ever open attachments using Zoho or Google Docs. Never download it or open it locally on MS Word / Excel, etc.

 

Scan all attachments using a malware scanner (especially if you use Windows). VirusTotal is a great online scanner.

 

E-mail Hygiene

Links

 

NEVER click a link in an e-mail that scares you into thinking you need to change your password, etc.  The bulk of these are phishing attempts.

 

ALWAYS check the link (usually it appears in the status bar) BEFORE clicking it.

E-mail Hygiene

Requests for Personal Information

 

• Howsoever authentic looking, never reply to an e-mail asking you for personal information like your password, bank account details, etc.