Complete manual

From Gender and Tech Resources

Revision as of 19:55, 27 May 2015 by Alex (Talk | contribs)

Understanding digital shadows

The internet is an amazing space to explore, learn, speak up, listen and communicate with people across the world. Unfortunately, it has also become a contentious space. There is a pushback against people who speak against, question or challenge dominant discourses, especially if those deal with gender and sexual orientations. When planning to be active on the internet as a vocal women, a woman human rights defender, a trans* person and/or a feminist, it’s a good idea to start from an assessment of the traces we leave behind us on the Internet, our digital shadow and the social domains that are spread across our online and physical activities. These two aspects can tell very accurate stories about us; who we are, were we live and hang out, what we are interested in and who our friends are.

This can expose us to several threats. In particular, it is the publicly available traces we leave behind that expose us to online harassment. However, there are also many strategies and tools we can use to shape or control our digital shadows, to increase our privacy, and ultimately to be more secure, both online and offline - without being less vocal or reducing our activity online.

Some examples of these include controlling the amount of data we give away by consciously stripping valuable information from content and metadata; trying the art of self doxing; and thinking about ways to play with and break up our online identity.


What is a digital shadow?

Our digital shadows can be defined as the stories data tells about us. These digital shadows are created by trillions of bits of data, digital traces we leave everyday when we connect to the Internet, our mobile phone and online services. Our digital shadows have a life of their own, are affected by others and change in unpredictable ways. Our digital shadows grow continuously, can be permanent permanent and we have little control over them. These traces are a spectre of our past and present activities, which melt together in a permanent and ever-changing profile.

How are these trillion bits of data created? The devices and the software we use to browse the Internet, access websites, connect to social networking platforms like Facebook and Twitter, publish blog posts, receive phone calls, send SMS messages or emails, chat, or buy things online, all create specific bits of data about us. These bits of data can include our name, location, contacts, pictures, messages, tweets and likes, but also the brand of our computer, length of our phone calls and information about which websites we visit. These data traces can be put out there by ourselves as well as other people.

How do we share data? In some cases we actively share data – for example when we share photos on Facebook, book a flight ticket online or contribute to a wiki. Other people can also actively share data about us, by tagging us in pictures, mentioning us in tweets or simply by communicating with us. In other cases, we give away data without necessarily realising it, or consenting to it. Our browsing habits and IP address are shared when we visit a website by means of "cookies" and other tracking technologies, which are active in the background. These technologies are embedded in the websites we visit, and the information shared is collected for a wide range of purposes, from website analytics to advertising. Our mobile phone apps also collect data on us without our active knowledge or consent – for example, the photos we take usually have location data embedded in them. These tracking technologies enable web services to identify and follow us as we move from one service to another - from our internet browser to the IM (instant messaging) app in our smartphone, from downloading e-books in our readers to publishing pictures from the latest protest we have covered.

What is data? Data can be broken into three parts: content, metadata and noise. Content is the content of our messages, blogs, tweets and phone calls; it is our pictures and videos. Metadata is data about data, information that is needed for the technological infrastructure to work. Metadata enables our email to be delivered, help find files on our computer and permit mobile communication. Metadata can be our email address, phone number, location, time and date when a message was sent or stored. Noise is the data that is created by either the manufacturing process or by the workings of the infrastructure. For example, every camera has an SD card to record and store pictures. Every SD card has unique scratches that were created by the machines producing the SD cards. These scratches make small changes to the data that are not visible to the eye but can be recognized by computers.

Who collects our data?

We might wonder about the importance of one picture, one message, one call or think there is so much data out there that nobody knows what to do with it. However, data collection and data analysis has become very sophisticated. The data traces you leave are collected, analysed and sorted by various parties to create digital shadows, or profiles. Every time a new piece of data is collected, it can be identified and added to your profile. These profiles are ever-expanding, and give those who create them or who have access to them an immense insight into who you are.

Data is collected by companies, governments and individuals for a variety of purposes. It can be bought and sold; it can be used to control; or it can be used to create harassment strategies. Our digital shadows or profiles can be used to gain insight into who we are, what we do, where we have been and with whom we have been interacting. By aggregating data, these can then be used to make predictions on what we might do or where we might be in future. For example, if someone knows that we are an outspoken blogger on gender issues in country x, they know that we will probably be present at a conference on blogging and women held in that country.

Anyone could potentially have access to our digital shadow – including communications service providers, law enforcement agencies and commercial companies, as well as groups and individuals running their own servers. We can't know exactly what is happening to our digital shadow, and that itself is a problem. Fortunately, there are many tools and tactics we can use to manage our digital shadows and to limit their ramifications in terms of profiling, control and surveillance. This will be discussed in the rest of this section.

Exploring our own digital shadow

Because anyone can potentially access to our digital shadow, we cannot know precisely what happens to our digital shadow and that itself is a problem. But there are tools and tactics to manage our digital shadow and to limit its ramifications in terms of profiling and surveillance. Some good places to start are:

  • Exploring our individual digital shadow with Trace My Shadow – https://myshadow.org/trace-my-shadow – a tool launched by Tactical Tech that offers a lot of tips on how to protect our privacy and control our digital shadow
  • Identifying and materialising social networks across our online and physical activities: John Fass, researcher and designer at the Royal College of Art, has created some activities to materialise our social networks and browser history ' [insert link].'
  • Seeing through the eyes of our mobile phone by installing a tool called openpath.cc. Read the Terms of Service carefully and explore if you can change the access settings in your phone. On an iPhone we can change the permissions for each app under its privacy setting.

Controlling what we share: content and metadata

The good news is that we can partly control what content and metadata we give away. When we publish content on the web, it is always a good idea to ask ourselves if what we are posting is public or personal and who could have access to it. Even if the information is connected to a public event and not to our personal lives, the names we mention or the images we upload may contribute to a picture about who we are, what we are doing, where we are doing it and so on. This could be used by people who wish to target us.

This does not mean that we should silence ourselves – by taking some basic measures, we can limit our risks by increasing the level of the effort that would be required to attack us or our contacts.

  • When giving personal information to a web service, it’s best to use HTTPS so that the communication channel is secure (see the section on security measures for more on this).
  • Using Tor will hide specific metadata like our IP address, thereby increasing our anonymity online.
  • Use strong and different passwords for each web service you use - if not, someone that intercepts your password could use it to access your other accounts.
  • When sharing personal details about our life, we can use private profiles that can only be accessed by selected contacts. When using those on commercial social media, we should be aware of the regular changes to the privacy policies of that platform. There have been cases where privacy settings have been changed, exposing pictures, content and conversations of private groups.
  • When writing or posting images about public events on the web, we should ask ourselves if the information we spread about single individuals, places and other details could be used to identify and/or attack someone. It is always a good idea to ask for permission to write about individuals and perhaps also to discuss shared agreements about posting information on public events.
  • You can prevent the tracking and collection of metadata through your browser by installing add-ons like Privacy Badger or Adblock Plus, as well as by monitoring our privacy settings and deleting cookies on a regular basis.
  • When registering a device or software such as Microsoft Office, Libre Office, Adobe Acrobat and others, not usingy our real name can help prevent the metadata created when using this device or software from being connected to you. You can also switch off the GPS tracker in your phone or camera.
  • Some file types contain more metadata than others, so when publishing contents online you can change files from ones that contain a lot of metadata (such as .doc and .jpeg) to ones that don’t (such as .txt and .png), or we can use plain text.
  • For editing or removing metada from PDF files, Windows or MAC OS users can use programs such as Adobe Acrobat XI Pro (for which a trial version is available). GNU/Linux users can use PDF MOD, a free and open source tool. However, it doesn’t remove the creation or modification timestamp, and it also doesn’t remove the information about the type of device used to create the PDF.

Self-Doxing

Doxing describes tracing or gathering information about someone using sources that are freely available on the internet and constitute a type of social engineering technique. This method depends on the ability of the attacker to recognise valuable information about their target, and to use this information for their own ends. Doxing is premised on the idea that the more you know about your target, the easier it will be to find his or her flaws. "Self-doxing" ourselves can help us to make informed decisions about what we share online, and how. Of course, these same instruments can also be used to learn more about someone we have met online before we give them our full trust.

Methods used for doxing include exploring archives, images, phone directories and other publicly available information; querying common search engines like Google or DuckDuckGo (https://duckduckgo.com); looking for a person's profile in specific services; searching for information in public forums and mailing lists. But it can also simply consist in looking up the public information on the owner of a website, through a simple "whois search" (see the section on "Creating a site of one’s own"). Before we start exploring these web services and looking for our digital self, a good idea is to use anonymisation tools like Torbrowser. Useful tips on self-doxing tools and techniques can be found here:

Social domains

As security expert Bruce Schneier explains, “Security is a chain, and a single weak link can break the entire system”. Each of us belongs to several social domains - our work or advocacy networks, our family networks, friends, and sports teams.

Some networks may be more secure than others. For example, we may tend to have a more secure communication practices for our work or advocacy activities, but less secure practices for interacting with friends on a social network.

If we use a single identity in all our domains, or if we always use our real name online, it becomes easier to gather information about us and to identify our vulnerabilities. For example, if we reveal in a social network that we like a particular kind of game, an attacker who wants to investigate our work or advocacy activities might trick us into downloading a game which is infected with spyware.

This is only possible, however, if our work identity and our gaming profile can be connected to the same person; and this is why separating our social domains can be useful. More on how to do this will be addressed later on, when we talk about identity management.

Mapping our social domains

To separate our social domains, it's helpful to first map them out and identify which ones could expose us most. We can do this by thinking about our different activities and networks, and reflecting how sensitive each of these is in order to better separate the domains that are sensitive from those that are not.

For instance, polish computer security researcher Joanna Rutkowska has developed a Linux distribution based on the concept of “security by isolation” called Qubes OS. In this system, each social domain is isolated in a separate virtual machine. The three basic domains Rutkowska identifies for herself are:

  • The work domain includes her work email, work PGP keys, reports, slides, papers, etc. She also has a less-trusted “work-pub” domain for things like accepting LinkedIn invites or downloading pictures for her presentations.
  • The personal domain includes personal email and calendar, holiday photos, videos, etc. She adds to this with a special domain called “very-personal”, which she uses for the communication with her partner.
  • The red domain includes the totally untrusted and which doesn’t require her to provide any sensitive information.

You can find more information about her scheme here:

Creating new identities

"Once something is on the internet it will stay on the internet, as the internet does not forget". We may think that deleting certain sensitive data from social networks and web services may be enough to protect ourselves, but metadata cannot be deleted as easily. And using just one identity through our whole life - in all our work and personal domains - creates a bulk of information that makes it easier to profile us.

One option to avoid this is to leave an old identity behind and create a new one, or several new ones for each of our social domains. We might also choose to use our real identity in some areas, and our new alternative identities in others.

  • When we create a new identity, we should select the contacts for each one carefully, and avoid sharing contacts with other identities we use for different activities. This effectively creates separate social domains, with separate accounts, mail addresses, browser profiles, apps, and possibly even devices.
  • Our various identities should not linked to each other, or to our real identity. Remember that some of these connections can be tenuous as for example when signing up for a new pseudonymous Gmail account using your real phone number.
  • Disposable extra identities can be useful, as they can be discarded easily if compromised.
  • Disposable extra identities can be created for new acquaintances when appropriate as introductory profiles to get to know somebody before we include them in our more trusted network.

To learn more about how to separate different identities into separate profiles, read the section on “Managing multiple online identities”.

Deleting identities

If we decide to separate our social domains by creating multiple identities, we should decide whether to delete or keep the identity or identities that we already have. To do this, we can start by investigating the traces of our existing identity or identities. (For methods and tools for following your own digital traces, see "Exploring your digital shadow" and "Self-Doxing"). If we opt for deleting existing accounts, we can visit the following places:

Retrieved from "https://gendersec.tacticaltech.org/wiki/index.php?title=Complete_manual&oldid=1294"