Tag: privacy

Wind Farm 0: If there was suddenly no Internet, what would we do?

(Originally, posted on Medium and Fold, but here since this is my *real* blog after all, and if the Internet went down, I still will have my local blog archive, and can run a teeny tiny WordPress server on my own computer, local network and/or $9 computer).

This last Friday and Saturday, a group of tool developers, designers, user advocates, security experts, tinkerers and curious humans gathered at the Berkman Center on Friday and Saturday for discussions, teachings and hands-on learning about the past, present and future of nearby network communication technology…. and to answer the basic question “If there was suddenly no Internet, what would we do?”.
11146648_10152944926373434_4549087628200142545_o
I call this new communication space between all of our devices “Wind”, as it is a counterpart to the Web, but very different in its shape and basic nature.Wind Farm is an event designed to understand how to better harness the power from the Wind, and shape it to our needs.
10955252_10152944926218434_1722205278635437230_o
We had over 40 participants from Microsoft Research, the Open Technology Institute (part of New America Foundation), F-Droid (Free Software Foundation Europe), Tibet Action Institute, Rights Action Lab, the Briar Project, the Guardian Project, DeNovo (out of UC Berkekey’s TIER group), NYU, USC, members of the local Nepali community, and fellows from Harvard’s Berkman Center and Nieman Foundation. We all realized that there is a shared core problem that needs to be solved, around the basic “dialtone” or “chime” that let’s people near you, and their smart devices, know that you are there, available and interested in communicating about a specific topic, or using a specific set of information.On day two, powered by donuts and coffee, I (Nathan) gathered our experts together with curious participants in our outdoor introductory workshop and simulation event… the event we simulated? An alien invasion where our telecommunication system for the planet was about to be taken out by their mother ship. The participants were taught basic skills like using Bluetooth, NFC, Wifi and other tools to share information directly between their smartphones, instead of using the Internet.
image (3)
Everyone also learned how to fold an origami pinwheel, and adorn it (or themselves) with a 1KB read/write capable near field communication sticker chip. If you can turn a square piece of paper into a beautiful, functional pinwheel, and make it a portable, power free hard drive by putting a sticker on it, then you can do just about anything!
10750351_10152947234823434_7432061859459728997_o
We taught people how to transfer apps between their Android phones directly, since Google Play and other app stores don’t work when the Internet doesn’t exist. To do so, we used F-Droid and the App Swap feature.
One of the missions to help build a new, nearby community-powered network was to deploy an adhoc wifi mesh system, using Commotion, across the Harvard campus. Using some elevated platforms (aka fire escape), we managed to build a five-hop system that connected 23 Everett Street to Harvard Yard, with nothing but handheld antennas, battery packs, and the creativity of determined humans…
Simultaneously with the Wifi-mesh, we also deployed multiple covert battery and solar-charged PirateBoxes(Boxen?) throughout campus, and used them in a data relay “Pony Express” manner. Two teams with four relay runners each moved photos between each pirate box, to reach their end goal. Every PirateBox also contained a full, offline/nearby copy of the Guardian Project’s F-Droid repo app store, for local app distribution.
pirateboxen
To coordinate communications between teams throughout the afternoon, we used the Gilga app (aka Pinwheel) to send messages using only Bluetooth and WifiDirect… it was the first medium scale test of the technology (with 10-20 users communicating together at any given team), and it worked as expected. Each team needed to use the app to send critical messages about media being shared through out the local nearby networks.
gilgadouble
If you’d like to learn more about the concept of Wind, and the entire Wind Farm event, you can read on at WindFarm0.link. We will be holding more Wind Farm events in the coming months, so that you, too, can be prepared for a day without the Internet, and app and tool builders can understand the unique challenges this type of situation creates.

 

My Quick Guide to a Less Risky Dropbox

While there are definitely many security-related holes and privacy concerns to be had about the free (but not open-source) Dropbox file sharing service, it has taken the world by storm, including many activist and human rights groups, mostly due to the simplicity and effectiveness of its user experience. As we have seen many times before, software and services that “just work”, will always win out over more secure options with the majority of the population. This post is a quick attempt to share some simple steps you can take to ensure your use of Dropbox, or any similar cloud-based file storage and sharing system, is more properly protected, obscured or otherwise mitigated as a direct threat to the security of your information.

1. Use Dropbox over Tor to stop local network monitors from knowing you are using Dropbox to begin with. This also is a good configuration to use with people who live in places where Dropbox might be blocked, but Tor is not.

Install Tor and use Vidalia (the GUI controller) to connect to the Tor network.

Set Dropbox->Preferences->Network->Proxy Settings to use Tor’s secure SOCKS proxy on localhost, port 9050

2. Set Bandwidth Usage to a low value to avoid creating large spikes in network traffic. This will reduce the likelihood your particular use will be singled out if you are syncing large media files or other transfers.

Set Dropbox->Preferences->Network->Bandwidth Usage to a low value such as 50KB/s for upload and download

3. Use Truecrypt to create encrypted disk volume files inside of Dropbox, and then store your files inside of that. This can still be shared by multiple users, if you use a password based volume.

Download, install and configure the free, open-source TrueCrypt software: http://www.truecrypt.org/

Create a new TrueCrypt volume, stored within a Dropbox folder

All in all, there are more secure ways to share sensitive information, such as using GPG file encryption or another OpenPGP solution, but if you absolutely must use Dropbox, and you are under any sort of threat at all to having the information you store on it used against you, then please follow this advice I have shared.

If you have additional tips, warnings or configurations along these lines, please add them to the comments below.

    SMS Privacy Tips for Election Monitoring And More

    I was recently asked to contribute my thoughts on how election monitors using simple mobile phones could improve their safety and security when working in hostile environments. More specifically, the goal was to find techniques by which their use of SMS messaging to report back to a centralized service or team could be done in a more secure, private manner, that would make it more difficult for an adversary working against them to stop, block or track. All of this must be done without software or special hardware, instead just relying on easily teachable techniques.

    Here’s the collection of tips and ideas I came up with on short notice. It is by no means complete, but I felt it would be useful to publish these to a wider audience here on my blog. Finally, before you say “well couldn’t criminals and terrorists use these techniques too?”, I will refer you to an excellent Abuse FAQ page from the Tor Project which covers this very topic (“Criminals can already do bad things. Since they’re willing to break laws, they already have lots of options available that provide better privacy than Tor provides”).

    Now, on to the topic at hand…

    Changing Your SIM Card
    Often the first thing that comes to mind when people think about reducing tracking of their mobile phone is to change their SIM card. Unfortunately, changing SIM cards isn’t a reliable solution to stop centralized tracking because each phone also has an IMEI (http://en.wikipedia.org/wiki/International_Mobile_Equipment_Identity) that uniquely identifies the underlying phone hardware itself. This means that even if you change your SIM card, the phone’s unique identifier can still be tracked. Still a new SIM card would change the phone number that is displayed or logged on the receivers phone, which could buy someone time or throw off a lazy investigator.

    You can check your IMEI by typing in: *#06# or something similar depending upon carrier or phone. There are a number of cheap Chinese phones on the market in some countries that have an IMEI of 000000000000, which can come in handy if they are those types of things available. It is illegal in most countries to change the IMEI or to use a phone with an invalid IMEI.

    Airplane Mode Ain’t Just for Airplanes
    If their phone has “Airplane Mode” or a way to disconnect from a network or manually choose a network, that usually works as well as taking the battery out. This is useful if they still want to take pictures, notes, record message, queue up SMS messages to be sent once they reconnect in a different location from where the data was captured.

    To step back a bit, it is important to understand, that mobile phones are always in constant contact with the cellular towers in the area. As you move about, your phone is in constant negotiation with different towers to connect to the best single, check for incoming calls, SMS message and so on. In addition, the server provider is checking your identifiers to make sure your phone is valid to work on the network, that you have an activated account, that your hardware isn’t blacklisted (aka stolen, etc), and so on. In summary, even if you aren’t using your phone, your phone is being tracked for operational and billing purposes, not necessarily malicious. However, it must be understand that this same data can be used by authorities for whatever purpose they like and is legal in the current country or context.

    In theory, if you put your phone into “Airplane Mode” all signals emanating from your phone are stopped.

    Complicating Monitoring by Turning Text into Pictures
    If picture messages or MMS is available, write a message/code on paper and take a picture of it instead of sending it as text. Harder to automatically filter/monitor, and that the small resolution on the screen harder to read… if they can get the message on a PC on the receiving end, it can be zoomed up, but if the sender is stopped by local authorities, they may not see it.

    In addition, picture messages of colors can also be a code:

    • Blue Sky = “okay”
    • Red Sign = “problem”
    • Brown Dirt = “Ballot Stuffing”

    Your Very Own Secret Code
    Come with a very basic text code that say involves ten digits, with each different representing 0-9 of possible states.

    • 0-9: how long is the wait (in hours)
    • 0-9: how bad is intimidation from militia (scale)
    • 0-9: how good is the turnout (scale)
    • 0-9: general code (0 = no problems, 1 = polling place closed, 2 = armed men outside, 3 = riot, 4 = no ballots available)

    could then result in a code:

    • 2190 <— this would be a pretty good polling place
    • 9912 <—- this would be a report of trouble

    You could easily write this on piece of paper and take a picture of it as well.

    Again, this type of code would just look like gibberish at the local level, and perhaps buy some time at a state surveillance level until they got their own copy of the code. At the least you would be making them work some more to figure it out, and make them less able to filter by keywords.

    Mobile Pyramid Scheme aka Improved Autonomy
    Local groups can send to one local person, and then that person can forward each message to another level up the tree and so on. This would enable a bit more protection than all field election monitors texting to a centralized number. It introduces some other issues around reliability of the data and complexity of the process, but in exchange you help foster autonomy and decentralization, two great tools to improve safety and privacy in your overall network.

    Managing What Gets Logged
    By default, phones tend to log and track everything you do, in the name of convenience. This includes all the text messages you send. The problem is that if a person is detained, it can be difficult to quickly delete those messages before the detainers take away the phone to see what they can learn from it.

    Most phones offer a way to NOT save outgoing SMS messages and also to potentially delete inbound after they are read. This feature should be utilized. In addition, numbers should be memorized and manually entered, instead of stored in an address book.

    More Ideas?
    If you are reading this post and have your own thoughts or firsthand experience to contribute to the discussion, please add them using the comment section below. I will make sure the right people see this information. Your insight and creativity can make a difference!

    Guardian-approved: Walkie-Talkie App for Android

    As part of rolling out the first-phase of The Guardian Project, I will be writing short reviews of existing applications for Android-based mobile phones that share our general goals or desired functionality. The goal of Guardian, in short, is to enable safe and secure communication for activists, organizers and advocates working for good around the world through the mobile phones they carry in their pockets.

    The Guardian project has no official relationship with these apps or their creators, but as we work towards developing our own unique software, we want to make sure to shine the spotlight on existing efforts that we admire and which are currently available. We’d also happily collaborate with any of them (or *you* if you are a developer reading this), and have them join our open-source efforts.

    The first application is Walkie Talkie Push to Talk, which is a great alternative take on real-time VOIP or standard phone calls. Physical walkie talkie radios and Nextel-style PTT services have long been a valuable tool for many activists, and this application bring that capability to a global scale. Walkie Talkie can be used over GRPS, EDGE, 3G or Wifi networks, as well – whatever is available at the time.

    Here’s a short description from the developer:

    Walkie Talkie Push to Talk is a mobile application that allows walkie talkie style voice communications. Simply hold down the “Record & Send” button and speak. Messages can be sent to a group of people. Received messages are automatically played. If program is running, incoming messages arrive as soon as 15 seconds. If program is not visible, it polls in the background every 1 minute (to save battery).

    The back-end messaging system used by this application is actual POP or IMAP, in other words email! If you utilize a secure IMAP/S connection with the application, then the voice communications are transmitted securely over the wireless network and Internet. If you use a service like Gmail (which offers secure IMAP access), then your access is hidden within the millions of other users accessing Gmail, as well.

    Not drawing attention to your network traffic is often as important as securing your data. Also, while Gmail isn’t always the ideal service to use if you wish to retain full control of your data, it is much more difficult for an authority to block than a single proxy or a private server.

    A few screenshots below:

    Learn more about Walkie Talkie and download it from the Android Market today.