security in-a-box community focus Security in-a-box provides the knowledge you need to recognise digital security threats and the tools you need to address them. It offers detailed, step-by-step instructions to help you use those tools effectively, as well as practical, non-technical advice for anyone who relies on digital technology to do sensitive advocacy work. https://securityinabox.org https://tacticaltech.org https://frontlinedefenders.org LS OO AN T D Y T A C C A T C I O C S V D F III II A O R security in-a-box community focus digital security tools and tactics for the African LGBT community TOOLS Y C A N A D C T O A V D C T A I R C S O F v1.1 IV i CONTENTS PART ONE: CONTEXT 1. Introduction 3 2. Digital threats to the African LGBTI community 9 Access to accounts and devices 10 LS Evidence for prosecution 12 OO AN T D T Y A C Entrapment and extortion 14 C A T C I C O S V D F A O R Harassment, physical and sexual attacks 16 Malware infection 17 Monitoring and tracking 19 This guide was developed by 3. How to assess your digital risk 25 the Tactical Technology Collective “Security’ and ‘Digital Security” 25 Coordination, writing & editing Azeenarh Mohammed ‘The who’ and ‘The why’ 26 (Part I) Daniel Ó Clunaigh The risk matrix: probability and impact 29 Writing (Part II) Wojtek Bogusz Dmitri Vitaliev PART TWO: HOW-TO BOOKLET Chris Walker Ali Ravi 1. How to protect your computer Daniel Ó Clunaigh Hadi Habbal from malware and hackers 35 Anne Roth Viruses 35 Special thanks Faith Bosworth Spyware 37 and many other anonymous Firewalls 39 human rights defenders who have contributed their inspiration, Keeping your software up-to-date 41 feedback and stories to the creation of this guide. 2. How to protect your information from physical threats 47 Design & illustration Lynne Stuart Assessing your risks 47 Funders American Jewish World Service Protecting your information from physical intruders 48 Swedish International Development Agency Maintaining a healthy environment for computer hardware 51 Creating your physical security policy 52 v1.1: July 2014 ii iii 3. How to create and maintain Anonymity networks and basic proxy servers 131 secure passwords 57 Specific circumvention proxies 135 Selecting and maintaining secure passwords 57 10. How to protect yourself and your data when Remembering and recording secure passwords 59 using social networking sites 141 4. How to protect the sensitive files on your General tips on using networking tools 142 Posting personal details 143 computer 67 Encrypting your information 68 11. How to protect yourself and your Hiding your sensitive information 70 data when using LGBT dating sites 151 Keeping your private bits private 152 5. How to recover from information loss 79 You and dating sites 154 Identifying and organising your information 79 General tips and advice for particular sites 156 Defining your backup strategy 81 Creating a digital backup 83 12. How to use mobile phones as Recovering from accidental file deletion 86 securely as possible 161 Mobile devices and security 161 6. How to destroy sensitive information 91 Mobility and the vulnerability of information 163 Deleting information 91 Wiping information with secure deletion tooll 92 13. How to use smart phones as Tips on using secure deletion tools effectively 95 securely as possible 173 Tips on wiping the entire contents of a storage device 95 Platforms , setup and installation 175 Communicating via smartphone (voice and message) 178 7. How to remove hidden metadata from files Storing information on your smartphone 181 Deleting hidden data from files using metadata 101 Sending emails from smartphones 182 removal tools 102 Capturing media with smartphones 182 8. How to keep your Internet Accessing the internet securely 183 communication private 109 Advanced smartphone security 185 Securing your email 110 14. How to use Internet Cafés as securely Tips on responding to suspected email surveillance 114 as possible 191 Securing other Internet communication tools 117 Protecting your data while using Internet Cafés 191 Advanced email security 120 Checklist: safer Internet Café usage 194 9. How to remain anonymous and bypass Glossary censorship on the internet 127 201 Understanding Internet censorship 127 Understanding censorship circumvention 130 iv v PART I: Context 1 Introduction vi 1 Introduction Welcome to Security in-a-Box Community Focus: digital security tools and tactics for the LGBTI community in sub-Saharan Africa. Security in-a-box is a collaborative effort of the Tactical Technology Collective and Front Line Defenders. It was created to meet the digital security and privacy needs of advocates and human rights defenders. Security in-a-box includes a How-to Booklet, which addresses a number of important digital security issues. It also provides a collection of Hands-on Guides, each of which includes a particular freeware or open source software tool, as well as instructions on how you can use that tool to secure your computer, protect your information or maintain the privacy of your Internet communication. This Community Focus edition is part of a series of guides which aim to further integrate digital security into the context of particular communities and human rights defenders. This edition was created in particular for Lesbian, Gay, Bisexual, Trans* and Intersex individuals and human rights defenders in the sub-Saharan region in Africa. It was preceded by a similar guide for the Arabic-speaking LGBTI community, and includes some of the same content. Both guides were written in collaboration with human rights defenders from the community. The guide includes: Part I - Context Introduction Digital attacks against the African LGBTI community How to assess your digital security risk Part II - How-to Booklet How to protect your computer from malware and hackers How to protect your information from physical threats How to create and maintain secure passwords How to protect the sensitive files on your computer How to recover from information loss How to remove hidden metadata from files How to destroy sensitive information How to keep your Internet communication private How to remain anonymous and bypass censorship on the internet How to protect yourself and your data when using social networking sites How to protect yourself and your data when using LGBTI dating sites How to use mobile phones as securely as possible How to use smartphones as securely as possible How to use Internet Cafés as securely as possible 2 3 In most sub-Saharan African countries, LGBTI persons are still far ‘punishment clubs’ where they engage gay men on social networks from gaining social recognition. Despite the various social and cultural and dating sites to extort, and blackmail their victims. These incidents differences within the region, silence remains a factor that prevails started to expose the pitfalls of the Internet and the many insecurities whenever such taboo issues as homosexuality or trans identity are and problems that come with its use for a community who at the same broached. time feel liberated by it. In recent years, LGBTI persons have indeed become more Social networks and dating websites remain a common way of visible and active in the public sphere. Nonetheless, the State and targeting LGBTI persons, through accessing their personal pages society all too often force them back “into the closet” with threats of (blogs, email addresses, Facebook or Twitter accounts); using their ostracization, harassment, physical violence and even death. Generally, information and at times pictures to blackmail or ‘out’ them to their LGBTI persons are still deemed to be at best non-existent, and at worst families, and setting up fake accounts, by police and others, to ambush cursed, possessed, deviant, immoral, abnormal and diseased. With LGBTI persons and ultimately arrest, threaten and scandalize them. The homosexual acts directly criminalized in most countries in the region, insecurities of information on the Internet are considerable in number, in some of which one can face the death penalty, it is already difficult and despite the recent increase in awareness about the dangers of for LGBTI persons to come out, be visible, live out their identities or insecure usage of the Internet, access to the most practical solutions that fight for their rights. While these laws are often ineffective and are not could ensure digital safety for LGBTI users remains limited. used systematically to prosecute individuals, the social and cultural Consequently, there is an increasing and dire need for both condemnations of homosexuality remain the biggest threat for LGBTI knowledge of the most recent methods and tools for digital security, communities across the region. as well as a stronger ethos of caution and care in our online activities, In view of the aforementioned context, the Internet has emerged through which LGBTI persons and human rights defenders could as a viable option for LGBTI persons to gain visibility, communicate, ensure their online privacy, circumvent governmental censorship and network, and express what one cannot express in public. Social threats, and protect their information, personal pages, profiles and networks, blogging platforms and forums have become, in most African websites from being hacked, accessed, and ultimately used against them. countries, the only spaces where LGBTI persons can have a voice, There is an inherent tension between the desire to claim one’s organize themselves, formulate their discourses around their issues and rights openly and publically, and the desire to act cautiously and work fight for recognition. out of the public eye. It is ultimately a personal decision to select a However, authorities and other opponents of LGBTI rights have comfortable point in this range. However, we do believe that in all cases endeavored to keep up with this change.