Protecting the Identity of Human Rights Activist When Using Mobile
Guardian Project
Facilitator: Derek
Goals - protect activists Collaborated with Tor project Built Android port of Tor Projects include: - Encrypted IM on Mobile - Automatic obfuscation of identity via facial recognition on mobile phone camera - Developer tools
Problems w/Tor: - Latency/sluggishness domestically - Some areas experience much more focused attacks on the Tor network - China: Private bridges are closed within 5-6 hours
Comment: - Our NPO staff sends emails etc. in the clear, but there are threats/risks from the governments in Brazil, Southeast Asia,
India, China, U.S. - Staff uses Skype for chat/calls - side note: New Skype vulnerability found - you can detect someone's IP address just by placing an uncompleted call
why don't people use security tools? - Because they're hard to use - e.g. PGP - For mobile phones - it's even harder - Hacking laptop/desktop config files for better security is still easier than trying to hack your phone (it's still like a
black box) - And this is for techies! For activists in the field it's even worse - Expectations differ between different cultures & user communities - Some balk at adding one more step to setting up/using
email, etc. Others (such as those who live in repressive regimes) are very security-/privacy-conscious even for non-tech
matters. - It's a psychology problem. Past frustrations with using security tools leads to user resistance in the future - People don't understand the consequences. They might understand the consequences of lax physical security (getting
arrested, having the sh*t beat out of them), but don't understand consequences of lax digital security (because they're in
the future, or a step removed) - Scare them with demos: Firesheep hacking, sniffing of their web photos
More Guardian projects
- Tools/app to make key exchange easy & happen in the background
- Android app: Orbot to support Tor over wifi hotspots
- Android app for visual privacy: ObscureCam - take photos on your
phone (or import them), the app processes the image using
facial recognition to _mask_ the faces. Then you can share the photos online with less risk of compromising people's
identities (e.g. taking/sharing pictures at an Occupy protest) - ObscureCam is partly based on use cases from the organization WITNESS - They're also thinking about a flip-side app: InformaCam for putting more identity, info into a photo & its metadata - one
use case: make photo admissible in court
Comment: Copwatch/Openwatch app discussion involved storing diffs between
Openwatch overview: Clandestine recording on your phone, e.g. to capture abuses by law enforcement officials One activist had to smuggle a video out on microSD card hidden in his gums!
Q: I thought the Guardian Project was a distro? A: They are doing custom handsets based on Cyanogenmod + custom distro on Nexus One, they give training before distributing
handsets. They want to make it a distro, but that's further down the roadmap, partly due to the time/resource constraints.
There's also some resistance to a fully-securitized Android distro from various parties - e.g. Android app devs didn't like
the toggling of Android system permissions
Whisper Systems - Whispercore project - Another mobile security project (firmware) - Has overlap with other security projects, high-quality developer, but not open source - Still recommended (until a better open source option becomes available)
Q. Is this available on lower-end handsets? A. Not yet, because of computation resource constraints (but this is changing, hardware on low-end phones is improving)
Q. How to encourage people to take privacy/security more seriously? A. One answer - make people see that they're not just protecting themselves, they're protecting their family/community.
Example from Safer Mobile project in Egypt: A boy was photographed in a public square engaged in questionable activity. He
was tagged on Facebook - because of this, he got thrown into jail
One-touch panic button - If you're under duress, blasts alert message/location info to selected contacts and also wipes
selected areas of your phone
"I'm Getting Arrested" app - Does something similar, used/developer for Occupy
Q. How to encourage developers to develop with privacy, security in mind? A. Some answers: - Name & Shame approach - publicly expose security vulnerabilities - Defcon dev contest for security tools drew very few entries - Understanding what are the "hot areas" of security/privacy development with the most activity - Frame it with a real-world impact, e.g. what technologies does the Occupy movement need? - Have more compelling narratives - Security horror stories that are personal - what could you build that would protect these
people? - App contests are not enough - devs want to help, but they need to eat - day job takes precedence - VMWare/Benetech - offer paid 3-month sabbaticals to do social coding for good
Report-back:
Usability issues for security tools: - User experience for OTR vs. PGP - User feedback on Tor Motivating users toward security practices: - Having your friends tagged in Facebook, then thrown in jail - Useful demos: Man-in-the-middle attacks, upside-down kitty pictures, Driftnet, Firesheep Apps & tools from Guardian Project + others in the space: - ObscuraCam, "I'm Getting Arrested" app, Key exchange, Tor, Whispercore
-- Kathryn Benedicto Happy Snowman Tech - Drupal Website Development for Nonprofits kathryn@happysnowmantech.com +1 408.394.0796 http://www.happysnowmantech.com