- cross-posted to:
- brainworms@lemm.ee
- cross-posted to:
- brainworms@lemm.ee
Simple steps to take before hitting the streets
You must log in or # to comment.
Leave it at home and, if you need a phone, take a burner that doesn’t have your personal data and isn’t logged into any of your accounts.
You also have better found a way to pay for the burner in cash or with a pre-paid debit card. A lot of places in the US won’t let you buy a “burner phone” without a credit/debit card that has your name attached to it.
Wut? The US is like one of the easiest places to buy anonymous mobile phones and plans.
Seriously. In Australia, you have to “activate” your Sim card with your full name, email, bank details (depending on the carrier), and a copy of your driver’s license. Hell, I bought my last phone directly from a carrier, completely outright, with cash, prepaid with no plan, and they took a photocopy of my drivers license. Buying phones elsewhere they’ve never done that to me, as long as it’s prepaid and bought outright, but for some reason the major telcos do it for all purchases
Usually what you do in this situation is go to the tourist hot spot and find a mobile shop pretending to be a tourist without a drivers license. Usually within a few days you’ll find someone who will use their info and sell you a Sim card.
While leaving it behind is best for privacy, the article touches on some reasons people bring them anyway
Leaving your phone behind means the data it holds and transmits will be the safest it will ever be, but it also means giving up access to important resources. It becomes much more difficult to coordinate with others, or get updates from social media. For many, phone cameras are also the only way they can document what’s happening.
If you have access to a separate phone, whether it’s a “burner” phone, an old smartphone that you can reset, or an old-fashioned camera, you could choose to bring these devices instead of your regularly-used phone. However, not everyone has access to these devices, or can afford to purchase a separate phone just for protesting.
Leave it at home.
Don’t take it with you, or have a faraday bag and only take it put when you’re done
Just leave your phone at home, and bring a Digital camera, and few SD Cards … Oh, wait… < insert company name here > makes Cameras that spy on you… nevermind…
maybe we should hire a fast sketching artist to draw police brutality … What.!.. your pencil can track you now… come…ooooonnn
No, its better to have a smart device that syncs photos to your encrypted cloud in case you’re attacked and your attacker breaks your SD card to destroy the evidence
Burner phone to anything that requires communication. Erase metadata of anything that will be shared and uploaded online.
Burner phones are a strange concept. If you want to store sensitive data on it, you shouldnt use some cheap android phone or even a dumbphone without encryption support.
All Androids since 9 at least have been encrypted by default as long as you have a lock screen enabled. Doesn’t matter if its cheap, it is there.
All Android phones have Google malware installed by default, as system apps, which means those apps can do whatever they want.
So every piece of data you put on there is possibly tracked and collected.
Then there are 2 more problems
- the software is proprietary and cannot be externally wiped clean
- the software is outdated
This makes it vulnerable to Pegasus attacks and others. There are tons of secure practices to avoid getting it, like LTE-only, HTTPS only, encrypted and trustworthy DNS, sandboxed processes, blocked javascript execution from unknown websites…
But still if the phone is outdated there are unpatched and publicly known security issues. Just spamming them at all phones is likely to succeed as so many people run vulnerable versions, as vendors suck.
Then if you have pegasus, the only way for security is to reflash the A/B partitions, both. Factory reset is not secure as it will keep what is already in the system partitions.
The firmware is protected and signed by the vendors, so it is likely clean.
But Pegasus installs itself to the phone storage.
If you A cant obtain factory images or B cant flash the phone at all, you cannot wipe it clean.
So a good activism phone needs
- trustworthy and minimal system apps / stock software
- modern software updates
- possible to reflash whole device externally
- nice to have: ability to verify checksum of system partition, like GrapheneOS Attestation
This makes them poorly pretty expensive. I think a slightly outdated GrapheneOS phone is okay though.
Most of that is solved by installing a ROM that’s not user hostile, keeping it updated of course, and using the phone strictly as a purpose specific device.
That means you run a trusted VPN on it so HTTP/S and DNS concerns go out the window.
Sandboxed processes, blocked JS? Fine if you only install what’s necessary and don’t use the web browser. JS blocking is not a huge hurdle though, ublock does it with just 2 clicks.Then if you have pegasus, the only way for security is to reflash the A/B partitions, both. Factory reset is not secure as it will keep what is already in the system partitions.
That’s right but I don’t think that this is enough. If the Pegasus malware (package) really is able to do that many things, it’s a walk in the park for it to modify any of the partitions, including that which contains the modem, or just data like the modem’s IMEI and MAC addresses.
In the cause I would either restore a backup of all partitions, or throw the phone away (not literally).The firmware is protected and signed by the vendors, so it is likely clean.
Except if they patched the verification mechanisms of the OS.
Also, the firmware may be protected, but what about data partitions which are read by vulnerable software.This makes them poorly pretty expensive. I think a slightly outdated GrapheneOS phone is okay though.
Are you sure? My 6 years old phone still receives LOS updates
Then get a burner pixel 3a and install grapheneOS or DivestOS
I think 3a is already too old. I think 4a is a better minimum, but this is still insecure of course.
The point is not cheapness but that you don’t care about the future of that phone. It’s only a tool for the protest, if it lasts longer that’s good but you expect it to get confiscated and never given back, you don’t care what cops did with it if you get it back, it does not have data you need in your daily life or anything irreplaceable, and you’re not really afraid that it gets destroyed by accident or maliciously.
Phones are tracking devices. Do not bring your phone, not even turned off because many phones emit Bluetooth beacons and other data that can be recorded and traced.
If you bring a phone, make sure that phone has no idea who you are.
If everyone followed this advice, we wouldn’t have footage of abuse at protests…
not even turned off because many phones emit Bluetooth beacons and other data that can be recorded and traced
That’s a bunch of bull, off is still off unless you have a reputable link/source that says otherwise.
No need to spread misinformation or conspiracy theories.
Never underestimate how far they will go to track your movements, habits, etc. It’s not even about “the gubment spyin’ on me”. It’s about how valuable that data is to corporate assholes who like to target you with customized advertising, and resell your data, etc. (And yes, as a side-effect, the police can also sometimes take advantage of this ubiquitous data capture).
We live in a time when even our stupid cars spy on us:
https://www.nytimes.com/2024/03/18/podcasts/the-daily/car-gm-insurance-spying.html
It’s why they push the internet of shit so hard. Nobody needs a “smart fridge” but by god, they really want us all to have one.
Well, its about both.
The drones with IMSI catchers flying over BLM protests are not for corporate gain.
Here you go:
https://9to5mac.com/2021/06/07/ios-15-find-my-network-can-find-your-iphone-when-it-is-powered-off/
And here:
https://www.androidauthority.com/google-pixel-8-android-15-powered-off-finding-features-3425709/
And there’s a few more about offline beacons about if you want.
Ok I stand partially corrected, it’s something that’s coming but is not rolled out yet and looks like it’ll need the latest phones so everything slightly older is still fine
It is actively rolled out right now all the way back to iPhone 11 (2019) while the device is powered off. Version 16 is current, and the power “off” tracking was backported to older devices.
Android support is spottier. We’ve had powered off features one OnePlus for some time, such as the ability to trigger alarms while turned off, but more advanced features like location tracking are much more recent to Android because it usually requires specific hardware support to operate while using almost no battery. Apple has the privilege of vertical integration, so they were able to update older firmware.
I think this trend is very concerning, because with no user-servicable battery, we’re essentially forced into having our phones on to some degree at all times.
I’m waiting for the first mass protest that utilizes Lora communications
Come on noobs, get with the times!
I wrote it many years ago. https://lemmy.ml/post/34220
Edit: who had the audacity to downvote a guide for activists here?
Layer one: “front line”: folks should be acting on passive listen/pushed information from folks far back that will not get kettled or trapped. Media they collect should be Livestreamed for safe storage… But they should be focused on non violent protest, emit the protest message and find/eject bad actors. Equipment should be “burner” quality, wiped and purpose setup with the expectation of seizure.
Layer 2: “observe, document, report”: folks should be using encrypted apps to communicate, and should intend to not be arrested, and to collect as much quality content as possible. These folks should be ready to be arrested, but avoid as possible.
Layer 3: “coordinate”: these folks should be digesting all possible data about risks, police activity, lawful orders, movements, etc. They should be feeding information about proper actions. They should use encrypted tools but plan to avoid arrest.
This is all hypothetical.
Pretty good stuff.
However I read many reactions : “don’t take your phone with you” This is a common issue in a lot of activist place to don’t ask ourselves why people are acting like this ? before telling them to stop. They may have good reasons, and in a case of protests, there is.
-
Filming the cops : I don’t know in the US, but in a lot of countries, cops are less violent when they know someone is filming them. This may help people harmed by the police, in giving them evidence, or helping mobilization in the futur. After mass arrestation, it could be hard to know how as been arrested or not; some legal support hotline ask this kind of evidence for this reasons. Of course this some sensitive material, and need to be secured too. For example, the cops may target you if you are filming them.
-
Calling the legal support hotline : Some of them ask to be called just after arrestation or cops actions, to make a precise report. You could call them when someone you know have been attacked or kidnapped by the police.
-
Call medial support : I don’t know how the emergency number is linked with the repressive force in the US, but in a lot of country, it’s not. Even if it’s rare, it could be a vital issue.
All this actions are important and individuals should compare the risks they take in taking them and what we lost in not acting like that. Of course this risks have to be documented; with flyers at the start of a protests for example.
I would recommend to mutualise actions to decentralize risks. Make a team with one or two people with burned phone and dedicated camera (paid by everyone); let your other phones at home. Stay (at least) by pair, and keep in eye someone with a phone.
They may be better plan of actions, but we couldn’t just let down cop watch ant street medic just for the illusion of individual safety. Such thing simply do not exist
-
Calyx OS on a Pixel
On a secondhand or wiped burner Pixel too. The Crowbar CVE can’t be patched by an OS.
I can’t seem to find any CVE called crowbar in regards to Android. Only one for PHP and one for SUSE.
Would you mind giving more info to help me find out more?Its a tongue in cheek CVE. Crowbar is literally a crowbar. Like… beat the password or device access from you.
Oh. That went straight over my head. 🤦
Thanks.No problem 😄
