How Do I Prepare My Phone for a Protest?
Simple steps to take before hitting the streets
https://themarkup.org/the-breakdown/2024/05/04/how-do-i-prepare-my-phone-for-a-protest-updated-2024Open linkView original on lemmy.zip322
Comments64https://themarkup.org/the-breakdown/2024/05/04/how-do-i-prepare-my-phone-for-a-protest-updated-2024Open linkView original on lemmy.zip
Leave it at home and, if you need a phone, take a burner that doesn’t have your personal data and isn’t logged into any of your accounts.
You also have better found a way to pay for the burner in cash or with a pre-paid debit card. A lot of places in the US won't let you buy a "burner phone" without a credit/debit card that has your name attached to it.
Treating phone numbers in contact list with username was a brilliant idea (for the spread of mobile messengers like Whatsapp) but also a very horrible idea (for user privacy and everything else). I can't just change a phone number for privacy. My acquaintances will gladly update them with my name, my old and new number, ready for Zucc to scoop them up in a fucking silver plate.
Is there an answer to this? I have a billion contacts from work (vendors, coworkers, etc) and my personal life. I don’t use any social media other than this and Discord (I know, I know) so I don’t think anyone other than Apple and Google have them. I’d like to stop feeding all of this into the machine but I can’t think of any good alternatives off the top of my head besides carrying around a physical book of phone numbers with me, and that’s not really a solution that works for me.
There's a difference between "none of my personal shit on it" and a full on ghost phone.
The first is worth doing.
If you get arrested, they are GOING to identify you before you leave detention. Being fully ghosted and keeping your mouth shut will just keep you in detention at minimum for the hours allowed to them, and if they can pin you with some fake crime, even longer. If arrested, you will not escape them without some level of identification.
Walmart lets you. At least as of October. The only rule was the amount of phones.
Wut? The US is like one of the easiest places to buy anonymous mobile phones and plans.
Usually what you do in this situation is go to the tourist hot spot and find a mobile shop pretending to be a tourist without a drivers license. Usually within a few days you'll find someone who will use their info and sell you a Sim card.
What about buying second hand?
Leave it at home.
While leaving it behind is best for privacy, the article touches on some reasons people bring them anyway
Layer one: "front line": folks should be acting on passive listen/pushed information from folks far back that will not get kettled or trapped. Media they collect should be Livestreamed for safe storage... But they should be focused on non violent protest, emit the protest message and find/eject bad actors. Equipment should be "burner" quality, wiped and purpose setup with the expectation of seizure.
Layer 2: "observe, document, report": folks should be using encrypted apps to communicate, and should intend to not be arrested, and to collect as much quality content as possible. These folks should be ready to be arrested, but avoid as possible.
Layer 3: "coordinate": these folks should be digesting all possible data about risks, police activity, lawful orders, movements, etc. They should be feeding information about proper actions. They should use encrypted tools but plan to avoid arrest.
This is all hypothetical.
Just leave your phone at home, and bring a Digital camera, and few SD Cards ... Oh, wait.. < insert company name here > makes Cameras that spy on you... nevermind...
maybe we should hire a fast sketching artist to draw police brutality ... What.!... your pencil can track you now... come...ooooonnn
No, its better to have a smart device that syncs photos to your encrypted cloud in case you're attacked and your attacker breaks your SD card to destroy the evidence
Burner phone to anything that requires communication. Erase metadata of anything that will be shared and uploaded online.
Burner phones are a strange concept. If you want to store sensitive data on it, you shouldnt use some cheap android phone or even a dumbphone without encryption support.
All Androids since 9 at least have been encrypted by default as long as you have a lock screen enabled. Doesn't matter if its cheap, it is there.
All Android phones have Google malware installed by default, as system apps, which means those apps can do whatever they want.
So every piece of data you put on there is possibly tracked and collected.
Then there are 2 more problems
This makes it vulnerable to Pegasus attacks and others. There are tons of secure practices to avoid getting it, like LTE-only, HTTPS only, encrypted and trustworthy DNS, sandboxed processes, blocked javascript execution from unknown websites...
But still if the phone is outdated there are unpatched and publicly known security issues. Just spamming them at all phones is likely to succeed as so many people run vulnerable versions, as vendors suck.
Then if you have pegasus, the only way for security is to reflash the A/B partitions, both. Factory reset is not secure as it will keep what is already in the system partitions.
The firmware is protected and signed by the vendors, so it is likely clean.
But Pegasus installs itself to the phone storage.
If you A cant obtain factory images or B cant flash the phone at all, you cannot wipe it clean.
So a good activism phone needs
This makes them poorly pretty expensive. I think a slightly outdated GrapheneOS phone is okay though.
Then get a burner pixel 3a and install grapheneOS or DivestOS
I think 3a is already too old. I think 4a is a better minimum, but this is still insecure of course.
https://divestos.org/pages/devices#device-sargo
Phones are tracking devices. Do not bring your phone, not even turned off because many phones emit Bluetooth beacons and other data that can be recorded and traced.
If you bring a phone, make sure that phone has no idea who you are.
Even if the phone doesn't know who you are, the shop that sold you the phone or the SIM, or the credit card company you paid with, can know who you are. So you'd have to use cash. Even without these, your movements can be tracked through a burner phone and informed guesses made about who you are (e.g. if the phone has been at your home or with your friends).
Turning off your phone doesn't necessarily protect you from tracking either:
https://www.androidauthority.com/android-15-powered-off-api-pixel-9-track-switched-off-3425472/
Easiest, as others say, just not to carry a phone.
In some places, you cant buy a burner with cash, but you could with a gift card that was registered with cash or a prepaid debit.
I would also recommend buying a faraday bag to keep it isolated.
Edit: keep that in the faraday bag untill you need it.
If everyone followed this advice, we wouldn't have footage of abuse at protests..
Mostly true. I will not deny there are benefits to bringing your phone. They are also substantial risks. Protesting can be risky business.
That's a bunch of bull, off is still off unless you have a reputable link/source that says otherwise.
No need to spread misinformation or conspiracy theories.
Here you go:
https://9to5mac.com/2021/06/07/ios-15-find-my-network-can-find-your-iphone-when-it-is-powered-off/
And here:
https://www.androidauthority.com/google-pixel-8-android-15-powered-off-finding-features-3425709/
And there's a few more about offline beacons about if you want.
Ok I stand partially corrected, it's something that's coming but is not rolled out yet and looks like it'll need the latest phones so everything slightly older is still fine
It is actively rolled out right now all the way back to iPhone 11 (2019) while the device is powered off. Version 16 is current, and the power "off" tracking was backported to older devices.
Android support is spottier. We've had powered off features one OnePlus for some time, such as the ability to trigger alarms while turned off, but more advanced features like location tracking are much more recent to Android because it usually requires specific hardware support to operate while using almost no battery. Apple has the privilege of vertical integration, so they were able to update older firmware.
I think this trend is very concerning, because with no user-servicable battery, we're essentially forced into having our phones on to some degree at all times.
You're right that this doesn't affect all devices. I'm not sure if its only a software thing or if its baked into hardware.
Eg I'd I buy some new device with this and install CalyxOS, does it still leave Bluetooth on when the device is off?
Never underestimate how far they will go to track your movements, habits, etc. It's not even about "the gubment spyin' on me". It's about how valuable that data is to corporate assholes who like to target you with customized advertising, and resell your data, etc. (And yes, as a side-effect, the police can also sometimes take advantage of this ubiquitous data capture).
We live in a time when even our stupid cars spy on us:
https://www.nytimes.com/2024/03/18/podcasts/the-daily/car-gm-insurance-spying.html
It's why they push the internet of shit so hard. Nobody needs a "smart fridge" but by god, they really want us all to have one.
Well, its about both.
The drones with IMSI catchers flying over BLM protests are not for corporate gain.
Pretty good stuff.
However I read many reactions : "don't take your phone with you" This is a common issue in a lot of activist place to don't ask ourselves why people are acting like this ? before telling them to stop. They may have good reasons, and in a case of protests, there is.
Filming the cops : I don't know in the US, but in a lot of countries, cops are less violent when they know someone is filming them. This may help people harmed by the police, in giving them evidence, or helping mobilization in the futur. After mass arrestation, it could be hard to know how as been arrested or not; some legal support hotline ask this kind of evidence for this reasons. Of course this some sensitive material, and need to be secured too. For example, the cops may target you if you are filming them.
Calling the legal support hotline : Some of them ask to be called just after arrestation or cops actions, to make a precise report. You could call them when someone you know have been attacked or kidnapped by the police.
Call medial support : I don't know how the emergency number is linked with the repressive force in the US, but in a lot of country, it's not. Even if it's rare, it could be a vital issue.
All this actions are important and individuals should compare the risks they take in taking them and what we lost in not acting like that. Of course this risks have to be documented; with flyers at the start of a protests for example.
I would recommend to mutualise actions to decentralize risks. Make a team with one or two people with burned phone and dedicated camera (paid by everyone); let your other phones at home. Stay (at least) by pair, and keep in eye someone with a phone.
They may be better plan of actions, but we couldn't just let down cop watch ant street medic just for the illusion of individual safety. Such thing simply do not exist
Don't take it with you, or have a faraday bag and only take it put when you're done
I'm waiting for the first mass protest that utilizes Lora communications
Come on noobs, get with the times!
Here is an alternative Piped link(s):
Lora communications
Piped is a privacy-respecting open-source alternative frontend to YouTube.
I'm open-source; check me out at GitHub.
Got a link to an article?
You can take a look at the meshtastic project - https//www.meshtastic.org - people have made some pretty wild solutions, it's pretty cheap to build too.
It's like $20 for cheap devices that talk to your phone via bluetooth. They have standalone devices too to fix that potential vulnerability.
I'm messing around with a few rn. Heltec V3s and TBeam Supremes.
I've got an order pending while I decide which setup I want to play with first - but I have a feeling I'm just going to go with one portable and one to leave in the office, and go from there.
Regardless of it's potential use for protests, it's a fun project!
My only concern is if they start employing frequency jamming since LoRa is in a very specific band which won’t impede much other uses when jammed.
LTE/5G bands have much more potential impacts if attempting to jam that band.
The funny bit is that the example from the video requires a companion device in order to actually have something to send, since it doesn't have a keyboard or microphone, and the natural companion device for that in a mobile situation would be ... an Android or iPhone.
That said, it would also work paired with a tablet and maybe it can just be paired with a bluetooth keyboard (the hardware in it - specifically the ESP32 - has bluetooth support built-in, so it depends on the software)
Mind you, this is only a limitation from this specific implementation (which is basically a gadget for electronics hobbyists hence no built-in keyboard), not from the LoRa stuff itself.
Anything with Bluetooth is a ID vector.
And since Apple AirTag tech is a thing there are other ID capabilities.
Maybe a Faraday bag to cut all radio.
imagine not being a gigachad bringing your nintendo 3ds, that actually has a physical switch to disable wireless communication and can record videos and take pictures
that totally don't look like they're from 2011I wouldn't even bring my phone, or if I absolutely needed something like that, I'd buy a cheapass pre-paid burner. And keep it off until you actually need it.
Signal & WhatsApp are not secure enough. Meta/Facebook regularly give data & metatadata to the cops & Signal is centralized & not self-hosted by your crew so while messages are encrypted, the metadata still isn’t. If you must use Signal, I would pick Molly as an Android client since you can a) encrypt the messages under a separate password for storage on seizure & b) you can use the UnifiedPush version to make sure your notification metadata isn’t going thru Google’s Firebase servers. Protests are the ideal place for Briar as it is works via mesh net so internet & SIM cards are not required (but years ago wden I tried it, the app was a major battery drainer).
Also worth noting that OpenStreetMaps works offline too.
That doesn't quite work in the case of Signal
The only data that they have, based on transparency reports and dissections of their source code, is the time you created your account and last connected to the servers.
Messages themselves are essentially only relayed, with sealed sender, and anything that would be actually useful to identify who was at a protest and who wasn't encrypted.
Things like, e.g when messages arrive at the server would have to be monitored live on compromised servers, which reasonably unless you assume* it is wiretapped already prior to a protest, isn't realistic.
*: of course, I am saying this because making an assumption and portraying it as truth (e.g assuming something is already wiretapped based on no evidence at all) is not the smartest of moves when it comes to threat modeling...especially if you wanna stay sane whilst having a threat model
With the right intel you could piece back some of the pieces, especially with some pieces from other sources, with just that metadata. With metadata, it’s about putting together lots of sources to see the picture clearly which is why Facebook bought WhatsApp for just the metadata (& address book). The thing is that you, can skip Signal & you will still have several free software messaging alternativ where nothing is on a US-based server where they can subpoena.
But that'd already entail control over the whole Signal AWS in- and egress as well as any VPN you may be using and/or your local ISP. And then you still have to prove the actual link to the natural person. At that point we're speaking of a threat level assuming the US DoD as adversary. While not impossible, I think if you're willing to pick that kind of fight, you're clever enough not to rely on Signal (or most digital communication).
Signal is not WhatsApp, there aren't a lot of data points linking your communications to end points in the same way Meta does link them.
Not saying you are wrong, but I think the argument a) should mention WhatsApp in the same breath as Signal & b) stopping at Signal instead of linking to where to find more info
You are absolutely right about metadata, but as far as protests, just having encryption is enough to prevent anyone from accessing the data. Extracting metadata from 3rd party companies or extracting a phone requires a lot more resources than cops can spare.
In the corpo cases, I’m sure all they have to do is ask. There are better alternatives & this guide feels radically incomplete stopping at such pedestrian option instead of labeling them in a bottom tier of like suffiecent-if-you-literally-can’t-use-anything-else.
If your problem with signal is that it isn’t self-hosted, just self-host it? It’s all open source.
Those components are not really meant for self-hosting, its open to be looked at. You would need to patch out the SIM requirement, point the hardcoded server/clients elsewhere, find some way to sideload modified clients to those using iOS lol, & it’s not federated so you would need a separate app for just this task. At this rate you are 100% better off using a choosing systems where server & clients are actually built with this in mind… Signal’s chat features are not novel
Calyx OS on a Pixel
On a secondhand or wiped burner Pixel too. The Crowbar CVE can’t be patched by an OS.
I can't seem to find any CVE called crowbar in regards to Android. Only one for PHP and one for SUSE.
Would you mind giving more info to help me find out more?
Its a tongue in cheek CVE. Crowbar is literally a crowbar. Like.. beat the password or device access from you.
Oh. That went straight over my head. 🤦
Thanks.
No problem 😄
Not so difficult to sync yor photos or movies with an Cloud server