A new post from Nadim (of Cryptocat fame) which I think contains many important points. Specifically: tools are the wrong place to start from when making security plans.
This post has proven a bit controversial within our community, so I'm hoping we can all assume good faith and discuss this like adults.
https://nadim.computer/2016/11/13/software-trump.html
Jonathan,
I've read the posting by Nadim. It seems perfectly logical and utterly self-evident to me.
Micah Lee and others have proposed a minor subset of tactics (use Signal, etc) but have no new strategy for dealing with the new reality we face at inauguration day. Nadim's advice seems relevant to any groups dealing with enviromental, public health, corporate/surveillance/law enforcement and other issues. What's the controversy?
Thanks again for linking that article,
Keith
I don't get it—the argument is that safe software practices on their own aren't enough to counter the entire Trump administration (I agree!) so we shouldn't bother trying to spread them at all?
Moving forward, Nadim's right that we need to be cautious about what we recommend. This amounts to asking security folks to recommend tools and practices in a responsive way; giving people misleading advice can be worse than no advice at all. And there are some things that we know wont protect against the concerns he described (e.g., Privacy badger is a great tool… For online tracking, not protecting yourself from government surveillance.)
In his words
It is even more difficult to combat this kind of rhetoric when the advice these people are offering is fundamentally useful. Of course you should you use Signal (or another privacy-enabling messenger, such as Wire or WhatsApp, or my own Cryptocat.) Of course you should install Privacy Badger. Of course you should encrypt your disks. Of course you should use a stronger password. These are things that every able adult should do, same as every adult should brush their teeth twice a day and wear a seat belt. The problem here is that this advice is being peddled as if it is directly relevant to protecting oneself against a Trump election, and without any notion of a threat model or concrete security goals. It isn’t directly relevant, and it’s being communicated opportunistically, not responsibly and not intelligently.
I'm glad that he's pointing out we need to be more responsive to realistic security concerns in an unknown future. But this is kind of like saying two statements.
(1) We don't know what a Trump presidency will be like.
(2) We need to come up with a coherent threat model that is responsive to a Trump presidency.
How should we think about responsive threat models with relatively little information about what a Trump presidency will be like?
I agree with him that we need to begin talking about this more. We don't have the full picture, but what do we know so far? His post really made me want to think about a few different issues:
(1) What do we know about the Obama administration's capacities that will likely be carried over into the Trump administration?
(2) What do we think he is likely to change?
(3) I suspect that some tools and practices are not likely to go away for the near future. What are those?
I think that it conveys a false sense of security. In other words, secure communications (more-or-less) aren't panaceas for surveillance on a mass scale and certainly won't defend against a direct attack by a government agency.
In my opinion, Silicon Valley (I'm using that as a synecdoche, by the way) should assume the worst case scenario and plan accordingly. That means wholesale and shared privacy standards, amongst other things. It also implies coordination with civil liberty defense groups (e.g. ACLU, EFF, EPIC). It may mean some loss of revenue...so, if that's the case, I supposed it's not likely to happen.
Martin,
I think you're right about those points but - to me - the salient issue is raising the general publics' awareness/interest in the problem. Even the Snowden revelations did little in that regard. It seems to me that the only solution is a proactive one undertaken by Google, et al and implemented for the public without any need for an end-user to do anything at all. What do you think?
I agree that it's not enough, but it's a start. While we're all figuring out what a Trump presidency is even going to look like (truly no one knows!) and how to defend against it, let's get as many people using good, secure software as possible.
Sam,
I certainly agree with you. I've sent the Nadim Kobeissi article to an environmental organization I'm involved with and (to my surprise) it was acknowledged as useful and it will be circulated. Perhaps I'm too pessimistic...but, I doubt it.
This may be relevant:
It's a security guide for activists, which I wrote. Not tool-centric at all.
Just my two cents on this topic w/r/t the incoming administration: sometimes outlasting the status quo can be better than civil breakdown. Remember, over twenty thousand people died in a single day in the battle of Antietam. I don't come here to talk politics, but please do remember that the US is a pretty politically stable place to live, relative to many of the alternatives. It would be nice to keep it that way while also resisting injustice. Some people (not here necessarily, but on Twitter/Facebook/Tumblr, etc) seem to be longing for civil war. I would really hope that they temper their enthusiasm. Nixon happened. We're all still here. Just a thought. /end political opinion
Edit: Just so folks know, I am happy to help out any journalist with security, regardless of their politics, as long as what you publish a.) is not deliberately false or circulated without any fact checking, and b.) is in the public interest. For me, things that aren't in the public interest include: doxing, revenge porn (including stuff like the Hulk Hogan tape), and outing people from the closet without their consent. I'm not a partisan person. Good infosec, much like good first amendment law, is a necessary prerequisite for a functioning press and a vibrant & informed participatory public sphere.
So, if you don't like my politics, that's OK!
Also worth mentioning:
Signal got a 400% growth in the first seven days since the elections. So it might be a good thing to share it far and wide. Even though I highly agree with Nadim that this is not enough, making sure that Trump's government can't get access to your previous communications if they decide to do so later on is a damn good first step.
Ever since the election everyone has been trying to figure out how to leverage the newfound agency built in this election. I am one of the folks who thinks that we should not be focusing on "building up the baselines" with future targeted and vulnerable populations. I fully support doing this with the general populace. But I have had to help too many activists, journalists, and civil society organizations who are dealing with the digital security exhaustion of using a range of tools that don't directly address their high impact risks.
I have had all sorts of folks coming to me to help them plan digital-security training's and advise them on how the groups they work with should "gear up" to protect themselves. I finally sent back e-mails about how I think digital security advisers and trainers should leverage agency in this changing threat landscape that I decided to just write it up.
Bruce Schneier's "Cryptogram" blog today summarized his feelings and his plans for the next 4 years.