The New Oil

Things are a little crazy here in the US right now – well, crazier than normal – so I thought now might be a good time to talk about protesting, surveillance, privacy and security. Now, before you roll your eyes and move on, I want to explain why I care: I fully support the right to a peaceful protest (peaceful being the key word). I absolutely despise the idea that you can be identified and tagged – 100% without human action – simply for exercising your constitutional rights and peacefully protesting. As the famous quote goes (roughly): “I disagree with what you say, but I will defend to the death your right to say it.” Without going into detail, I believe that attending a protest will absolutely get you put on a list automatically (if you can be identified), that being tagged for peacefully protesting chills free speech, that laws are not an indicator of morality, and that peaceful dissent is an absolutely valid way to demand change. So if being tagged discourages people from attending protests, then it’s a form of control and is immoral. (See my website for more detail and sources.) That’s why I want to cover protesting today: ways you might be tagged and how you can avoid it to protect your privacy and not end up on a list just for exercising your rights.

Finding and Attending the Protest

For most of us, social media will be our main avenue to learn about upcoming protests. That’s fine, but I recommend you don’t actually mark yourself as attending the protest. Several years ago during the Keystone XL protests, law enforcement was accused of using Facebook check-ins to target protesters. The veracity of this claim is debated, but why risk it? Feel free to keep checking the page before the protest to learn of any updates or changes, but don’t publicly mark yourself as attending. Police don’t need a warrant to look at a list of attendees on a Facebook event.

Getting to the protest can also present challenges. Protests often take place at locations that are politically relevant and heavily monitored such as capitol buildings or police station. If you’re in a large city (as the capitols usually are), you can pretty much guarantee that the city is using license-plate scanning technology to track your vehicle as you travel in real-time. Often times public transit is recommended. This of course, isn’t foolproof as many public transit services also have cameras and records, but we’ll come to that shortly. You could also order a cab and pay in cash, but even cabs are starting to include cameras.

Whatever method you take, I recommend arriving near but not at the location. If you drive or get a ride, park or get dropped off a few blocks away. In the unlikely event that public transit stops at the exact location, get off at the stop before or after. Same thing once you’re ready to leave. Move a few blocks away then get picked up. If you’re extra cautious, consider using a different location than you did before. Also if you have to pay for parking and can’t use cash, consider picking up a Vanilla gift card in cash so it can’t be easily connected to your debit or credit card.

Biometric Recognition

At the time of this writing, the COVID-19 pandemic is still a thing and therefore wearing face masks in public is not only acceptable but recommended. That’s great, but some facial recognition actually focuses on the eyes. I have it on good authority that I trust that the least-suspicious-yet-most-effective way to beat facial recognition is aviator sunglasses and a baseball cap. Try to get your hands on a plain black hat. I bought one with a design on it then cut the design off. You could also try getting one that’s out of character for you, maybe with a sports team you’re indifferent to or a band you don’t really listen to. Either way, get these items far in advance. It’s easier to pull up purchases from a week ago or earlier that day and correlate them to you. If you made the purchase more than a month ago, that makes things trickier.

For tattoos, wear long sleeves or clothing that covers them. Think smart. If you’re protesting in the summer, wearing a coat is kind of suspicious. Wearing a long-sleeve shirt is less suspicious. I’ve posted articles in the past about how even your walk can give you away. I read once somewhere (I forget where) that the best defense against this is to wear baggy clothes. These will help obscure your gait, but keep in mind that if they’re too baggy it could interfere with your ability to get away quickly if violence breaks out (and I highly recommend that you bail as soon as the first rock or punch gets thrown even if you had nothing to do with it).

Cell Phones

Now for cell phones. Cell phones are a death sentence if you want to remain anonymous at a protest. Even if you turn off all cell data, WiFi, Bluetooth, and location settings your phone still has to ping cell phone towers continuously to check for regular SMS messages and phone calls. And those pings contain unique, identifying information about your device, which is likely already linked to you unless you keep a device just for this kind of occasion. If you really think you might need your phone, you could leave it in the car or turn it off on arrival, but both of those things run the risk of being suspicious (the location and/or the sudden turning off of the phone, both of which are easily detectable by your provider and police). In my opinion, your safest bet is just to leave the phone on at home. If you must bring the phone, remember to make a backup before you go and maybe even wipe it in case it gets lost, stolen, broken, or confiscated.

What if you do need a phone but you also need to be invisible? Burner phone. Here’s how it works: buy a phone in cash. If you desperately need secrecy, get someone else to do it for you to avoid the cameras (former hacker Kevin Mitnick suggests even paying a stranger to do it if your threat level is high enough). If you need a cheap phone, you can buy a dumb phone but I don’t recommend that for reasons I’ll get into in a moment. Instead, you can buy a slightly-more-expensive-but-still-cheap smartphone Android for about $100. Do not under any circumstance give the phone any real information about you. Use a fake name, don’t use any biometric information to unlock it, etc. I know this is hard, but it can be done. You may have to use something like the Tor Browser to create an anonymous email account for this purpose. That’s fine. Once you have the phone, make sure not to put service in your name, either. Get a prepaid card and use fake information. Make sure to never, ever, ever have this phone on at home. Do the set up a public location like a library or Starbucks. Once you're done setting it up, turn it off and leave it off until you get to the protest. Turn it off again as you leave. If your threat model is low, you can probably repeat this strategy for a few protests at a time. If your threat level is high, I recommend ditching the phone as soon as the protest is over. And as always, I recommend using encrypted messaging – even on a burner phone – and encrypting the device itself whenever possible.

I mentioned not getting a dumb phone. The reason is this: I’ve mentioned Stingray devices before. Quick refresher: Stingrays (technically called IMSI-catchers) are cell-phone tower emulators. They forcibly capture all cell signal in a certain area, copy the data (including the content), and then pass the data along like normal as if nothing ever happened. In fact, you have almost no way of knowing one was even used. Also, these devices are incredibly small – about the size of a desktop computer on the large end and they only get smaller from there. One or more could be easily connected inside a police car along the protest perimeter and you’d never even notice them. I have absolutely zero doubt (though no proof) that these devices are used generously during protests, and that means that every single signal your cell phone sends during that protest will be copied by the police. If you buy a dumb phone, you have zero protection. You cannot load encrypted messaging apps or VPNs onto that device. That means every text you send is readable, as well as who it went to. Even if you only text one person and speak in code, that dramatically increases your risk of being identified. However, if you use a burner smartphone, you can load encrypted messaging apps and VPN apps which will dramatically improve your privacy. The police will still capture your traffic, but it will be all encrypted.

If Detained or Arrested

After extensive research, here’s some things I think every American should know:

Arrest means you are in police custody. They can place you in handcuffs, move you around, and more. At this point, you have a variety of rights such as the right to remain silent and the right to have an attorney. If you cannot afford an attorney, you have the right to have one provided to you by the state. You may or may not be entitled to any phone calls. The call does not have to be to an attorney, but if it is the police are not permitted to record or otherwise monitor the call. If it is not to an attorney, assume the call is being recorded. Also at this time you are not entitled to refuse a search without a warrant. At this point, you may be ordered to unlock a device such as a phone or computer, but you are not required to tell them the password.

Detainment means you are not under arrest, but you are not free to leave. At this point in time, you are not entitled to an attorney provided by the state, but you are entitled to stay silent, to have an attorney present if you can afford one or have one, and to refuse a search without a warrant. Keep in mind that your devices are protected by warrants. Police are not allowed to unlock and search your devices without a warrant or consent from you. I recommend you use a PIN or password lock anyways because unfortunately not all cops know this or care. Don’t use facial ID or fingerprint because the officer might try to point the camera at you in an attempt to unlock the device without your consent and search through it.

In general you are never required to answer any questions without an attorney present, regardless of whether you’re arrested or not. You are never required to tell the police any passwords to unlock your phone, computer, tablet, or any device although – as noted before – you may be required to unlock the device if you’re under arrest. Keep in mind that police are allowed to confiscate your device and copy the data (hence why encryption is necessary). I have been detained at protests. In my experience, it is generally okay to answer some questions such as identifying yourself and saying why you were in attendance. If you feel uncomfortable or the questions start getting accusatory, definitely request a lawyer. One of my non-privacy related interests is true crime, and I can’t tell you how many cases I’ve studied where innocent people thought they were making themselves look good and doing themselves a favor by not requesting a lawyer (cause they had nothing to hide) and it ended up coming back to bite them.

I am not a lawyer. I do keep very up to date with my rights, but things change, laws vary from place to place, and I have no legal background whatsoever. I have written all of this with the best faith, but I encourage you to contact an actual lawyer if you have concerns and questions in this area. Do your own research. I highly recommend EFF’s Surveillance Self Defense portal, especially their article on attending protests. EFF is comprised of actual, experienced lawyers, so I trust their judgement and information. I actually got a lot of the information in this blog post from there.

If you choose to exercise your first amendment rights, please do so peacefully and keep yourself safe. You should never be tagged on a list for peacefully exercising your rights, and you should not be marked for further surveillance or future retribution either. Keep yourself protected, and good luck!

Tech changes fast, so be sure to check TheNewOil.org for the latest recommendations on tools, services, settings, and more. You can find our other content across the web here or support our work in a variety of ways here. You can also leave a comment on this post here: Discuss...