An international perspective on activist surveillance
more extreme threat models
how do we assess threat profiles -- what our risk actually is in a situation
Lets' say you live in SF and are planning a trip to Tijuana. You can't really figure out strategies for that until you understand the types of crime or risks that are endemic to that environment. You have to start building up profiles of the countries that you are dealing with.
And as soon as you start doing that, someone from the country will tell you that your profile is too generic and that every city is different. Best solution is to do lots of research with people who are doing security and research in that country.
Building networks of trust are slow and difficult.
Seems like in other non-U.S. countries are more aware of when the threats include potential loss of life. E.g. groups in India who are gathering information about Rohinga, even if they are very non-technical, are super careful with that data because it could be life threatening.
Also though, differs in the U.S. between black/white privileged/not. More about person's context than just national.
We're all probably not paranoid enough. And, if a state-level actor wants to put you under active surveillance, you're owned. *BUT*, putting one person under *active* surveillance takes about 40 highly trained people to do. Rarely done -- e.g. terrorist attack in UK, person was flying ISIS flags and threatening an attack, but was still not under active surveillance. So we should still resist and not just give up.
The U.S. gov't is collecting massive amounts of surveillance data passively, but it's so much they can't actually make use of it mostly.
1 rule: don't ever post anything online which is illegal. Obvious, but makes it super easy for them to get you.
If you're using a burner phone, it's really easy for the gov't to know that Person X is using burner phone Y. The way they figure it out is by looking at patterns -- every seven days a new one pops up in the same location or the same radius around your home. That's you, switching burner phones.
Have to set up false patterns -- e.g. move around to neighborhoods where you DON'T actually work or live and use the phone there, is an example of how to lay down a false pattern.
Overall security threat modelling approach:
Assets, Adversaries, what could they do, what is the likelihood they would do it, what am I willing to do to prevent that
We sometimes focus all on the craziest, high-tech problems, rather than "security hygiene" -- make a habit of doing the standard normal things well and reliably (e.g. don't keep data about people around any longer than you need. making Signal your default messaging.)