Building Security practices

Building Security practices is hard, most of the times it is stressing and it is a common reaction to freeze or give up. It is also very common to feel an individualistic approach, where there is no community nor collective work being done. We want to challenge that view, therefore our guiding principles (a description of each is below the list) are:

1. Failing better next time;
2. Security is a process, not a checklist;
3. Security is a collective care practice;
4. This is a learning space;
5. Open-Sourcing Security;

Failing better next times

The traditional western thought and learning process is based on either being able to do something or to not be able to perform it. This leads to people giving up on security or people thinking that they will never be able to understand it.

We want to purpose a “new” (many other places and organizational cultures have been following this practice for years) practice, based on knowing that we will eventually fail, and using each failure as an opportunity to actually learn, not only from textbooks or exercises but from experience.

This also means to celebrate our small victories in creating and supporting each other on the Security Culture process.

Security is a process, not a checklist

You have probably been to a camp, or massive action, that had a “Security Culture Guide” (or something similar), that presented policies (or bullet points) to follow, without explanation or collective reasoning behind. Some of the policies may be fit for the specific context, while others might seem out of place (especially when multiple organizational practices and methods come together to converge on one action/camp). Most of the times it lacks an actual analysis of what surround us, and is unable to flow to the needs of everyone in the space and to the specific threat model.

The adherence of a good Security Culture comes from the collective feeling of ownership of that proposal, not from a checklist that someone wrote. It is also far better to explain the thinking behind the proposal, for new members that were not present.

Processes are evolving, they are not a “one time deal”. We cannot spend 2 days working on our Security Culture, drafting protocols and guides and then proceeding to the next task. Building a Security Culture means working constantly (as a collective) to address bad practices, find new vulnerabilities, and creating ways to get stronger.

Security is a collective care practices

Security is about many different things. It is about being able to build a better world, fighting state surveillance and being able to actually plan for a future and present. It is about protecting comrades and compas, not endangering them. It is about allowing at risk people to join you, while taking care of their needs.

Security is sometimes used as a way to either silence or shut-down people, we need to work on that. We cannot build a transformative Security Culture where Patriarchal behavior is used in justification of “Security”.

I recommend everyone to read the following article, it was written driven by an unfortunate situation but it is essential to read. It is Why Mysoginists Make Great Informants by Courtney Desiree Morris.

This is a learning space

As with most projects around security, this is a learning space for you and for the project. I (Larus Argentatus) don’t know everything, will make eventually mistakes and want to learn from them. I come from a specific Organizational Culture that might reflect on some of the things I write. At the same time, I try to read from other collectives and comrades that have developed strategies around Security and Building Security Culture. I want to learn about topics that I know and don’t know and I hope that you feel the same way.

Open-Sourcing Security

In software development there are two major approaches:

• Open Source;
• Proprietary / Closed Source;

The biggest difference between them is that in Open Source software anyone can check the code, build the application and discover security vulnerabilities, while with Proprietary software only the company developing the software has access (at least lawful access) to the source code.

Most of the Security related software and protocols are open-source for a simple reason, more people looking at the code generally means that security vulnerabilities are easier to detect and you do not have to necessarily trust the developers. ¹

The same approach can be done with our Security Practices, security trough obscurity generally doesn’t work and you will be spending much more energy trying to keep it secret than actually protecting yourself / the collective.

As such, we will also recommend Open-Source Software that is actively maintained when reccomending software and new tools.

Situational Awareness

One of the main bases of good security is being aware of what surrounds us, and what is happening around us. It is the skill, built over time, that allows us to detect real time threats and act accordingly.

There are a plethora of exercises that can prepare you for common situations, even though you cannot always prepare for everything. Before going into the exercises, let’s do a quick theoretical introduction.

Physical Surveillance 101

Most of the physical surveillance happens for 3 general reasons:

• Information Gathering (next steps for the movement, future actions, information about specific militants (address, work, close people and comrades), meetings and members of an organization,) - it is mainly used to understand who you are and what is the movement;
• Intimidation - the thought/feeling of being surveilled might be enough to discourage whatever plans you have;
• Process - the state might be following you to understand your schedules, to arrest you at a later time;

No matter what is the reason behind the surveillance, it is always essential to find the balance between continuing to act, taking precautionary measures and to not feel paranoid.

The general tips to be aware of your surroundings are:

• Follow your Instinct - If you feel that something is wrong / out of place, even when you cannot pinpoint why, you should follow your instincts and get away from that situation (it might be a meeting you are going to that feels strange, the place where you are going to act that seems to have more police/security than when you scouted it…);
• Being aware of your surroundings - In the common places of your life (home, university / workplace, movement spaces) try to memorize what exists there and find the things that feel out of place. Physical Surveillance has to start somewhere and these are some of the most common places to start.
  • Be aware of the people - People that seem out of place, people that are always there but don’t interact with you, people that appear in multiple places of your life (in front of your house, at work, in a leftist space) that you don’t know;
  • Be aware of the objects - Strange devices plugged into walls (Ears and Eyes is a really good project to present some of the surveillance technology being used against anarchist militants), cars and vans parked on the street regularly without anyone from your street/collective;
• Create a communication plan - If you are being actively surveilled, how will you communicate to your companions what is going on?
  • With whom will you communicate?
  • What will you say?
  • Will you do it covertly? Is there a specific phrase that you can use to not raise suspicion?
  • What is your response plan? Do you have a burner phone (for example) to communicate with key people? What are your steps after understanding that you are being surveilled?

Situational Awareness (SA) is based on a cycle between:

• Observe;
• Decide;
• Act;

This only works if you know what to Observe, what to Decide to be able to Act.

There is a collection of common Reactions on the page about Understanding Risks

Practical Training

Besides training for specific situations, you also need to train your own eyes to detect new information.

Some of these exercises come from Protest Games, a really interesting resource to find games and affinity building exercises for activists.

Observation Skills

Object Game

One simple exercise to get used to observing and memorizing information is:

1. Someone gets 10-15 objects and lays them out on a table;
2. They give you 1 minute to memorize the objects in that table;
3. They cover the objects;
4. You tell them as many objects as you remember;

The first few rounds might be hard and you might only get some of the objects, but with time your eyes and brain will start to get better at memorizing them.

After a while, you might also want to try to memorize the conditions of the objects (such as color, marks, maker…).

People “Memory” Game

This exercise is really useful to create a collective sense of “the surveillor”. It can be useful if multiple people feel that they are being surveilled and can describe the person, creating a clearer picture of who is watching and who is being whatched.

1. One person picks an image of someone (might be a family member or a random picture from the Web);
2. That person shows the picture to the group for a while (30 seconds to 1 minute);
3. Each person from the group tries to write down a description of the person;
4. You compare the descriptions between the group and then you show the image;

It is normal for people to notice different things, the main purpose of the exercise is to get you to notice on as many things as possible, and to be able to describe them clearly for other people.

Solo-Exercise - Peripheral Vision

Most of us walk looking at our screens, this creates a tunnel vision that will shorten what our eyes can actually see.

This is a simple exercise that you can do while waiting for someone, or while waiting for the train to arrive.

In order to be able to train your Peripheral Vision, you can:

1. Without moving your head, scan your surroundings from left to right, covering mostly what is right in front of you;
2. Describe what you saw;
3. Refocus and try to go a little further to what is far away from you, and more to the side;
4. Describe what you saw;
5. Repeat this process as many times as you can, trying to always go further to the back and to the sides;
6. When you get the hang of it, you can try to describe objects or people that only show up for a brief second on your side view;

Protest Scavenger Hunt

If you go to a protest with an affinity group but don’t plan to do anything besides being there, you can use that time to train your observational skills.

1. In your group, decide who will be the “Treasure Finder”
2. The “Treasure Finder” will have 10-15 minutes to go into the march, find signs and banners and note them down;
3. The Scavengers will then write all of the “treasures” and try to take a picture of them (always ask for consent while photographing other demonstrators). You can also play this exercise without phones, noting down which treasures you found;
4. Everyone gets back together and changes the “Treasure Finder”;

You can also play this game in other places, like at the Social Center’s party or in the street;

Commuting

One easy and quick exercise you can do daily is to try and memorize who is on your Public Transport commute regularly (extra points if you greet them and create solidarity with other members of our class).

You can always complexify your task, trying to memorize where they leave the bus or what bag where they carrying.

Little Brother

Taken directly from Protest Games

Your aim is to take covert photos or film of the other players. If spotted taking footage, you must stop immediately. For footage to count, a player must be recognisable in it – either by clothes or by facial features, according to mutual agreement.

Play for at least half an hour at any kind of protest. Limit each recording to less than ten seconds for practicality and battery saving. At the end of the time limit, compare footage.

The player who took the most footage wins the Cop Award.

The player who appears in the most footage wins the Mask Up Prize, and any players who appear in no footage win the Covert Award.

If you win both the Cop and the Covert Award, apply to your nearest government intelligence agency or infosec division.

Advanced Mode: Play for a week. Expert Mode: Never stop playing.

Exits and CCTVs

Another simple exercise that you can do most of the days, to train your Situational and Spatial Awareness is, while entering into a new building, memorize the Exit routes and try to find most of the CCTVs (this exercise is especially useful to train for Direct Actions).

Role-play

Role-playing might sometimes be useful to put yourself into new scenarios that you hadn’t thought before.

A simple exercise would be:

1. In a group, one person presents the scenario;
2. Everyone gets a role in the scenario;
3. You do the scenario;
4. Debrief, you talk about what happened, what could be different, what new thoughts came from the exercise;
5. Optional - You might repeat this with new inputs, discovering new thoughts and practices;

Some of the scenarios you might want to role-play are:

Final notes

Most of these exercises, if done regularly, can improve your Situational Awareness by a lot. YOu should try to do them with comrades and share your progress and celebrate victories.

Be aware that different presenting people does not necessarily mean that an undercover operation is going on, and that someone “dressed as an activist” might be an undercover police/informant. This also applies to the way someone speaks (if they do not know the local activist lingo). You should, as an organizer, be aware that new people might need to adapt or not fit instantly. More resources on infiltrators will be shown especially on the Organizational Security section and on articles about Security Culture.

Understanding Risk

Risk can generally be presented with the following formula:

Where:

• Risk is “the possibility of an event resulting in damage (psychological, legal, financial, personal, organizational, physical)”;
• Threats are the “indication, suspicion or declaration of intention to create damage (psychological, legal, financial, personal, organizational, physical)”;
• Vulnerabilities are the “factors that inhibit damage or that exponentiate the final result”;
• Capacities are the “factors (*resources, technological capacities, mental state, support people and specific abilities) that mitigate the possibility of damage or reduce the impact of it”;

When talking about security measures, there are 3 major approaches/strategies, these approaches inform us on what we should focus on (based on the formula above):

• Acceptance - focused in reducing threats, creating consensus in society about the work you are doing and negotiating with the other actors in society to neutralize those that might become enemies (reducing Threats);
• Dissuasion - focused in intimidating threats, using legal, public relations or political repercussion to those that threaten your movement. This approach works mostly when you have power or strong allies;
• Protection - focused on protecting your collective and actions, with a strong emphasis in Security Culture, functional and informed Operational Security and robust Organizational Security to deal with repression, surveillance and infiltration (improving Capacities);

In general, the strategy that we follow is the Protection strategy, even though that different moments, and specific actions might have a different strategy underlying it.

Reactions

One of the biggest necessities to understand when talking about Situational Awareness and Risk is how will you react (Decide) to what you observe. In general, there are 5 common reactions to threats:

There are plenty reasons why someone might react, from the mental state, to energy in the moment, material conditions… including previous training, experience and preparations.

Final notes

Based on understanding Risks, Security Strategies and common Reactions, we purpose some exercises you might do (personally or in collective).

Risks Table

You might do a table like this for each action / task that you have. Afterward the people from the collective might share them and analyze them collectively, detecting common risks and necessities.

Example Table

Risk Matrix

Besides understanding the risks and what we might to if something happens, it is always to understand the actual probability of the risk to happen and the impact if that materializes.

To do that, we might use the Risk Matrix

With the Risk Matrix done, we can understand and focus our energies on addressing the risks in top-right corner first, and then proceed to mitigate the other ones.

Threat Modeling

We live in complex times (as most people that engaged in Radical Action lived). We live in times where change has to be done by us before everything changes against us.

The stakes are high, repression is expanding, not only on the physical realm, but also on the digital one.

Governments, fossil fuel companies and the far right mobilize against us and try to intimidate us.

That is why we must create good Threat Models to inform our security practices.

What is a Threat Model?

A Threat Model is an analysis tool that answers:

1. What are we protecting;
2. Why are we protecting it;
3. From whom are we protecting it;

The what, why and from whom informs what do we need to do and sets up the bar for revolutionary discipline in our day to day life, concerning security.

It is a structured approach to identify and prioritize potential threats and creating useful and functional mitigations to neutralize those threats.

When doing a threat modeling, you should also take into consideration your current structure, how you communicate internally and how do you communicate to the general public.

Creating a Threat Model

Find time to do this collectively since the threat model is the analysis that justifies your security practices.

Threat modeling should be done before major actions for specific practices and threats, but you should also have a threat model for your collective / organization, it should be updated regularly and known by all the members.

When starting, you should begin from the inside out. Therefore, start by answering the what. Some of the main guiding questions around it are:

• Are there meeting places that need to be kept hidden?
• Where are the objects (speakers, banners, megaphones …) of the collective stored?
• Are we trying to hide the identity of the members of the collective?
• What are our next steps? Are they public?

Afterwards, to create common understanding on why there are security practices. collectively discuss why are you protecting that information, you might discover that some of it is critical, while other information is already public.

Using the input of the exercises from Understanding Risk (Risks Table and Risk Matrix) try to understand who would be able to turn those Risks into a reality. Those are the people that you are protecting from. It is advised to go as specific as possible (is it a Working Group from the Local Law Enforcment Agency? is it a specific Far-Right Organization, what is their common modus operandi?).

Phone Security

Cellphones are one of the basis of the modern world, they allow us to communicate our messages, recruit new members, get information fast and connect with far away comrades. At the same time, phones are the easiest surveillance device that we carry daily, creating metadata about our daily routine and mapping our acquaintances.

This article is separated into 3 sections:

• Day to Day Security;
• Before an Action;
• Emergency Situations;

We will also dive into some application alternatives (all open source and actively maintained).

Day to Day Security

Operating Systems

Before delving into digital security practices, we wanted to present our analysis on cellphone Operating Systems.

The 2 major ones are iOS and Android. There are many reasons why someone would use one or another and while we defend Open Source software as a practice, iOS devices are used by many activists and we cannot ignore that they also need to harden. In general we suggest the usage of a private-centered Android Distribution (such as Graphene OS) but we will have security advice for either stock Android and iOS in this article.

Encryption

The first thing you should do is enabling Encryption on your device. This will protect your phone’s contents when turned off, creating a bigger work for police to access your device in case it gets seized.

On iOS:

1. Update your iOS version by:

• Going to the Settings app;
• Selecting General in the menu;
• Going to the Software Update section;
• If there is any version that you can update to, do it;

2. Enable Encryption by enabling Passcode:

• Go to the Settings app;
• Create a good passcode (you might need to select Passcode Options to switch from the standard 6 digit code to a custom alphanumeric code)

You should deactivate Touch ID & Face ID since those are easier to crack (the police might just point it to your face our your finger).

On Android:

1. Create a password:

• Go to the Settings app;
• Find the Security section;
• Select Screen Lock and create a Password (mix between numbers and letters, minimum of 8 digits recommended);

2. Check if Encryption is enabled:

• Go to the Settings app;
• Find the Security section;
• Select Encryption;
  • If phone is Encrypted do nothing;
  • If phone is not encrypted, while charging, select Encrypt;

You should not use Fingerprint or Facial features to unlock the phone.

Installed Applications

1. Reducing the number of applications you use is a practice advised, each app that you have expands the attack vector that Law Enforcement or Private Companies might exploit to get access to your cellphone;
2. Be wary of the permissions you give to Applications (especially Media Access, you can refuse to give them that access and when you want to share something on that app you go to the File Manager and share the specific file/image with the application);
3. See the end of this article to find Open-Source and Secure alternatives to everyday apps;
4. Keep all the applications updated (daily);

You can have secure a secure browser, secure messaging and “private” social media but do not forget to install a Secure and preferably Open-Source Keyboard.

Our Suggestions are:

• For iOS - use the default keyboard with telemetry (analytics) turned off;
• For Android - do not use the default keyboard (most of the times filled with telemetry and data-grabbing), you might try:
  • AnySoftKeyboard;
  • OpenBoard;
  • Simple Keyboard;
  • FlorisBoard (still in beta);

Connecting and Using the Internet

The main reason why we need smartphones is the capacity to connect to the internet. There are a number of threats that we need to be on the look out for when doing this, namely:

• Your connection might be unsafe (your logins and what pages you access can be changed/recorded);
• Your location might be exposed;
• The device you are using might be exposed;
• The downloads you make might be malicious;
• You might access malicious websites;

To deal with this you should:

• On Public Networks, always use a VPN (see our recommendation in the end);

The usage of a Virtual Private Networks (VPN) creates an encrypted tunnel between your device and the VPN Server (that you should trust for this to work), making the connection inside the Public Network.

• Activate HTTPS, do not connect to websites using HTTP;
• If you want to hide your location, either use a VPN or use Orbot / Tor Browser;
• To hide what your device is use Tor Browser;
• Always be careful on what you download into your device, try to open documents on the browser and keep your device activated;
• Do not accept permissions (Download, Media Acess, Location, Camera, Microphone) from websites you do not regularly use/trust;

About Tor Browser and Orbot.

Tor Browser is a Web Browser (just like Firefox/Chrome…) that comes already setup with Fingerprinting Resistance and other technical protections. Besides those protections, it is used to connect to Tor network, a network made by thousands of servers and relays that can hide to what website your are connecting to (from your perspective and from the website’s perspective).

Orbot acts as a VPN on the Tor Network, where your web-request s trough 3 other servers before connecting to the website/service, goes trough 3 other servers before connecting to the website/service, anonymizing your connection and protecting it from snooping.

Secure Communication 101

Firstly, SMS and Phone Calls are always insecure, they can be easily intercepted and modified by the State and you should not use them to contact comrades. Besides the content (data), using SMS will mean that our enemies can paint a map of our networks and militants (metadata).

Secondly, closed-source applications (such as Whatsapp) are generally untrustworthy due to the fact that we cannot check the actual code of the applications

Thirdly, Telegram is not secure by default even though they try to market themselves as such. There is no encryption in group chats and the end-to-end encryption on direct messages has to be activated individually for each chat. Telegram also states in their Privacy Policy that if they recieve a Court Order confirming that you are a Terror Suspect they will disclose your IP Address (location) and Phone Number. It is not an uncommon tactic for enemies of the socio-economic system to be painted as terrorists (see Alfredo Cospito in 41 bis).

Finally, our array of suggestions on instant messaging:

• Signal / Molly (see our [Signal Hardening] article);
• Briar;
• Cwtch;

To understand Briar and Cwtch, and why you might prefer them to Signal, you can read the article called The Guide to Peer-to-Peer, Encryption and Tor.

Before an Action

Our main recommendation, synchronized with many radical groups and activists recommendation, is to leave your phone at home.

Bringing it to the action leaves a digital trail that can connect you with whatever happens there. Bringing it will also mean that it could eventually be seized.

A simple (but possibly expensive) solution is to get a temporary phone (either dumb or smart (if you need to take photographs (aka you are part of a Media Team))).

Besides that, here are some of the main things you should do before leaving your house (with or without your cellphone).

Cleanup

Purpose: removing information that might put you or others in danger.

Cellphone

• Make a list of photographs, documents, guides, contacts (…) that you have on your phne;
• Copy them to an encrypted flash drive / laptop;
• Delete them from your phone;

Signal

Multiple options, depending on threat level.

• Uninstall Signal;
• Delete all the messages (Signal > Settings > Storage > Delete Message History);
• Exit all groups, delete “Direct Messages” and delete “Notes to Self”;

You might mix and match all of these options as well.

Contacts

Imagine if the police gets access to your phone.

• Do not save contacts as “Name - Collective X” / “Name - Action Y”. Rename those that were written in this format.

Social Media

• Logout of all Social Media accounts you do not need;
• Logout of Social Media accounts from other collectives you are part of;
• Do the same with E-mail accounts;

Browser

• Delete the browser and internet history;

Lockdown

Purpose: creating more barriers to protect yourself / your device.

Cellphone

• Deactivate Biometrics (Face ID, Fingerprint …);
• Create a good password (8-12 numbers and letters);
• Uninstall applications you do not need during the action (you can reinstall them afterwards);
• Confirm if you have your files Encrypted (see how here);
• Update your phone (applications and operating system);
• Reboot (most mobile malware doesn’t survive a reboot);

Signal

• Follow our Signal Hardening article;

Emergency Situations

There are some scenarios where you should plan ahead what would you do. In times of stress (emergency) it is much harder to think thoroughly therefore you need to have specific protocols on what to do individually and collectively.

• What happens in case there is a raid/arrest?
  • How will you communicate this with other people?
  • What needs to happen while you are arrested (are there collective accounts that need their password changed (…)?
  • You should not use that phone anymore (especially if it was separated from you), how will you communicate with your comrades in the next months?
  • What will you do and how fast can you do it? (It is a good security policy to uninstall Signal and to shutdown your phone (or even Factory Reset it))
• How will you find spyware / what will you do in case of suspicion?
  • Do you have any alternative devices?
  • How could you warn your comrades to not message you?
  • Is there any support group that can help you? You might want to check out the Collectives page.

Application Alternatives

You can find more alternatives here.

Further Reading

• The guide to Peer-to-Peer, Encrypted and over Tor communication;
• Turn Off Your Phone! And other basic digital security strategies;

Collectives and other Projects

There are many support, infrastructure, training and funding collectives and organizations that either support or might support (depending on the context) Radical Activists and Organizations. Here are some of them.