The New Oil

Things are a little crazy here in the US right now – as is our perpetual state of existence these days – so I thought now might be a good time to revisit my 2020 blog post about protesting, surveillance, privacy and security. For the cynics in the crowd, I want to make it clear that I am not supporting rioting, looting, or violence. This is a post about exercising your Constitutional right (in America and many other countries) to peacefully assemble and demonstrate over any given issue. I am vehemently opposed to the idea that you can be identified and tagged – 100% without human action – simply for exercising that right. Even if I disagree with the issue or the stance on it, as the famous quote goes (roughly): “I disagree with what you say, but I will defend to the death your right to say it.”

We are already in a world of 24/7 connectivity, and that coverage only expands and deepens with each passing day. While facial recognition tech and geofence warrants are not new, since I originally wrote this blog post these things have been kicked into hyperspeed and rolled out in greater numbers and with increasing frequency at all levels of government. And that’s to say nothing about the rise of AI, which – while sometimes faulty – is capable of parsing through vast amounts of data at (literally) inhuman speeds and noticing trends no human possibly could. These changes in effective surveillance coverage, previously unknown surveillance techniques, and the ability to automatically store, parse, and analyze it all is setting the stage for a new level of dystopian capabilities previously limited (mostly) to the realm of sci-fi and nation-state targeting. And now, with the reversal of Roe v Wade, I am unfortunately able to pull the “I told you so” card and point to concrete, Western-world proof that what was perfectly legal today may be a felony worthy of prison time tomorrow. So with that context, let’s talk about how you can legally express your voice without ending up on “a list.”

Finding and Attending the Protest

For most of us, social media will be our main avenue to learn about upcoming protests. That’s fine, but I recommend you don’t actually mark yourself as attending the protest. Several years ago during the Keystone XL protests, law enforcement was accused of using Facebook check-ins to target protesters. The veracity of this claim is debated, but why risk it? Feel free to keep checking the page before the protest to learn of any updates or changes, but don’t publicly mark yourself as attending. Police don’t need a warrant to look at a public list of attendees on a Facebook event.

Getting to a protest can also present challenges. Protests often take place at locations that are politically relevant and heavily monitored such as capitol buildings or police stations. If you’re in a large city (as the capitols usually are), you can pretty much guarantee that the city is using automatic license plate readers to track your vehicle as you travel in real-time. There’s also likely a patchwork of CCTV cameras and – at least for this specific event – drones and Stingrays. (I recommend visiting the EFF’s Atlas of Surveillance to get a better picture of what your local law enforcement might be capable of.) If possible, I would recommend using public transit instead. This of course, isn’t foolproof as many public transit services also have cameras and records, but we’ll come to that shortly. You could also order a cab and pay in cash, but even cabs sometimes have cameras installed for security reasons.

Whatever method you take, I recommend arriving near but not at the location. If you drive or get a ride, park or get dropped off a few blocks away. In the unlikely event that public transit stops at the exact location, get off at the stop before or after. Same thing once you’re ready to leave. Move a few blocks away then get picked up. If you’re extra cautious, consider using a different location than you did before. Not only will this possibly mean less traffic to deal with, but it will help avoid creating an obvious pattern and will hopefully put you further away from the more heavily-surveilled areas as you arrive and depart, making you just slightly harder to trace. Also if you have to pay for parking and can’t use cash, consider picking up a Vanilla gift card in cash so it can’t be easily connected to your debit or credit card.

Biometric Recognition

One silver lining from the COVID-19 pandemic is that wearing face masks in public is not only acceptable but relatively common, especially in large crowds like a protest (especially in liberal ones). That’s great, but it’s not foolproof. Because of the rise of face masks, many facial recognition technologies were forced to learn how to identify faces with only a partial face visible so that – as an example – people can still unlock their phones in public conveniently. The eyes themselves are also a critical part of facial recognition capabilities, even prior to this. I have it on good authority that the least-suspicious-yet-most-effective way to beat facial recognition is aviator sunglasses and a baseball cap. Try to get your hands on a hat that doesn’t actually reveal anything about you and is very common. For example, I am not a sports fan, but I do live in Texas. As such, a hat with a Houston Astros or Dallas Cowboys logo would not only be a red herring for me, but you can throw a rock on any given day downtown and probably find one or both of those logos within five feet of where it lands as a bumper sticker, shirt, backpack, wallet, etc. Either way, get these items far in advance. It’s easier to pull up purchases from a week ago or earlier that day and correlate them to you. If you made the purchase months ago, that makes things trickier. In fact, if you’re reading this right now and thinking “I’m not interested in protesting right now but I could see myself going if it was an issue I care about,” this is your cue to buy such a hat this weekend.

If you have tattoos, wear long sleeves or clothing that covers them. Think smart. If you’re protesting in the summer, wearing a coat is kind of suspicious. Wearing a long-sleeve shirt is less suspicious. Remove any earrings. Even your walk can give you away, though full disclosure I’m not sure how commonly gait recognition is deployed. I read once somewhere (unfortunately I can’t recall where) that the best defense against this is to wear baggy clothes. These will help obscure your gait, but keep in mind that if they’re too baggy it could interfere with your ability to get away quickly if violence breaks out (and I highly recommend that you bail as soon as the first rock or punch gets thrown even if you had nothing to do with it). Julian Assange also famously put a rock in his shoe to disrupt his gait at one point, however that can be immediately painful and potentially harmful after a while, so I’m not sure the benefits outweigh the risks on that technique.

Cell Phones

Of course, in modern society, we must discuss cell phones. There are a number of reasons that people may wish to bring a cell phone to a protest: the ability to document reality on the ground via video and photos, a contact list in case they get into trouble, the ability to send and receive real-time updates via social media or messaging, and maybe transit capabilities (ridesharing or public transit ticketing apps, for example). However, there are also a significant number of threats, too: your device may get lost, stolen, or damaged. Police may confiscate it. And of course, the Stingrays I mentioned earlier.

The common advice is simply to leave the phone at home. This is the absolute best-case scenario. If you go this route, I recommend writing an important phone number on your body in permanent marker so that it’s harder to rub off if you sweat, ideally somewhere where it won’t be obviously visible as it won’t wash off for a few days. For example, you may want to have the phone number of a close friend who offered to pick you up after the protest or a lawyer in case you get arrested and you may wish to write it on your upper arm where it’s covered by a shirt. It’s a little paranoid, but I’d rather have it and not need it than need it and not have it.

If you do wish to have a phone, the best option is a burner phone. However, at the time of this writing, inflation is kneecapping everyone so the idea of asking someone to go drop even one hundred dollars on a phone for a few hours is pretty ridiculous. If you do have that kind of flexible income, then this is definitely the best plan. Get a cheap Android phone paid for in cash and don’t sign in. Check this page for settings you can modify to make the phone a little more private and secure, and download any apps you need from F-Droid, Aurora Store, or directly from the official website as an APK to avoid needing to link an account to the device. If you couple this with a new anonymous SIM card from a budget-friendly Mobile Virtual Network Operator (MVNO) like Mint Mobile or Visible Wireless, you should have all the capabilities you need (such as recording and instant cloud sync as a backup in case the device gets damaged, lost, or confiscated) with a nearly completely anonymous phone. It is worth noting that cheap Androids tend to have the worst privacy and security: they tend to come preloaded with “bloatware” – apps you don’t need and can’t remove – and some manufacturers are missing the ability to disable 2G, which is a prerequisite to defend against Stingrays. However, since this phone is anonymous and you’re using as few apps as possible, I think this is probably a safe trade-off for most people (assuming you factory reset and discard the phone immediately after the protest). Note: I recommend against getting a dumb phone. Dumb phones may not offer adequate protection against Stingrays and seizure such as VPNs, secure messaging apps, and other settings.

For those who want to have a phone at the protest but cannot afford a burner, you have several options. One is to simply turn it off when you arrive. This is an acceptable option if you don’t plan to record anything (by the time you boot and unlock your phone, it may be too late), though be aware that there will be a metadata record of your device being turned off a specific time and place and then being turned on later. You can also put your phone into airplane mode so that you can still quickly record, but again, there will be a metadata trail of this, too. In this scenario, you should also be aware of “BFU” mode, or “Before First Unlock.” The simple explanation is that if you restart your phone, before you unlock it for the first time with your PIN or passowrd, that is the most secure state your phone can possibly be in. You haven’t unlocked it yet, therefore everything is encrypted as much as possible. With iPhones, you can still swipe up from the bottom of the phone and activate the camera to record in this mode. Androids do not have this capability to my knowledge (at least I was unable to replicate it on my own Android). If your phone gets confiscated, try to turn it off before handing it over to put it back in BFU mode for maximum security (more on that later.) Be sure to visit this page to ensure you’ve locked down your phone as much as possible to protect against Stingrays and other threats.

If Detained or Arrested

So what happens if something goes wrong and the cops do detain you? I am not a lawyer, but after extensive research, here’s a few things I think every American should know:

Arrest means you are in police custody. They can place you in handcuffs, transport you (say to jail), and more. At this point, you have a variety of rights such as the right to remain silent and the right to have an attorney. If you cannot afford an attorney, you have the right to have one provided to you by the state. You may or may not be entitled to any phone calls. The call does not have to be to an attorney, but if it is the police are not permitted to record or otherwise monitor the call. If it is not to an attorney, assume the call is being recorded. At this point, you may be court-ordered to unlock a device such as a phone or computer, but you are not required to tell them the password. They may also legally confiscate it and simply attempt to hack it. This is why I recommended putting your phone in BFU state earlier.

Detainment means you are not under arrest, but you are not free to leave. At this point in time, you are not entitled to an attorney provided by the state, but you are entitled to stay silent, to have an attorney present if you can afford one or have one, and to refuse a search without a warrant. Whether or not your devices are protected from search at this point is still a gray area with many conflicting rulings. You may decide to refuse to unlock your phone, however that may risk being detained longer or escalating the situation to an arrest. It’s worth noting that there have been instances of police unlocking devices using Face ID without consent. The legality of this, as I said, is still being decided. However, because handing over your password or PIN is definitively not required (at least not without a court order), I recommend that prior to attending the protest, you replace your phone with biometrics with a strong PIN or password instead. This will, at a bare minimum, protect your devices from non-consensual searches and abuse.

In general you are never required to answer any questions without an attorney present, regardless of whether you’re arrested or not. You are never required to tell the police any passwords to unlock your phone, computer, tablet, or any device although – as noted before – you may be required to unlock the device if you’re under arrest. Keep in mind that police are allowed to confiscate your device and copy the data (hence why encryption is necessary). I have been detained at protests. In my experience, it is generally recommended to answer some questions such as identifying yourself and saying why you were in attendance. If you feel uncomfortable or the questions start getting accusatory, definitely request a lawyer. One of my non-privacy related interests is true crime, and I can’t tell you how many cases I’ve learned of where innocent people thought they were making themselves look good and doing themselves a favor by not requesting a lawyer (cause they had nothing to hide) and it ended up coming back to bite them.

As I said before, I am not a lawyer. I do keep very up to date with my rights, but things change, laws vary from place to place, and I have no legal background whatsoever. I have written all of this with the best faith, but I encourage you to contact an actual lawyer if you have concerns and questions in this area. Do your own research. I highly recommend EFF’s Surveillance Self Defense portal, especially their article on attending protests. EFF is comprised of actual, experienced lawyers, so I trust their judgment and information. I actually got a lot of the information in this blog post from there.

If you choose to exercise your first amendment rights, please do so peacefully and keep yourself safe. You should never be tagged on a list for peacefully exercising your rights, and you should not be marked for further surveillance or future retribution either. Keep yourself protected, and good luck!

Tech changes fast, so be sure to check TheNewOil.org for the latest recommendations on tools, services, settings, and more. You can find our other content across the web here or support our work in a variety of ways here. You can also leave a comment on this post here: Discuss...