Slashdot Mirror
Ask Slashdot: Securing a Journalist's Laptop Against a Police Search?
Bruce66423 writes: In the light of the British police's seizure of a BBC laptop what is the right configuration and practices to ensure that such a seizure provides zero information to the cops? This post from Thursday might be a good place for some ideas, but that one's expressly about securing a Chromebook; what would you advise for securing a more conventional laptop? (Or desktop, for that matter.)
Shred it...
“He’s not deformed, he’s just drunk!”
Don't store your information on the laptop in the first place. Just use it as an editing and remote-access tool over a secure connection or to a USB stick you don't expose to search procedures.
That's about the best you can do, short of memorizing everything.
Encrypt the laptop, and you could lose it. Just let them search it top to bottom, then when they're done and you're wherever you're going, wipe the hard drive, reinstall your OS, and carry on.
It's really not a great idea to carry information you need to be secure around with you.
I've fallen off your lawn, and I can't get up.
https://xkcd.com/538/
Easy: Store nothing sensitive anywhere on the laptop. Make sure all browsing history/data is wiped before the laptop is every put to sleep/hibernate.
Whatever kind of encryption you use should have the ability to use alternative passwords - an unlimited number of them. So enter password (A) reveals your tax records, password (B) gets pictures of naked 30 year old men. But enter password (C) and you get clear pictures of Mr. Cameron violating a dead pig. When they demand your password, give them password A. If they get all torture-ish you give them password B.
excitingthingstodo.blogspot.com
Unlike common criminals, try cooperating with the police. You'll be better off in the end for it generally.
What if the police have become criminals themselves?
Pick up that can.
Best bet is simply not to have anything for them to find. Store your data on a thumb drive (that you'll carry or ship separately) or upload it to your own server or a service like Google Drive or Dropbox, encrypting it or not first, all depending on how sensitive the information is. Delete it or secure-wipe it or wipe the whole drive and do a complete factory restore on your laptop depending on how invasive you think the search might be. Then let the cops search all they want, they won't find what isn't there.
NB: Linux makes a better platform for this than Windows. On Windows bits of your files can end up in the oddest places to be found during a scan of the drive. On Linux it's easy to set up a separate partition where all your data will go and be certain it didn't leave traces anywhere else, and that partition can be secure-wiped and reformatted without messing up the OS installation in the process. Plus the cops are less likely to be familiar with Linux, and you can play the dumb-non-techie card of "I dunno, it's whatever the guys in IT put on it. I just follow the instructions to run my programs and everything works.".
https://www.youtube.com/watch?... http://www.kirkpiccione.com/10...
Comment removed based on user account deletion
> Unlike common criminals, try cooperating with the police. You'll be better off in the end for it generally.
Sigh... Dont Talk to Police
In the British Police-State, that is not possible, unless the journalist is willing to go to prison for failing to disclose an encryption password. Forget about "plausible deniability", that is for kids and morons. It does not work in practice.
The time to protect essential freedoms in Britain is past, and the battle (pathetic though as it has been) is lost. Anybody now trying to protect itself will just be classified as a "terror supporter" and that is it. Expect concentration camps to be opened soon.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
That one is true even in budding fascism as the British now clearly have.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Unlike common criminals, try cooperating with the police. You'll be better off in the end for it generally.
Yeah, in this case I'd have to agree with you. According to the article, the police went to a judge and obtained a court order to get the information - so if you don't provide it, be prepared to sit in a jail cell until you change your mind.
I do think these laws are overreaching and need to be rewritten (and rescinded in some cases) - but the police were following the letter of the law here.
#DeleteChrome
That's very bad advice sometimes, when it is. You're advocating 4th amendment roullette. Moronic.
It's an unfortunate sign of the times, but I've read far too many articles about people being arrested and jailed for unknowingly violating the technicalities of various different laws.. consenting partners under 18 being jailed as sex offenders and being listed for life, insulting heads of state or reporting on human rights abuses, jailed for having cartoon porn / weird tentacle thing stuff from Japan that still gets branded as child pornography, or even for whistle-blowing. And particularly for America, reading in recent times, the attitude of border agents that they're outside the law and no-one has any constitutional rights.. frankly, if you are a journalist reporting about things your government (either American or elsewhere) are doing, you'd be a fool not to have everything strongly encrypted, and give them the leisure to browse through your stuff to find something to charge you with.
On your Laptop there is a normal Windows installation which is not used for work. Only for stuff like browsing the web in the evening at the hotel. mails to the kids, etc.
On a USB stick on the keychain there is a copy of Tails https://tails.boum.org/index.e...
You rent some VPS or root server in a country of your choice, under a different name, preferably paid via cash. This is the place where all the data for work is stored. encrypted.
This server you only access via Tails which uses Tor by default.
If you can't do this, you put an encrypted VM onto your Laptop which happens to have the data for work and you write your stuff or access the web for work related research only in this VM. Again using a distro like Tails.
I agree. Those damn blacks in the 60s should've just kept themselves out of white facilities like the police told them to do. How dare they fight against injustice.
What do you mean, 'budding' fascism?
Have you forgotten in the late 1930's the UK had the largest Nazi party outside of Germany?
And it's leader was a member of the royal family.
Yes I know there is a small difference between Nazism and Fascism.
"The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
If I'm not a common criminal why should I put up with being treated like one? Not all of us love choking down authoritarian cock like yourself.
Don't store anything on the laptop. The fact they can legally compel you to provide the means of data access means you are in trouble in every case which they have possession of both you and your laptop. You can either do a really good job of hiding the data or you can keep it outside of where they can get it. How about a remote server a trusted person can deactivate if they hear about your situation?
When things get complex, multiply by the complex conjugate.
Don't have a drive in it. Don't have bits that they can claim to find suspicious. No excuses, because even (or perhaps especially) if they don't find anything on your laptop they'll confiscate it anyway to have the boys back at the shop take it apart ten ways from Sunday.
When you arrive, buy a new drive and load it up. How? Well, if you're visiting a field (or home) office, they'll have a disk image handy for you to use. If there are private bits that you haven't shipped over yet (SRSLY? They travel faster than you do, after all) then you can take them along. The border peeps aren't interested in doing cavity searches on everyone, after all, and short of shredding all of your clothing as well as the rubber-glove treatment they're not likely to find a micro-SD.
Lacking <sarcasm> tags,
So for one, securing it won't do much, everyone loves to coerce passwords and harass the hell out of you. The best way is to hide the data in such a way a forensics utility won't catch things and it will take a significant amount of effort to find the data, and if they do, it's very difficult to determine who's culpable.
1: Switch the label of the hdd with one of a similar model but lower capacity, then use a data hiding utility to store data in a hidden boot partition. A Sector scan might pick up on the data but only if it's not encyrpted; if you encrypt it, then it's practically impossible to find as the data is indiscernible from junk (given you fill the drive up with data that you then delete). If memory serves the PCI-E Config register can't be overwritten and will store the true model number so you can spot this but then it's a "I thought the manufacturer made a mistake, honest!". Pretty easy to scan in the label, modify it, clean the surface, print out a new one on a zebra printer, use an exacto knife to cut around the sucker and stick it on there. If you buy one refurbished from a no-name vendor, even easier to give yourself plausible deniability.
2: MicroSD and BootCD's. Load a Plain win7 install, make it look mundane. Have your disposable linux bootcd, boot that up, and use it to get to the internet and to view and edit pictures and footage to store on MicroSD. MicroSD's are so small you can sneak them through anywhere, they basically have to shred everything to find one. You can sew them into a patch of clothing, cut a slot in the bottom of a boot and fit it in, et-cetera.
3: Stenography. Lots and lots of utilities here to hide stuff in word documents.
4: Save your encrypted data as a video file and upload it somewhere. Old trick for getting data out of a firewall; compress it as a video stream and reassemble on the remote side.
5: Ship it internationally. Again, MicroSD.
6: Have a friend taking a completely different unaffiliated trip sneak it through for you.
In the UK you can be forced to hand over keys so keeping anything, encrypted or not, on the laptop is a no-no.
Get yourself a 4G account and mail the Veracrypt file to a safe country.
"The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
When you are not a common criminal but an uncommon criminal then you have additional problems. An uncommon criminal seeks to inform the public of the illegal and or immoral actions of their government. The police are usually just doing their jobs and may not like the outcome of what they have to do but it almost never stops them. Much of the good advice on this thread involve not putting the police in an uncomfortable position. In almost all situations but this one cooperating with the police is a good idea.
1. Use Linux for the simple reason you can separate partitions. Create a separate /home partition that mounts on an encrypted removable drive, like an Ironkey.
2. Do all work on the removable drive.
3. Never cross a border with both the laptop and the removable drive. Ship out courier the drive separately and carry the laptop.
This way there is nothing on the laptop to be searched or seized.
Learning HOW to think is more important than learning WHAT to think.
to what you can actually do.
You can hide files in a hidden container, you can encrypt files and give the key to someone in a different jurisdiction. But, in the end, if they have you and they have the computer, they will probably get what they want. We used to call it "rubber hose crypto".
If you don't have to bring the data with you, don't. Put the encrypted data somewhere in the cloud and pull it down when you need it. Then purge it from your computer.
SD cards are small and might pass if you are not subject to intense scrutiny. But if they are really looking at you, they will be found. If you don't have a lot of data, consider encrypting it and then use steganography to hide it in some of the files in you iPod.
Assuming you do not keep data on the computer, what you need to do is install apps that will:
Make sure to clear history, etc.
The best way to store data securely is in your own head.
linquendum tondere
They won't be able to figure out how to make it work, so your data will be safe.
Heh heh. You said what if.
The Regulation of Investigatory Powers Act allows them to compel you to hand over any passwords or encryption keys needed to access the data.
You want to run gentoo hardened. Separate partition for /boot and use full disk encryption with cryptsetup. I'd recommend paranoid high iteration count and using serpent over the official AES. Think of a nice long sentence or two and type it out without using the space bar, then toss a real password at the end of around 10 characters minimum. Do not use USB thumb drives for the key, memorize it as I said above.
Use non-standard use flags and do not use any -O optimization level and opt for safer-but-slower code. Do not use hardware acceleration hooks for encryption, prefer slower software generation (less backdoors/issues from biased hardware). Do not run or use any remote admin tools such as SSH, or if you do generate 16384 bit diffie-hellman moduli on two different machines and use only the ones common in both outputted moduli as your real DH pairs in /etc/ssh/moduli.
Keep the system partition with disk encryption, separate from your small-as-possible directory where you keep the sensitive news items. Known plaintext attacks can assist breaking the encryption behind the system-partition since there's files that *must* contain certain content inside /etc and such. You want your documents to use a separate encrypted mountpoint and never copy any known things there and only put things you write inside that partition uncompressed (again known plaintext).
With the Gentoo hardened GRSec kernel, you will want to use the option to disable any USB devices added after boot as to prevent NSA USB Fobs from being inserted to do DMA-memory attacks. You will never use wireless, always opting for a physical cable. You will never use firewire/thunderbolt/sound and they should be missing from the machine or disabled. Remove the microphone from the system, keep the webcam and tape over it (later you can use it to shed encryption keys from memory upon seeing a fast moving blob approaching when agents raid.
You will never leave the machine out of your sight booted up with the encryption keys in memory. Upon leaving the machine, you should spray a light bit of silly-string over it and take a photo of the unique strands. When you come back compare it and if you spot any differences the machine was accessed while you were away.
Wrap the machine in RF shielding and when doing encryption, run other encryption of the same type in a loop before starting the real encryption to prevent side channel attacks against the Chinese Remainder Theorem (youtube this for a demo of snatching RSA keys over RF leaks).
Never type your password with a cellphone within hearing range or else the keys will be heard and deciphered that way. Put the cell phone in a box like the oven or microwave then go back and type your passwords. Once the setup is complete with the machine, you will never update it and do not use it to get online once setup. Go back to using CDROMs as the input medium and mount it readonly,noexec with the system encryption key unlocked but not the private directory. Reboot after using the CDROM and *then* unlock the private directory and move the files from the system directory over. This way any memory loading/stealing by a hijacked CDROM device won't be resident or have the ability to snag that coveted secret key.
I'd keep going, but I'm afraid I've already said too much...
Encrypt and swallow.
Securely erase laptop before returning to the country.
Present Trojan Horse Micro SD as your Data.
If you do not, then you are a "troublemaker" and will be treated just the same as a criminal. The police state is violently opposed to any and all resistance and the law does only support them, not you anymore.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Put non-sensitive and fake-cover-story and other data you want them to see on the laptop.
For everything sensitive, see other suggestions above.
If possible, study memorization techniques and memorize what you can.
Most modern OSes (Windows, Android, Chrome, iOS, etc.) have all been specifically designed from the ground up to "leak" personal information and spy on the user. I have read articles that no matter what steps you take, you can only disable about 80% of Windows 10's spyware.
With that said, if the enemy has physical possession of the hardware there is very little that can be done. US police routinely torture people to get confessions and other information out of them, the UK have laws that will imprison you indefinitely until you divulge the passphrase, and most other countries police are even more barbaric.
All government spooks have backdoors into most modern ciphers via the NSA's contamination of the dual-elliptical curve libraries. They also have the computing power to brute force many of the older ciphers.
If the journalist has a home computer, suppose it was left on, with plenty of UPS protection, while the journalist was out of the country, with laptop? Then, shortly before travelling back to the home country, the journalist uses the laptop with Tor or some other secure protocol to upload/transfer critical data to the other computer. The laptop can then be TOTALLY erased --we know programs exist to do a thorough job of it-- such that a fundamental reinstall of all software would be needed, before it can get used again. The erased laptop is, of course, what would be handed over to customs ghouls.
1) Make one of these: https://hackaday.com/2015/10/1...
2) Hand everything over. Warn the bad guys that if they try to use your USB stick, it'll fry their computer.
3) When they fry their computer, ask if they have learned their lesson about taking you on your word.
4) Be cooperative. You already won the battle of wits, be a gracious winner.
5) Your data was on your obscure self-hosted webserver elsewhere in the first place.
Liberty - Security - Laziness - Pick any two.
its the only way to be sure
Use a Cloud RAID or USB stick as part of a RAID striping procedure to distribute part of a disk volume both on an off the laptop.
That way to reassemble the pieces you have to have all of the components.
A password or decryption key is sort of the same idea.. except it torpedos assurances that all of the bits cannot be rearranged to be read.
You can't read what isn't physically on the laptop in total, if its striped and then encrypted,, it will practically be airgapped
Back when I was at Kazaa many years ago, I kept all my files in a BestCrypt-encrypted drive, and all sensitive emails were PGP-encrypted. I was feeling pleased - if anyone got hold of my computer, there was nothing to see. But then one day our office was raided in a search discovery order, and all that time spent encrypting things came to naught, if I refused to hand over anything it would have been contempt of court. And so I printed out thousands of emails in one long continuous unformatted strip... that was about as far as I could go. I did consider that I could have gone one step further and used BestCrypt's feature that lets you create an encrypted drive that's actually two partitions - give out one key and all you see is nice set of clean files, plus a whole lot of random bytes. It's something to consider, but you're living dangerously if it's a court order. BTW, there's discussion here about keeping data in the cloud - another tempting option. Broadly the law can compel you to hand over any data "In your control or possession", where possession is defined as including the means to retrieve remote data. So there would need to be zero knowledge of having that remote data at all. Just sayin'
The parent organisation should maintain a networked data store that all it's reporters have a write only password for.
Data is then sent via ssl. No other encryption software of any kind on the laptop.
Absolute minimum of services and a tiny hard drive, with no swap file/partition.
Reporters should only use a plain, single view, text editor that doesn't store parts of a working document to file, and can be made to direct send the data without ever touching the hard drive.
And for the politically correct, social just warriors, etc. .. man in the sense of person
You carry a laptop, you carry a live boot USB stick/CD, You carry encrypted media, possibly the same as a boot USB. Your counterpart, possibly in another country, carries the decryption key. You carry his decryption key. Never cross an international border together.
Personally, I'd perform a persistent install [of the distro of your choice] to a bootable MicroSD card. You can not only boot it up on virtually any PC, there are myriad ways you can throw them off or just plain fuck with them. Hell, really mess with their heads and lug around a laptop with Win9x on it (you don't even need all the drivers; present 'em with one huge fucking list of yellow exclamation marks in Device Manager!).
The bootable MicroSD card you can hide almost anywhere (up your nose, in a slit cut in the sole of your shoe, etc etc).
1) Use a Chromebook burner running Chrubuntu
2) Setup an OpenVPN server on your home LAN
3) Setup a Virtual Machine on home computer with TrueCrypt encrypted virtual hard disk(Truecrype will handle all of the plausible deniability/FDE stuff)
4) Use X11 forwarding to run the virtual machine on your laptop through the VPN tunnel. Only rendering is handled locally with no persistence for forensics.
If you want to get extra fancy, do some sort of "partial hangout" with an encrypted SD card running Chrubuntu and then setup a second duress VPN to a Raspberry Pi porn server with lots of Gay porn/Big Tits/Anime Tentacles/etc.
If you don't save the OpenVPN connection information between boots then there is no way for them to use a rubber hose to get your VPN/home workstation password.
That's why this is a stupid question: all of this is hard work and the questioner clearly has no idea what they're doing and doesn't want to do the work to figure it out themselves. If they can't be bothered to do their own research, they certainly aren't going to do the work to secure their shit against APT attackers(IE. Corporation Backed LEO).
Can I instead recommend a flashdrive with teamviewer portable on it as an 80% solution?
Use a live CD OS (knoppix or similar) for security critical work, and store all data in the cloud or in storage that you arrange through a hosting provider. The non-secure data is present and nothing seems off.
There is no data or signs of data stored on the drive. There is no data on your person/in your luggage on thumb drives. There is no browser history to lead to the data.
Or just toss the $50 drive in the trash after a basic erase. Plug in a new one before the trip home.
Zip the relevant files, and then change the extension to .odt
When people cant read them, they will blame Microsoft!
(Or use bzip, or compress or even IBM Squoze)
Sent from my ASR33 using ASCII
What, no one uses truecrypt anymore? Just run an older os that truecrypt supports. Government shut down truecrypt because they hated it, so that should be a good recommendation. You can still find copies banging around out there.
Store the data in an encrypted micro SD hidden within your firearm. You know, that flare gun you store with your cameras so you can lock them with locks not pickable by the TSA. And if someone steals the luggage, you get instant attention when you tell security someone stole your gun.
However, the best way is not having any information that matters if someone found it. Don't be stupid enough to write down contact details or locations. Memorize them. Don't travel with anything explicit. Do you really need to masturbate that much to risk your life? Your company should already have guidelines and practices in place for transferring sensitive materials, or are you just claiming to be a journalist because you have a blog?
Encrypt the hard drive, store the key on a USB drive.
Mail the drive out of the country. Separately mail the USB drive somewhere else.
Take the laptop with no hard drive through customs.
If you're asked where the hard drive is, tell the truth. You've already sent it to your destination and you're a journalist.
Anything they want is already out of the country before you were asked about it, so no crime has been committed.
If customs open either package, they can't do anything with out both of them.
These folks provide advice for human rights activists who want to stay safe and protect their sources from nasty governments: Security in a Box.
run a parasent Linux distro like puppy on a micro sd as the entire os is stored in ram. save you data to the sd card they can be easily hidden or destroyed. now the fun part encrypt your entire harddisk with windows on it to make them think your hiding something then make them wast there time getting a court order to hand over the key just to find nothing.
Buy a camera that uses dual SD cards, like a Nikon D7000, and keep the card in the camera when moving through security. Store your computer data on one of the SD cards in an encrypted hidden file. Make sure you take lots of pictures and have the camera set to use the cards in mirror mode. No security people will image a camera card. At best they look at all the pictures using the camera. If they do image the card, highly unlikely, all they can find is a hidden encrypted file that you just deny any knowledge of.
In the UK , there is no bill of rights, and your protections as an individual are much weaker.
Protection from self incrimination does not exist universally, and for a range of offenses you are legally required to answer, even if it is self incriminating (and can be jailed for contempt of court for not answering).
You can be compelled, at pain of imprisonment to unlock/decrypt anything at the border.
So...
That means you should not have the data or they keys to the data with you when you cross the border.
Best interim solution:
iPad with TouchID and a complex passcode, and set the self-wipe to 3 incorrect attempts. Turn it off prior to entering the controlled area.
If you get searched, boot it and fumble the password.
If there is even the hint you are doing something funny, in many countries that means jail time until you give them what they want. Good luck convincing them its not there, or you dont have the key.
Make the computer a simple 'terminal': "i'm sorry there is no data on here at all, but you are welcome to keep my machine to look as much as you like". "its company policy not to store data, it wasn't my idea"
Can't you just encrypt a drive using LUKS and use a remote LUKS header?
Someone could then destroy the header it if they don't hear from you, or you could set it to auto-destruct if you don't log in to some service ... (not sure if there would be a convenient way to do this)
This way not even you would be able to decrypt your files.
But a question, would you still get arrested?
Easy. Don't do anything - and I mean ANYTHING - locally on your laptop. Use it as a glorified VPN and Remote Desktop/VNC Client to a PC safely behind your employer's firewall, or at a hosting provider that is in a country with good privacy protections.
With a really long passphrase with weird characters. They'll spend the rest of the natural lives waiting for it to be cracked.
Survival 101.
Pissing off the border guard.
How the story ends if you "Ask Slashdot."
2) Hand everything over. Warn the bad guys that if they try to use your USB stick, it'll fry their computer.
3) When they fry their computer, ask if they have learned their lesson about taking you on your word.
4) Be cooperative. You already won the battle of wits, be a gracious winner.
How the story ends in the cinematic world.
[Anonymous basement interrogation room]
Wake up! I need you to be focused!
You either give me what I need or this switch will stay on until they turn the power off for lack of payment on the bill.
Which do you think cuts closer to the truth?
1. Backup the data files to a single backup file.
2. Encrypt the backup file using an OpenPGP application (e.g., PGP, Gnu Privacy Guard). Software should not have sensitive data so it does not need to be encrypted.
3. Upload the encrypted backup file to a cloud service whose servers are in a nation that will not respond to a police warrant from the nation whose police worry you.
4. Use a strong eraser application to erase the original files, the backup file, and the encrypted backup file on the laptop.
Project Gutenberg has 50,000 books. Each book as 100,000 words.
Each word can be the starting point for 5 keys (5 to 10 words long).
That's 25,000,000,000 keys. Roughly a 34 bit keyspace. Not really
all that great, IF they know that's the algorithm you used to choose
the key. If you drop the e's and they don't know, then their brute
force attack won't work.
Oh come on people (including the police), please stop making out that you've got something on a laptop that belongs to you.
See subject: NOT an SSD, but a software ramdisk - that is, If you want things disposed of as well as possible as in "poof it's gone", that's as good as you get instantly @ powerdown - & the b.s. about being able to retrieve data from system RAM once it's powered out is about as reliable as harddisk data recovery services.
* Anyone else want to 'chime in' & correct me, FEEL FREE to do so - I may learn something.
(That's as good as I can suggest - but, the data should be mirrored IF you require saves... that's a weak point in & of itself, much like power being continuous is, but that's the breaks + rules of physics...)
APK
P.S.=> Fucking shame that those that help keep society in check (and yes, conversely ruin it as tools of the "powers that be" for things like character assasination etc. - most of those 'powers that be' are FUBAR'd to hell - my evidence/proof thereof? Hey - Look hard @ the results they're producing out there now today especially & their underlying motivations (most importantly), is all I have to say to that & to any 'naysayers' paid off trolls/shills who don't like it) have to do this, but, there ya go... apk
I believe you are missing my point here as it appears others may have as well since I've been modded as a troll and someone else posted the "don't talk to police" thing. There is a difference between being polite and cooperative - good things - and volunteering information expecting the police to simply send you on your way, which can happen but is highly unlikely. I'm advocating the former. As in most aspects of life 'polite and cooperative' is generally the best policy, at least at the beginning of any conversation with authority.
http://yro.slashdot.org/commen...
* :)
APK
P.S.=> Sound off on it if you wish - but I ask that you do it there, not here (thanks)... apk
If you have a Chromebook, have a separate gmail account that looks active (subscribe to some innocuous mailing lists.)
Prior to border simply powerwash the Chromebook and login with the clean account. Nothing to see here officer. The password is 1234.
After you get home, login with your normal account.
Confronting the police by breaking laws in order to protest the laws is, at least in the US, a pointless excercise as the policy neither make the laws nor do they judge whether the laws are fair or even legal. The job of the police is to simple enforce laws that have been made. That is as true today as it was 50 years ago.
Boy I should have proof read that before posting. Several misspellings, but I believe you can get my point.
Many countries in the world require the ability to search computers brought across the border. You can be detained if you fail to provide access such as passwords.
Do not take precious data with you. Leave the data safely at home and connect securely.
Use secure cloud storage or even secure storage back at home base and connect using a secure VPN.
Confused... is disk encryption not cool?
Get some clunker laptop and pull the hard drive out of it. Build a bootable Linux CD/DVD with team viewer on it. Don't save any passwords IDs, etc. to it. When you're in the field, fire up team viewer to a machine that is safely at home. Work. When done power the machine down. Toss DVD before going to the airport, or keep it if you like to live dangerously. Cops snatch the laptop, has no hard drive they will have 20 questions for you, and they will ask them in a way that usually involving bright white lights, waterboarding, etc. but they will not have your data.
Are the answers to this question any different than if the question was "How do I keep the police from finding my child pornography and videos of the women I've murdered and eaten?"
It's not entirely pointless. In the US, courts have this sorry attitude that you have to have been 'harmed' by a law in order to challenge it. In many cases, that means actually being arrested.
So Congress passes a blatantly unconstitutional law like they always do. Let's say it makes something you like to do illegal. So you stop doing it, or you hide that you do it, or whatever. To me and most thinking people, you've been harmed by the law. But the courts won't hear your case until you get arrested for whatever it is.
The US needs something like France has, where there's a court to throw out unconstitutional laws before they get used. Either that or our judges need to get their heads out of their asses and realize how the world works for real.
As in most aspects of life 'polite and cooperative' is generally the best policy, at least at the beginning of any conversation with authority.
Polite and cooperative does not include volunteering anything. Law enforcement employees are not your friends, and will use anything you give them against you in any way they can.
So, yes, cooperate, and be polite, but don't think for a minute that they'll reward you in a positive way for anything you volunteer.
Be especially wary about promises of immunity for testifying as a witness. Unless it's a full immunity in perpetuity (which is rarely given), they can demand that you incriminate yourself and waive your fifth because you have "immunity". Then they turn around and gather evidence for a crime they knew nothing about before, and nail you. They can't use your testimony against you, but they can and will use it as a basis for discovering other evidence.
So don't volunteer anything if you have anything to hide. Not even anything unrelated to what you have to hide.
And quite frankly, who can say with certainty that they have never broken a law - wittingly or unwittingly? In the eye of the cops, prosecutors and judges, everybody is guilty of something. And they are probably right.
Put your encrypted computer or data store in a diplomatic bag for transport across borders. This may require having diplomat friends at both ends of the chain. Then again, friendly countries may be glad to help if they suspect you might embarrass an enemy.
In a time of universal deceit, telling the truth is a revolutionary act. George Orwell
Even thats getting tricky. In the old days that was a perfect method. But with diplomatic protection now been confused with local embassy staff any convention on is getting weak. A person can claim to be, show id, seek protections but might have already been searched and had data cloned. ;)
Later nice comments about "intake procedures" "arrest" and "appropriate procedures" will be released to the press ie the full diplomatic immunity part vs consular immunity was not found until well after the search
Domestic spying is now "Benign Information Gathering"
"In the light of the British police's seizure of a BBC laptop what is the right configuration and practices to ensure that such a seizure provides zero information to the cops?"
BBC should have a BBC-owned drop server, synchole only, where theyr reporters can write/drop data but never read from. User-GUID based acces for in-house peoples, anonymous for wistle-blowers.
BBC reporters should use diskless laptops, booting from a BBC made CD, with an BBC personalized OS. This way, the corporation entierly controls the dataflow.
This way of functioning guarantees the reporter's integrity, any "wrong-doings" by the company employees, in the name of the company, should be handled by the justice departament directly with the company. We are BBC, we have sent the reporter do work for us, the info he retrieved is ours. Have problems with the data? Should see that with us, leave the poor guy alone, he's only trying his best at doing his job (and has a ridiculous small remuneration for the riscs he assumes).
The keyspace is only large if the attacker doesn't know or suspect how your password is constructed. Otherwise: 10^3 possible famous books, 10^5 words (starting positions) per book, 5 possible key lengths, 2 for with/without spaces. This gives you a key space of 10^9 that can easily be brute-forced.
And if they/NSA see you look up the book on your browser, you're definitely done.
Avantslash: low-bandwidth mobile slashdot.
NAZI is a flawed english transliteration of NSDAP National Socialist German Workers' Party. A socialist workers party isn't a "bad thing" and most people didn't notice it was not a worker's party, nor socialist until it was too late. I have no idea what the UK party was like at the time, but I'd guess they were more like the theoretical ideals, not the "kill all Jews" party. But maybe they were.
The NAZI party was a German nationalist party, why would there be so many German nationalists in the UK?
Learn to love Alaska
I don't know what I expected. Clicking random youtube links on slashdot is like playing russian roulette with your mood.
About halfway through the first video, very very interesting stuff.
...
You guys are aware that self encrypting drives have been readily available for a decade now, right? The bios detects that the drive requires a password and asks for it at book. The password unlocks an internal key used to encrypt the drive. Unless the adversary manages to capture laptop while it's on or in standby, no password = no data.
Moderating "-1, Disagree" is simple censorship. Have the guts to post your opinion.
nt
That was in the '60s. Today Rosa Parks wpuld be shot for "appearing threatening", Martin Luther King would be character-assassinated and then killed, Malcolm X deported to Gitmo and any civil rights march bombed by drones.
Timothy - Any chance you could post "Ask Slashdot" stories to the "Ask Slashdot" section of the site? It exists for that very reason you know.
'The tyrant will always find pretext for his tyranny.' - Aesop's Fables
Encrypted IronKey. If it is tampered with, it will self-destruct.
If the journalist use a truecrypt container in a unusual folder (in the program file folder of an uncommon program with a .DAT extension for example). The computer can be taken, the police won't find evidence. In some countries you must provide the key to decrypt so a full encryption will be suspicious. So hide in the crowd.
You are just going to have to find it yourself. There will be no answers on "ask /."
You all are missing the point. There is a simple solution that requires no technology.
Don't talk or work with terrorist.
A Linux Bootable USB can store the operating system in a read only state. A lot of distros have a boot flag that allows you to load the entire OS and system files to RAM. Insert USB, boot to USB, remove USB... do your dirty work... submit all information to your remote write only server. Memorize the IP/user/pass of that server instead of putting it on the USB.
Once the laptop is turned off, your RAM is wiped and the system is cleaner than any z-fill could ever accomplish and your bootable USB only has an innocent install of Ubuntu.
In retrospect, there's no reason you can't make the harddrive read only and boot to RAM that way for convenience.
Turn on FileVault to encrypt the drive. Set a firmware password. Make sure there are no guest accounts. See https://support.apple.com/kb/P... and https://support.apple.com/en-u... . Turn off iCloud and don't enter an AppleID. Use an encrypted text editor on top of this with a 3rd password. This won't stop the NSA, but will stop most hack attempts. Putting documents on an encrypted SD card is not a bad idea.
With the new powers being asked by the terrorist Theresa May, there's no need to even look at a person's laptop or data, they simply go to the ISP, Google, and Facebook for all your data and associates and browsing history.
Forget Tor, it's full of spying nodes setup by GCHQ and NSA.
Unless you're using end-to-end encryption like Apple's iMessage or Pidgin for transferring all your data and comms, it's simply not possible to not leak any information over the air, either through Tor or by going directly through your ISP.
using a mac+filevault2+bootprom password should cover you
VeraCrypt whole disk encryption. (Successor to TrueCrypt.) Duh!
Make sure it's powered off when you're traveling, and avoid malware infection. Then, you're all good.
If you're worried about compulsory password requests, then things get a bit more complicated. You can use the plausible deniability feature of VeraCrypt to accomplish this, but deniability also requires rigorous adherence to modified computing practices.
To prevent the collapse of Western Civilization due to complete automation and unfettered rent-seeking we need to institute these three policies:
Universal Basic Income which will replace most forms of welfare. However, this will not work without...
Land Value Tax based on the rental value of land not including any improvements. This will replace most other forms of taxation. For this to have the desired effect we also need...
Full Reserve Banking which will remove the ability of banks to create money and then charge interest on it.
Private natural monopolies and every other form of rent extraction must be hunted down and neutralised.
If we don't do these things the booms and busts will continue to ratchet up wealth inequality until the economy collapses and the peasants revolt.
secure cloud storage?
Seriously? Were you drunk when you wrote that?
Hidden dead man's switch. If a certain code isn't entered at every power up/login and say every couple hours, have the device silently overwrite the files with random garbage (a couple times for mechanical hard drives, maybe just once for SSD). There should be no prompt all except maybe a very soft tone or sound effect for when it is time to enter the code. Make sure it is entered like a cheat code (holding down control and a keying in a sequence of letters). Probaly have the prog rename all files to something non suspicious but would have justification for this type of security (maybe like ::your name:: tax return.xls or something) prior to delete/scrub and even delete/wipe the prog itself (these are just ideas. precice implimentation left up to reader's best judgement). Of course, you may have to code this or have someone code it for you scince this may not have been written yet. Oh, MAKE SURE ALL FILES INCLUDING SWAP AND TEMP FILES ARE SCRUBBED TOO AS THESE CAN STILL CONTAIN INCRIMINATING DATA.
it might be a good idea to have decoy files as well that read like something they would expect, but have nothing incriminating. Make sure you create/modify these before or after the "sensitive" files and update them along with the sensitive ones so the dates (and content) don't seem suspicious.
If your having to do all that then wat-eva your doing is against the law. If your going to be breaking the law then I cannot help you. Criminals!! I have not heard of more then maybe 5 real true Hero Journalists these days the remaining are just not being true to the people.
oh one more thing: make sure you change the time/date stamp of the sensitive/"suspicious" files so they are NOT the same or close to the decoy files!
Meh.
~
give weapon_shotgun
*BOOM HEADSHOT*
When in doubt, cheat.
Stop breaking the law assholes.
Just stand up... your laptop goes away.
Don't take a laptop, just an install DVD. When you arrive, pick up your pre-arranged rental laptop and install your image from the DVD. Use that to download the rest from home. Then work normally.
When you're ready to leave, upload everything over the net and use the DVD as a rescue boot so you can wipe the drives. Return the laptop and shred the DVD.
I would strongly suspect that EFS has have a backdoor that Microsoft would give up immediately upon request. Same for any and all cloud storage. Also, Windows 10 is offered for free which means that someone else is paying Microsoft for the data that this OS collects by default. It's like "Here, take this free stuff so we can keep track of everything you do." Has Microsoft ever given away anything for free? Not that I can remember.
Hidden dead man's switch. If a certain code isn't entered at every power up/login and say every couple hours, have the device silently overwrite the files with random garbage (a couple times for mechanical hard drives, maybe just once for SSD). There should be no prompt all except maybe a very soft tone or sound effect for when it is time to enter the code. Make sure it is entered like a cheat code (holding down control and a keying in a sequence of letters). Probaly have the prog rename all files to something non suspicious but would have justification for this type of security (maybe like ::your name:: tax return.xls or something) prior to delete/scrub and even delete/wipe the prog itself (these are just ideas. precice implimentation left up to reader's best judgement). Of course, you may have to code this or have someone code it for you scince this may not have been written yet. Oh, MAKE SURE ALL FILES INCLUDING SWAP AND TEMP FILES ARE SCRUBBED TOO AS THESE CAN STILL CONTAIN INCRIMINATING DATA.
it might be a good idea to have decoy files as well that read like something they would expect, but have nothing incriminating. Make sure you create/modify these before or after the "sensitive" files and update them along with the sensitive ones so the dates (and content) don't seem suspicious.
oh one more thing: make sure you change the time/date stamp of the (to be) deleted files so they are NOT the same or close to the decoy files!
If the po seizes your laptop at the airport, how are you going to destroy it? Better find someway to encrypt and/or arrange to have the data destroyed somehow after it is seized and out of control.
(of course, they can remove the drive and read it on another system, or use a very reliable and inexpensive decryption method that involves a claw hammer/pliers and your exremities/fingernails and/or threats of prison torture and rape, or have you disappeared forever if you successfuly have the data automaticaly destroyed. You are most likely fucked in this situation no matter how you slice it)
They can remove the drive and read it on another system, or use a very reliable and inexpensive decryption method that involves a claw hammer/pliers and your extremities/fingernails and/or threats of prison torture and rape, or have you disappeared forever if you successfuly have the data automaticaly destroyed. You are most likely fucked in this situation no matter how you slice it.
Best I have heard of is / was PGP
http://buy.symantec.com/estore/clp/smb_d4v2_9p9s_pgpencryption1_default
the weakest link in any security system is the flesh and blood one...
Actually, Nazi was a derogative nickname for the party (there was a comparable nickname, Sozi, for a left-wing party). It was used in Germany, but not by Nazis, who always used "National Socialist". I would suspect it was a lot less used after 1933.
"When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
The UK can compel disclosure of a password, with up to 2 years in jail for simply refusing to comply.
https://en.wikipedia.org/wiki/...
TrueCrypt could provide plausible deniability in theory, but the difference between theory and reality is often smaller in theory than in reality.
https://www.eff.org/https-everywhere
Just load your laptop like usual, and run your vm from inside an encrypted veracrypt folder. Put another vm with some games (so you have a reason to have the vm host running). Most investigators won't spot the vm's, most of the ones that do, won't spot the encrypted ones. The ones that do spot the encrypted one, won't be able to get into it.
Cheap storage VM.
I wouldn't do that without also encrypting the host OS's whole disk with VeraCrypt in case the passwords leak out of RAM onto disk unencrypted.
I would say that's unnecessary for 99% of use cases, and defeats the purpose.
Cheap storage VM.
...the police neither make the laws nor do they judge whether the laws are fair or even legal. The job of the police is to simply enforce laws that have been made. That is as true today as it was 50 years ago.
That's never been true.
The US Bill of Rights is open-ended. James Madison deliberately made it that way. It provides for unspecified rights retained by the people (9th Amendment), and unspecified right reserved to the people (10th Amendment).
These rights, like everything else not specifically limited to Congress, apply to the state and local governments as well as to the federal government. That would follow simply as a consequence of the right to ethical practice of law (certainly an universal and inalienable right), and it also follows from Madison's original text of the Bill of Rights.
In short, the police are required, by the highest law in the land, to recognize that individuals have rights that go beyond the actions and decisions of executive, legislative and judicial bodies. In short, individual responsibility is enshrined in the highest law of the law, which every police officer swears an oath to uphold, as a precondition for holding that office. That oath is binding on their actions, every minute of every day.
Strange you should mention 50 years ago, since that's about when some significant events happened at a place called Nuremberg. There a number of Germans claimed that it wasn't their duty to judge whether the laws compelling their obedience were ethical, legal, or moral.
This defense was rejected. US police officers who refuse to act responsibly with respect to illegal laws (of which the USA has a plethora) are in the wrong, ethically, legally, and morally, just as those Germans were.
You may be confused by the fact that you don't often see this happening. That should not be taken as an indication of what the police should be doing, but rather tells us how badly some police officers are doing their jobs. Also, when police officers do the right thing (and some do understand these issues), it doesn't make the news, so we don't hear about.
There is sometimes a big difference between what the law says, and how things work in practice, in large part due to ethics problems within the profession of law. The US legal profession has a vested interest in not recognizing the authority of the 9th Amendment, leading to many failures of integrity, and lots of illegal laws, illegal court orders, illegal executive order, and illegal precedents.
These failures of integrity on the part of the legal profession do not in any way relieve the police officers of their responsibility to do the right thing.
Further, if you don't see the police doing the right thing, it means the police are breaking the law.
This happens a lot.
It's no different now than it was during the "Jim Crow" era, when incompetent or amoral or incompetent police officers chose to enforce blatantly illegal laws (which the Jim Crow laws certainly were). After a while, that kind of thing becomes a norm, as people make assumptions about what is acceptable based on what they see others doing, which is why having a poorly educated police force is a very bad thing for a society.
I would say that's unnecessary for 99% of use cases, and defeats the purpose.
Hi pnutjam. That was my thought about the VM solution actually versus plain whole disk encryption. ;-) Is the use case you're worried about the plausible deniability requirement? Apart from that, do you see a use case that makes it preferable to go this route and install a VM instead of just using whole disk encryption?
On the plausible deniability front however, your suggestion seems pretty interesting; definitely sounds simpler to use an encrypted container with a hidden volume than an encrypted system with a hidden OS.
Well, the problem with just a hidden container, is that you often don't realize where things are being written by programs you use. It's easy to end up with something in an insecure location, or sitting in you hibernation or suspend file.
With the whole OS encapsulated, you can more easily contain it. You can also have it use a vpn or tor network, so the main pc can't listen to it's traffic.
The only big problem in this situation, would be keyloggers, or some sort of malware that is taking screen shots periodically. You can guard against key loggers by using an onscreen keyboard, but the other is something you will have to avoid with opsec.
Cheap storage VM.
In regards to whole disk encryption, I think that is great also. However, it's still difficult for your average user. I think it's more common and less of a red flag now.
My problem with whole disk encryption is that it's usually integrated into the logon. You just need to leave your pc running, and it's defeated.
I think the separate vm provides a sort of reminder and encourages you to be more conscious of operational security, which is where most people screw up.
I also like the portability.
Cheap storage VM.