Graphic: flickr/mmapstone

Most reporters use a whole bunch of different online tools and apps such as Skype, WhatsApp, Facebook, Gmail, Tumblr, Blogger, WordPress and Dropbox to make their work easier. To commemorate this year’s Safer Internet Day, onMedia highlights a few risks associated with some of the most popular journalism tools and suggests possible, more secure alternatives.

Skype

Functionality: Video conferences, chats with newsmakers, interviews and interview recordings.

Risks for journalists: Skype was always assumed to be safe because of its end-to-end encryption. But the Snowden revelations have revealed that the NSA has been listening to Skype since 2011 and it’s unclear to what extent other agencies are able to intercept the service. Skype “can no longer be trusted to protect user privacy,” says Eric King, head of research at Privacy International.

Possible solutions: Use Skype as if it were a public forum. Everything you say or write may be used against you.

Alternatives: Jitsi (encrypted text, voice and video messaging), Linphone (encrypted voice and video chat), Mumble (encrypted voice chat).

WhatsApp

Functionality: WhatsApp is one of the most popular messaging apps in the word. It lets you send messages without having to pay for sms services although the person you are sending to also has to be using the app. It’s an easy way to stay in touch with the newsroom and colleagues while in the field, especially as you can exchange images, video and audio.

Risks for journalists: Currently, WhatsApp claims messages are encrypted but because the company won’t say what method they use, it’s difficult to know how secure the service is. There are reports that WhatsApp messages sent over wifi and other public channels can be decrypted. There are apps out there which try to make WhatsApp more secure.

Possible solutions: Resort to more secure apps

Alternatives: Pidgin (off-the-record messaging), TorChat (anonymous P2P chat), ChatSecure (formerly Gibberbot) and Xabber for Android.

Facebook

Functionality: You don’t really need to have Facebook explained to you, right? Journalists use this global social network to share their work, crowdsource information, stay in touch with colleagues and newsmakers, follow companies and news on their beats, subscribe to important people and participate in groups.

Risks for journalists: Facebook is a huge data collector. The list of your friends may influence the decision of local authorities to grant you a visa to work in a certain region, and the open groups you are a member of let strangers know about your interests even if your profile is closed to external visitors. Also, Facebook is constantly experimenting with new tracking methods.

Possible solutions: Be very careful publishing information on Facebook. Once it’s online, you lose control of it. Go to the privacy settings in the upper right corner of your Facebook page and make sure you have all the precautionary measures taken. Always log out of your Facebook account when surfing other websites.

Alternatives: To be able to use other, private social networks, you’ll need a certain level of technical proficiency. Of course you need to remember that it’s difficult to have the same reach as Facebook when using its alternatives. Diaspora is a community-run, distributed social network that allows you to be in control of your information. Other alternatives: Buddycloud, Friendica and RetroShare.

Twitter

Functionality: Twitter is good for following breaking news and breaking news yourself. You can also use it to collaborate with others, find communities, and follow trends and topics.

Risks for journalists: Everything you do on Twitter is visible. If you have geotagging enabled, it can be easy to locate you. The service is also a haven for malware attacks.

Possible solutions: Be careful what you post and whom you follow. Don’t create open lists unless you are absolutely sure you won’t get into trouble by doing this. Disable geotagging.

Alternatives: Sorry, there isn’t really one.

Gmail / Googlemail

Functionality: This is one of the most popular email clients with integrated tasks, contacts and calendar.

Risks for journalists: Gmail has fairly robust security for everyday use but it’s not advisable if you need to keep your communications secret. Google scans your email’s content to better target you with ads and also complies with government requests for information. Kapersky has more information about the risks here.

Possible solutions: Don’t use your Gmail account to discuss sensitive issues. Add two-step verification to your account to prevent third parties from cracking it.

Alternatives: MyKolab (hosted in Switzerland), Riseup.

Google Drive

Functionality: Create, store and share documents, presentations and spreadsheets in the cloud. The service is connected to your Google account.

Risks for journalists: Your information can be made available to government agencies.

Possible solutions: Use Google Drive only for documents with no great importance. Use local physical backup (external hard drives, USB flash drives) when possible.

Alternatives: ownCloud, SparkleShare, Tahoe-LAFS.

Google search

Functionality: Google search is pretty much the gold standard and definitely the most popular option for research on the web. There are a number of techniques such as advanced search that help you achieve better results.

Risks for journalists: Google stores your searches. This information can be made information available to government agencies upon request.

Possible solutions: Try other search engines.

Alternatives: DuckDuckGo (anonymous web searches), Startpage (private, unlogged web searches), YaCy (decentralized web search), Seeks Project (open decentralized platform for collaborative search).

Dropbox

Functionality: Store text, audio and video files in the cloud. Dropbox comes in handy when you need to synchronize your data across different devices.

Risks for journalists: Your data might be available to third parties.

Possible solutions: Always encrypt your data before moving it to Dropbox. You can use Boxcryptor or free encrypting tools like TrueCrypt or AxCrypt. Read more about file encryption here.

Alternatives: The same as for Google Drive: ownCloud, SparkleShare, Tahoe-LAFS.

Tumblr/Blogger/WordPress

Functionality: Publishing platforms for text, audio and video. They help journalists blog on issues, establish a web presence and thus become more visible to their audience.

Risks for journalists: Your data might be available to third parties.

Possible solutions: Try self-hosting. This will help you stay in control of your data. For example, WordPress offers an option to self-host your data.

Alternatives: WordPress.org (self-hosted website publishing), Noblogs (blog publishing platform based on WordPress), MediaGoblin (decentralized media publishing platform), Zenphoto (self-hosted media management system).

For more free alternatives to proprietary software, check out the website PrismBreak.

By Natalia Karbasova

Photo: flickr/CyberHades

DW Akademie devoted the whole of the week December 2- December 6, 2013 to the issue of Digital Safety for Journalists. As well as live online sessions on the topic, we also tackled issues on our digital safety blog important to reporters who want to or need to keep their activities away from prying eyes. Here is a list of some of the posts that can put you on the road to a more secure digital life.

A good starting point is to determine how much digital security you really need. In What’s your threat? Working out your security needs, we talk with Jonathan Stray, a Columbia Journalism School professor, about how to put together a “threat model” for yourself and your situation, and how to act based on it.

We’ve also talked with someone who knows first-hand about the uncomfortable reach of some government authorities. In Know your enemy!” Security tips from Tunisian cyberactivist Slim Amamou, readers will get real-world advice about what to do if your fear persecution because of your online activities.

Several posts look at ways to maintain your privacy and our authors test drive software to see how easy or difficult it is to install and use.

Using the Tor network is cited by many security experts as a good way to keep your internet activities under wraps and bypass censorship. In Hiding your online identity: Trialling Tor in Cambodia, we take this global system of routers that can throw spies off your tail for a test run in Cambodia.

Secure your surfing with a Virtual Private Network (VPN) explores another way to stay anonymous online. VPNs create “tunnels” though which your data goes over the wider internet, shielding it from others. They’re especially important for people who travel or use networks they don’t own, like at a café or airport.

Graphic: flickr/One Way Stock

Continuing on the topic of surfing, Your browser’s ‘fingerprints’ and how to reduce them looks at how advertisers and others with more malevolent intentions can identify you by collecting bits of information about your browser. We talk with IT expert Henning Tillmann about how it works and how you can make your fingerprint harder to read.

Some people think Skype is the way to go to keep their conversations private. Well, the post Think Skype is safe? Think again will disabuse you of that notion, and give you alternatives.

In the wake of revelations about the NSA’s spying program, some privacy advocates have almost thrown up their hands in surrender. But they shouldn’t. Is encryption still worth the trouble? You bet it is discusses why people who should know say encrypting your sensitive communications, while not a failsafe, it still the way to go to avoid interception.

But if a virus or other malware gets on your computer, even the best defenses against spying can be circumvented. That’s why strong anti-virus protection is an absolute must. Read Anti-virus software: Boosting your digital immune system for the basics of these nasty bugs and how to keep your computer and mobile devices healthy. We also test drive virus detection software that runs from your USB, so you can make sure the internet café computer you’re using is safe.

Services, apps and platforms like Facebook, WhatsApp, Twitter, Gmail, Dropbox, etc. are incredibly useful for journalists. But What are the risks of using Skype, Facebook, WhatsApp and Co.? explores their downsides regarding privacy and discuss ways to user them more safely.

There’s lots more on the blog, including wrap-ups of our workshop sessions, so surf on over and get more useful information on staying safe and secure online.

Written by Kyle James, edited by Kate Hairsine

Photo: flickr/WarzauWynn

All of this week, DW Akademie is exploring the topic of digital safety for journalists in a free open online workshop with live panel discussions and online sessions. Follow this link to participate in the live sessions from December 2 to 6.  There you’ll also find more digital security posts like this one by journalist Kyle James, who takes the anonymous surfing tool Tor on a test drive in Cambodia.

Keeping your identity anonymous on the Internet can have major advantages. If you’re a political activist living in a country with a repressive regime, disguising your Internet identity might just keep you out of jail, and alive. Alternatively, if you’re a reporter working on a story your government doesn’t approve of, surfing anonymously can help you bypass your country’s censorship or filters.

One of the best known and easy-to-use systems for doing this is Tor. But Tor has some disadvantages – many complain it slows down their surfing. So what happens when you use it somewhere like Cambodia that already has slow internet?

What is Tor?

Originally an acronym for “The Onion Router,” Tor works by using a software bundle and an open network of internet relays strung around the world.

Tor was originally developed by US Navy researchers and its primary purpose was to protect government communications. Today it’s used by everyday people, activists, law enforcement officials, and, of course, journalists who want to escape prying eyes on the Internet. Reporters without Borders recommend Tor as part of their Online Survival Kit.

How does Tor work?

The “onion” part of the acronym refers to the many layers that Tor directs your internet traffic through to keep it hidden. Those “layers” are the more than 4,500 relays run by volunteers around the world.

Tor keeps your surfing secret by bundling internet data into a packet and encrypting it several times. Then the packet is randomly bounced among the relays, each link in this circuitous chain knowing only about the link before and after it. It’s been compared to a person taking a roundabout way along city streets to shake a pursuer. (For more information on how Tor works, see here.)

This method conceals a user’s location and usage from network surveillance and traffic analysis efforts. The Tor software will make it difficult, if not completely impossible, for people to see your webmail, search history, social media posts or other online activity. They also won’t see what country you’re in or get an IP address.

Needless to say, such privacy can be very useful for journalists

Installing Tor

For such a complicated system, Tor is remarkably easy to install and use. Your author, no tech genius himself, simply went to the Tor Project page and downloaded the Tor Browser Bundle. It’s available for Windows, Mac, Linux and Android devices.

iPhone users can use it, but it’s a bit more complicated to get it set up.

The Tor bundle contains a version of Firefox which you use just like an ordinary web browser but this particular version is preconfigured to send traffic through the Tor network. You don’t need to configure your own system, change lines or code or have any more technical knowledge than simply knowing how to download basic software.

NOTE – I did have to disable Gatekeeper on my Mac since it identified Tor as an “unidentified developer” and initially refused the download. I went into my Mac’s Security & Privacy settings and told it to accept the program. Since I was downloading from the actual Tor site, I felt fine doing this.

The Tor Project offers videos showing installation for Windows, Mac and Linux. Or check out this video for Mac installation or this one for Windows.

Surfing in Secret

Once installed, you’ll see the Vidalia control panel, which controls the Tor software. Here is where you start and stop Tor, set yourself up as a relay, look at the network, change your identity and a bunch of other things.

I simply hit the start button and my specially configured browser popped up.

I was ready to surf in secret.

The biggest reported drawback with Tor is that surfing can get very sluggish, and the World Wide Web becomes the World Wide Wait. That’s due to traffic having to jump through at least three relays and it’s the price you pay for anonymity. As more users sign up, the problem is evidently getting worse. Tor is aware of the issue, releasing a troubleshooting guide a while back.

For people who already have fast internet connections, the difference in speed that Tor makes might be very noticeable and very frustrating. But here in Cambodia, my connection speed is pretty mediocre on a good day. So for me, the difference was negligible. Although, admittedly I wasn’t accessing a lot of audio and video, mainly since Flash is disabled with the Tor browser on installation.

Surfing the web with and without Tor, I compared 12 sites that I visit often – both Cambodian ones and ones based the other side of the world. I found that a few of them did load more slowly using Tor but it wasn’t at all as slow as I’d feared.

Some sites that took around three seconds to appear using my normal browser took five or six seconds using Tor. This wasn’t enough to send me jumping out of a window. In fact, some pages seemed to load just as quickly as they always did. Happy day!

Tor also successfully hid my IP address. With my regular browser, I opened geoiptool.com which identified my location. But using the Tor browser, it thought I was in Germany, almost half a world away. If you want to appear to be in a specific country, this video tells you how to use the Tor software to do that.

Overall, I experienced very few problems using Tor. Occasionally when I opened a new tab to do a Google search, I was asked to enter a series of numbers and letters to prove I wasn’t a robot. This was only a small inconvenience.

As I mentioned above, Flash, Quick Time and JavaScript-based plugins are disabled, since they can reveal your IP address. That means YouTube and a lot of audio and video elements of other sites won’t work, although there are workarounds for Windows and similar ones for Mac users.

What journalists should know

Tor is not 100 percent secure and it cannot guarantee absolute anonymity. Very smart hackers and investigators can sometimes connect the dots. In October, the administrator of the underground illegal drug marketplace Silk Road, which could only be accessed through Tor, was arrested by the FBI after an extensive investigation.

As the Tor website points out, users will need to change some behaviors if they want to be really secure – such as always using the Tor browser, not installing or enabling browser plugins, using HTTPS versions of sites and not opening documents downloaded through Tor while you’re online.

Some also say Tor users attract more attention from authorities because governments are more suspicious of people who use the network.

As long as you keep these things in mind, Tor is an excellent option for journalists, dissidents and others interested in online privacy.

Operating Systems: Windows, Mac, Linux, Android

Cost: Free

Languages: English, Arabic, German, Spanish, Farsi, French, Italian, Korean, Dutch, Polish, Portuguese, Russian, Vietnamese, Chinese

Technical knowledge needed: Minimal. Easy installation. Operates on a modified Firefox browser.

Written by Kyle James, edited by Kate Hairsine

The revelations of the surveillance program of the US

DW Akademie’s Natalia Karbasova spoke to Roth about the biggest risks journalists face online, and about the parties interested in gathering all relevant and irrelevant information: from local authorities to national secret services.

Is it possible for journalists to completely protect their online privacy?

Complete protection is not really possible. It will not be possible in the future either, since we need to supply our data to an internet provider to go online in the first place. The question is rather: what do you want to be secure from? If you want to be sure you are not being tracked by the advertising industry, you can use an adblocker as a browser plugin and configure it manually. If you want to shop online and at the same time protect your identity, you can use secure online payment services like Paysafecard or UKash. If you want to use internet services without disclosing your IP address, you should use the software Tor. Still, this personal anonymity is only guaranteed if you don’t use your personal log-in data while browsing the web.

What are the biggest security vulnerabilities online?

There’s no general answer to this question. It depends on whether you are a big company, a journalist or just a normal user. Access to data which are being transferred unencrypted through email or other internet services pose a big problem. If data transfer isn’t SSL-encrypted (you can see this encryption in your browser address bar which says “https://” instead of “http://”), it can be easily intercepted in an open WiFi network.

It is especially Windows users who face security problems. There’re numerous viruses and malware for Windows out there since this operating system is wide spread. They use unknown security weaknesses of Windows or install standard software and browser plug-ins to get daily access to the computer. That’s why is it is extremely important that you install the latest updates and the latest software.

You should also be really careful and limit yourself to the software, plug-ins and add-ons you really need. You can also protect yourself by installing a personal firewall and a virus scanner.

How do I know I’m being spied upon?

Normally you won’t discover if you’re being kept under surveillance by the authorities. In Germany, you have the right to request this information from the German Federal Intelligence Service and other services. The question is, if you get the answer. Foreign secret services like the NSA don’t provide any information to non-US citizens.

Who is interested in gathering my private information in the first place?

On the one hand, we talk about authorities, on the other hand, about companies. Their motives and methods differ of course. Secret services gather information on internet usage and on users not only to protect their country against terror attacks, but also to exchange this information with foreign secret services which are not necessarily able to track the global internet traffic on their own. The approach of the secret services can be described as “full take”: you take so much information as you can. Edward Snowden and other whistleblowers have shown that secret services often use special interfaces, which global companies have provided them with. Secret services also use intercontinental internet lines.

You have to be extremely cautious when it comes to using free services on the web. Remember that you still pay for it, but in a different manner, that is, not with money but with your data. That’s when you stop being a client and become a product.

What do companies do with the data they collect?

The data are collected through third-party cookies – little text files – users accept by browsing the web. Most users are not aware that they interact with other, third, parties when reading a news or any other website. These sites get paid to let the third parties have access to their users’ data. The more information is known about a user, the more valuable and up-to-date is his or her profile.

The advertising industry uses profiles for individual ads. Financial and insurance industries use your profile data to give predictions and to calculate how expensive their services should be for the end customers. By the way, the German registry office also sells your data, which many of us don’t know.

What’s so bad about it?

The problem of such data pools is, data collectors want more and more data. The intended use is often expanded later without updating those affected. That’s why I would recommend to be very careful with requests to share your address, you date of birth or the data of your children.

There’s an ongoing discussion in Germany following the data retention directive of the European Union. It regards retention of communication meta data. It is basically the same as gathering of metadata which is being intensely debated in the light of Prism. You can easily generate motion profiles and networks with the help of these data, which show who knows whom, who makes calls with whom and how long these calls last. The initial purpose of the initiative was counter-terrorism, but it’s obvious that even here others are interested to extend access options.

Set Tor up correctly and the little green onion is a sign you are on the way to surfing anonymously. (Photo: Guy Degen)

Whether you are doing investigative journalism, communicating with a trusted source or traveling to a country where authorities are known for electronic eavesdropping, online security is increasingly becoming a must-know skill for journalists. 

Jens Kubieziel is security expert and author of the book Anonym im Netz (Anonymous on the web) which offers useful advice for keeping secure on the web, the must-have tools to anonymously surf the web and how proxies can protect your privacy.

DW Akademie’s Natalia Karbasova asked Kubiezel how journalists can surf the web safely, and when necessary, anonymously.

Is Internet security possible on a small budget?

A higher level of IT security usually comes at a price. You can compare it with the analogue world. When driving a car one uses a belt. When visiting a crisis zone one tries to obtain information about specific risks, takes certain precautions and even wears protective gear such as a bulletproof vest. If you want to have more IT security you also need to put more effort into it.

Many websites advise you to use tools such as Tor for anonymous web surfing on the web. However, the basics of online security are often left out. What should you start with?

First of all you should think about your risks. Are you sitting in an office in Germany with your desktop computer or are you doing some ground research in an dangerous zone? In the first case, it might be sufficient to use anti-virus software and be careful when opening email attachments. But in the latter case, all information is saved on your devices. An attacker might try to steal your devices and acquire important information. He could try to locate and harass you. So you need many more countermeasures. Encrypting your device is a must. (See our blog post on data encryption)

You mentioned Tor as a anonymisation software. This is one the most used and well researched software of its kind. But Tor alone does not make you anonymous. The Tor Project lists several warnings on its website. If you read the list and follow the instructions, this will increase your anonymity a lot.

Are there any differences in security across different browsers? And what should you look out for? 

If you use an updated browser, I’d say that all the major browsers are equally secure. It is older versions, especially those of Internet Explorer below version 7 and Mozilla Firefox, that are known to have security bugs.

Nowadays the risk lies more within plugins. Some of them introduce critical bugs and decrease the overall security. Others leak data and help attackers who want to find out your location. The Mozilla project has a blacklist of such extensions.

Which are the must-have tools to anonymously surf the web without disclosing your IP address?

I would suggest the Tor Browser Bundle. This is a software package with the Tor software itself plus a preconfigured Mozilla Firefox. You can just download the bundle, extract it to your hard drive or USB drive and start it without any installation. The browser is configured in a way that it doesn’t allow an attacker to find out anything about your location. So it offers good anonymity. A further solution I’d recommend is JonDonym.

Offering information in an anonymous way is much more difficult. At the moment, there are two basic approaches which seem fit. To the first category belong I2P eepsites [website’s that are hosted anonymously]. I2P is an anonymisation software which establishes its own network. Within that network one can have websites, blogs etc. The authors of the software claim that no third party can find out who put this information online. However, as far as I know there is no research on this software and therefore nobody really knows how secure it is.

The second category embraces Tor’s hidden services. You can setup a website and connect it with Tor. The software tries to protect your identity. At the moment there are some known attacks against hidden services. So if there is a strong attacker it might not be safe enough.

Both solutions have one thing in common: you need I2P or Tor to get access to the information such as a website or a blog. So they are hidden from the “public web”.

What are proxies and how to they help protect your privacy? Which tools would you recommend?

A proxy server is special software which is located between your local computer and the site you want to open. Such servers often cache websites which helps them download faster. Another purpose is to scan the contents, recognize viruses or other malware and sometimes also to block access to specific information.

If several users access the web through proxies they can help to blur their identities. So the website does not see the address of a specific computer, but only that of the proxy.

However, if a site wants to track you and your browsing habits it will install a cookie. This small text file is located on your computer and can be transferred to the remote site. It can contain information about your last visit or your username or any other type of information. Using a proxy doesn’t protect you from this and other track methods.

A proxy might be useful to hide your geographical location. Plugins like Stealthy or websites like xroxy.com help to find open proxies in different countries. So it might help to get access to information which is specific to a country.

How can you find out if an anonymizing service isn’t run by a secret service, which is apparently the case with Anonymizer?

This is quite hard, if not impossible. Any agency or private person can set up a proxy and offer it to the public. And if it attracts users it is possible to intercept the communication. Often you’ll find rumours that this or that service is run by some agency. But usually there is no proof. You should be cautious and keep in mind that any proxy provider can intercept your communication. If you need good anonymity you should use tools like Tor or JonDonym.

To get a better insight into the issues of online security, check out our previous posts best free tools to encrypt your data and how to create and manage secure passwords.

About the expert:

Jens Kubieziel is an IT security consultant and trainer. He advises companies and government agencies on securing their IT systems and networks. Kubieziel also trains activists and journalists on such issues as secure usage of Internet tools and censorship circumvention.