This is not an easy time for journalists all over the world, with the discoveries of surveillance on citizens, which includes journalists and their sources.
The old-fashioned promises Im not going to reveal my sources identity or give up my notes are kind of empty if youre not taking steps to protect your information digitally, says Barton Gellman of the Washington Post, whose source, former NSA contractor Edward Snowden, helped uncover the scope of the NSAs and British GCHQs operations.
Senior journalist Michael Dagan believes that it is possible to make it difficult for anyone to intercept your emails, the text messages youre sending or your phone calls, using a range of methods.
He has written a guide to his colleagues all over the world, which can help them protect their work and fulfil their mission.
Here are some of his tips to ensure that a journalists sources and data are secure and well. Access to the full guide is at the link below.
1. Beware of big names:Presume that large companies encryption systems and possibly even big name operating systems (proprietary software) have back doors that secret services in their country of origin (at least in the US and the UK) can access.
2. Always encrypt everything:Security experts use simple math to make their point: as you raise the cost of decrypting your files (say, for intelligence agencies like the NSA), you automatically increase the degree of effort expended on following you. If youre not Chelsea Manning, Julian Assange, or Edward Snowden and if you werent involved in active surveillance around Trump Tower apartments, they may give up the effort even if your encrypted communications were stored. And should anyone decide to track you despite your efforts, it will be more of a headache if you use strong encryption like AES (Advanced Encryption Standard) and tools like PGP or open VPN, which are the strongest widely available encryption methods (VPNs are used by the US government itself). But if you want bullet-proof security, you will need more than the AES encryption method. P.S. if you want to discover the year your information landed at the NSAs hands, just have a peekhere.
3. Perform full disk encryption:This is done just in case someone gets their hands on your computer or phone. Full disk encryption can be done usingFileVault,VeraCryptorBitLocker. Putting a computer to Sleep (instead of Shutdown or Hibernate) may allow an attacker to bypass this defense. Here,Mika Leegives a complete guide for encrypting your laptop.
4. Avoid chatting with sources on the phone:All phone companies store data related to the caller and the receivers numbers, as well as the location of the devices at the time calls were made. In the US and several other countries, theyre required by law to disclose information on registered calls in their possession. What can be done? You should use a secure call service, such as the one the Signal app which was tested repeatedly for security possesses. Although this may mean that both the source and the editor need to download the appas well, the process takes just a few minutes. Here is aguideon how to use it. Just for the hang of it, check out how many of your non-journalist friends are hanging out there. However you choose to communicate with your source, do not bring your mobile phone to sensitive meetings. Buy a disposable device and find a way to convey its number to the source in advance. The source needs to have a disposable safe device too. Authorities can track your movement through cellular network signals and its advised to make it harder on them to locate you retroactively in the exact same cafe where the source was sitting. If you fail to follow this rule, all local authorities will be required to do is ask (politely and legally) for the video filmed by the cafs security camera at the time of your meeting.
5. Choose secure messengers:your calls (cellular ones and via landlines) can be monitored by law enforcement agencies and each SMS is like a postcard all text is fully visible to those who may intercept it. Therefore, use Messengers that allow for secure end to end call: signal, which was already mentioned above, and Telegram are considered to be the safest (although Telegram as well as WhatsApps web apps were compromised once and then fixed). According to some experts, you can also consider using SMSSecure, Threema and even Whatsapp.The Signal Protocol has been actually implemented intoWhatsApp,Facebook Messenger, andGoogle Allo, making conversations using them encrypted. However, unlike Signal and WhatsApp, Google Allo and Facebook Messenger do not encrypt by default, nor notify users that conversations are unencrypted but offer end-to-end encryption in an optional mode. You should also keep in mind that Facebook messenger and WhatsApp are both owned by Facebook.Adium and Pidgin are the most popular Mac and Windows instant messaging clients that support the OTR (Off the Record) encryption protocol and Tor the webs best encrypted browser, which we will get to in detail later (See how to enable Tor in Adiumhereand in Pidginhere). Naturally, you could also use the Tor Messenger itself, which is probably the safest of them all.Two final notes on texting: A cyber security expert Ive discussed this with, says you should also have a working hypothesis that text is encrypted but the fact that these specific two individuals are talking, at this present time, might not go unnoticed.The second note is you should also remember to delete the messages in your phone (although this may not be enough to withstand a forensic check), just in case your device falls in the wrong hands, toavoid exposingthem.
6. Do not use organizational chats:Slack, Campfire, Skype and Google Hangouts should not be used for private conversations. They are easy to break in, and are exposed to disclosure requests for courts use, to resolve legal issues at the workplace. Therefore, its best to avoid them, not only when it comes to conversations with sources, but also conversations between colleagues, editors, etc., when you need to pass information received from your source, whose identity must be kept under cover. Many popular VoIP services like Jitsi have built-in chat features, and several of them are designed to offer most of Skypes features, which make them a great replacement.
7. In extreme cases, consider using aBlackphone:This phone, which strives to provide perfect protection for web surfing, calls, text messages and emails, is probably the best substitute for a regular phone if you are about to topple your government or getting ready to publish secret military files. An anti-bullet vest may also come in handy. Alternatively, try to do without a cell phone, Or opt for a cellular phone RFID signal-blocking bag. Theres always an option that even the Blackphone can be tracked using its IMEI (the mobile phones ID).
8. Protecting Data on your computer:Its very easy to break regular passwords, but it can take years to break passphrases i.e., random combinations of words. We recommend trying secure password management tools like: LastPass and 1Password and KeePassX. Youll need to remember only one password, versus too many Passwords. And still, when handling important services such as your email, do not rely on password managers: Just make sure you remember the password.In aninterviewto Alastair Reid in journalism.co.uk, Arjen Kamphuis, an information security expert, recommended that for encrypted hard drives, secure email, and unlocking laptops, one should choose a password of over 20 characters. Of course, the longer the password, the harder it is to crack but the harder it is to remember too. Thats why he recommends the use of a passphrase. It can be anything, like a line of your favorite poetry, Kamphuis says, maybe a line from something you wrote when you were nine that no one else will know about.Reid reports this thought provoking calculation, using theGibson Research Corporations password strength calculator: A password like F53r2GZlYT97uWB0DDQGZn3j2e, from a random password generator, seems very strong, and indeed it is, taking 1.29 hundred billion trillion centuries to exhaust all the combinations even when the software is making one hundred trillion guesses per second.
9. Two-factor authenticationis also a very good idea. In a regular two-stage authentication you sign in with your password and receive a second code, often via a text message to your smartphone. You can use Yubikey, as well as hardware tokens to further secure sensitive files on your computer. For more information, read the7 golden rules for password security.
10. Assign a computer for inspecting suspicious files/attachments:The easiest way to distribute malware and spyware is through installation via USB or through attachments and email links. It is recommended therefore you use one air-gapped computer to examine these threats under quarantine. With this computer, you can freely use a USB and download files from the Internet, but do not transfer the files to your regular computer or re-use that USB.
11. How to buy your own secured computer:Security expert Arjen Kamphuisrecommendspurchasing a pre-2009 IBM ThinkPad X60 or X61. These are the only modern enough laptops with modern software systems, which enable replacing low level software. Another point to take into account is that you should not buy your computer online, as it may be intercepted during delivery. Kamphuis recommends buying it from a second-hand store for cash. He also points out that you should abolish all connectivity: Remove all Ethernet, modem, Wi-Fi or Bluetooth capabilities. Personally, I know security experts who wouldnt trust such a computer.
12. Educating your Sources:Its possible that by the time the original and valuable information reaches you, its already too late. Your source may have made every possible mistake, leaving behind a trail of evidence. But beyond the need to secure the information once its in your hands, you should strive to teach your sources how to hide the information: store it securely and communicate safely via safe devices. Most people have no clue how to handle sensitive information, and in general what theyre up against the moment they get in touch with you.
13. Use a designated secure system for receiving documents:Replace Dropbox or Google Drive and use something less popular but more secure. For example,SecureDropis a designated system allowing you to receive files from anonymous sources and to safely scan and check them. Edward Snowden described Dropbox as hostile to privacy and recommendedSpideroakinstead. OnionShare is another free service that allows transferring files easily and anonymously.
14. Dont keep notes:neither on a laptop, nor calendars or contact lists on your cellphone or computer or in the cloud do not keep record of your sources name, initials, phone number, email or user name in messengers. Just dont.
15. Visual tracking:On the way to sensitive meetings, avoid using public transportation and guide your source to do the same. You should also avoid meeting places such as modern malls, where video cameras are spread all over the place.
16. Evading social media:Some people prefer to opt for radical anonymity. If for some reason, you need to vanish from the face of the earth without leaving a fully blown profile behind on every social media, totally delete your accounts. Its different from deactivating them, a state in which all your info is stored and can be re-activated.
17. Make friends among hackers:This will help you avoid big mistakes, save time and headaches and keep you up to date on the technological arms race.
18. Payment method:Pay for everything in cash, consider using Bitcoins buy them anonymously (use thisBusiness Insiderguide for that purpose) and, if you have somebody willing to accept them at the other end of the transaction, useDarkcoin. A pre-paid credit card from an online store is also an option.
19. Scribble wisely:If you jotted down information on a piece of paper, what they used to call a note in the Precambrian world, destroy it. And dont forget even that wrinkled one at the bottom of your pocket. Yes, right next to that gum.
You can see the eBook PDF-version of this guidehere.
See the rest here:
Online privacy guide for journalists - Radioinfo (subscription)
- How to Deploy Jitsi Meet with Docker on Ubuntu 20.04 - March 31st, 2023 [March 31st, 2023]
- Jitsi Meet review | TechRadar - February 18th, 2023 [February 18th, 2023]
- Zoom vs Jitsi for video conferencing? | ONLYOFFICE Blog - February 18th, 2023 [February 18th, 2023]
- IFrame API | Jitsi Meet - GitHub Pages - November 25th, 2022 [November 25th, 2022]
- Self-Hosting Guide - Debian/Ubuntu server | Jitsi Meet - October 17th, 2022 [October 17th, 2022]
- Best Video Calling Apps: Zoom, Skype, Hangouts, Jitsi And More On Test - Which? - Which? - October 11th, 2022 [October 11th, 2022]
- When is it a good idea to turn off the camera during a video call - Aviation Analysis Wing - March 18th, 2022 [March 18th, 2022]
- Rwanda: Wave of Free Speech Prosecutions - Human Rights Watch - March 18th, 2022 [March 18th, 2022]
- 8x8 Video Conferencing API | 8x8 - February 19th, 2022 [February 19th, 2022]
- Video-as-a-Service Market is Expected to Generate Huge Profits by 2021 2026 Bulk Solids Handling - Bulk Solids Handling - October 3rd, 2021 [October 3rd, 2021]
- Android SDK Jitsi Meet Handbook - September 29th, 2021 [September 29th, 2021]
- Brave is taking the video conferencing fight to Zoom - Techradar - September 27th, 2021 [September 27th, 2021]
- Braves non-tracking, browser-based video conferencing tool is out of beta - TechCrunch - September 24th, 2021 [September 24th, 2021]
- Brave Talk, a new private video conferencing service tied to the web browser - InTallaght - September 24th, 2021 [September 24th, 2021]
- Brave gets a video call service integrated with the browser and leaves no traces The Clare People - The Clare People - September 24th, 2021 [September 24th, 2021]
- How To Install Jitsi Meet on Ubuntu 18.04 | DigitalOcean - August 2nd, 2021 [August 2nd, 2021]
- Zoom launches Zoom Apps and Zoom Events 'to empower the hybrid workforce' - iTWire - July 25th, 2021 [July 25th, 2021]
- Google Meets limiting free group calls to an hour what are your options? - The Next Web - July 14th, 2021 [July 14th, 2021]
- Its Official: We ODd on the Internet - OneZero - OneZero - June 13th, 2021 [June 13th, 2021]
- Is it the same as google duo? Explica .co - Explica - June 13th, 2021 [June 13th, 2021]
- Tips on Cybersecurity for Students and Teachers - Al-Fanar Media - June 4th, 2021 [June 4th, 2021]
- What is Jitsi Meet and how does it work the best free open source alternative to Zoom and Google Meet | Technology Explica .co - Explica - May 14th, 2021 [May 14th, 2021]
- Choose Your Own Adventure in the Virtual World - Observatory of Educational Innovation - April 19th, 2021 [April 19th, 2021]
- How Artists Used the Discord App to Build Community During COVID-19 - Hyperallergic - March 31st, 2021 [March 31st, 2021]
- How to Self Host Jitsi Meet With Docker [Step by Step Guide] - March 11th, 2021 [March 11th, 2021]
- Protesting in the Age of Mass Surveillance - EFF - March 11th, 2021 [March 11th, 2021]
- Jitsi | Quick Install | Advance Configuraton | Some Fixes - March 7th, 2021 [March 7th, 2021]
- Market trends and outlook coupled with factors driving and restraining the growth of the Web Conferencing market Jumbo News - Jumbo News - February 16th, 2021 [February 16th, 2021]
- Jenny Turner Ready to Go Off LRB 18 February 2021 - London Review of Books - February 16th, 2021 [February 16th, 2021]
- Want a goat to stand in for you on Zoom? Itll cost you around R102 for 5 minutes - SowetanLIVE - February 8th, 2021 [February 8th, 2021]
- Keeping mindfulness and employee health at the forefront: app reviews - Tech Wire Asia - February 8th, 2021 [February 8th, 2021]
- Inside job: Why Zoombombing isnt as random as you might think - Digital Trends - February 8th, 2021 [February 8th, 2021]
- Tech Trends 2021: All You Need To Know - CCM - January 17th, 2021 [January 17th, 2021]
- Comprehensive Report on Web Conferencing Market 2021 | Trends, Growth Demand, Opportunities & Forecast To 2027 |IBM, ReadyTalk, Adobe, ezTalks,... - January 9th, 2021 [January 9th, 2021]
- Jitsi Meet: Open Source Zoom Alternative - December 19th, 2020 [December 19th, 2020]
- Jitsi Meet - Download - December 19th, 2020 [December 19th, 2020]
- How to Install Jitsi Meet on CentOS 8 - RoseHosting - December 19th, 2020 [December 19th, 2020]
- New 8x8 CEO expected to improve business operations - TechTarget - December 19th, 2020 [December 19th, 2020]
- Is HelmChat Free Helmet Comm Solution A Good Alternative? - RideApart - September 18th, 2020 [September 18th, 2020]
- How to recreate water cooler moments in the virtual workplace - Quartz - August 13th, 2020 [August 13th, 2020]
- Our right to health and the COVID-19 pandemic - Davao Today - June 13th, 2020 [June 13th, 2020]
- A look at how Jitsi became a 'secure' open-source alternative to Zoom - The Next Web - May 24th, 2020 [May 24th, 2020]
- How the Covid-19 Lockdown Is Reshaping Uighur Activism - The Nation - May 24th, 2020 [May 24th, 2020]
- TikTok now gives you one-tap access to streaming app Resso - The Next Web - May 24th, 2020 [May 24th, 2020]
- Tips on Running a Remote Animation Studio - Animation World Network - May 24th, 2020 [May 24th, 2020]
- Adapting from Home: This Weeks View of Video Meeting Triumphs and Concerns - Yahoo Finance - March 31st, 2020 [March 31st, 2020]
- 8 Best Zoom Alternatives for Video Conferencing and Webinars - Beebom - March 31st, 2020 [March 31st, 2020]
- Jitsi Downloads - iOS & Android apps; Jitsi Meet, & Jitsi ... - March 26th, 2020 [March 26th, 2020]
- What Is the Most Secure Video Conferencing Software? - VICE - March 26th, 2020 [March 26th, 2020]
- Home schooling tips: The things I wish I'd known before the schools went into lockdown - Telegraph.co.uk - March 26th, 2020 [March 26th, 2020]
- Fox Sports 1 Utilized Video Call Center to Extend Reach of Shows Like The Herd with Colin Cowherd - Sports Video Group - December 22nd, 2019 [December 22nd, 2019]
- Fox Sports 1 Dials Up VCC for The Herd With Colin Cowherd - TV Technology - December 22nd, 2019 [December 22nd, 2019]
- Gladstone gold does club proud - Gladstone Observer - July 19th, 2017 [July 19th, 2017]
- Jitsi | Futurist Transhuman News Blog - euvolution.com - July 10th, 2017 [July 10th, 2017]
- FAQ | Jitsi | Prometheism.net euvolution.com | Futurist ... - July 5th, 2017 [July 5th, 2017]
- FAQ | Jitsi | Futurist Transhuman News Blog - June 29th, 2017 [June 29th, 2017]
- Tsirang vegetable vendors commit to selling local chillies - Kuensel, Buhutan's National Newspaper - June 27th, 2017 [June 27th, 2017]
- FAQ | Jitsi | Prometheism.net - euvolution.com - June 26th, 2017 [June 26th, 2017]
- FAQ | Jitsi - June 25th, 2017 [June 25th, 2017]
- Jitsi - PediaView.com - June 14th, 2017 [June 14th, 2017]
- How to Configure and Set-Up Jitsi - Liberty Under Attack - June 6th, 2017 [June 6th, 2017]
- Jitsi Meet (advanced) Projects - May 23rd, 2017 [May 23rd, 2017]
- Diaspora* and Other Free Software Are Available in the Occitan Language, Thanks to Volunteer Translators - Global Voices Online - May 23rd, 2017 [May 23rd, 2017]
- Your Essential List of 7 Productivity Hacks and Time Management Tips - Business 2 Community - May 11th, 2017 [May 11th, 2017]
- Encrypted Chat Took Over. Let's Encrypt Calls, Too - Huffington Post - April 25th, 2017 [April 25th, 2017]
- 5 Apps You Didn't Know You Needed - Syracuse University News - April 3rd, 2017 [April 3rd, 2017]
- Jitsi Meet - Android Apps on Google Play - March 9th, 2017 [March 9th, 2017]
- Snowden helping develop tools to protect journalists and whistleblowers - 'to make the game a little more fair' - Press Gazette - February 15th, 2017 [February 15th, 2017]
- Edward Snowden's New Job: Protecting Reporters From Spies - WIRED - February 14th, 2017 [February 14th, 2017]
- Jitsi for Windows - Secure Instant Messaging and VoIP - February 11th, 2017 [February 11th, 2017]
- Jitsi for Mac - Download - jitsi.en.softonic.com - February 6th, 2017 [February 6th, 2017]
- Jitsi softphone for Windows OnSIP Support - November 23rd, 2016 [November 23rd, 2016]
- Trying to install jitsi meet with apache2 - Stack Overflow - October 29th, 2016 [October 29th, 2016]
- Jitsi - Wikipedia - October 27th, 2016 [October 27th, 2016]
- Jitsi - Mensajera instantnea segura de texto, audio y ... - August 10th, 2016 [August 10th, 2016]
- Jitsi - Quora - May 31st, 2016 [May 31st, 2016]
- Chocolatey Gallery | Jitsi 2.8.5426 - May 28th, 2016 [May 28th, 2016]
- Jitsi - - May 24th, 2016 [May 24th, 2016]
- Jitsi - FreeBSD Wiki - May 22nd, 2016 [May 22nd, 2016]
- Jitsi - OSTN - Guardian Project Open Dev - May 21st, 2016 [May 21st, 2016]