Tag: encryption

Anarchists Publish SecOps Guidelines

According to info sharing and analysis centers, anarchists published a new handbook focused on developing secure communications infrastructure on 6 October 2022.

According to Welund, anarchists produced a new handbook focused on developing secure communications infrastructure in early October 2022 [1]. In this publication, called The P.E.T. Guide: New Communication Infrastructure for Anarchists [2], fundamental methods and structures for protecting digital communications are established:

  1. Peer-to-peer: messages are not routed through a centralized server as with Signal and other common communication interfaces, effectively discarding the ability to collect most relevant metadata.
  2. Encrypted: intercepting messages become useless because it is data is only readable by sender and receiver.
  3. Tor: uses anonymous networks with multiple hubs to communicate data, thereby anonymizing the sender.

Given that digital communication is essential for “coordinating, collaborating, and staying connected” [2], anarchists are calling for continuous scrutiny and review of existing digital communication platforms and practices in an aim to strengthen group resilience, security, and enhance effectiveness. This text identifies “adversarial capabilities” [2]—i.e. capabilities of local and federal law enforcement and intelligence agencies–related to monitoring and/or intercepting digital communications, dissects vulnerabilities in Signal (app) security, and proposes the use of two alternative digital communication applications; Briar and Cwtch, which mostly mitigate the vulnerabilities addressed.


According to the Center for Strategic and International Studies (CSIS), “anarchists remain a persistent problem in the United States, though they pose a low-level threat—both in terms of lethality and rate of attacks—in comparison to other extremist movements” [3]. However, 92% percent of U.S. militant anarchist attacks and plots recorded since 1994 have been directed at property and infrastructure [3]. As such, for security operators and analysts concerned with detecting and analyzing threats to the bulk electric power system, changes in the communications infrastructure used by domestic extremist groups provide relevant inputs and may help define strategic changes to the intelligence collection process moving forward.

The handbook was posted on October 6, 2022, by the site It’s Going Down,[1] and later shared by sites such as the EarthFirst! Journal,[2] and Anarchist News[3].

Sources:

[1]Welund, “New anarchist secure communications handbook,” 9 October 2022.
[2]Anonymous, “The P.E.T. Guide: New Communication Infrastructure for Anarchists,” [online], 2022.
[3]G. Hwang, “Examining Extremism: U.S. Militant Anarchists,” Center for Strategic and International Studies, Washington, D.C., 2021.

[1] hxxps://itsgoingdown[.]org/the-guide-to-peer-to-peer-encryption-and-tor-new-communication-infrastructure-for-anarchists/ (defanged)

[2] hxxps://earthfirstjournal[.]news/2022/10/08/the-guide-to-peer-to-peer-encryption-and-tor-new-communication-infrastructure-for-anarchists/ (defanged)

[3] hxxps://anarchistnews[.]org/content/new-communication-infrastructure-anarchists (defanged)

S2 Underground: One Time Pads/Encipherment

If you taken the Groundrod course from Combat Studies Group, then you’ve learned about one-time pads, but maybe you need a refresher. Maybe you’re completely unfamiliar with this method of encryption which is considered unbreakable unless your pad is compromised, either through being stolen or if it was not randomly generated. Get an introduction or refresher from S2 Underground in this video.

American Partisan: Signal App Compromised? Not So Fast…

NC Scout at American Partisan talks about the supposed compromise of the secure messaging app Signal in Signal App Compromised? Not So Fast… Remember that encryption works, and because encryption works the people who want your data will do anything they can to convince you to just not take the effort to use it.

Much has been written about the supposed compromise of Signal as a so-called ‘secure messaging app’, with some sources being a bit better than others on the matter. I’ve had a ton of questions about it over the past couple of days, and almost all of it doesn’t revolve around the issues with an app itself, but rather, the tradecraft errors behind using it.

First things first, almost everyone I come into contact with in the Liberty community, absent those with serious .mil backgrounds requiring at least a primer in tradecraft, have no idea what they’re actually doing. That statement is not meant to deride, far from it; its simply the truth. When it comes to communications, most are looking for a replacement: a methadone for a heroin addiction, if you will- to their incessant need for a phone. This is especially true when it comes to the instant gratification of messaging. I’m reminded of Russell Crowe’s line from a movie long since memory-holed, Body of Lies, saying “we just need al Saleem on the phone. Langley’ll do the rest.”

And they did.

Signal, as a software, does what it claims to do. On top of that, the source code for the app is open source and subject to anyone’s audit or modifications, should your skillset include the expertise in that area. And should you have that level of ability, you can even modify it to suit your needs running a code off the beaten path while still utilizing Signal’s network. It is end-to-end encrypted, after all. And what exactly does that mean? It means that the administrators can see that someone is accessing the network, but not what is being passed along it, much the same way that TOR actually works. Even with audio calls, the system does what it claims to do.

So let’s discuss the actual vulnerability in question.

According to documents filed by the Department of Justice and first obtained by Forbes, Signal’s encrypted messages can be intercepted from iPhone devices when those Apple devices are in a mode called  “partial AFU,” which means “after first unlock.”

When phones are in partial AFU mode, Signal messages can be seized by federal authorities and other potentially hostile interests. GrayKey and Cellebrite are the tools typically used by the FBI to gain this sensitive information, an expert has explained.

“It uses some very advanced approach using hardware vulnerabilities,” said Vladimir Katalov, who founded the Russian forensics company ElcomSoft, believing that GrayKey was used by federal authorities to crack Signal.

So its not the app after all, but rather the hardware’s setting. A vulnerability which, since its a hardware exploit, likely applies to every messaging app. So tradecraft, or the lack thereof, is the heart. As per the usual. And the hardware in question is the hipster device of choice, an Apple iPhone. Shocker. But I thought Apple prided itself on user security?

Maybe at one point. But clearly no longer. Must be all that CCP money. And the real kick in the groin is that (shocker, again!) the FBI (or any other domestic security agency) can get into your phone without your handy little thumbprint. And just because they didn’t mention Android, don’t think its not every bit as vulnerable. It is.

So let’s talk about how to mitigate it.

First, understand the levels of data collected from cellular devices. I’ve discussed this ad nausem in the past. Your phone is constantly tracking you, no matter what you do absent putting it in an EMP bag, and if you cannot fully comprehend this reality then you’re really, really far behind the power curve. The lone answer is moving to using wi-fi only mobile devices for communications using open source apps. Wifi is common enough even in rural areas and if the technology is beyond you, so is your usefulness in a direct action cell.

Second, understand how to properly message people. The magic blanket of encryption may conceal our message but it neither conceals our presence nor our patterns of life- and in particular, who’s being messaged. This requires first discipline, and second, a pre-arranged (and trained on) code. One Time Pads work quite well, but a pre-configured Trigram or Brevity matrix works as well. On top of that, messages should be set to delete after a short period of time. Signal enables this, and if the message is important (it should be if you’re using Signal to send it), write it down. Clandestine messages are usually one-way as it is, requiring no overt response. Or if a response is necessary, respond through another backchannel (the same way I teach communicating on two different frequencies simultaneously in the RTO Course). Further, group messages of any more than two individuals is an instant non-starter. This violates even the most basic rules of clandestine cell organization and why Liberty groups feel the need to broadcast everything to everyone, I’ll never understand. Maybe you’ll learn one day. Domestic Black Sites are real.

Last, what you’re using as a so-called daily driver, ie your surface phone, is absolutely not used for this role. One of my own personal objections to Signal is and has always been the requirement of a phone number for registration. My Sudo allows us to bypass this by generating another phone number, but alternative apps such as Wire and Threema register via an email account…far, far better. And on that note you did install it on your own, absent Google play, correct?

So with that said, what do I think of this so-called ‘compromise’? It think its a smoke screen for CCP / Apple to keep their own compromise hidden in the details, as well as a smoke screen for disgruntled feminist intersectionalist IT workers behind the scenes at Signal unhappy that anyone other than AntiFa degenerates and washed up Agency Spooks would be using their app. For me, Signal is the C in my PACE plan- the ability to contact those using cell phones from my own wifi device, should the need arise. I don’t hang my hat on its ability outside my control. Neither should you. And the fact that a lot of people in this community do underscores just how behind the curve some of the louder voices really are. No matter what you’re doing, the correct answer is always using open source systems, have a PACE plan, follow the Moscow Rules and if there’s any doubt, there is no doubt.

AmRRON: Red Ryder BB Gun OTP Contest for Young Partisans

AmRRON announces their 2020 Christmas Red Ryder contest. More info through link.

Young Partisans! Radio Free Redoubt brings you another chance to win one of TWO Red Ryder Carbine Action 600-shot  BB guns, with a compass in the Stock and this thing that tells time, just like Ralphie in the movie, ‘A Christmas Story’.

Straight from the Daisy Museum, this year’s rifles will be engraved with ‘AmRRON YOUNG PARTISAN on the receiver!  A REAL COLLECTORS EDITION!

Learn how to decode One Time Pad secret messages just like real spies do, and enter to win your very own ‘Christmas Dream’ Daisy Museum BB Gun! Must be under 18 years old (it’s an honor system!).
-John Jacob Schmidt

 

How to participate:

    1. Listen to the John Jacob Show anytime after 8pm, Sunday night December, 6th at

      Episode 20-40 Young Partisan OTP Christmas Contest – The Secret Code Numbers

    2. Write the numbers down exactly.
    3. Then, go to the posting titled, “Christmas Red Ryder 2020” for further instructions!
    4. The drawing will be held Sunday evening, December 16th on Radio Free Redoubt

Kids, you might need your parent’s help. They can assist you using the OTP–A Simplified Exercise by JJS. It will walk you through the steps for decrypting a OTP message.

 

IntelTechniques Chart of Digital Communication Security

A section on Email application security from IntelTechniques

IntelTechniques has a chart they put out last month covering the security of voice, email, messaging, and video applications. Click here to view the page. Some explanations of the terminology used:

E2EE – end to end encryption. E2EE is good to have. If something is encrypted, but not end to end, then at some point in the data’s journey between two end points it is “in the clear” for anyone to view.

Country of ownership is there to indicate the likely laws governing privacy or to investigate how easily a company submits to subpoenas for access to their servers.

14-eyes association is another name for SIGINT Seniors Europe or SSEUR – an association of fourteen countries around the world who all share surveillance data with each other. For example, the US may have a law that makes it illegal to collect surveillance data on a US citizen without a warrant, but they can ask an ally from SSEUR to share that same data with them because it wasn’t collected by the US agency.

Open Source is the name for software where the program source code is available to the public to check (and even modify under conditions of the various open source licenses) for accuracy, security, or other reasons.

Third-party metadata – does the application allow metadata access (such as To, From, Subject, source IP, etc) to any third parties?

Third-party analystics – does the application allow any third party to analyze traffic that passes through the application system?

Ephemeral messages – An ephemeral message is one that can or will disappear from both the sender and receiver devices after some amount of time.

Third-party audit indicated whether the application source code has been audited by a neutral third party for security problems.

I believe that most of the other terms are more easily understood.

Brushbeater: No Encryption, No Problem – Analog Radio Operations For Guerrilla Units

NC Scout at Brushbeater blog writes about communications security in No Encryption, No Problem: Analog Radio Operations For Guerrilla Units

Since I started the Brushbeater blog project back in late 2015, a constant question I’ve got in emails has been about communications security and very often how to use encryption over the radio. Back when I got into the civilian side of operational communications and I no longer had uncle sugar providing my equipment, I had all those same questions and none of the answers. Encryption and communications security is generally verboten among the old-time Ham crowd. Asking about it immediately can gain a novice the cold shoulder- it’s just one of those things that’s best left unasked, figured out on one’s own, or asked once you’ve got in the good graces of the locals (community building, anyone?). For me it was and is a creative outlet, allowing all the fun stuff I did in the Army to be a useful skill and one I teach others.

Since communications in general, like patrolling, like TC3, and like basic survival are all topics woefully misunderstood by civilians, an area as complicated as securing analog transmissions can go way over people’s heads in a hurry. It’s a different skillset than what you’re either used to seeing or doing. It requires a little understanding about radio theory, a little understanding about the planning process, along with some other skills like how to use a compass and basic awareness of your operating environment. Above all, it takes experience; you can’t just talk about it, you gotta do it. That said, we also have to recognize that the equipment we have is the equipment you’re going to be working with when things go sideways. No magic gear fairy is going to drop you a bundle of PRC-152s, much less the working knowledge to use them. So learning to use what you have in hand to its maximum capability is a heck of a lot more important than hanging out in fantasy land with stuff pushed by hobbyists.

Communications Security Begins With You, or, Encryption Won’t Save You

In a recent conversation with a friend and fellow well-seasoned vet, we brought up some of the obstacles facing would-be partisans that many preppers don’t take into account. Logistics being a HUGE one (if I burn through 500 rounds doing “supporting fire” aka just making noise, who resupplies my ammo?) but also the enablers a lot of the contemporary veteran crowd are used to having but cannot expect in the near future. NSA Type 3 AES encryption comes to mind here. We took a lot of resources for granted, especially in the commo department. We had/have an enemy who generally lacked any real electronic warfare (EW) capability, with the result being incredibly sloppy communications practices. The reliance on electronic security left a lot of the old common practices in the dust, many of which are once more very relevant today. Since about 80-90% of the prepping crowd’s electronic signal devices are limited to VHF/UHF dual band analog handhelds, you have to stop thinking in terms of simply press n’ talk if you want to even begin to be secure. The presence of a pattern of signals, even if encrypted, digital, analog or whatever, will give you away if you lack basic discipline. The saying everything that’s old is new again comes to mind, because a lot of the old hand practices developed in Vietnam for rural patrolling are the first place to begin. What was high tech for them is dirt cheap today. And the training value in their blood soaked lessons shouldn’t be lost on you.

But first, why do you need a radio? A lot of folks buy gear just for the sake of buying something. The first thing you should be asking yourself is exactly what your goal is and then work towards that instead of buying a whole bunch of something, because someone told you to, only for it not to be used. If that goal is talking with others in your group on the back forty, that’s one thing. If it’s rural patrolling, that’s another. Electronic communications, of any type, are the least secure method of communication. Messengers are the most secure. When getting started you’ve gotta figure out what it is you need to do. You might find you don’t need as much as you think; keeping it simple goes a long way. And for those of you only concerned with a homestead right now, COMSEC (communications security) is a very real issue for you whether you know it or not. A common surveillance mission for us was called “patterns of life”, where we watched a place for several days. Surveillance means everything, including the signals coming from the target, which in turn can provide a high amount of intelligence value due to shoddy practices. If you’re lazy, someone who learns a few signals intelligence techniques can not only find you very easily but listen to all your voices, get your names, know your timelines, and finally, disrupt you to the point of shutting you down, usually once they’re ready to attack. I know, I’ve done it in real life. So all of you only relying on those walmart FRS radios are very easy prey.

Contras on patrol hunting commies. Notice the handheld radio (HT) on the RPK gunner’s chest. Inter-team radios should be placed among the leaders of maneuver elements, including force multipliers such as your machine gunner / Automatic Rifleman / Support By Fire and Designated Marksman (DM).

It’s important to point out the difference between tactical communications and clandestine communications. Tactical communications require immediate action and either give short orders or brief reports and are local in nature. For preppers, these are for retreat security and short duration patrols; snoop n’ poop around the woodline to make sure nobody is waiting on us to go to sleep. The RTO Basic course focuses almost entirely on tactical communications. Clandestine communications are long term, far more in depth messages that usually use multiple layers of encoding- this is where the One Time Pads come in– and are sent to cells working over a region. These are referred to as cables in the intelligence field. Numbers stations come to mind, and that’s a whole other conversation entirely…(continues)

Crimethinc: Tools and Tactics in the Portland Protests

Ready or not—the war is on.

This article at Crimethinc brings together a lot of other articles and social media thread to show the many tactics used by rioters in Portland, from using shields and umbrellas to lasers, fires, and digital security – Tools and Tactics in the Portland Protests.

Across over two months of protests, demonstrators in Portland have experimented with a variety of tactics and strategies. The clashes in Portland drew international attention starting in mid-June, when footage spread of federal agents in unmarked cars snatching demonstrators off the sidewalks and Donald Trump announced that federal agents would be using this model to intervene in other cities around the United States. After Trump’s announcement, the demonstrations in Portland grew exponentially, drawing thousands each night, until the governor of Oregon declared that federal agents would be withdrawn from the streets. In the following overview, participants in the Portland demonstrations describe some of the tools and tactics they have seen employed there.

Many of these tools work best in combination with each other. As usual, diversity of tactics is key—not just tolerance for different approaches, but thinking about how to combine all of them into a symbiotic whole. Soon, we aim to follow up this cursory review with a more thorough accounting of the full range of street tactics and equipment relevant to today’s demonstrators.

The Portland protests have also produced some new terminology, such as the expression “swoop,” which describes what happens when a reformist with a megaphone makes a power play to hijack a gathering organized by people who want to see the police abolished. As demonstrators expand their notions of what tactics are appropriate in this swiftly polarizing society, we hope they will also expand their visions of what is worth fighting for, adopting horizontal models of organization and learning how to identify and resist power plays.

Table of Contents

Digital Security
Masking and Proper Attire
Riot Ribs, Food Carts, Infrastructure
Leaf Blowers
Umbrellas
Shields
Sports Equipment
Balloons and Bubbles
Lasers
Graffiti
Paint Bombs
Fireworks
Fire
Fence Toppling
De-Arresting
Crowd Movement
Disabling Cameras, Breaking Windows
Legal Support, Jail Support

Digital Security

This thread spells out how to protect your privacy via proper phone safety at demonstrations—before, during, and after the protest. You can find a lot of important information about general security in protest situations here.

Masking and Proper Attire

Wearing a mask is responsible from a medical perspective—in the era of the pandemic—but also for security reasons, to protect your privacy. Nowadays you don’t just have to worry about the police filming and arresting you, but also about far-right internet trolls trying to identify you from video footage.

If demonstrators are dressed appropriately in black bloc fashion, it should be difficult to make out identifying particulars.

Pay attention to detail. Cover your tattoos and other unique traits. Cover your whole face, not just your mouth. There should be no visible logos on your clothes, shoes, or backpack. Read this for more details.

Riot Ribs, Food Carts, Infrastructure

It is really good for morale to have a group of people providing food and other needed resources. Portland protesters have been deeply thankful that Riot Ribs have come out to feed everyone free food. This enables people to stay longer and helps them to feel that it is worth the effort and risk to support the movement that nourishes them.

You can read about Riot Ribs here.

Feds and cops know how important these mutual aid efforts are and intentionally target them in hopes of breaking the will of the demonstrators:

Here you can “before” and “after” shots of the infrastructure one night that federal mercenaries attacked it:

Unfortunately, uniformed officers are not the only danger threatening community infrastructure. In late July, Riot Ribs experienced a coup involving physical violence and intimidation. Wherever money is involved in activism, there is great risk of infighting unless the goals, structures, and expectations have been set very precisely in advance. The original Riot Ribs folks have left town, apparently taking the concept of Riot Ribs on the road to other cities as Revolution Ribs. Someone should write in detail about the rise, fall, and rebirth of Riot Ribs…(continues)

Click here to read the entire story at Crimethinc.

EFF: EARN IT Bill to Scan Every Online Message

From digital civil liberties champion Electronic Frontier Foundation, The EARN IT Bill Is the Government’s Plan to Scan Every Message Online

Imagine an Internet where the law required every message sent to be read by government-approved scanning software. Companies that handle such messages wouldn’t be allowed to securely encrypt them, or they’d lose legal protections that allow them to operate.

That’s what the Senate Judiciary Committee has proposed and hopes to pass into law. The so-called EARN IT bill, sponsored by Senators Lindsay Graham (R-SC) and Richard Blumenthal (D-CT), will strip Section 230 protections away from any website that doesn’t follow a list of “best practices,” meaning those sites can be sued into bankruptcy. The “best practices” list will be created by a government commission, headed by Attorney General Barr, who has made it very clear he would like to ban encryption, and guarantee law enforcement “legal access” to any digital message.

The EARN IT bill had its first hearing today, and its supporters’ strategy is clear. Because they didn’t put the word “encryption” in the bill, they’re going to insist it doesn’t affect encryption.

“This bill says nothing about encryption,” co-sponsor Sen. Blumenthal said at today’s hearing. “Have you found a word in this bill about encryption?” he asked one witness.

It’s true that the bill’s authors avoided using that word. But they did propose legislation that enables an all-out assault on encryption. It would create a 19-person commission that’s completely controlled by the Attorney General and law enforcement agencies. And, at the hearing, a Vice-President at the National Center for Missing and Exploited Children (NCMEC) made it clear [PDF] what he wants the best practices to be. NCMEC believes online services should be made to screen their messages for material that NCMEC considers abusive; use screening technology approved by NCMEC and law enforcement; report what they find in the messages to NCMEC; and be held legally responsible for the content of messages sent by others.

You can’t have an Internet where messages are screened en masse, and also have end-to-end encryption any more than you can create backdoors that can only be used by the good guys. The two are mutually exclusive. Concepts like “client-side scanning” aren’t a clever route around this; such scanning is just another way to break end-to-end encryption. Either the message remains private to everyone but its recipients, or it’s available to others…

Click here to read the entire article at EFF.org.

American Partisan: Using Encryption with Veracrypt

This practical article from American Partisan discusses the use of the program Veracrypt to encrypt data in files and hard drives. While the lead of the title is “Clandestine Communications,” there are many reasons that you might want to use Veracrypt encryption in your day to day life. I have used it in a legal setting in order to encrypt an attorney’s sensitive trial files to take them between the office and the court room. You can use it to safely store a password file. At home, you can use it to securely store photocopies of your credit cards, social security cards, firearm serial numbers, birth certificates, passports, banking information, or any other information that you want to have available, but not just sitting where it can be stolen or hacked. For preppers, you can take that same encrypted file of your important information and put it on a USB drive and toss it in your bug out bag or a vehicle Go-bag so that if you have to leave home because of a fire you’ve got all of that vital information gathered already.

Clandestine Communications Part Four: File and Hard Drive Encryption with Veracrypt is a pretty simple overview of getting started with using Veracrypt software. Veracrypt is a free (free as in no cost), open-source (free as in liberty) software program. Because it is open source, the source programming code is freely available for viewing so that the software can be audited for security holes and backdoors. You can use Veracrypt to encrypt an entire drive, or you can create a volume which looks like a file to your computer which you can then mount as its own drive. There are also other more advanced features.

Today’s article is going to talk a little bit about how to use Veracrypt in order to encrypt both a file volume and a flash drive. Veracrypt can be downloaded from here.

Once you install the program, let’s take a look at what it looks like.

I recommend you spend some time in the Help menu – particularly in the ‘User’s guide” and “Beginner’s Tutorial”.

Veracrypt can encrypt your files in a few different ways. The first way is creating a volume. The volume is almost like a file itself – it can be copied, pasted, etc. It acts, in a way, like a super secure .zip file (without the file compression). The second way you can encrypt your files is by encrypting an entire hard drive or flash drive. This method in particular could be useful if you were using a dead drop system to pass a One Time Pad as you could buy a lot of inexpensive flash drives, encrypt them, and then use them in your drops.

Veracrypt also has a really cool future that I may touch on in a later article called Hidden Volumes. Basically, this creates a volume within a volume, and each volume has a separate password. This could be useful if you are forced to open the volume at gun point. The idea is that in the outer volume you have some sensitive looking documents but not the actual files you want to encrypt. If you were forced at gunpoint to open the volume, your actual files would be safe (since they use a different password). This may be something that many of you are interested in.

Volumes

To create a Volume, click on the “Create Volume” button in the lower left of Veracrypt. Here, a menu gives you some options. For now, we are going to stick with the default option of “Create an encrypted file container”. The second option is used for encrypting flash drives or external hard drives, and the third option is for encrypting the hard drive that runs your Operating System. Click Next.

Here, we have the option of creating a Standard Volume or a Hidden Volume. Since we are just starting out, make sure Standard Veracrypt volume is checked and hit Next. Now it is time to decide where we want the Volume to be. Click “Select File”. To make it easy, navigate to your desktop. In the “File Name” line, name your file. Click Save and then Next.

The next screen is where you can chose what type of encryption you want to use. I will leave it up to all of you to figure out which one is best (to be honest, I don’t really understand the differences so I am not going to give you a recommendation – if you do, throw it in the comments). Once you do, click Next.

The next screen is where you get to decide how big you want the file to be. For this example, I am going to go with 1 GB but you can choose whatever you want (think about what you are wanting to store in it and use that as a guide). Once you decide, click Next.

This screen is where you create your password. I have two rules for you to follow: 1) use numbers, letters, and symbols, and 2) use capital letters and, if you want, spaces. A great way to get a strong password is to use a password manager like KeePassXC. I actually don’t have one set up yet, so I will be doing a future article on how to do that as well. You can also use keyfiles, which is like selecting a few different files you already have to use them as the password. It is not my favorite way of doing it, but YMMV. Once you have your password entered, click Next.

The next screen is very important. You are choosing both the filesystem you want and generating the random pool to make your encryption stronger. I generally tend to use an NTFS system because FAT filesystems don’t like files over 4 GB, but again do your research and choose the filesystem you want. Then, move your mouse as random as possible inside the window. You will see tons and tons of characters in the “Random Pool area. Do this for at least 60 seconds, but the longer the better. Once you are done, click Format.

Once the formatting is done, it is time to mount your file. Go back to the first window that appeared when you started Veracrypt. Now, click on Select File on the bottom right. Navigate to your file and select it, and then select Mount. Enter your password, and select OK. Once the file mounts, you can go into Windows Explorer. You will notice in your hard drive list under “Computer” on the left hand side, there will be a new hard drive. In my case, it is Local Disk (J:) as we can see the size is 0.99GB. You can now click on that and copy your files in! In order to dismount the volume, just select it again on the main screen of Veracrypt and click “Dismount”.

Flash Drive / External HDDs

To encrypt a flash drive, begin once again by clicking “Create Volume”. This time, select the middle option of “Encrypt a non-system partition/drive”. Click Next, and you see that once more we have the option of creating a Hidden or Standard volume. For this, I am creating a Standard Veracrypt Volume. Click Next.

Now, instead of creating a file, you are selecting the flash drive or hard drive you want to encrypt. Once you select your drive, click OK. You are given two options for the Volume Creation Mode. The first one is for when you have no files on the drive and want to encrypt it more quickly. If you choose this option AND you have files on the drive, they WILL be overwritten and lost. If you have files on the drive and you cannot or do not want to take them off, chose the second option, “Encrypt partition in place”. I have never used that second option because I am terrified something will go wrong and I will lose my files, but YMMV. Make your selection and click Next.

Just like creating the volume, select your encryption algorithm and click Next. Verify that the size on the screen is really close to the size of the drive you want to encrypt (in this case, my flash drive is 4 GB in theory and in the above picture we see it is 3.7 GB, which matches closely below which says 3.65 GB). If it is really off, go back and make sure you selected the right drive to encrypt – this is really important. Once you verify it is correct, click Next.

Once again, create your password (DIFFERENT FROM YOUR FIRST ONE – NEVER REPEAT) and click Next. The same rules from the Volume section apply to the password. Now choose your file type and click next (again, I personally use NTFS). Move your mouse around in the box again to random the Heading Pool and, once you are done with that, click Format.

In order to Mount the drive, you can select what letter drive you want to mount the volume in and either 1) Click “Auto-Mount Devices”, type in the password, and click OK, or 2) Click “Select Device” and choose the device on the screen. Then, access the drive just like the volume and copy your files in!

References

https://securityinabox.org/en/guide/veracrypt/windows/

https://www.veracrypt.fr/en/Beginner%27s%20Tutorial.html

https://www.veracrypt.fr/en/Plausible%20Deniability.html

EFF: Dangers to Privacy in EARN IT Act

The EARN IT Act introduced by Senator Lindsay Graham purports to be for the prevention of online child exploitation “and other purposes.” It’s those other purposes that we need to watch. The EFF, an organization fighting for your digital civil liberties, writes the article Congress Must Stop the Graham-Blumenthal Anti-Security Bill, expounding upon the many dangers lurking inside this bill.

There’s a new and serious threat to both free speech and security online. Under a draft bill that Bloomberg recently leaked, the Attorney General could unilaterally dictate how online platforms and services must operate. If those companies don’t follow the Attorney General’s rules, they could be on the hook for millions of dollars in civil damages and even state criminal penalties.

The bill, known as the Eliminating Abusive and Rampant Neglect of Interactive Technologies (EARN IT) Act, grants sweeping powers to the Executive Branch. It opens the door for the government to require new measures to screen users’ speech and even backdoors to read your private communications—a stated goal of one of the bill’s authors.

Senators Lindsay Graham (R-SC) and Richard Blumenthal (D-CT) have been quietly circulating a draft version of EARN IT. Congress must forcefully reject this dangerous bill before it is introduced.

EARN IT Is an Attack on Speech

EARN IT undermines Section 230, the most important law protecting free speech online. Section 230 enforces the common-sense principle that if you say something illegal online, you should be the one held responsible, not the website or platform where you said it (with some important exceptions)…

EARN IT is a direct threat to constitutional protections for free speech and expression. To pass constitutional muster, a law that regulates the content of speech must be as narrowly tailored as possible so as not to chill legitimate, lawful speech. Rather than being narrowly tailored, EARN IT is absurdly broad: under EARN IT, the Commission would effectively have the power to change and broaden the law however it saw fit, as long as it could claim that its recommendations somehow aided in the prevention of child exploitation. Those laws could change and expand unpredictably, especially after changes in the presidential administration…

Throughout his term as Attorney General, William Barr has frequently and vocally demanded “lawful access” to encrypted communications, ignoring the bedrock technical consensus that it is impossible to build a backdoor that is only available to law enforcement. Barr is far from the first administration official to make impossible demands of encryption providers: he joins a long history of government officials from both parties demanding that encryption providers compromise their users’ security.

We know how Barr is going to use his power on the “best practices” panel: to break encryption. He’s said, over and over, that he thinks the “best practice” is to always give law enforcement extraordinary access. So it’s easy to predict that Barr would use EARN IT to demand that providers of end-to-end encrypted communication give law enforcement officers a way to access users’ encrypted messages. This could take the form of straight-up mandated backdoors, or subtler but no less dangerous “solutions” such as client-side scanning. These demands would put encryption providers like WhatsApp and Signal in an awful conundrum: either face the possibility of losing everything in a single lawsuit or knowingly undermine their own users’ security, making all of us more vulnerable to criminals…

Weakening Section 230 makes it much more difficult for a startup to compete with the likes of Facebook or Google. Giving platforms a legal requirement to screen or filter users’ posts makes it extremely difficult for a platform without the resources of the big five tech companies to grow its user base (and of course, if a startup can’t grow its user base, it can’t get the investment necessary to compete)…

Click here to read the entire article at EFF

 

Liberty Blitzkrieg: AG Barr Wants to Kill Privacy and Security

Michael Krieger of Liberty Blitzkrieg has written a post about US Attorney General William Barr who has come out very much against the use of encryption by anyone but the government in recent weeks. The government wants full access to everything that you do and say wherever you are doing it, no matter how personal or private. As usual, it must be done “to save the children.”

William Barr Wants to Kill Privacy and Security…’For the Children’

U.S. Attorney General William Barr, along with co-conspirators in the UK and Australia, recently wrote a letter to Mark Zuckerberg requesting he not move forward with a plan to implement end-to-end encryption across Facebook’s messaging services. A draft of the letter was published earlier this month by Buzzfeed, and it’s worth examining in some detail.

What immediately strikes you is the letter’s emphasis on “protecting the children,” a talking point universally used by authoritarians throughout history to justify both a reduction of public liberty and a transfer of increased power to the state. Though this tactic is transparent and well understood by those paying attention, it’s nevertheless disturbing to observe Barr’s disingenuous and shameless use of it (the words ‘child’ and ‘children’ appear 17 times in the course of this brief letter).

Here’s just one example from the letter:

Companies should not deliberately design their systems to preclude any form of access to content, even for preventing or investigating the most serious crimes. This puts our citizens and societies at risk by severely eroding a company’s ability to detect and respond to illegal content and activity, such as child sexual exploitation and abuse, terrorism, and foreign adversaries’ attempts to undermine democratic values and institutions, preventing the prosecution of offenders and safeguarding of victims. It also impedes law enforcement’s ability to investigate these and other serious crimes. Risks to public safety from Facebook’s proposals are exacerbated in the context of a single platform that would combine inaccessible messaging services with open profiles, providing unique routes for prospective offenders to identify and groom our children.

Barr and the U.S. government feign deep concern regarding the ability of bad people to “identify and groom our children,” yet this is the same guy and government who allowed Jeffrey Epstein to be suicided in a Department of Justice prison just a few months ago. It’s the same guy and government who can’t find or doesn’t want to find Ghislaine Maxwell. And it’s same guy and government that can’t be bothered to raid Epstein’s New Mexico ranch despite known instances of child abuse there…

Click here to read the entire article at Liberty Blitzkrieg.

Natural News: NSA Archiving Encrypted Communications to Decrypt Later

Encryption works. But as computing power increases the time requires to brute force crack your encryption keys decreases. This article from Natural News notes that the NSA is archiving all eencrypted emails and transactions in the hopes that increases in computing power, including quantum computing, will allow them to be decrypted in the next few years. Note that it mentions 256-bit AES and RSA keys. Upgrade your encryption to elliptic encryption if your apps support it. If your apps don’t support it, look for ones that do.

That said, the NSA also has a vested interest in making people believe that using encryption is useless. So this could also be a smoke screen. Cover your bases and use the best encryption practicable. The government has no business reading your correspondence without a valid warrant.

The NSA is archiving all encrypted emails and transactions, knowing they will be able to decrypt most digital files in about 3 years, thanks to quantum computing

All encrypted emails, files and hard drives that currently rely on 256-bit encryption (such as AES or RSA) may be retroactively broken by the NSA in the next three years, thanks to rapid advances in quantum computing recently announced by Google scientists.

The NSA is currently archiving all encrypted communications and storing the digital files on offline storage servers in its “Bumblehive” domestic spying facility in Utah. Currently these digital files cannot be broken because classical computing presents a strongly asymmetrical complexity problem that makes breaking encrypted files prohibitively time consuming and expensive. Files encrypted with 2^n bits currently present computational complexity that requires 2^n computer power to break. In other words, encrypting files is easy (linear), but breaking encryption is incredibly difficult (logarithmic).

But rapid advances in quantum computing transform the breaking of encryption from a logarithmic mathematical problem to a linear problem, collapsing the complexity to 2 * n instead of 2 ^ n…

Organic Prepper: Gov’t Still Wants to Backdoor Encryption

Daisy Luther at the Organic Prepper has written an article summarizing some of the recent press and government meetings discussing the government’s desire to be able to reverse encryption on communication devices, web pages, etc. – The Govt. Wants to OUTLAW Encrypted Messaging in iMessage, WhatsApp, Signal, Wickr, Telegram, Etc. If you’re tuned into the modern fight over privacy, they probably isn’t news to you. The government always wants more control over your data, communication and information. They say they need it to keep you safe.  Luckily there are still entities with some pull who are arguing that putting in encryption backdoors will harm the United States, but they’re fighting on the basis of economic harm. No one cares about your privacy. No one in government, anyway.

If you ever use the encrypted messaging options on programs like iMessage, WhatsApp, Signal, Wickr, Telegram, or any other service, your time to discuss things privately over the phone may be running out. The US government doesn’t like for anything to get in the way of their ability to spy on investigate even the most mundane of conversations.

Instead of seeing privacy as a right, they see it as suspicious. Your devices are already being searched at quadruple the previous rate in airports. And the attack on free speech is now going as far as our private messages to our friends and family.

Because the only reason we’d want privacy is that we’re criminals

This was the topic of a National Security meeting last week.

The encryption challenge, which the government calls “going dark,” was the focus of a National Security Council meeting Wednesday morning that included the No. 2 officials from several key agencies, according to three people familiar with the matter.

Senior officials debated whether to ask Congress to effectively outlaw end-to-end encryption, which scrambles data so that only its sender and recipient can read it, these people told POLITICO. Tech companies like Apple, Google and Facebook have increasingly built end-to-end encryption into their products and software in recent years — billing it as a privacy and security feature but frustrating authorities investigating terrorism, drug trafficking and child pornography. (source)

So, which government agencies are hot to make encrypted messages illegal?

The DOJ and the FBI argue that catching criminals and terrorists should be the top priority, even if watered-down encryption creates hacking risks. The Commerce and State Departments disagree, pointing to the economic, security and diplomatic consequences of mandating encryption “backdoors.”

DHS is internally divided. The Cybersecurity and Infrastructure Security Agency knows the importance of encrypting sensitive data, especially in critical infrastructure operations, but ICE and the Secret Service regularly run into encryption roadblocks during their investigations. (source)

It looks like the simpler answer is the few who understand there are reasonable, non-criminal uses.

There are plenty of legitimate reasons we might want to encrypt our conversations.

Of course, we know there are dozens of reasons we might want to use the encryption function on our favorite messaging apps. For example, when I was recently traveling in Europe, I needed to give my daughter credit card information to pay a bill for me. I used the encryption function on Telegram to send it because who wants that out there floating around?

Indeed, there are many legitimate reasons to use end-to-end encryption…

Click here to read the entire article at the Organic Prepper.