Risk analysis and remediation — an example with phones at protests [security.102.1]

by | Jul 15, 2022 | 1 comment

Length: 10 minutes

Let’s take a more in-depth look at the theory we use in this guide to evaluate risk. In the previous section, I talked about using risk and severity to judge a threat, but you might be wondering how to apply that concept to situations you will face in the real world. Let’s look at one more real-world example and figure out how they apply to your average activist.

Phones at protests

Several protest guides I’ve seen floating around the web tell people to leave their phones at home. Why is this advice so common? Let’s think of some reasons why its good advice:

  • Your cell carrier (and by extension, the police) can’t track your phone if you don’t have it. This can prevent police from being able to prove you were at a protest later. You don’t need to worry about leaking data from a device you aren’t carrying at all. Simple and effective!
  • Conversations in-person are much harder to record or have used against you compared to online conversations. Having a conversation recorded in public is challenging; it’s easier to screenshot or subpoena an online conversation.
  • You may already know the route of the protest or are familiar enough with the area to know how to get to the protest and back home without a phone. Why risk taking your phone if you don’t need it?
Generated with Disco Diffusion 5.2

But most people (at least that I’ve seen) don’t leave their phone at home when going to a protest. Why? A few reasons:

  • Most people have their phone on them 24/7 and are loath to part with it for any reason.
  • Some people rely on their phones to communicate with each other using secure apps like Signal. When you leave your phone at home, you can be cut off from others. This can be especially important when marshalling.
  • Many police departments have software that uses facial recognition and other tools to identify people at protests. This software scans thousands of photos posted online and private cop databases. You can prevent police from getting your phone history, but depending on how much they are out to get you, they might be able to construct a timeline from CCTV cameras, police cameras, and photos/videos posted to public social media pages.
  • Most people don’t have a dedicated camera, they use their phone. Countless photos and videos of illegal police activity at protests has helped put public pressure on police departments. Leaving your phone at home with no dedicated camera means you aren’t ready to capture these moments.

What do you think the likelihood of getting arrested at a protest is for you, and how impactful would it be? Is the protest likely to be calm and go as planned, or is it larger than expected? Do you need to communicate with others digitally, or are you going with a group that can stick together? If the police take your phone, what information will they get? Are they going to let you go, or will they call in the big guns at the FBI?

The rest of this guide will assume you evaluated the risk and decided to take your phone to a protest, which matches what I see in the wild. Let’s talk about how we can reduce the risk of this behavior!

Generated with Disco Diffusion 5.2

Risk Reduction

There are several ways we can reduce the risk of taking a phone to a protest, and we’ll cover two right now – the SOS trick and disabling biometrics.

Don’t look, don’t touch

Before a protest, you should go into Settings and completely turn off biometrics (Face ID, fingerprint) until you’re back home. This will prevent cops from – legally! – unlocking your phone against your will and rifling through it. Yes, you could close your eyes or ball up your fingers, until the rubber hose comes out.

Security
The foundational text of internet security. Credit: XKCD (link)

While still illegal, it’s not unheard of for cops to beat secrets of prisoners – but it’s much harder, costlier, and riskier than them plugging your phone into a hacking device that just hands over the data. Also, the hacking device cops use is under constant development. Given enough time, no phone is truly safe. iPhones tend to last the longest before a flaw is found that compromises their encryption.

So, when you’re near me, darling, can’t you hear me? S.O.S

But what if you forget? Or, what if you are approached by police unexpectedly – when you don’t have time to turn everything off? The SOS trick is a quick way to disable Face ID and fingerprint unlock.

On iPhone, hold the side button and a volume button until the power off and SOS sliders appear. That’s it! Your iPhone will now require your passcode once to turn on face ID again. This is easy to do from your pocket without pulling your phone out, and a phone with face ID disabled is very difficult for police to get into.

The volume button is located on the left side of the device, and the side button is located on the right
To temporarily disable Face ID, hole the side and Volume Down key.

Recent Android phones have something similar called Lockdown Mode that can be enabled under Settings > Sign in & security. Usually, you can activate it on the Power menu. Unfortunately, this can vary greatly by manufacturer and software version, so I can’t give general advice.

Turning off your phone completely will also require your passcode on startup, and provides another layer of protection (more on this later). This is something easy and simple people can do that, in the event they’re arrested, prevents a bad situation from being much worse. For newer iPhones, it’s almost impossible for police to get the data if Face ID is disabled.

One more thing…

Before we wrap up, two other phone tips: If you use a wearable device, like an Apple Watch, make sure it cannot unlock your phone or laptop by being nearby. Also, make sure your phone has the latest software updates.

Recap

We took an issue — our privacy and safety at a protest — and thought about it on the axes of risk (carrying a phone) and probability (the phone being searched by police). We then used a simple trick (disabling biometrics) to greatly reduce the risk of the activity.

You may have come to a different conclusion than me about carrying your phone at a protest! Either way, I hope the method of using risk and probability to make security choices is clearer.

We’ll keep using this risk analysis framework throughout the course. For the next lesson, let’s start talking about why it’s harder for police to get into your phone when there’s a passcode on it.

The above content is part of a course on socialism.tools. If you login, you’ll see quizzes and links to other lessons in the course.