Risk
6/12/2013
12:59 PM
Connect Directly
RSS
E-Mail
50%
50%

7 Tips To Avoid NSA Digital Dragnet

These apps will keep your cell phone calls under wraps -- if the NSA hasn't already found a way to break them.

The Syrian Electronic Army: 9 Things We Know
(click image for larger view)
The Syrian Electronic Army: 9 Things We Know
Is it possible to avoid the National Security Agency's digital dragnet?

Thanks to NSA contractor Edward Snowden, leaked documents published last week revealed that the agency has captured the metadata -- numbers called, call duration, approximate geographical location -- for millions of U.S. phone subscribers. Under U.S. law, the agency is only allowed to spy on foreigners. But the system that's been revealed appears to capture data on everyone, then rely on search algorithms to prevent information being retrieved on anyone who seems to be a U.S. citizen.

But what if you object to the blanket capture of U.S. cell subscribers' metadata information, or simply don't trust the NSA? Is it possible to avoid having information captured as part of the phone-tapping program, or via the surveillance program known as Prism that captures audio, email and video communications made by using such well-known services as Gmail, Facebook, Hotmail, Skype and Yahoo?

Earlier this week, The Washington Post detailed five strategies for preventing communications from being intercepted, including browsing using Tor and using Silent Circle to make phone calls. To what extent will these approaches easily secure your communications, and what other possibilities are available?

[ Cell phone calls are just one way U.S. citizens are monitored. Read What's Next In Video Surveillance. ]

In fact, many of the approaches trade increased information security for decreased usability. Then again, for some people, the tradeoff might be worth it. Here's what's available:

1. Tor, For Anonymous Browsing.

Using the Tor anonymous network helps prevent your traffic from being intercepted, thus foiling anyone who's attempting to identify which websites you're visiting, or people with whom you're communicating. In fact, Snowden, a former CIA employee and NSA contractor, was photographed with a Tor sticker.

Tor, which is free to use, uses an encrypted network to route your browsing. Using it for anonymous browsing is as easy as downloading the Tor Browser Bundle, which is a version of Firefox for Windows, Mac OS X and Linux. But that encrypted, anonymous network comes at a price: slower browsing.

Furthermore, Tor isn't foolproof. The 2011 attacks against Dutch certificate authority DigiNotar, for example, resulted in the creation of fraudulent digital certificates for Facebook, Google, Skype, as well as Tor, apparently for the purpose of spying on Iranian Internet users. Likewise, researchers occasionally identify vulnerabilities in the service that can be exploited to identify users.

2. An OTR App, For Encrypted Chat.

Snowden communicated with Glenn Greenwald, the Guardian journalist who published some of the documents he leaked, using an unnamed OTR -- for "off the record" -- chat messaging program or plug-in.

For many people who want anonymous communications, the ease of using OTR applications, which enable chat sessions to be encrypted between two people using compatible clients or plug-ins for their chat service, makes it a natural choice. Furthermore, numerous free clients exist, including Cryptocat, Adium for Mac OS X and IM+ for Android and iPhone.

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Mathew
50%
50%
Mathew,
User Rank: Apprentice
6/14/2013 | 8:48:02 AM
re: 7 Tips To Avoid NSA Digital Dragnet
More good advice (besides VPN): "Figure out what you are trying to protect (and from whom), separate it from everything else, and then select tools, techniques and procedures that will enable you to protect it."
http://grugq.github.io/blog/20...
Mathew
50%
50%
Mathew,
User Rank: Apprentice
6/14/2013 | 8:46:33 AM
re: 7 Tips To Avoid NSA Digital Dragnet
I don't know, but you'd imagine they'd have taken care of landlines ages ago.
HildyJ
50%
50%
HildyJ,
User Rank: Apprentice
6/13/2013 | 3:46:01 PM
re: 7 Tips To Avoid NSA Digital Dragnet
If you are truly concerned, buy a prepaid phone that can be refilled with cards available at a grocery store. Use cash. Then keep the battery out and don't use it from your home or office. Add this to the Information Week tips and you should be reasonably safe.

Broad surveillance like the NSA's is best at catching stupid people. The kind that would email an al-Qaeda website and ask how to join.
Terabyte Net
50%
50%
Terabyte Net,
User Rank: Apprentice
6/13/2013 | 12:35:39 PM
re: 7 Tips To Avoid NSA Digital Dragnet
Taking the battery out is nice but some of the most popular phones do not allow that any more, say iPhone, Razr, etc... Wonder if Apple and Motorola are working with the Feds on phone design? Just sayin'...
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6335
Published: 2014-08-26
The Backup-Archive client in IBM Tivoli Storage Manager (TSM) for Space Management 5.x and 6.x before 6.2.5.3, 6.3.x before 6.3.2, 6.4.x before 6.4.2, and 7.1.x before 7.1.0.3 on Linux and AIX, and 5.x and 6.x before 6.1.5.6 on Solaris and HP-UX, does not preserve file permissions across backup and ...

CVE-2014-0480
Published: 2014-08-26
The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not properly validate URLs, which allows remote attackers to conduct phishing attacks via a // (slash slash) in a URL, which triggers a scheme-relative URL ...

CVE-2014-0481
Published: 2014-08-26
The default configuration for the file upload handling system in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 uses a sequential file name generation process when a file with a conflicting name is uploaded, which allows remote attackers to cause a d...

CVE-2014-0482
Published: 2014-08-26
The contrib.auth.middleware.RemoteUserMiddleware middleware in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3, when using the contrib.auth.backends.RemoteUserBackend backend, allows remote authenticated users to hijack web sessions via vectors relate...

CVE-2014-0483
Published: 2014-08-26
The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a to_field ...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
This episode of Dark Reading Radio looks at infosec security from the big enterprise POV with interviews featuring Ron Plesco, Cyber Investigations, Intelligence & Analytics at KPMG; and Chris Inglis & Chris Bell of Securonix.