Establish secure communications when reaching out for help.
- Identify unencrypted channels
- Identify which channels are encrypted
- Seek remote help
- Establish trust when reaching out
- Contact organisations for help
Isaac worries his computer might be hacked into. He wants to reach out to his friend Brenda who he thinks can advise her.
But Isaac thinks that he might be at risk if he reveals too much about his situation, or worse, that he could put Brenda herself at risk if he doesn't use secure communications to reach out to her.
As a general rule, it is important to understand that most ‘normal’ communications tools are not very secure against eavesdropping.
Mobile and landline phone communication is not encrypted and can be listened to by governments, law enforcement agencies, or other parties with the necessary technical equipment.
Sending unencrypted communication is like sending a postcard, anyone who has access to the postcard can read the message.
Normal communications are insecure against eavesdropping
Sending encrypted communication is like placing the postcard inside a locked box, which only you and those you trust know the combination to and are able to open and read the message.
Secure communication is always a trade-off between security and convenience. Choosing the most appropriate form of secure communication will depend on your unique situation and the activities in which you are involved.
A communication tool that provides end-to-end encryption is recommended. PGP-encrypted email, or chat with OTR or Signal on your phone encrypt messages "all the way" (between you and your recipient).
If an end-to-end encrypted tool is not available, use tools that encrypt message only between you and the provider. Such as Gmail, Facebook, or Twitter which all use HTTPS.
This, in turn, is better than using unencrypted communications (such as your phone or text messages). Do the best that you can with the resources and skills available.
Use encrypted channels when possible
Start with the most secure form of communication you can manage and the person you reach out to may be able to help you establish a line of communications that is more secure, if necessary.
In many cases, it is better to reach out for help insecurely than not to reach out for help at all. You might want to share only limited information or use code words when you know that the channel is insecure.
If you believe that you cannot trust your computer or device you might want to find an alternate trustworthy device. You might also want to go to the Malware lesson.
Whether you are helping someone remotely or seeking help from a third party, establishing trust is very important.
It might be safer to presume that an adversary may have access to all your account details as well as your communications when seeking help and might be attempting to provide specific, bad advice.
If you know the party you're reaching out to, using a video call or a phone call will help establish that you're really in contact with them.
When you are initiating contact with third parties you might want to create a new email account from a trusted device. If possible, do not rely on unknown people you find online.
- Digital Security Helpline (Access Now): email@example.com
- Front Line Defenders: firstname.lastname@example.org
- Rory Peck Trust: www.rorypecktrust.org
- Amnesty International: www.amnesty.org
- Committee to Protect Journalists: JournAsst@cpj.org
- Reporters Sans Frontieres: email@example.com
- Tactical Technology Collective: firstname.lastname@example.org
- Digital Defenders Partnership: email@example.com
- Internews: firstname.lastname@example.org
- Electronic Frontier Foundation: email@example.com
Landlines are not encrypted but mobile phones are
- en/topics/practice-1-emergencies/0-getting-started: Find out about other types of emergencies
- en/topics/understand-2-security/0-getting-started: Dig deeper on various aspects of security
- en/topics/understand-3-opsec/0-getting-started: Find out about what operational security or opsec means
- en/topics/understand-4-digisec/0-getting-started: Learn more about important concepts of digital security
- en/topics/tool-1-signal/0-getting-started: Find out about Signal for your encrypted communications