3.4 Case Study 4
Secure Email and Blogging

Outline

She is finding it increasingly difficult to keep working. Her articles sent by email do not arrive at their destination, access to her blog site has been blocked and she is afraid of endangering the people whom she interviews and mentions in her reports. She fears that her email is being monitored. On one occasion, an editor wrote to her surprised by the content of her recent article. On re-reading it, she realises that the article has been altered by someone on the way from her email box to the newspaper.

Threats

• cannot send articles by email
• cannot access her blog and update it
• her assumed identity could be compromised
• articles, stored on her laptop, are accessible to outsiders
• viruses or hackers could damage the articles on her laptop

Solutions

Secure email

This appears a simple and effective method for dealing the journalists' concerns. As long as the address bar in the Internet browser through which she accesses her email account begins with 'https:', she knows that her communications are secure.

Secure communications over SSL Riseup.net email accounts

As a further precaution, she writes to RiseUp and asks them to send the fingerprint of their SSL certificate. They forward her to a page on their website where this fingerprint is shown. The precaution she is taking here is against a Man-in-the-Middle attack, whereby the adversary intercepts the communication line to https://mail.riseup.net and attempts to fool the user into thinking they have arrived at the intended website. An SSL certificate is presented and, once the user accepts it, the connection is re-directed to the adversary's website. However, an inspection of the SSL certificate will show whether or not it is different from the original.¹¹⁰

Securing information

Even though she has managed to secure her email box, she would still like to make the articles she sends unreadable to anyone but the designated recipi- ent. This is done in case she loses her email password or it gets compro- mised. It is also a good precaution against Man-in-the-Middle attacks. She installs the Thunderbird email program and sets it up to read her RiseUp account. She adds the Enigmail extension to Thunderbird and follows instruc- tion in the Digital Security Toolkit to create a keypair that she will use to encrypt her articles to the public key of the editor¹¹¹. All parties that wish to commu- nicate securely with each other using the public key encryption system, will need to install relevant software and swap their public keys with each other¹¹².

Using encryption to secure sent messages

Sometimes, the use of encryption may alert the monitoring body. She does not know whether encryption is legal in her country and whether using it will just attract a lot more unwanted attention to her. She decides to employ an alternative method that will not immediately appear cryptic and hence suspicious. By using a steganography program, she can embed her article in a photo and upload it to an inconspicuous website. As long as there is a prior arrangement, whereby the editors know where and when to look for this picture/article, this method can bypass many surveillance systems. It should be implemented by maintaining a regular stream of similar activity (uploading photos to the Internet) and should not appear irregular in her normal pattern of activity.¹¹³

Using steganography to hide the presence of a message in your communications

Anonymous email

Another way of countering email blocking and censorship is to use an array of popular free webmail services. Yahoo, Hotmail, Gmail and others have millions of registered users. It is possible to create a completely new account every time you wish to send an email. The registration details can be random and, if sent from a public space (e.g. an Internet café), the email would be very difficult to track.

It is likely that secure email services (like RiseUp) may already be blocked or will become blocked after frequent use. Only a handful of countries block access to large free email systems, like Yahoo. However, these global providers have in the past cooperated with some governments (e.g. the Chinese government) in giving the latter access to their users' email accounts. Should our journalist decide to use a large webmail provider, her usage must be limited to accessing it from an Internet café or other public space, where her details are not recorded and the IP address, from which the email is sent, cannot be traced back to her. She can also create accounts using a pseudonym, pre-arranged with her editor.

Circumventing website blocks

To access her blog site, the journalist will require different methods of cir- cumventing the Internet block inside her country. The choice of tools will depend on the government's blocking practice. For example, she could register to receive news of the latest anonymisers from Peacefire¹¹⁴ or ask one of her friends living in a country that does not censor the Internet to set up Psiphon (see Chapter 2.6 for further explanation) for her use.

With an anonymous proxy, the destination website will not know where your computer is really located

Alternatively, she installs the Tor Browser115 on a USB memory stick, so that she can operate without any blocking restrictions whatsoever. Tor will anonymise her website requests and will penetrate the majority of national censorship systems.

It is often easier and more practical to ask a friend from another country to upload your articles onto your blog. The articles can be transmitted by secure email.

Protecting identity

At present, the journalist does not wish her identity to be linked with her pseudonym. She is very careful to not include her real name in the emails and articles she sends through the Internet. Nor does she use her ISP email account, as it is linked directly to her. She only uses her home Internet connection to access a secure webmail account or does it in conjunction with an anonymity tool when updating her blog.
Some Internet cafés in her town have begun to record their users' names and times of access. She avoids these cafés, as Internet and email activity can traced back to the computer's IP and eventually to her.
When using a computer in an Internet café, she is very careful not to allow the browser to remember her passwords and browsing history. At the beginning of her session, she spends a couple of minutes configuring the Internet browser to be more secure and deletes all saved information from the computer at the end¹¹⁶.

Securing laptop

Passwords

To sum up, she has a bag of different tricks and methods to use at her discretion. At first, they may appear laborious and time-consuming, but she knows that her security is paramount. Perhaps a secure laptop and email address will be enough for her to continue her work. As some methods of protection become obsolete or unavailable, she may choose different solutions. The Internet is a vast landscape, with many possibilities for both surveillance and anonymity.