When it comes to digital security, what does a journalist from West Africa, a Syrian journalist based in Turkey, and a French journalist on a reporting trip to Kashmir have in common? Answer: Very little. Each of them is working in completely different environments. They all need to protect their data, their communications, and their sources, but they must each do this in different ways, with methods adapted to their individual contexts.<\/p>\n
<\/p>\n
If you have ever attended a digital safety workshop, you\u2019ve probably been taught how to create strong passwords, how to encrypt a folder or an external hard drive, and how to activate two-factor authentication on your online messaging services. All that is fine. But it\u2019s often not enough. What you really need to learn is which tools and which best practices fit your own specific situation and environment. For example, a journalist working in France must learn how to protect his or her sources, but the situation (and therefore the tools they will use) are very different than for someone working in an environment where the rule of law does not apply. Security experts may have the technical knowledge, but journalists and human rights defenders know their context better than anyone, so we must begin with a dialogue.<\/p>\n
Jean-Marc Bourguignon and I \u2014 who have worked in the field of digital safety and hacking for 10 years, Jean-Marc as hacker and myself as a journalist and NGO worker \u2014 founded Nothing2Hide<\/a> in 2017 because we couldn\u2019t find any organization working with journalists and human rights defenders that had tech in its DNA. Our mission is to help protect the information and communications of journalists, bloggers, lawyers, human rights activists, and citizens. And whether we\u2019re holding a workshop on digital security, carrying out a security audit for a media outlet, or deploying tools to get around censorship, we always start by having a conversation about the needs of those we\u2019re working with. Security experts like us may have the technical knowledge, but journalists and human rights defenders know their context better than anyone, so we must begin with a dialogue.<\/p>\n Here are three examples of how we\u2019ve tailored digital security methods to fit different journalists\u2019 situations.<\/p>\n Journalists from an independent Syrian media outlet based in Istanbul asked for our help to make their systems secure. They are in a very delicate situation; they work on a daily basis with journalists based inside Syria. In order to get people to adopt security measures durably, it\u2019s key to keep things simple and provide long-term technical support.<\/p>\n We started by observing their work methods. Then, we put in place solutions adapted to their needs, with always the same motto in mind: \u201cKeep It Simple, Stupid.\u201d This allows us to create solutions that are easy to put into place and to reproduce.<\/p>\n We didn\u2019t change the team\u2019s work methods much because we learned that changing journalists\u2019 habits is the fastest way to failure. In order to get people to adopt security measures durably, it\u2019s key to keep things simple and provide long-term technical support.<\/p>\n Earlier this year, we held a workshop in Ghana with two dozen journalists and activists from various African countries. Some of the participants worked in places with repressive governments. In these places, turning smartphones and laptops into digital safes is pointless and even dangerous: arbitrary arrests, violence, and torture can surmount the most robust of passwords.<\/p>\n Instead, we showed the participants how to leave the fewest possible traces on their smartphones. To do this, we signed them up for accounts on ProtonMail, an encrypted email service.<\/p>\n Like many email providers, ProtonMail also offers a mobile phone app. But we advised them not to use it \u2014 the idea was to keep the least possible amount of information on their phones. Instead, they used ProtonMail on their web browsers, in private windows and using a VPN. That way, if one of the journalists gets arrested, no traces of their ProtonMail messages will be found on their smartphones. Moreover, local phone companies who have been known to cooperate with authorities won\u2019t be able to see who is using ProtonMail.<\/p>\n In France, photojournalists asked us how they could safeguard photos they were going to take during a trip to Kashmir, a region where foreign reporters run the risk of getting arrested and kicked out. Even if someone obtained access to their computer, it would be impossible for them to see the photos, or to even know that any photos had been stored on the computer.<\/p>\n Here\u2019s the system we put in place: During their reporting trip, the photojournalists would send their photos once a day to one of our servers. When the upload was complete, the files were copied onto a second server and erased from the first. This way, even if someone obtained access to the journalists\u2019 computer, it would be impossible for them to see the photos or to even know that any photos had been stored on the computer.<\/p>\n We also provided them with a plan B for cases in which they might not have access to the internet by creating a Veracrypt container (an encrypted folder) that was the size of a video file and in which they could store their photos. The container was camouflaged to look like a video file and stored among hundreds of other video files. This made it impossible to distinguish the container from the real videos.<\/p>\n While anyone can use this plan B \u2014 for local encrypted storage, all you have to do is change the name of the Veracrypt container and add an .mpg extension to make it look like a video \u2014 the plan A, i.e., remote storage, is a bit harder to put in place as it requires some technical skills. This method is, however, accessible to most: All that\u2019s required is a simple FTP server, a script shell, and FileZilla.<\/p>\n This article was originally published the Global Invesigative Journalist Network<\/a> (GIJN). The 182 member organisations of the GIJN \u2013 including Nothing2Hide \u2013 support, produce and promote investigative journalism. Image by Robin Jay<\/a> under CC BY SA license.<\/p>\n","protected":false},"excerpt":{"rendered":" When it comes to digital security, what does a journalist from West Africa, a Syrian journalist based in Turkey, and a French journalist on a reporting trip to Kashmir have in common? Answer: Very little. Each of them is working in completely different environments. They all need to protect their data, their communications, and their […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_coblocks_attr":"","_coblocks_dimensions":"","_coblocks_responsive_height":"","_coblocks_accordion_ie_support":"","footnotes":""},"categories":[1],"tags":[],"class_list":["post-130","post","type-post","status-publish","format-standard","hentry","category-news"],"_links":{"self":[{"href":"https:\/\/nothing2hide.org\/en\/wp-json\/wp\/v2\/posts\/130","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nothing2hide.org\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nothing2hide.org\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nothing2hide.org\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/nothing2hide.org\/en\/wp-json\/wp\/v2\/comments?post=130"}],"version-history":[{"count":0,"href":"https:\/\/nothing2hide.org\/en\/wp-json\/wp\/v2\/posts\/130\/revisions"}],"wp:attachment":[{"href":"https:\/\/nothing2hide.org\/en\/wp-json\/wp\/v2\/media?parent=130"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nothing2hide.org\/en\/wp-json\/wp\/v2\/categories?post=130"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nothing2hide.org\/en\/wp-json\/wp\/v2\/tags?post=130"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Avoid Changing Work Methods<\/strong><\/h4>\n
\n
Turning Your Smartphone Into a Safe Can Be Counter-Productive<\/strong><\/h4>\n
Erasing Traces on a Computer<\/strong><\/h4>\n