This document summarizes a workshop on security and privacy for online research. It discusses threats to privacy from surveillance like the NSA and how encryption can help. It recommends using browsers like Firefox that allow privacy-enhancing plugins, clearing history regularly, and using tools like HTTPS Everywhere, Ghostery and NoScript to block tracking. The TOR browser bundles these protections and anonymizes activity. The document also recommends a password manager, private search engines, backing up and protecting data, and securing communications with tools like off-the-record chat and GPG email. Resources on digital security and privacy for researchers and human rights defenders are provided.

1. Security and Privacy in
Online Research
Workshop at EASO Conference,
26th and 27th March 2014

2. Who we are
HURIDOCS: Malta
26th
March 2014
• HURIDOCS was founded in 1982
• Secretariat in Geneva, active around
the world
• Working with human rights
organisations on using information
effectively

3. What privacy?
HURIDOCS: Malta
26th
March 2014
• „The NSA has huge capabilities – and
if it wants in to your computer, it's in.“
Bruce Schneier,
http://www.theguardian.com/world/201
3/sep/05/nsa-how-to-remain-secure-su
rveillance

4. What privacy?
HURIDOCS: Malta
26th
March 2014
„Encryption works.
Properly implemented strong crypto
systems are one of the few things
that you can rely on. Unfortunately,
endpoint security is so terrifically
weak that NSA can frequently find
ways around it.“
Edward Snowden

5. What privacy?
HURIDOCS: Malta
26th
March 2014
• „Anything that requires them to
attack individual endpoint computers
is significantly more costly and risky
for them, and they will do those
things carefully and sparingly.“
Bruce Schneier

6. What privacy?
HURIDOCS: Malta
26th
March 2014
• Security is a process, a number of
practices – tools by themselves do
not solve problems
• Solution should depend on a threat
model – what do you want to protect
from whom?
• Four elements to consider: threats,
assets, adversaries, risks

7. Group work
HURIDOCS: Malta
26th
March 2014
• When doing online research, what are
the...
– Threats (group one)
– Adversaries (group two)
– Assets (group three)
– Risks (group four)
• Use as reference:
https://ssd.eff.org/risk

8. Solutions
HURIDOCS: Malta
26th
March 2014
●
Do not use Internet Explorer, Safari
●
In Chrome, Firefox, configure privacy
settings
●
Enhance privacy by using browser
plugins (and configure them)

9. Browser Settings
HURIDOCS: Malta
26th
March 2014
●
Do not store passwords in your
browser
●
Clear cookies and cache regularly or
after every session
●
Clear history regularly or after every
session
●
Use CC Cleaner to delete temporary
files, history, cookies

10. Browser plugins
HURIDOCS: Malta
26th
March 2014
●
HTTPS Everywhere – force encrypted
connections
●
Ghostery – stop tracking gently
●
NoScript – stop tracking the hard
way as well as malicious attacks

11. All in one
HURIDOCS: Malta
26th
March 2014
●
TOR Browser bundle is built on
Firefox, includes NoScript, HTTPS
Everywhere
●
Routes all traffic through TOR,
anonymises your online activity
(unless you login to a service that
knows you, e.g. Google)
●
Can be slow to use

12. Summary
HURIDOCS: Malta
26th
March 2014
●
Settings and plugins can
considerably increase your privacy
protection
●
They need to be applied consistently
to work
●
Using them decreases convenience,
but you can choose to what extent

13. Further
recommendations
HURIDOCS: Malta
26th
March 2014
• Forget passwords, use a password
manager (Recommendation: Keepass)
• Don't google, use other search engines
(Recommendations: DuckDuckGo,
Startpage)
• Back up your data, protect it from loss
• Learn how to secure your
communications (Off-the-record chat,
GPG email)

14. Resources
HURIDOCS: Malta
26th
March 2014
• Security-in-a-box, https://securityinabox.org
• Me and My Shadow, https://myshadow.org
• „Digital Security and Privacy for Human
Rights Defenders“, handbook
(http://www.frontlinedefenders.org/
esecman/)
• EFF tutorials for risk analysis:
https://ssd.eff.org/risk

15. Thank you for your
attention!
Visit us: www.huridocs.org
Contact me:
friedhelm@huridocs.org,
@whyfrycek