April 2015 - cypherpunks@lists.ogf.org

Re: "Blackphone" said to be "a super-secure nsa-proof"
by Ulex Europae 14 Oct '16

14 Oct '16

At 05:25 AM 1/17/2014, Jim Bell forwarded: ><<http:///>http://www.yahoo.com/tech/startup-launching-a-super-secure-nsa-proof-735110…> It's been long enough, has anyone acquired one of these and tested it? Ulex

10 13

Re: [Cryptography] Bruce Schneier has gotten seriously spooked
by Eugen Leitl 07 Sep '16

07 Sep '16

----- Forwarded message from Brian Gladman <brg(a)gladman.plus.com> ----- Date: Sat, 07 Sep 2013 09:33:28 +0100 From: Brian Gladman <brg(a)gladman.plus.com> To: Cryptography Mailing List <cryptography(a)metzdowd.com> Subject: Re: [Cryptography] Bruce Schneier has gotten seriously spooked User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:17.0) Gecko/20130801 Thunderbird/17.0.8 On 07/09/2013 01:48, Chris Palmer wrote: >> Q: "Could the NSA be intercepting downloads of open-source encryption software and silently replacing these with their own versions?" > > Why would they perform the attack only for encryption software? They > could compromise people's laptops by spiking any popular app. Because NSA and GCHQ are much more interested in attacking communictions in transit rather than attacking endpoints. Endpoint attacks cost more to undertake, only give access to a limited amount of data and involve much greater risks that their attack will either be discovered or their means of attack will leave evidence of what they have done and how they have done it. The internal bueaucratic costs of gaining approval for (adverarial) endpoint attacks also makes it a more costly process than the use of network based interception. There is significant use of open source encryption software in end to end encryption solutions, in file archivers, in wifi and network routers, and in protecing the communications used to manage and control such components when at remote locations. The open source software is provided in source code form and is compiled from source in a huge number of applications and this means that the ability to covertly substitute broken source code could provide access to a huge amount of traffic without the risks involved in endpoint attacks. I stress that I am NOT suggesting that this has happened (or is happening), simply that it has attractions from an NSA/GCHQ viewpoint. Fortunately, I think it is a difficult attack to mount covertly (that is, without the acqiecience of the author(s) of the software in question). On the more general debate here, in my view, 'security for the masses' through the deployment of encryption is a 'pipe dream' that isn't going to happen. Functionality (and the complexity that comes with it) is the enemy of security and it is very clear that the public places a much higher value on functionality than it does on security (or privacy). Every time a new device comes onto the market, it starts with limited functionality and some hope of decent security but rapidly evolves to be a high functionality product in which the prospect of decent security declines rapidly to zero. Raspberry Pis look interesting _now_ but I would be willing to bet that they won't buck the trend of increasing funtionality and declining security simply because this is what the majority in even this limited user community will want. To buck this trend we need an effort like the Raspberry Pi effort but one driven by our community with a strong commitment to simplicty and deliberately limited functionality in both hardware and software. Brian Gladman _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

8 14

Re: [liberationtech] Interesting things in keyservers
by Eugen Leitl 17 Aug '16

17 Aug '16

----- Forwarded message from micah <micah(a)riseup.net> ----- Date: Sat, 20 Jul 2013 10:05:42 -0400 From: micah <micah(a)riseup.net> To: Micah Lee <micahflee(a)riseup.net>, 'liberationtech' <liberationtech(a)lists.stanford.edu> Subject: Re: [liberationtech] Interesting things in keyservers User-Agent: Notmuch/0.15.2 (http://notmuchmail.org) Emacs/24.3.1 (x86_64-pc-linux-gnu) Reply-To: liberationtech <liberationtech(a)lists.stanford.edu> Hi Micah! Micah Lee <micahflee(a)riseup.net> writes: > I'm working on a talk for OHM2013 about PGP. Can anyone send me examples > of interesting keys in key servers that you know of? Since you are preparing a talk about the subject, I'm going to be pedantic and correct your usage of "PGP", because it is important to get your terminology straight when giving a talk. I presume you aren't giving a talk about the commercial software, but instead you are actually giving a talk about OpenPGP which is the standard specified by RFC4880 that different programs like GnuPG, Seahorse, MacGPG, and PGP etc. all implement. If that is true, then you should refer to it as OpenPGP, and not PGP. I dont know what your talk will consist of, besides the funny enigmail XSS and goatse.cx stuff (thanks for that! always good to have some goatse early in the morning), but I would like to point out a few things that might be useful to mention. One is a wiki page that I created with some people: https://we.riseup.net/riseuplabs+paow/openpgp-best-practices - it contains some useful hints about using OpenPGP, maintaining a good key and some general good practices that people often dont know about (such as the importance of keeping your keys updated to get critical revocation and expiration extension certifications!) One thing mentioned on that page that I wanted to highlight, because you used pgp.mit.edu links in your original email, is that the keyserver pgp.mit.edu is not a good one to use/promote. Everyone uses it as their 'goto' keyserver, but it is a really bad idea! As a keyserver, it has been broken for years. For a long time it was just dropping revocations, subkey updates and expirations on the floor. That is *really* bad. Eventually, they upgraded their keyserver software, but it is *still* running an older version of SKS, a version that fails to handle 16-digit subkeyid lookups (among other failings). So, please don't rely on pgp.mit.edu for your security, and please don't include them in your slides! If you are looking for one to use, I highly recommend using the SKS pool address (hkp://pool.sks-keyservers.net or http://hkps.pool.sks-keyservers.net/ - or if you want a more close geographical pool, have a look at http://sks-keyservers.net/overview-of-pools.php) Finally, there seems to be some amazing misconceptions about keyservers, keys and the web of trust. In particular this http://cryptome.org/2013/07/mining-pgp-keyservers.htm circulated recently and it pained me to see because it suggested various wreckless conclusions that were dangerously off the mark[0] (and used pgp.mit.edu, hah). While it is true that we've jokingly called the OpenPGP web of trust "the original social network" because of the exposed social relational graphing that can be done by querying keyservers, and it is for this reason that many activists I know do not want to have signatures uploaded to keyservers (and instead use the bulky local-only signature work-around)... ... but for some reason people seem to think that if it is on a keyserver, is true, or it means something that it doesn't. People don't realize critical things, such as the fact that I can create a key with the UID Nadim Kobeissi and upload it to the keyservers[1]. That doesn't mean that is the real Nadim's key (this is what exchanging key fingerprints and doing certifications is for, so you can know, with a certain degree of certainty, that this person is the person who controls that secret key material). Or people think that because I signed your key and that signature is on the keyserver that indicates: I trust you; we met in person at that date; we know each other; we are involved in a criminal conspiracy with each other; or many other wrong assumptions about what that certification means. I can sign Edward Snowden's key and send that to the keyservers[1]. Hell, I can sign Snowden's key with my fake Nadim Kobeissi key[1] and then send it to the keyservers. Does that mean that Nadim and Snowden have met in person?! No, it does not at all. Anyways, I can keep going... but I dont know what the focus of your OHM talk is about, so going on like this isn't particularly useful to you and your talk... however, I'd be happy to provide more feedback about your talk if you would like![2] After all, we Micahs need to stick together, micah 0. "the cryptome article just sounds like impenetrable bullshit from someone with no interest in actually understandning what's happening" - I'm not saying who said this... 1. no, I didn't do that, nor did I upload the edward snowden or bradly manning keys. -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

4 3

NSA Attacks on VPN, SSL, TLS, SSH, Tor
by John Young 17 Dec '15

17 Dec '15

Der Spiegel released largest single day number of Snowden docs today, 666 pages, on NSA Attacks on VPN, SSL, TLS, SSH, Tor. http://www.spiegel.de/international/world/nsa-documents-attacks-on-vpn-ssl-… We offer a RAR of the 44 docs: http://cryptome.org/2014/12/nsa-spiegel-14-1228.rar (197MB)

8 9

FOIPA adventures
by coderman 22 Aug '15

22 Aug '15

"you want me to consent to make my FBI file public? Are you fucking mad?" - https://twitter.com/thegrugq/status/563036665837789184 --- i am currently making requests through MuckRock.com which i recommend for their helpful and dedicated staff, as well as their time devoted to review and reporting on released information. i am using the professional service, which lets you set requests private until reviewed and ready to release publicly. this implies a bit of trust in MuckRock, and i hope it is not misplaced. few years back i asked for participants in a similar effort. some things resulted: 1) this also opens up the requester to risk; that is, whoever is filing must also potentially show some trust, if a falsified DOJ-361 is sent and used as pretext to "deter" you. i have not heard of this actually happening, but i was also not willing to push it. '''beware who you accept, coder, or they're setting you up for USC 18 fuckery. sure, it may in the end be ok. but you're in misery until cleared.'''' 2) the information is going to be public; if you've got a file because you're a privacy enthusiast, then filing to make your file public is the opposite of enjoying your privacy. there is merit in taking one for team earth human, however... --- as a first report, deliveries of USPS forms DOJ-361 to multiple, and a batch of three sent concurrently. two arrived promptly, but one got scrutiny before leaving town (forms to FBI, perhaps related to ? :) a) INTERPOL Washington FOIA Service Center (202)-616-0201 U.S. Department of Justice Washington, D.C. 20530 --- Form DOJ-361 sent, currently: February 4, 2015 , 11:41 pm - Arrived at USPS Facility - WASHINGTON, DC 20066 Tracking Number: 9405510200829494303833 b) U.S. Department of Justice United States Marshals Service Office of General Counsel Washington, DC 20530-1000 --- Form DOJ-361 sent, currently: February 4, 2015 , 11:40 pm - Arrived at USPS Facility - WASHINGTON, DC 20066 "Your item arrived at our USPS facility in WASHINGTON, DC 20066 on February 4, 2015 at 11:40 pm. The item is currently in transit to the destination." Tracking Number: 9405510200830593742348 c) Record/Information Dissemination Section (RIDS) FBI-Records Management Division 170 Marcel Drive, Winchester, VA 22602-4843 --- Form DOJ-361 sent, currently: February 3, 2015 , 6:15 pm - Arrived at USPS Origin Facility - PORTLAND, OR 97218 "Your item arrived at our USPS origin facility in PORTLAND, OR 97218 on February 3, 2015 at 6:15 pm. The item is currently in transit to the destination." Tracking Number: 9405510200828494428195 [ i offered to send via FAX if mail was problematic and excessively latent. ]

3 28

How are the Baltimore riots going?
by Georgi Guninski 07 May '15

07 May '15

How are the Baltimore riots going? https://en.wikipedia.org/wiki/2015_Baltimore_riots > Mandatory curfew effective April 28 – May 5 from 10pm-5am

16 32

Surveillance forces journalists to think and act like spies
by Lorenz Szabo 04 May '15

04 May '15

Interesting read. Found via HackerNews on ycombinator.com. Original here https://cpj.org/x/5fdd <https://cpj.org/x/5fdd>; cleaned up ASCII version below. ~ BizDevCon ___ Austria, Vienna PGP: 3542726F Surveillance forces journalists to think and act like spies April 27, 2015 By Tom Lowenthal Once upon a time, a journalist never gave up a confidential source. When someone comes forward, anonymously, to inform the public, it's better to risk time incarcerated than give them up. This ethical responsibility was also a practical and professional necessity. If you promise anonymity, you're obliged to deliver. If you can't keep your word, who will trust you in the future? Sources go elsewhere and stories pass you by. Grizzled correspondents might recall this time with nostalgia. For many young journalists, it's more like historical fiction--a time when reporters could choose not to give up a source, gruff editors chain-smoked cigars, and you could spot a press hack by the telltale notebook and card in the brim of a hat. The experience of a new generation of news writers tells a different story. Whether you choose to yield a source's name is secondary. Can you even protect your source to begin with? Call records, email archives, phone tapping, cell-site location information, smart transit passes, roving bugs, and surveillance cameras--our world defaults to being watched. You can perhaps achieve privacy for a few fleeting moments, but, even then, only with a great deal of effort. Yet this is journalism's brave new world. In the United States, the National Security Agency, otherwise known as the NSA, seeks to listen to every electronic communication sent or received. In the U.K., the Government Communications Headquarters, or GCHQ, has succeeded in intercepting and storing every peep that passes over the wires. Commercial spy software FinFisher (also called FinSpy) monitors citizens in at least 20 other countries, according to a report by The Citizen Lab, a research group based at the Munk School of Global Affairs at the University of Toronto in Ontario, Canada. Global Information Society Watch's global report details the state of communications surveillance in plenty more. Even Canada's spy agency may be watching Canadians illegally, though the GISWatch report could not say so conclusively. If a journalist can protect the identity of his or her sources at all, it's only with the application of incredible expertise and practice, along with expensive tools. Journalists now compete with spooks and spies, and the spooks have the home-field advantage. Shadowy worlds of subterfuge and surveillance should not be a journalist's habitat. The time a journalist spends learning to play Spy-vs.-Spy could be better spent honing his or her craft. Every hour spent wrangling complex security tools could be an hour spent researching and writing. All the staff on a newsroom's security team could be writers and editors instead. Each geeky gizmo and air-gapped computer (a computer that is never connected to a network) could be another camera or microphone, or the cost could be spent on payroll. All the extra labor and logistics dedicated to evading espionage is a loss. This poses sometimes-steep financial costs on newsrooms. If journalists and media organizations are to protect themselves, they must buy more tools and adopt practices that limit their efficiency. Robust security practices are complex and time-consuming, imposing logistical costs. The psychological toll of constant surveillance leads to exhaustion and burnout. Few journalists do their best work when they know that government thugs could break down the door at any moment--as they did at the home of independent New Zealand reporter Nicky Hager in October 2014, according to The Intercept. Many have worked to slow the swing of the pendulum from privacy to panopticon, increasing development of anti-surveillance tools and advice for journalists. The response to widespread knowledge of the long arm of the surveillance state has been gradual but impressive. Developers have increased work on surveillance-resistance projects and anonymous tip lines. Experts have put together numerous digital security guides and training programs, all intended to help reporters from falling under the focused gaze of government surveillance. Perhaps the flagship of this proliferation is SecureDrop, a secure and anonymous submission system for journalists. First pioneered by the former hacker and current digital security journalist Kevin Poulsen and the late programmer and political activist Aaron Swartz under the moniker DeadDrop, SecureDrop is intended to allow a potential source or whistleblower to get in touch with journalists without leaving any dangerous records of his or her identity. SecureDrop combines several pieces of security and privacy software into an integrated system, ensuring that only the journalists can read anonymous tips. Messages are protected with PGP, the tried-and-true gold standard for this task. Sources' anonymity is provided by Tor, the anonymity network that underpins private communications for everyone from the U.S. Navy and CIA to large businesses and survivors of domestic abuse. The result is safely encrypted messages and no metadata trail. With SecureDrop, journalists don't just choose not to reveal a source's identity. Unless a source chooses to reveal his or her identity, the reporters could not unmask the source even if they tried. Initially just an idea and some prototype code, SecureDrop was mostly theoretical until early 2013. The first major deployment was at The New Yorker. The project was soon adopted by the nonprofit Freedom of the Press Foundation, which was founded with the specific mission of facilitating journalism that governments oppose. FPF, as the foundation is known, soon took over SecureDrop's development and maintenance, as well as outreach and funding. More than a dozen other news organizations and prominent journalists have now deployed SecureDrop. With an ongoing crowdfunding campaign, FPF plans to bring it to many more. SecureDrop works hard to evade even targeted attacks and surveillance. Making use of cutting-edge technology and contemporary security best practices, SecureDrop separates different tasks onto different computers. Each machine only performs part of the puzzle, so it's very difficult to compromise the whole system at once. This makes SecureDrop quite expensive to deploy. FPF estimates that a single SecureDrop installation would set a newsroom back around $3,000, which is a lot to ask for a tool designed to protect the most important of tips from the most advanced of snoops. Other organizations have developed and distributed best practices and training materials. Universities have deepened their research into the threats journalists face. The Citizen Lab, already discussed in this piece, is dedicated to deep research about how technology and security affect human rights and is the source of some of the most detailed and comprehensive technical reports of recent years. If you want to know about the threats facing journalists and human rights groups, Citizen Lab is the place to go. Yet, as deep as Citizen Lab's work goes, it is as likely to induce security nihilism as it is to produce savvy security practices. An August 2014 report tells of terrifying new tools for state attacks on the media. Called "network injection appliances," these devices insert malicious software into otherwise innocuous traffic. Used right, one can modify an online video, adding malware that takes over a journalist's computer. If a journalist is using a service such as YouTube or Vimeo, session cookies allow the journalist to be targeted precisely. This makes these attacks very difficult to detect and prevent. With this new technology, journalists don't have to make a mistake to be compromised. Gone are the phishing days of opening a malicious attachment or clicking a suspicious link. There's no trap to notice and avoid. Just browsing the Web puts one at risk, and avoiding online video is an impractical ask of a journalist conducting research. Network injection appliances have likely already been deployed in Oman and Turkmenistan, according to Citizen Lab, and because they're commercially developed by private companies, the price of these devices will only continue to drop as their capabilities expand. Another Citizen Lab paper paints a disturbing picture of government cyberattacks. Journalists, among the principal victims of this sort of technological espionage, face state-level threats while lacking the funds and expertise to protect themselves. Attacks on computer systems can reach across borders into seemingly safe locations, allowing attackers to disrupt communications and impairing journalists' ability to do their core work. Sometimes attacks are simply a nuisance or a resource drain; at other times they present major risks to individuals' safety. It's all but impossible for journalists to learn the strategies of the state and appropriate countermeasures on a shoestring budget. Websites and service providers are often better positioned to protect journalists from these attacks. Securing the everyday tools of the trade works much better than does demanding that journalists jump through arcane hoops to stay safe. Simple measures can go a long way. Just enabling secure HTTPS rather than insecure HTTP can make a huge difference. The New York Times has called on all news sites to adopt this very measure by the end of 2015. As noted security expert The Grugq puts it: "We can secure the things people actually do, or we can tell them to do things differently. Only one of these has any chance of working." Since we first saw Edward Snowden's face, in 2013, computer-security guides for journalists have multiplied, but using computers safely is hard when a government is trying to get the drop on you. Many guides only scratch the surface, detailing basic--but important--steps. Turning on automatic software updates or using password managers and two-factor authentication for online accounts make a big difference. These first steps make journalists slightly harder to attack. In fact, simple practices probably have a greater impact than do more complex ones. Esoteric security strategies are a lot of work and sometimes only inconvenience a savvy attacker. Simple measures completely stymie simple attacks and force advanced attackers to change their tactics. A sophisticated attacker will never use an advanced technique when a simple one will do. More sophisticated attempts require more work, cost more, and are more prone to detection. Changing the game by forcing attackers to use scarce resources helps everyone stay safe. Other guides delve deeply into advanced principles of operational security. Abbreviated "OPSEC," the term is military jargon for measures taken to keep critical information out of hostile hands. If the phrase sounds more at home in a spy thriller than in a journalism manual, that's a hint at the problems posed by press surveillance. Mainstream journalists and press organizations openly acknowledge their need to learn spies' tactics and techniques to stay a step ahead. The adoption of military tactics and an espionage mindset has a substantial downside. The Grugq explains: "OPSEC comes at a cost, and a significant part of that cost is efficiency. Maintaining a strong security posture ... for long periods of time is very stressful, even for professionally trained espionage officers." Yet even in apparently free democratic societies, compromising a free press is the day-to-day work of the security services. Intelligence services sometimes target journalists for surveillance, even when the missions of the agencies involved are ostensibly centered around foreign intelligence. Iranian spies orchestrate elaborate campaigns to bamboozle journalists; they even pose as journalists when targeting think tanks and lawmakers, Wired has reported. The FBI has also admitted using the latter tactic and actually defended it publicly when criticized. In the U.K., security services have abandoned restraint when it comes to surveillance of journalists and civil society, Ryan Gallagher wrote in The Intercept, summarizing: "An investigative journalist working on a case or story involving state secrets could be targeted on the basis that they are perceived to be working against the vaguely defined national security interests of the government." Some journalists have risen to this challenge. After meeting with Snowden, Laura Poitras and Glenn Greenwald realized that traditional newspapers and media groups were not well suited to this world of watchers. They needed a new sort of organization--one ready to play spy games with professional spies from the very start. They founded the First Look Media group with help from fellow investigative journalist Jeremy Scahill and funding from eBay mogul Pierre Omidyar. First Look's flagship online magazine, The Intercept, is dedicated to exposing the abuses of the surveillance state. Choosing such powerful foes meant that The Intercept had to stay one step ahead from the start. Micah Lee is The Intercept's resident security expert. Formerly a staff technologist at technology civil rights group the Electronic Frontier Foundation, Lee was on The Intercept team from the beginning. He designed and implemented the security measures that Greenwald, Poitras, and Scahill--and now a team of 20--use to stay safe. When asked about the infrastructure needed to protect the publication, he frankly admitted: "When we think it'll make us safer, we normally just buy another computer or device. We're willing to spend money on these things when there's a clear security benefit." Lee was referring to security practices typically only needed when one is facing adversaries with the sophistication of governments. Protecting important information on separate air-gapped computers is a common practice at The Intercept. Lee and other technologists are fond of a security principle called "defense in depth," an approach that assumes that some security measures will fail and calls for systems that remain secure even when that happens. In the planning for defense in depth, a process should become insecure not when one security measure fails but instead when dozens do. Systems built this way demand more hardware than do those where security is more brittle. Several computers ensure that the compromise of one will leave the others safe. Smartcards protect cryptographic keys even when other things go wrong. All of this tech costs money and requires experienced technologists like Lee to design and operate. In keeping with this level of prudent paranoia, Lee and his colleagues often eschew regular smartphones in favor of the CryptoPhone. These $3,500 devices, made by German manufacturer GSMK, don't just provide encrypted calls; they're heavily customized and locked-down Android devices loaded with a whole host of custom software. They even try to detect anomalies in cellular networks that might be indicative of an attack or targeted surveillance. These practices and this technology are the best that media organizations can buy. It's a far cry from the James Bond-esque gadgetry that one might see at MI6 or the CIA, but, used correctly, it can keep the spooks at bay long enough for you to meet with sources and write the stories that need to be written. Staff at The Intercept use PGP for email encryption by default. Lee estimates that more than 80 percent of the emails he sent in the last six months were encrypted in this way. For most people who aren't security experts, PGP is a niche tool with a notoriously steep learning curve. Getting started requires hours of training and practice to wrap one's head around complex and unintuitive principles of public-key cryptography. The process takes even longer if one doesn't have an experienced guide. Between building sustainable long-term security strategies and jetting around protecting the magazine's VIP writers, Lee quickly ran out of the time needed to show each new hire how to use PGP. But he noticed that he wasn't always needed: "Folks learn PGP the same way they do any other tricky technical thing--they Google it, or they ask their nerd friends, and sometimes they get bad advice," he said. At The Intercept, new hires were learning PGP from folks already there--journalists and editors as well as technologists. The Intercept had developed what Lee calls a "security culture," an operational security term that has its roots in activism. In a "security culture," a community adopts customs and norms that protect its members. It's a wholesale adoption of operational security practices into the everyday work and activities of the group. The Intercept team considers security a core value, so people there are willing to work together to protect one another, even when that's outside their usual work. "Of course, having Erinn in New York helps, too," Lee joked, referring to Erinn Clark, the most recent member of First Look's security team. Clark came to First Look from the Tor Project, the nonprofit group responsible for developing Tor. Another security virtuoso, Clark is more than familiar not only with the nitty-gritty of security tools but also with the adoption of secure practices across an organization. In technology circles, the Tor Project is famous both for the exotic ways in which states have tried to infiltrate and attack it and for the extreme security measures its members have adopted to protect themselves. Leading the incredible heavy hitters of First Look's security team is Morgan "Mayhem" Marquis-Boire. A security superstar, Marquis-Boire worked on Google's security incident-response team, and he is a senior researcher at The Citizen Lab. This incredible brain trust isn't just there to keep just First Look safe. Once First Look's basic security needs are met, the group plans to branch out. "We want the security team to start developing tools and hardware and doing bigger research." Lee said. The team members plan to use their skills and expertise to help other organizations that can't afford their own elite security teams. The challenge is always resources. First Look has a billionaire on call to pay for the latest technology and fancy technologists. This is a rarity. Other journalists may face a stark choice between hard-hitting stories and staying safe. What does information security look like at publications that don't have First Look's billionaire funding? FPF regularly sends technical experts to help newsrooms install, set up, and upgrade SecureDrop. Every time they set foot in a newsroom, FPF techs find themselves flooded with security questions from reporters and editors. Questions aren't just about SecureDrop or FPF; news teams want to know about everything from the ins and out of other tools, such as OTR and Tails, to the sort of advanced operational security measures that can help them keep their heads above water when spies come snooping. Runa A. Sandvik, a member of FPF's technical team, said, "Even if you wanted to use these tools and had all the patience to learn them, there's still so much conflicting information--it's very confusing, very intimidating." And though few media organizations have the ability to hire technologists to work with their reporting staffs, Sandvik notes that the situation for journalists not affiliated with a major organization is even bleaker: "If you have a technologist, someone to help you, that's one thing. If you're freelance and not overly technical, I don't know how you're going to work this stuff out." She added, "Many feel overwhelmed; they don't know who to ask for help." Just having a technologist to help with analysis and security may not be enough. The newsroom has to commit to understanding the issues and taking good advice. Barton Gellman, who currently writes for The Washington Post, was one of the recipients of the document cache Snowden assembled, and he knew that he didn't have the technical skills to work on the documents alone. He brought prominent security researcher Ashkan Soltani (now chief technologist for the Federal Trade Commission) on board to help. Soltani bolstered Gellman's security practices and helped Gellman analyze and understand the more technical material in the collection. To make matters worse, intelligence agencies encourage confusion and misunderstanding when it comes to secure tools and practices. They try to associate a need for privacy with wrongdoing. This association makes it even harder for journalists to protect themselves and their sources. Persuading a source to protect him- or herself is harder when the tools of safety are associated with suspicion. In some cases, making secure tools seem suspicious actively endangers sources who live in less tolerant environs, such as dissidents in mainland China who use Tor. This doublethink is a strange flip side to the surveillance state: First, watch everyone, always, then vilify any attempt to recover some privacy. This is especially disruptive to journalists and their ability to serve as watchdogs. Even without state propaganda and unforced errors, covert action takes a substantial toll on the press's ability to hold leaders accountable. Espionage targeting journalists and their sources impairs the healthy function of the states where it occurs. And these practices are not just a feature of regimes known to be restrictive or autocratic. In 2013, David Miranda was detained for most of a day while making a connection between flights at Heathrow Airport in London. Miranda was changing planes on a journey from Germany to Brazil on which he was transporting documents and video footage between Glenn Greenwald and Laura Poitras. British police held him under measures designed to combat terrorism. Their reasoning? Miranda was promoting a "political or ideological cause." In July 2013, surveillance agency GCHQ destroyed computers at the Guardian newspaper in London. The security agency had already threatened the newspaper's editors, demanding that the Guardian stop reporting on government surveillance. A security service literally knocked on the doors of a prominent and critical newspaper in Western Europe. They ground a computer into pieces with the use of power tools. All of this was done in a vain attempt to prevent the publication of more articles on a topic that discomfited the government. These are the tools the state has at its disposal to discourage dissent. It is understandable that, for some, the risk of challenging this authority is simply too great. When these are the consequences of hard-hitting reporting, sticking to "safe" topics and innocuous pieces is a reasonable response. But even for those who choose to continue the hard work of comforting the afflicted and afflicting the comfortable, evading the panopticon comes at a tremendous cost. There are the costs incurred in avoiding simple tools in favor of secure ones. The costs of using extra hardware to protect sensitive materials. The costs of hiring elite security teams instead of extra editors. The costs of worrying that you've made a mistake in your security measures. The costs of wondering whether your hotel room will be undisturbed when you get back. The costs of hoping that today isn't the day that a government agent knocks at the door and asks to destroy your work, or worse. When journalists must compete with spies and surveillance, even when they win, society loses. Disclosure: The author previously worked at the Tor Project, the non-profit organization responsible for developing and maintaining the Tor software and network Tom Lowenthal is CPJ's resident expert in operational security and surveillance self-defense. He is also a freelance journalist on security and tech policy matters. Web site content (c) CPJ. All rights reserved. Articles may be reproduced only with permission.

6 8

Opinions of qwertycards.com?
by Shawn K. Quinn 02 May '15

02 May '15

https://www.qwertycards.com Has anyone on the list tried one of these? Thoughts? -- Shawn K. Quinn <skquinn(a)rushpost.com>

4 3

any going to Nepal?
by Zenaan Harkness 01 May '15

01 May '15

To help establish new mobile base stations, internet network, etc? Ham radios are being used right now, but longer term there's lots of tourist dollars that need mobile phone homes and connections, along with the rest. If you work ok with others, are able to travel and passionate for our collective future, perhaps now is a moment. I dunno where else to send this email. I tried searching for libre mobile base station (thought there was some project in that regards) but found only gnuradio. Carpe diem.

2 3

Matt Blaze Testimony on Encrytion
by John Young 01 May '15

01 May '15

Matt Blaze testified yesterday at the House hearing on encryption http://oversight.house.gov/wp-content/uploads/2015/04/4-29-2015-IT-Subcommi… Others too: http://oversight.house.gov/hearing/encryption-technology-potential-u-s-poli…

2 1