Last week, I briefly introduced the term “operational security“. If using anti-malware software, installing security updates and keeping your data backed up are the “book smarts” of cyber security, operational security represents the “street smarts”. And as you can imagine, it’s hard to describe or teach street smarts in a direct fashion.
The most common scenario we think of is a laptop or phone getting stolen. Encryption is extremely helpful here. Sure, a thief may have your fancy new phone but at least they won’t be able to go through your photos and contacts. Clear win for encryption, right?
So what could go wrong?
Well, suppose you’re traveling to the People’s Republic of China. Having an encrypted device might get you stopped at the border. And you might be asked to decrypt the device for inspection. And if you refuse to comply, you might be denied entry. If you’re just a tourist, maybe this isn’t a big deal. You unlock your device, enjoy your vacation and go home.
But what if you’re a journalist heading to Beijing to interview a political dissident? Unlocking your device for the authorities could potentially have pretty grave consequences. But you also can’t not encrypt your device, right? So what do you do? Well, wait a second. Who says you need to bring your device?
Ok, well, it still sounds like on the whole, you’re better off encrypting than not encrypting and it’s still worth it to get that bulletproof protection for your personal data.
Except it’s not always bulletproof. For starters, all of that fancy encryption is usually unlocked by either a password (which tend to be bad), a pin (which tend to be bad) or a pattern (which tend to be bad). Thank goodness those new phones have fingerprint readers now.
So what could go wrong now?
Most devices with fingerprint readers tend to treat your fingerprint as a substitution for a password from a technical perspective, even if fingerprints are very different from an operational perspective. What kind of differences? Well, legal differences, for one. And while passwords, pins and pattern locks may not be strong, you can at least change them regularly. You can’t change your fingerprint. It’s a good thing your fingerprint can’t be stolen, right?
It’s important to not get too caught up in specifics, because the specifics change over time. Operational security is all about focusing on the bigger picture and to understand that bigger picture, you’ll need to ask yourself three questions:
- What are you trying to protect?
- Who are you trying to protect it from?
- What consequences am I prepared to assume if my security measures fail?
I’ll tackle each of these specifically over the coming week.
Days Gone Bye
On the topic of political dissidents, the Tor anonymizing network remains one of the best tools to use for protecting yourself from the prying eyes of oppressive regimes. Unfortunately, Tor is under attack. The US Government has conducted high profile busts of dark web sites that use Tor to stay hidden and it is alleged that the Russian Government is actively attempting to subvert the service as well.
The problems are many but the solutions are fairly straightforward, albeit difficult to implement in practice. Tor is a peer-to-peer network, so as in the case of the supposed Russian attack, a successful attack simply means being in control of enough peers. The way to help combat this is to grow the Tor network, which is exactly what the Electronic Frontier Foundation is trying to do. Recently, the Library Freedom Project has also popped up to drum up Tor support among public libraries.
Those efforts help to make the Tor network infrastructure more robust but the other side of the coin is to increase the actual legitimate use of Tor. While the amount of illegal activity occurring over Tor is typically exaggerated, the inescapable reality is that the qualities of Tor that enable truly important work can also be used to conduct criminal activity.
This Harvard student who was caught using Tor to send a bomb threat, based on the fact that he was the only person using Tor at the time when the bomb threat was made, is a very good illustration of the fundamental problem. If the only people using Tor are the ones who need anonymity, then Tor traffic becomes a red flag – whether you’re a criminal in a free society or a political dissident in a repressive one.
If you’re interested in learning more about the positive uses for Tor, here’s a good overview of the causes that Tor can enable. And if you’re looking to jump in a get your hands dirty, so to speak, here’s a good place to start.
And Another Thing
As you can imagine, there are folks out there who may try to exploit your interest in Tor. Like trying to sell you a half-baked product. Or trick you into installing something malicious. Or even end up as collateral damage.
Make sure that, at the very least, you only download the Tor Browser Bundle from the Tor Project’s website. And if you are in a situation where you need, rather than simply desire, anonymity, it is best to learn how to verify signatures as well.