September 19, 2017
Among the many revelations into the systematic repression of the human rights community to have come to light since the beginning of the 709 Crackdown have been accounts from those released about the access of police and state security to chat logs and emails, even communications and documents those people thought they had deleted.
This heightened awareness has certainly pushed the idea of taking digital security precautions in how to prevent sensitive information from falling into the hands of police in the event of detention. However, the focus of trainings and guidebooks is often directed in the wrong direction, namely on more advanced hacking and sophisticated intrusion. This continued focus on advanced threats actually has and will continue to harm human rights defenders’ safety. This is because it is not only nearly impossible to defend against such high level threats but that also in almost every case this is not the real threat. In the end, time is consumed trying to defend against a largely non-existent threat.
It is true that the capability of the Chinese Government concerning data forensics and hacking has developed like other aspects of the country, but those often limited resources are used against other bigger, and usually international, targets. On top of that, police and state security know well that the impunity with which they can act means that they have more direct, easier, access to whatever a human rights defenders’ computer or phone might hold; namely the use of direct threats, torture and intimidation against family, friends and loved ones. There are exceptions, but against these tools of repression, few people can stand up for long.
Real security must thus be based on the fact that a defenders’ computer and phone will be taken, and chances are that they will be forced to give up the information the police is after. The threat of torture or disappearance is sadly quite effective against even the best password or encrypted file. Any training and training material must be based on this reality. Digital security requires physical and behavioral changes in addition to passwords and applications.
The reality is also that digital security solutions that decrease the efficiency of our phones and computers are likely to be abandoned after time, regardless of the quality or number of trainings the rights defender or journalist has attended. Security solutions are only solutions if they are actually applied and maintained, something a lot of training material seems to gloss over when they offer solutions that are realistically not feasible for the majority of rights defenders.
Real security, that is sufficient and sustainable, can only come from finding the middle path, by focusing on real threats, while offering solutions that come from basic behavior rather than advanced technological solutions.
The newly released Practical Digital Protection self-study guide has been developed with these considerations in mind. It was developed over 12 months, together with journalists, lawyers, NGO workers and rights defenders across China, looking at their own experiences with security issues, detentions, interrogations and data forensic techniques applied by police and state security. The manual doesn’t only provide behavior-based solutions, but also real-life stories from defenders illustrating how their own best or worst case solutions have had a direct impact on how their technology has either been used against them, their partners, and coworkers, or prevented from being exploited by the State.
The following abridged story is one of several from the Practical Digital Protection manual.
A seasoned rights defense lawyer received a message on Telegram from a trusted colleague that the police had been asking questions about her and that she should expect to be detained or at least questioned. She had at this point already taken on many rights defense cases and worked with many other similar lawyers for several years. She was quite skilled in cybersecurity, having always been afraid police might detain her or take her computer and try to use her information against her. She rarely used WeChat, and never for work. She even knew how to use hidden encryption, not only to protect the data itself, but also to hide its very existence. Police can’t ask about what they don’t know exist she figured, correctly.
The information she had wasn’t just about her, but also about others. If this information fell into the wrong hands it didn’t just mean possible imprisonment for her, but for others. She had already been smart enough to realize that normal encryption would be of little help. If police knew what to ask for, she doubted that she would be able to resist for long, as she as a lawyer was well aware that the legal protections against torture and mistreatment in China are barely worth the paper they are written on.
When the police eventually detained her and placed her alone in a cell, to undergo more than a month of interrogations, they also seized her computer, several phones, and USBs.
After a few days in detention, she was very surprised when the police began to start each new day by showing her documents from her computer. She knew these documents had been stored in a hidden encrypted space that the police did not have access too, or even knew about. She was frantic each time the police produced one of these documents. These documents threatened to expose some of her sensitive rights defense work and provide evidence that would make it easy for the police to go after her clients or other lawyers she had worked with.
Before being detained she had agreed to a cover story with her colleagues who might also be detained. Some of the documents the police produced challenged their cover story, and severely increased hers and their risks.
The documents the police had were very random. Many of them were also just partial, a few pages of a larger document. How did they get these documents, she continued to wonder.
In the end, the police did not find the ‘smoking gun’ they were looking for, and even though she remains to this day under threat, having been released on ‘bail’, with police able to pick her up again any day they wish, the fact that most documents remained protected saved her.
Only after her release, with time and access to information online did she figure out what had gone wrong. File Recovery program it read. With this, she would learn of something that even many of those skilled in Cybersecurity fails to understand, or if they do understand it, fails to realize how big of a threat it is.
Data, she realized, are like memories. They linger for a long time, and even when they begin to fade, it happens slowly, and only parts of it disappear. Data, once ‘deleted,’ she realized, is not actually deleted, but continues to lie on the hard drive, only not visible to the normal user. It’s all still there, until the space holding the data is filled up with something new. The fact that most of data was in an encrypted space didn’t always matter, as many of the documents she had produced over the years had been created on the desktop (outside the encrypted area), before being moved to the encrypted space (which leaves traces of the original). An act of laziness. Many documents had also been deleted over time, she like most thus assumed they were safe. It had been deleted after all.
So what had happened? All those documents that had been on her normal hard drive, once moved to the encrypted storage, were readily available to the police using File Recovery, easy to use programs available for free online. All they had to do was scan her hard drive in detail, and step by step pieces of old data long ago deleted could be put together. This is because the documents weren’t properly erased from her computer. But there are solutions. Programs such as CCleaner for example, securely delete files to make sure nobody can ever recover them. Understanding how data deletion really works, and making secure deletion part of a normal routine will drastically increase security.
Safeguard Defenders new practical digital protection manual (English and Chinese editions) can be found at practicaldigitalprotection.com.
In addition to the current Chinese- and English language editions, other editions are being produced in collaboration with Reporters Without Borders, with a Vietnamese and a Turkish edition coming this fall.
