Data Security: How to protect yourself, your sources, and your stories
1
Julien Martin
Data & Research Unit
(01/2016-01/2019)
World Conference of Scientific Journalists
Lausanne, 4 July 2019
It’s never going to be fully secure
Leaks, breaches and attacks can occur everywhere
Understand technologies, procedures and their limits
When possible, avoid technology; use it when needed, not by default
Practical decisions depend on your threat model (context)
2
bit.ly/wcsj19-datasec
Threat modeling or what’s the situation?
What do I want to protect?
(documents, names, locations, people, device, …)
From whom? Who is (not) a potential threat?
(corporation, government, criminal organization, …)
What are the risks? What can they do/afford?
(Life threat, physical or legal harassing/attack, theft, eavesdropping, revealing source’s identity or a crucial document, …)
What can I afford? (effort, time, inconvenience, people, tech., …)
3
bit.ly/wcsj19-datasec
Some security and privacy principles
<Confidentiality, Integrity, Availability> and
<Security, Usability, Functionality> are
inter-dependent properties
Improving one comes at the expense of the others.
4
bit.ly/wcsj19-datasec
Some security and privacy principles
5
bit.ly/wcsj19-datasec
Data security, practically
6
Prefer passphrase over password
Passphrases are
usually stronger
and easier to
remember than
passwords.
7
https://xkcd.com/936/
bit.ly/wcsj19-datasec
Set a single master passphrase
A password manager generates and
stores “strong” and unique passwords
for each of your accounts, from a single
master passphrase.
e.g. Keepass
8
bit.ly/wcsj19-datasec
Set up two-factor authentication
2FA requires a second step of verification for log in
Gmail, Facebook, …
e.g. a code generated by the Google Authenticator app on your phone.
9
npinfo.com
bit.ly/wcsj19-datasec
Encrypt your devices
Enable full disk encryption of your devices, in case of theft
Veracrypt provides plausible deniability, especially useful for travels / customs checks
(Allows hidden disk volumes and hidden operating systems)
Accept data from sources with SecureDrop
10
bit.ly/wcsj19-datasec
Share PGP encrypted files
Use tools that follow OpenPGP standard:
GnuPG on Linux
GPG Suite on Mac OS X
Gpg4win on Windows
11
bit.ly/wcsj19-datasec
Send PGP encrypted emails
FlowCrypt (Gmail) or Mailvelope (Webmail)
Enigmail (Thunderbird)
ProtonMail
Set message expiration, if possible
Email and messaging services leave traces on servers (metadata)
12
bit.ly/wcsj19-datasec
Use encrypted messengers
Signal Keybase
Wire Olvid
Set message expiration, if possible
Email and messaging services leave traces on servers (metadata)
Olvid claims metadata encryption (but is a recent product)
13
bit.ly/wcsj19-datasec
Beware the metadata
— “Metadata absolutely tells you everything about somebody’s life. If you have enough metadata, you don’t really need content.”
Stewart Baker, NSA General Counsel
— “Absolutely correct, (...) We kill people based on metadata.”
General Michael Hayden, former director of the NSA and the CIA
www.nybooks.com/daily/2014/05/10/we-kill-people-based-metadata/
14
bit.ly/wcsj19-datasec
Hide your location and activity
Hide IP address and activity from third-parties ( not all!) with
over a Virtual Private Network
(VPN provider can log your IP)
NordVPN , ProtonVPN , RiseUpVPN
15
bit.ly/wcsj19-datasec
Hiding your location and activity
Comparitech.com
16
bit.ly/wcsj19-datasec
Mitigating the risks, in general
Whenever possible, turn your devices off and do things the old fashioned way
17
bit.ly/wcsj19-datasec
If you can’t mitigate the risks anymore
has a mission: bypassing any form of censorship by publishing [your] stories.
We offer journalists working on a sensitive issue a secure way to backup their work with us.
In case something happens to the journalist, we will be able to pick up the investigation, complete it, and publish it broadly.
18
bit.ly/wcsj19-datasec
How ICIJ’s Datashare project will help journalists breach borders
19
The International Consortium of Investigative Journalists
A small non-profit organization based in the US
A global network of:
A pioneering data journalism team
20
bit.ly/wcsj19-datasec
21
~ 370 journalists from 75 countries
bit.ly/wcsj19-datasec
Real-world Impacts
22
$1.2+B
bit.ly/wcsj19-datasec
From a single data provider
23
Knowledge Center
bit.ly/wcsj19-datasec
To a global network of data providers
24
Knowledge Center
bit.ly/wcsj19-datasec
DataShare: security by design
Security work in collaboration with the Security and privacy engineering research team at EPFL, Lausanne
25
bit.ly/wcsj19-datasec
Empowering reporters
26
Gabriela
ICIJ member
Gabriela is awash in a flood of potentially damning documents linking a government minister to contract price-fixing.
We’ll call our fictional minister João Silva.
bit.ly/wcsj19-datasec
Empowering reporters
Gabriela
“João Silva”
Lucas Machado
Engenharia Inc.
São Paolo
bit.ly/wcsj19-datasec
DataShare processing chain
(3) Extract Names
(2) Extract Text
(1) Scan Folder
bit.ly/wcsj19-datasec
DataShare global network
29
?
Gabriela
ICIJ member
Knowledge Center
Would someone have documents about
João Silva ?
Hey! There’s a match
for João Silva!
bit.ly/wcsj19-datasec
Connecting reporters’ data
30
Gabriela,
ICIJ member
Anastasia, ICIJ member
Can I get access to some of your documents?
Maybe. Who are you and what was your query?
I’m Gabriela and had searched for João Silva
Alright, let’s have a conversation first.
Here are the documents
about João Silva
bit.ly/wcsj19-datasec
Some References
31
bit.ly/wcsj19-datasec
32
Thank you!
julien.pierre.martin@gmail.com
bit.ly/wcsj19-datasec