This document discusses digital risks and security for activists. It outlines how information security has evolved as more data is shared online. It notes that online services are inherently insecure as users are the products, and security tools can be counterintuitive. The document emphasizes understanding what assets need protection, from what threats, and what risks exist. It recommends considering how information could identify people and the implications. Data collectors have a responsibility around consent and transparency on data use and risks. The document provides examples of security tools to consider and resources for online protection.

1. Digital Risks
and Security for Activists
eCampaigning Forum
Future Forum
April 11th, 2014
Dirk Slater
FabRiders- www.fabrider.net
@fabrider

3.  Evolution of Information Security
 Stuff that makes us vulnerable
 The Problem with Online Services and Security
Tools
 Frameworks for Information Security
 Responsibility of Data Collectors
 Some tools and resources
Today

4.  A personal look at protecting information
 The rise of the relational database
Evolution of Information
Security

5. Stuff that makes us
Vulnerable
• Email
• Search engines
• Web browsers
• Cloud services
• VoIP comms
• Social networking
• (i.e. everything we do on the internet)

6. MOBILES
Stuff That Makes Us
Vulnerable

7. The problem with
online services
If you aren't paying for it
you are the product

8. The problem with
online services

9. The problem with
online services

10. Why are we surprised?

11. The problem with
security tools
They are often counter-intuitive
and not in the reach of mere mortals
They often arise suspicion
It's an arms race

12.  Information about us is shared everywhere
 Online Services are completely insecure and are
making money off the information they are collecting
 Security tools are problematic
So?

13. What about just
using a notebook?

14.  How does information itself make people
vulnerable?
Information Security not
Digital Security

15. Three things to remember
when sharing information
What are your assets?
What are the threats?
What are the risks?

16. Assets
How is the information valuable?

17. What is the threat?
• Confidentiality is keeping assets or knowledge about assets away
from unauthorized parties.
• Integrity is keeping assets undamaged and unaltered.
• Availability is the assurance that assets are available to parties
authorized to use them.
• Consistency is when assets behave and work as expected, all the
time.
• Control is the regulation of access to assets.
• Audit is the ability to verify that assets are secure.

18. What is the Risk?
The Likelihood of a Threat Actually Occurring:
• Confidentiality
• Integrity
• Availability
• Consi
• stency
• Control
• Verification

19. Responsibility of
Data Collection
• How can information be traced back
to real people?
• What are the implications of that?

20. Responsibility of
Data Collection
• Do you have consent?
• Do people understand how you are
going to use the data?
• Do people understand the risks?

21. Five Questions About
Security Solutions*
 What assets are you trying to protect?
 What are the risks to those assets?
 How well does the security solution mitigate
those risks?
 What other risks does the security solution
cause?
 What costs and trade-offs does the security
solution impose?
* from Bruce Shneier's book 'Beyond Fear'

22.  Password Managers
 PGP (email encryption)
 TOR
 The Guardian Project (TOR for
Android)
Security Tools to Consider

23.  What are the assets, risks, & threats?
 Be responsible in your data collection
 Consider using security tools after you’ve assessed
their impact
Remember

24.  EFF’s Surveillance Self Defense -
https://ssd.eff.org/risk
 Tactical Tech’s Protect Program –
https://protect.tacticaltech.org/
 Me and My Shadow https://myshadow.org/#
 Article 19’s Online Protection
Videoshttp://www.article19.org/online-protection/
Resources

25. Dirk Slater
FabRiders
dirk@fabriders.net
www.fabriders.net
Twitter: @fabrider
THANKS!!!