Recommendations for times of protests

The world is going through complicated times. Several countries are currently seeing dramatic upheaval, where protests are met by violent repression and a lack of respect for human rights. During these times, digital resources can be extremely powerful, when used correctly. But they can also be blocked in various ways, and in the worst cases be used against protesters, activists and journalists.

In this brief guide we want to describe some things to keep in mind before and during a protest, focusing on digital resources. This guide is primarily meant for people living under repressive and violent circumstances where human rights are NOT respected. Under these circumstances, digital self-protection and collection of evidence is among the most important things you can do.

Hopefully this post can give some quick advice. The advice in this post are things that will generally be useful, but are not directed at any specific situation. In those cases, a more long term threat model exercise might be appropriate, and also continuous work on understanding operational security.

Before a protest

Some things should be done before you actually go to the protest or complicated situation. They might require some time, but will protect you once you get to the protest.

Make sure you phone is encrypted

The content of your mobile phone has to be encrypted. If it gets stolen or taken, you should not risk everything on it being accessible to an attacker. In repressive countries, there’s the possibility that information about other protesters could be extracted from an unencrypted phone. It is also possible that incriminating evidence could be implanted by governments that don’t respect the rule of law. The only way to avoid these risks is to make sure that your phone is encrypted. On iPhone, this is not an issue. Modern Android distributions also do it by default - but in older ones you might have to turn it on.

Make sure you only have a PIN code for your phone

You can open up a phone in many different ways, including fingerprint recognition, face recognition, drawing of patterns, PIN codes and even not having any block at all. For the same reasons as above, you really need the method for opening your phone to be safe and secure. That means ONLY use PIN codes. All the other methods have significant issues associated with them. We recommend disabling other methods and only using a PIN code - and this PIN code should be at least 8 digits long.

Configure a VPN or Tor

During protests, it has become common for repressive governments to disable access to internet services in certain areas. This blocking can be divided into three different categories. The first one is to simply completely block internet access in a certain area. If this happens, there isn’t much you can do about it during the protest – unless WiFi access is available, or you have a satellite connection. The second alternative is that all internet access is blocked, but only for specific mobile phones. If the adversary has managed to identify the mobile phones used by the protestors, this can be an effective tactic. The final method is to block or slow down access to certain services that are commonly used during protests, such as WhatsApp, Twitter and Youtube, but leave access to other resources open. If this happens, you can often work around this censorship using either virtual private networks (VPNs), or Tor.

If you use Android, the Orbot application can be used to configure Tor for your phone. This will work in some circumstances, but sometimes access to Twitter and other big sites can be complicated from Tor. Sometimes, repressive governments also block access to the Tor network. In these circumstances, configuring a VPN to a server outside of the country you’re in might be enough to work around the block. For the purpose of documenting a protest, this might be the best short term solution. It is important to keep in mind that in this case, the use of the VPN is primarily for circumventing illegal censorship, and not to give extra protection. For that reason, your choice of VPN provider can be a bit looser.

Some VPN providers need you to install an application, and the configuration can be a bit frustrating to get right. It is a good idea to experiment with these tools before you need them, so you have things prepared and ready to go when a protest becomes active.

Use a temporary SIM card if possible

If it’s possible to do so legally in your country, it could be a good idea to use a temporary and anomymous SIM card instead of your main SIM card. If you only use this SIM card during a protest, and you only activate it away from your house, it becomes significantly harder for an oppressive regime to track who you are, and who you are associating with. This tip is only relevant if it’s possible to legally get access to anonymous SIM cards, though.

Have the minimum apps installed

The more applications you have on your mobile phone, the more likely it is that one of them can be used to attack you in some way. If you are planning on taking part in protests, it is a good idea to keep your phone as clean as possible, to avoid more sophisticated types of interference and attack.

Use encrypted communication applications if possible

It has sadly become all too easy for both repressive governments and other bad actors to intercept the communication of protesters in various ways. The recommended way of avoiding this is to prefer encrypted messenger applications. Our recommendation would be to prefer Signal and Wire if possible. Signal has better privacy protection, but require a phone number, while Wire doesn’t require one - but have been known to sell user information. Both of them have outstanding encryption capabilities that can’t be turned off, and are open source so we are reasonably comfortable that they do what they should. Telegram should be avoided at all costs - it is often not encrypted and have been known to give out a lot of information. WhatsApp can be used in an emergency when Signal or Wire doesn’t work. Do not ever use regular text messages - and if you receive text messages during a protest, it is possible that they have been manipulated or forged in some way.

Review applications with access to your location

Many applications and systems on our phones have access to our locations, and in some cases they will leak or sell that information to others. If you have one of those applications on your phone while going to a protest, you might give away information you really don’t want to give out. There have been known examples of activists being tracked by dating applications and then arrested. Most mobile phones have a way of looking at the permissions for location tracking and see what applications can do that - and take those permissions away. Do this regularly, and keep the list to the minimum. If you have to have location tracking turned on in an application, make sure to only use the mode for only giving access to the location while the application is active. That way, you gain some control at least.

During a protest

A protest can be anything from a simple and peaceful walk with companions, to a violent struggle for your life. And in some cases you won’t know which one you are walking into. It is important to be prepared. If a protest turns dangerous or something abusive happens, documentation is important. But every protest group needs to figure out how to balance self protection with documentation. Our recommendation is that if you are part of group, figure out who has what responsibilities, so that you can balance all concerns.

Don’t bring your phone if possible

If you can go to a protest without a phone, that is a good idea. A mobile phone can be very useful, both for coordination and documentation, but it can also be a liability. Mobile phones can easily be tracked and associated with other mobile phones. They can be attacked in various ways. And if something happens they can be used against you. So if you are in a position to go without a phone, that’s a good idea. Alternatively, if you need the phone in case of emergency, but won’t use it during the protest, keep it in airplane mode and turned off - if possible taking out the battery and in a faraday bag if you can get access to one.

In case you don’t bring a phone, we strongly recommend writing down important phone numbers on your body in a way that can’t be easily removed.

Have a separate device for protests

If you are planning on documenting what happens, it might be a good idea to try to use a separate device for this purpose. That way, you won’t have anything sensitive on the device you use - and you can install and optimize only for the goal of documenting what happens as well as possible. If you plan to use this method, it’s better to not use the device for communication at all - only use it for streaming documentation.

Be aware of surrounding cameras - especially above you - when opening your phone

If you bring a mobile phone with you, be very aware of your surroundings when unlocking it. Modern street cameras have sufficiently good resolution that they can often see a pattern or PIN code when typed on a phone. This might lead you to believe that using fingerprint or facial recognition would be better, but as we mentioned above, these methods have even greater risk. So, use a PIN, but make sure to look around before unlocking your phone. Remember to look around, but also up. Street cameras are usually a few meters up, and these days drones can also carry high-resolution cameras.

If possible, live stream video instead of just recording it

Often, protests are documented by capturing video. This can often go to groups on various messenger applications, such as WhatsApp, Signal or Telegram. However, often, these videos will not be sent until finished recording. Since you don’t know what can happen, it is almost always better to live stream video instead of just recording it. Many sites such as Twitter, Youtube and Facebook supports live streaming, and since this is significantly safer for you both during the protest and after it, this should be your default mode of operation.

Try to avoid digital means for coordination

Much of the advice in this post is focused on limiting how you use a mobile phone in various ways. The sad truth is that mobile phones can make you extremely vulnerable, so minimizing them is a good idea. If you are part of a group, we recommend that you try to avoid digital means of coordination, especially during the protest. If you have to coordinate before a protest, make sure to use the most secure method available. But if you can, make plans for coordination, including backup plans, coordination points, meeting places, backups and backups for the backups. This is important, not just because you want to minimize the use of mobile phones, but also because mobile phones can be lost or broken. Since phones can be lost or broken, or lose battery, you will always need to have plans for when that happens and people have no digital communication. Our recommendation is that instead of having these plans only be for situations where you lose such means of communications, instead plan for non-digital communication and coordination first, since you will have to do it anyway.

Resources

This is a very short guide for things to think about both before and during a protest. We can’t cover everything, and much has already been written about these subjects.

When it comes to documenting protests, the Witness project have many good resources. I recommend starting in their section for resources about documenting protests here: https://library.witness.org/product-tag/protests/ (in Spanish, the best place is the resource section for guides, video, and video as evidence, here: https://es.witness.org/recursos/)).

The Electronic Frontier Foundation has a Surveillance Self-Defense page focused on attending protests here: https://ssd.eff.org/en/module/attending-protest (in Spanish here: https://ssd.eff.org/es/module/asistir-una-protesta)).

Finally, The Intercept has a guide on how to create a simple mobile phone specifically for the purpose of protesting here: https://theintercept.com/2020/06/15/protest-tech-safety-burner-phone/