Flickr user: jmarty CC BY 2.0

Are you using any encryption tools or doing anything to protect your files, email and contacts on your computer or mobile phone?

As we find out more about the internet surveillance activities of the US National Security Agency, it’s clear that journalists and media organisations are among the targets of intelligence gathering agencies.

“Encrypt everything.”

That was one of the take home messages of Hauke Gierow’s talk on journalism and surveillance at this week’s Social Media Week Berlin.

Gierow heads the internet freedom desk at Reporters Without Borders in Germany. Surveillance he says has a chilling effect on journalism. Your sources become unwilling to talk; there is an erosion of trust in the media; and, people who might be key whistleblowers hesitate to speak out.

Perhaps just as worrying is what he describes as the complicity of technology firms in surveillance – or as Reporters Without Borders refers to them in their 2013 report: “Corporate Enemies of the Internet”.

Gierow says there are some 230 companies worldwide that develop spyware and internet traffic monitoring products that may be used by governments to violate human rights and freedom of information. A number of these firms are within EU countries.

Tools for online security

Here on the onMedia blog you can check out our in-depth series on online security resources and techniques produced by Natalia Karbasova. It’s an ongoing topic onMedia will cover.

But for journalists in developing countries, working safely online can be even more challenging – particularly if they are using shared computers in newsrooms, or in internet cafes. And, some tools may make the net slower to use or be hard to install on shared computers.

So what can you do?

Gierow says open source tools are useful for online security

Gierow says to first check out the tools and the how to guides in Tactical Technology Collective’s Security in a Box. These guides are also available in many languages.

He also suggests journalists using shared computers at work should have a dedicated user name and login; try to store their files in encrypted folders; limit the applications you install on the computer to the ones you only need to use; surf the net using the TOR network; and use encrypted chat programs.

Gierow cautions journalists to avoid talking about sensitive information over Skype.( You can also read our interview with Fabian von Keudell from CHIP magazine that examines the security of VoIP services such as Skype.)

You can watch Hauke Gierow’s full presentation below and follow the journalism related links and discussions at Social Media Week Berlin on #smwbjournalim.

UPDATE:

Dutch MEP Marietje Schaake has also drawn attention to the dual use of “digital arms” and wants European lawmakers to take action.

‘It is a bit hypocritical to talk about the NSA revaluations with concern to stress the importance of cyber security, which is also a very popular topic nowadays, without addressing the fact that it’s EU based companies that are making and producing these digital arms.’

Author: Guy Degen

The Tactical Technology Collective, an organisation dedicated to the use of information in activism, offers useful guides on secure alternatives for standard software for browsing, searching the web, writing emails and chatting. It has also compiled a great collection of tools and tactics for more digital security. “It is important that you understand how you are communicating and inform yourself on secure alternatives,” says Anne Roth, researcher for the Tactical Technology Collective.

Following the interview with Anne Roth in our previous post, here are her essential tips on how journalists can stay secure online and when they are using smartphones and tablets.

1. Always use a secure internet connection

This rule is especially important when you’re filling out forms on the web: https:// (not http://) should be displayed in your browser bar.

2. Make your browsing experience more secure

Use different pseudonyms and different browsers with different add-ons for different services. The add-ons recommended by the Tactical Technology Collective can be found in the Shadow Tracers Kit. Always secure your WiFi router at home and in the office.

3. Know what you are downloading

Malware can be either contained in files which you download from the website or in browser scripts. So firstly check the files you are going to download with a virus scanner. Never open files directly in your browser. Better to first download the file, then check it with a virus scanner, then open it. Secondly, make sure you install the add-on NoScript for your Firefox browser. This add-on prevents scripts, which are important for the display of certain contents in your browser from transporting malware.

4. Adjust your browser settings

Go to “Settings” and tell your browser to save no cookies from third-party service providers. Cookies are small text files which are saved on your device and help identify you when you are visiting the same page again. Cookies can be helpful when you need to log in, so it’s not necessarily recommended to deactivate them completely. If you use the Firefox browser, you can adjust browser settings so that you are asked each time when a cookie is going to be installed. That significantly reduces the overall number of cookies.

5. Don’t let your search be tracked

To make sure your search queries aren’t being tracked, use search engines DuckDuckGo and Startpage. However, note that DuckDuckGo is based in the US.

6. Use special cloud services

There are many cloud services like Dropbox out there, but you can’t expect total security from them. Alternatively, you can host your own cloud with the software by OwnCloud. Always encrypt the data on your device before sending them into the cloud. However, that still means your metadata (file name, place and time of the upload) is visible.

7. Use complex passwords

Also, never use the same password for different services. You can resort to a password manager like KeePass for Windows or KeePassX for Mac.

8. Encrypt your hard drive

You can do it with standard software on your computer. That will help you secure your data should your device be lost or stolen. Don’t forget to regularly backup your data.

9. Secure your communication

It’s not a secret any more that Skype, Google, Facebook and other US companies are cooperating with the secret services. So think if you really need to use voice or video chat, especially in case of important conversations.
Use different email addresses for different purposes. It is recommended to use an email client like Thunderbird with an add-on Enigmail instead of a webmail. Here’s how you install it. If you do use webmail, make sure the data is being transferred per secure protocol SSL. Try to avoid using Facebook or Twitter messaging services, traditional email is still more secure.

10. Secure your mobile devices

Users should use a tablet or a laptop with open source – or free – software rather than a smartphone to secure your communication. To avoid tracking of any kind, UMTS, GPS and geolocation features should be deactivated.
Have a look at this introduction on secure use of smartphones and check the Guardian project which offers security apps for mobile devices.

11. Prevent interception of phone calls

There’re encrypted mobile phones out there with a respective price tag. There’re apps like RedPhone, OStel or Jitsi which encrypt your phone calls. Internet telephony is also a good option, which allows you to avoid using phone lines and mobile phone networks.

12. Don’t let others locate your mobile phone

To avoid the identification of your mobile phone location, deactivate the GPS function. But you can avoid being located completely only if you deactivate the phone and take out the sim card -your phone automatically checks in at mobile towers to be able to make calls.

The revelations of the surveillance program of the US

DW Akademie’s Natalia Karbasova spoke to Roth about the biggest risks journalists face online, and about the parties interested in gathering all relevant and irrelevant information: from local authorities to national secret services.

Is it possible for journalists to completely protect their online privacy?

Complete protection is not really possible. It will not be possible in the future either, since we need to supply our data to an internet provider to go online in the first place. The question is rather: what do you want to be secure from? If you want to be sure you are not being tracked by the advertising industry, you can use an adblocker as a browser plugin and configure it manually. If you want to shop online and at the same time protect your identity, you can use secure online payment services like Paysafecard or UKash. If you want to use internet services without disclosing your IP address, you should use the software Tor. Still, this personal anonymity is only guaranteed if you don’t use your personal log-in data while browsing the web.

What are the biggest security vulnerabilities online?

There’s no general answer to this question. It depends on whether you are a big company, a journalist or just a normal user. Access to data which are being transferred unencrypted through email or other internet services pose a big problem. If data transfer isn’t SSL-encrypted (you can see this encryption in your browser address bar which says “https://” instead of “http://”), it can be easily intercepted in an open WiFi network.

It is especially Windows users who face security problems. There’re numerous viruses and malware for Windows out there since this operating system is wide spread. They use unknown security weaknesses of Windows or install standard software and browser plug-ins to get daily access to the computer. That’s why is it is extremely important that you install the latest updates and the latest software.

You should also be really careful and limit yourself to the software, plug-ins and add-ons you really need. You can also protect yourself by installing a personal firewall and a virus scanner.

How do I know I’m being spied upon?

Normally you won’t discover if you’re being kept under surveillance by the authorities. In Germany, you have the right to request this information from the German Federal Intelligence Service and other services. The question is, if you get the answer. Foreign secret services like the NSA don’t provide any information to non-US citizens.

Who is interested in gathering my private information in the first place?

On the one hand, we talk about authorities, on the other hand, about companies. Their motives and methods differ of course. Secret services gather information on internet usage and on users not only to protect their country against terror attacks, but also to exchange this information with foreign secret services which are not necessarily able to track the global internet traffic on their own. The approach of the secret services can be described as “full take”: you take so much information as you can. Edward Snowden and other whistleblowers have shown that secret services often use special interfaces, which global companies have provided them with. Secret services also use intercontinental internet lines.

You have to be extremely cautious when it comes to using free services on the web. Remember that you still pay for it, but in a different manner, that is, not with money but with your data. That’s when you stop being a client and become a product.

What do companies do with the data they collect?

The data are collected through third-party cookies – little text files – users accept by browsing the web. Most users are not aware that they interact with other, third, parties when reading a news or any other website. These sites get paid to let the third parties have access to their users’ data. The more information is known about a user, the more valuable and up-to-date is his or her profile.

The advertising industry uses profiles for individual ads. Financial and insurance industries use your profile data to give predictions and to calculate how expensive their services should be for the end customers. By the way, the German registry office also sells your data, which many of us don’t know.

What’s so bad about it?

The problem of such data pools is, data collectors want more and more data. The intended use is often expanded later without updating those affected. That’s why I would recommend to be very careful with requests to share your address, you date of birth or the data of your children.

There’s an ongoing discussion in Germany following the data retention directive of the European Union. It regards retention of communication meta data. It is basically the same as gathering of metadata which is being intensely debated in the light of Prism. You can easily generate motion profiles and networks with the help of these data, which show who knows whom, who makes calls with whom and how long these calls last. The initial purpose of the initiative was counter-terrorism, but it’s obvious that even here others are interested to extend access options.

The revelations into the electronic surveillance activities of the US National Security Agency and its Prism system have shown that no one is safe from being spied on. However, journalists can still use some clever tools and open source programs to ensure more security browsing the web, sending emails and communicating with colleagues and sources.

Sandra Mamitzsch of re:publica, Germany’s largest conference on internet and society, offered useful insights on how to start securing your data during her workshop How to keep the NSA out of your Email – a Practical Guide to more Security for your Data at the DLDWomen conference.

“Everything you do online is only as secure as your passwords and your software” says Sandra Mamitzsch. “So use open source wherever possible.”

Here are her best tips:

Strengthening your mobile device

• Update frequently
• Make backups
• Full disk encryption (works for Android devices)
• Use a code/password to lock your device
• Change standard configurations, for example services which have the permission to track you and get your address book data on the iPhone
• Don’t jailbreak you device if you are not sure what you are doing. From the perspective of hackers, it’s more secure to use a standard operating system that is being updated frequently.

Browsing the web

• Always use secure encryption protocol HTTPS
• Use Tor anonymity network – it bounces your communications around a distributed network of relays and makes it impossible to track you
• Activate Do not track option in your browser
• Install blockers like Ghostery which is a plug-in for your browser
• You can use separate browsers, one for logging into your Facebook/ Twitter accounts and another one, where all trackers are blocked.

Email

• Use email encryption software GPG4win for Windows and GPGTools for OSX
• Use mail clients Thunderbird with the security extension Enigmail. Please note people you are communicating with should also install the program.

Chat

• To chat securely, use Adium (OS X), Pidgin (Windows, Linux), ChatSecure (iOS) or Gibberbot (Android)
• Use Threema instead of What’sApp. The app is available both for iOS and Android and ecnrypts your messages. Make sure that the person your are communicating to uses the app as well.

Useful tools for more security

• Tor anonymizer
• Tails – the amnestic incognito live system uses Tor anonymity network, helps you leave no trace on the computer you’re using and encrypt your files, email and instant messaging.
• PortableApps to use with a USB flash drive
• OS X portable applications
• 8 password manager options for Mac and iOS

Further reading on security and encryption:

Encryption Works: How to Protect Your Privacy in the Age of NSA Surveillance by Press Freedom Foundation

The workshop took place at this year’s conference DLDWomen (15-16th July) organized by the German publishing house Hubert Burda Media. DLD (Digital Life Design) is a global conference network devoted to the latest digital trends.

Author and photo: Natalia Karbasova

In our previous post on online security, we’ve covered basic tools which will help you securely erase data from you computer, or SSD and USB flash drives. So let’s now take a look at how you can restore your data in case you’ve deleted it by accident. As well as being a good skill to know if you can bring the deleted data back to life it’s also useful to know you find out how effective your efforts were securely delete the data in the first place.

For this post, let’s keep things straightforward to begin with. Imagine you have accidentally deleted an important file on your computer. What can you do? First of all, remain calm. Don’t panic! There’s still a very good chance that you’ll get your files back.

As we already know, deleting files securely actually requires much more that simply hitting the delete button on your computer. Even if you’ve deleted a file and then emptied your recycle bin, it’s still possible to get your file back with a number of free tools.

First steps in recovering your files

As soon as you notice you’ve unintentionally deleted a file, don’t wait too long. Best of all, stop working on your computer and begin recovering your file immediately. The point is, after marking your file as deleted, computers operating on Microsoft Windows can start overwriting it with different information. This will complicate the process of file recovery. So don’t wait too long.

Recuva

Recuva is an absolute go-to tool. This freeware recovers files deleted from your Windows computer, recycle bin, digital camera card and MP3 player. Recuva can even find your files on a formatted drive and restore unsaved Word documents.

After downloading and launching Recuva, you’ll need to choose your file type and file location (or you can also choose to search on your entire computer). Recuva searches your computer for deleted files. You’ll then need to check the files you need and click the Recover button. Then select the location where your recovered file will be saved.

There’s also a portable version of Recuva to store on a USB flash drive which can come in pretty handy. The tool has been programmed by the developers of CCleaner which is a popular free tool for cleaning your computer. In most cases, you should be more than happy with this tool.

Importantly, Recuva has some limitations: it can’t recover files after programs like CCleaner or Eraser have been used to wipe free disk space or if Windows itself has already overwritten any previously occupied space. Recuva also can not recover damaged documents and files.

When things get complicated: alternatives to Recuva

If Recuva is not able to identify your file, it makes sense to try other tools which may deliver slightly different results. For example, you may have deleted your hard drive partitions together with all files saved there.

In this case, you can use the following programs:

With freeware TestDisk, you can scan deleted hard drive partitions. According to developers, TestDisk was primarily designed to help recover lost partitions and make non-booting disks bootable again when these symptoms are caused by faulty software, certain viruses or human error.

PC Inspector File Recovery is another free data recovery programme which will automatically find partitions and recovers your files. The programme supports such popular data types as Excel and Word documents, HTML files, JPG and PNG images, WAV and MP3 sound files and ZIP archive folders.

To recover data on your Android device, use the free Hexacomb Recovery-Lite app.

Other popular programs to recover deleted files include Restoration, Undelete Plus and PC Inspector File Recovery. You can find more file recovery alternatives here.

You can recover your data even if you’ve wiped your hard drive. To find out how, read this article about hard drive recovery.

Remember to backup your data

It is extremely important that you backup your data so that even deleting a file and not being able to recover it later will not be critical.

To find out more on data backup, read this guide on how to recover from information loss by Frontline and Tactical Technology Collective. You can also check out this post about how to automatically backup your hard drive and this article on how to backup your data on your Windows computer.

By Natalia Karbasova