In January 2017, Donald Trump will become President of the United States of America, and the most technologically advanced surveillance infrastructure in the world will start reporting directly to him.
When Edward Snowden revealed the extent of the National Security Agency’s domestic surveillance regime in 2013, he warned that a new American president could rapidly expand its scope overnight with just a simple change of government policy.
“A new leader will be elected,” Snowden said. “They’ll flip the switch, say that because of the crisis, because of the dangers that we face in the world, some new and unpredicted threat, we need more authority, we need more power, and there will be nothing the people can do at that point to oppose it. And it will be turnkey tyranny.”
As in many other policy areas, we don’t yet know Trump’s plans for surveillance, but better safe than sorry.
Protecting yourself from surveillance by the NSA isn’t easy, but with information security technologies it is possible. In fact, it’s possible to fit the basic guidelines in a tweet, like this from the pseudonymous security researcher the grugq:
.@snowden OPSEC guide:
– use Signal
– use Tor
– use full disk encryption
– use a password manager
– use two factor authSolid basics.
— the grugq (@thegrugq) November 23, 2015
Use Signal
Encrypted messaging has got a lot easier over the past few years, particularly with the rise of encrypted texting apps such as Signal, developed by Open Whisper Systems.
The gold standard of encrypted communications is still PGP, an encryption standard first released 25 years ago by Phil Zimmermann. While PGP has the honour of being one of the few encryption systems that the NSA appears to have not developed a workable attack against, it is also tricky to use, with few good mobile options and a number of potential usability hiccups which can result in accidental exposure of information.
Signal, by contrast, is very easy to use. The app lets users add each other using their phone numbers, before providing a scannable QR code for double checking that no third-party has intercepted the initial communication. Scan each others’ QR codes, and if they both flash green, you’re good to go: you can use Signal from then on like a conventional messaging app, even installing a desktop extension so you can chat on the go.
If switching to another app is too much hassle – or if switching friends, family and colleagues to it is – there are good alternatives in the commercial sphere. Both Apple’s iMessage and Facebook’s WhatsApp offer end-to-end encryption, with the latter even using the same open standard developed by Signal.
Avoid unencrypted apps such as WeChat and Google Hangouts, as well as apps with an “optional” encrypted mode like Google Allo and Facebook Messenger. It’s too easy to accidentally forget to turn on the encrypted mode, or get lazy and stop using it altogether. And definitely avoid email and SMS, both of which are sent unencrypted and are easy to intercept.
Use Tor
Tor, once called The Onion Router, is a technology most associated with the Dark Web the shady part of the internet that hits headlines for being full of illegal material.
But the technology was created, ironically, by the US state department, to help activists in repressive nations communicate freely online, and it’s effective for keeping all of your browsing out of the reach of prying eyes.
It works by parcelling up data into bundles, which are then encrypted multiple times to dictate a path through a network of volunteer computers before reaching the final destination. Like a game of pass-the-parcel, each “relay node” in the network receives the bundle and decrypts one layer, which reveals the instructions for where to pass it on to.
This means that the destination server doesn’t know where the request came from, and the relays in the middle know neither the user nor the destination. Ideally, the system is secure from eavesdropping.
Tor Hidden Services, which make up the core of the Dark web, are even more secure, as the destination server is itself a fully configured Tor node, ensuring the request need never return to the surface web. That means that an observer can’t tell that a Tor user has even visited the site at all, let alone which particular Tor user.
Among the companies running Tor Hidden Services are the Guardian and Facebook.
In practice, there are more difficulties to using Tor than there are Signal.
For one, the nature of the network will make browsing more difficult: the limited capacity imposes bandwidth constraints slowing internet speeds, while many sites, uneasy about having users who they can’t identify through IP addresses, will block Tor entirely.
Additionally, there is more scope for error with Tor. It’s possible to mess up and send some information over an unencrypted connection if you aren’t careful, which can provide a fingerprint that an eavesdropping agency can use to deanonymise you.
In addition, there have been successful attacks on Tor, which work by flooding the network with fake relay points in an attempt to control all of the middle nodes on a given connection.
If you are in a country which hasn’t just elected a populist demagogue president, you can help counter these efforts by setting up your own Tor relays.
Use full disk encryption
This is easier than ever these days. On a Mac, you will likely have full disk encryption on by default if you are running a recent version of macOS. Check by going to the Security and Privacy tab of system preferences and clicking on FileVault. If it’s turned on, you’re good to go.
On Windows 10, it’s only slightly harder. BitLocker, Microsoft’s full disk encryption feature, isn’t on by default, but can be turned on by searching for “encryption” from the start menu, clicking “Change device encryption settings” then “manage BitLocker” and turning it on. Similar settings are available in older versions of Windows going back to Vista.
If you’re running a version of Windows older than Vista, you need to upgrade: Microsoft is no longer issuing security updates for your computer, leaving you essentially undefended against any and all attackers.
As always, there is a trade-off: if you forget your passwords when you have full disk encryption turned on, you will not be able to recover your data, ever.
Full disk encryption will only protect you if your computer is actually turned off, or logged out, though. If you’re in the habit of simply letting it sleep while you’re not using it, reconsider.
Use a password manager and two factor authentication
The final piece of advice is both the best general security advice, and the least relevant for the majority of people when it comes to living under the NSA.
While encrypted communications are important for protecting users from “dragnet”-style surveillance, where a huge amount of personal communications are automatically intercepted and scanned, fixing passwords won’t do much: there is no evidence the NSA engages in large-scale hacking of accounts not already under investigation.
But even if you don’t worry about being specifically targeted, securing your accounts online is just good sense.
The actions you take to fight repressive regimes may only end up protecting your bank account, but that’s still a positive.
A password manager, such as 1Password, Dashlane or LastPass, lets you generate and store random, unguessable passwords, and you should use a unique one for every online account you have. You should be doing this as a matter of course: even if you only re-use passwords on “unimportant” websites, access can be used to gain greater access.
Whether or not you reuse passwords, services like Troy Hunt’s Have I Been Pwned are good too. Hunt monitors for large scale password dumps, and will email you if any of your accounts have been posted in the internet in security breaches like Adobe’s hack of 2.9m accounts in 2013.
Two-factor authentication, meanwhile, protects you even if you lose your passwords. Companies including Facebook, Twitter, Google and Apple all offer different forms of two-factor, requiring you to either enter a code displayed on another device, or approve the sign-in, when logging in.
Keep up to date
The NSA is always on the hunt for new, undiscovered, ways to hack into targets, but that doesn’t mean it isn’t perfectly happy to use tried-and-tested methods to access information too.
Always keep your software up to date, installing security updates as soon as they’re available, to avoid being targeted through a security weakness which has already been fixed.
Like all the best infosec advice, this will serve you well in your day to day life, too. Malware like ransomware infections frequently spread by taking advantage of recently-patched flaws in software like Adobe Flash, so keeping that up to date will protect you from the NSA and from common-or-garden cybercriminals.
This is also a reason to reconsider your model of phone. While Apple has a long track record of shipping security updates for devices long after release, the Android landscape is more patchy. Google has promised to update its Pixel phones, while manufacturers like Samsung keep their top-tier handsets, like the Galaxy line, up to date.
But cheaper models are often left with the version of Android they ship with forever, meaning they rapidly become insecure.
Think
Lastly, use this as a moment to take stock.
That app you’re about to install: does it really need to know your location? Does it need access to your contacts? Could information you share publicly be used against you? What about information you share privately, but through insecure mediums? Do you need to chat to colleagues using your work’s communication tools, rather than face-to-face, or even over the phone? Is your archive of thousands of tweets, or millions of Facebook interactions, enough for a determined attacker to damage you?
“If you give me six lines written by the hand of the most honest of men, I will find something in them which will hang him,” wrote Cardinal Richelieu. Four hundred years on, and modern Richelieus are spoiled for choice.
