Software to Support Human Rights
An anonymous reader writes "Some software rollouts have lives hanging in the balance. Human rights workers in massacre zones from El Salvador to Kosovo face prying eyes peering into their address books and logs, who follow up with bullets and poison gas. One project, Martus, takes these hostile environments into account: a leak can get whole families killed. They use encryption, distributed backup, and other techniques designed to survive the ultimate corrosive environment: vindictive armies in countrysides in the throes of war. The source code is open, to allow meaningful contributions from anyone willing to help. These people bet their lives on open source and private data. The sponsor organization, Benetech in Silicon Valley, funds projects that arm global rights workers, and people under siege, with communications tools that counterbalance the overwhelming force used to exterminate everything "Free"."
Also vim helps human rights... "Uganda licence" is a good idea to make OS Software even more useful...
And soon enough even the possession of these kinds of tools will be enough to put people in jail. After all, they were probably using them to swap MP3s or kiddie-pr0n or even plan terrorist acts.
Strong crypto is only a part of the answer (whatever that answer may be).
Xix.
"Everything is adjustable, provided you have the right tools"
You didn't snip enough to tell folks the REAL power of Rubberhose.
It is possible to create encrypted containers 'embedded' in other ecrypted containers (Matryoshka-doll fashion), each protected with a password. So when the 'thugs' come knocking, you can give them a password which will unlock the outer container, without compromising the inner ones (which, obviously, aren't visible- you have to KNOW they exist).
Of course, the thugs already know about this software, so you can repeat the above process- give them three passwords and then say "that's all there is"- they can't prove otherwise.
Let's be pragmatic, though- this is only going to work if you believe the thugs would let you go if they couldn't prove anything. Otherwise, it's simpler to use gpg and a cyanide pill.
Yes they can get the key out of you ('rubber hose cryptanalysis') but there are some systems where you can have several keys and each key reveals different data - so you could disclose a key which gives a dummy, fairly uninformative address book. Then there is no way to show that extra data is hidden unless you have the extra keys. This means that when you say 'I have told you everything I know' there is no way to verify that claim. This has both good and bad points.
Disguising the data in something else like a minidisk recorder is a good idea but obviously not everyone can do that - each person must choose a different kind of disguise, so it gets tricky.
-- Ed Avis ed@membled.com