Simple steps to take before hitting the streets
Signal & WhatsApp are not secure enough. Meta/Facebook regularly give data & metatadata to the cops & Signal is centralized & not self-hosted by your crew so while messages are encrypted, the metadata still isn’t. If you must use Signal, I would pick Molly as an Android client since you can a) encrypt the messages under a separate password for storage on seizure & b) you can use the UnifiedPush version to make sure your notification metadata isn’t going thru Google’s Firebase servers. Protests are the ideal place for Briar as it is works via mesh net so internet & SIM cards are not required (but years ago wden I tried it, the app was a major battery drainer).
the metadata still isn’t.
That doesn’t quite work in the case of Signal
The only data that they have, based on transparency reports and dissections of their source code, is the time you created your account and last connected to the servers.
Messages themselves are essentially only relayed, with sealed sender, and anything that would be actually useful to identify who was at a protest and who wasn’t encrypted.
Things like, e.g when messages arrive at the server would have to be monitored live on compromised servers, which reasonably unless you assume* it is wiretapped already prior to a protest, isn’t realistic.
*: of course, I am saying this because making an assumption and portraying it as truth (e.g assuming something is already wiretapped based on no evidence at all) is not the smartest of moves when it comes to threat modeling…especially if you wanna stay sane whilst having a threat model
With the right intel you could piece back some of the pieces, especially with some pieces from other sources, with just that metadata. With metadata, it’s about putting together lots of sources to see the picture clearly which is why Facebook bought WhatsApp for just the metadata (& address book). The thing is that you, can skip Signal & you will still have several free software messaging alternativ where nothing is on a US-based server where they can subpoena.
But that’d already entail control over the whole Signal AWS in- and egress as well as any VPN you may be using and/or your local ISP. And then you still have to prove the actual link to the natural person. At that point we’re speaking of a threat level assuming the US DoD as adversary. While not impossible, I think if you’re willing to pick that kind of fight, you’re clever enough not to rely on Signal (or most digital communication).
Signal is not WhatsApp, there aren’t a lot of data points linking your communications to end points in the same way Meta does link them.
Just leave your phone at home, and bring a Digital camera, and few SD Cards … Oh, wait… < insert company name here > makes Cameras that spy on you… nevermind…
maybe we should hire a fast sketching artist to draw police brutality … What.!.. your pencil can track you now… come…ooooonnn
Burner phone to anything that requires communication. Erase metadata of anything that will be shared and uploaded online.
Burner phones are a strange concept. If you want to store sensitive data on it, you shouldnt use some cheap android phone or even a dumbphone without encryption support.
The point is not cheapness but that you don’t care about the future of that phone. It’s only a tool for the protest, if it lasts longer that’s good but you expect it to get confiscated and never given back, you don’t care what cops did with it if you get it back, it does not have data you need in your daily life or anything irreplaceable, and you’re not really afraid that it gets destroyed by accident or maliciously.
All Androids since 9 at least have been encrypted by default as long as you have a lock screen enabled. Doesn’t matter if its cheap, it is there.
