Counter Surveillance
Counter Surveillance
Counter Surveillance
Introduction
First of all, we'll start with what CS is. In simple terms, its the avoidance of surveillance and the
methods of which one may take to minimize the risk of surveillance. Its uses can range from (as
in my case) "covering yourself" from people who may wish to take negative actions against you,
to activists or political advocates who may also have wronged people. It also applies to those
who feel they may be under surveillance by official means - Law Enforcement.
Before we delve into CS; it may be worth taking the following into account:
Your security is only as strong as your weakest point - there is no point investing time
and effort into securing yourself from surveillance if you're broadcasting your activities
and movements via insecure electronic means. (Plaintext websites, Email, Phone, SMS)
Having compromising items on you can ruin even the best of silences. (Unencrypted
USB disks, notes, documents..)
A comprehensive security plan is not going to be an easy thing to accomplish, and can
take weeks to implement depending on your past
Note, you may want to install truecrypt - copy all your data over to a USB disk encrypted with
truecrypt before erasing (secure deletion) your whole hard drive and re-installing the OS and
starting a fresh. Your truecrypt partition will be able to be read by any truecrypt installation - so
this will work!
LEARN TO FIX YOUR OWN COMPUTER. Don't trust ANYONE going near it to try and fix
it, or repair it in anyway. Fixing computers is easy anyway, even if it means buying a simple
book on the subject - just learn to become utterly self-reliant with things like this. The same goes
for mobile phones.
Additionally, you may wish to ensure you have a decent BIOS password set-up to stop anyone
from booting up your system from a live distribution and copying data over. This means you
need to ensure your hard disk is #1 in the boot priority. They could, just remove your hard disk
then - so you may want to get a computer case that allows you to use a lock.
Another way of protecting your data is to use the "FDE" (Full Disk Encryption) feature of
Truecrypt which encrypts the entire hard drive. Windows 7 wont work with this, UNLESS you
do some magic to the partition table prior to installation. (Google for instructions. Basically
windows 7 creates an emergency partition which stops truecrypt from working - but Windows 7
wont do this if theres already a partition table; so you create 2 partitions yourself, install
windows 7, delete the spare one, and make the windows 7 one bigger..)
Now please note, that is far from a fully comprehensive plan for your ITSEC, but it should have
given you more than enough food for thought to get into a secure routine and to clean your
system. Now we have a secure system we need to consider the fact its going to be
communicating with systems on a insecure and vulnerable network - let me introduce you to our
new best friend; COMSEC, or Communications Security.
We have to remember our system is meerly a peer within millions of, often insecure, peers. With
this in mind we need to do everything to ensure that those which we communicate with are
adhering to similar guidelines; and if not - we're only communicating with some ability of
anonymity. To do this we may need to think about..
Virtual Private Networks; Do we require a secure gateway where even our ISP can't
seewhat we're doing? If so, do we also need to keep speed up to an acceptable level? If
so; a
VPN maybe for us. All traffic can be routed via a VPN which is also nice when
consideringthings like file sharing and email.
Install Messaging Encryption; There are many encryption applications out there for IM.
One of these is OTR, OTR provide support for several popular clients. Please note; OTR
is closed source and I cannot confirm the security afforded by this! (Aim for open source
solutions if possible)
Email Encryption; Ensure anything of secrecy is sent between encrypted peers using PGP
Encryption. GNUPGP is available for free, and there are many resources available on
theinternet regarding the setting up procedure. There are also firefox add-ons available to
interface GNUPGP with Gmail in Firefox.
Email and IM Anonymity; should you choose to run a VPN then this will be fine - as all
your IM and Email traffic will be routed via that. However, if you don't then you may
wish to route your IM applications via TOR - although TOR is not secure, it is
anonymous - and security should be covered with your encryption! Now thats the
obvious methods of communication covered. Lets cover the traditional types;
Mail. Do you even use this anymore? As far as COMSEC goes you may want to be
carefulabout handwritting, but similarly you may want to be careful of printer signatures.
Telephones. Get a Pay as you go SIM card, a disposable phone and use that. Gaurd this
number with your life and keep it seperate from your personal phone/number. If you use
a smartphone, limit the amount of apps you install and make sure things like the Google
tracking service are OFF. Bluetooth? Off. Be prepard to dispose of this number at any
time, if you can afford, get a new SIM card every 2 weeks or so - 99p stores have a
variety of SIM cards in the UK. Ensure you have a PIN code, contacts are named
discreetly, and the phone requires the PIN code to unlock.
Now we have the basis of PERSEC (ITSEC + COMSEC inc.) covered - its time to meet our
good friend Operational Security (OPSEC). This is all very specific to what you are doing -
however the objective of operational security is to ensure that your operation isnt
compromised by any information leaks, and that only trusted people have trustable amounts
of information.
The most obvious approach to this is to not tell anyone about what you're upto, keep notes on
your USB encrypted pen drive and keep your wits about you. Generally, PERSEC and
OPSEC overlap quite a bit, as do most of these security disciplines.
Before we get on to the Counter-Surveillance it may be a good time to look at your own
Physical Security. Most of us on this forum know quite a bit on Physical Security so I wont
waste my time going on about locks, deadbolts, chains, window locks, ensuring you can't card
your way in...
However, some of us may wish to consider leaving traps around should anyone get in. Even
simple things like leaving items in specific spots, taking photos and comparing them. Or
sellotaping a peice of thread to the back of a drawer, to the back of the chest of draws -
meaning if anyone opens the draw then the thread will be ripped off.. You can use your
imagination and go wild with these ideas; but they may just help you find out if someones
been having a nosey around your stuff!
Part 3. Profiling your associates, their trust worthiness and creating your own profile
This is one of the harder things to do - it often means making harsh judgements on those you
feel the strongest about. However, following on from PERSEC - you need to determine who
knows what about you, and how trust worthy they are. Now this goes beyond the usual
"friends trust" that you are familiar with..
- Would this person be able to handle themselves should something I say to them get them in
trouble?
- How much do they know of me already, would they expect it?
- How likely are they to tell anyone? When drunk? To impress a girl?
Often, its best just to tell people what they specifically need to know - if anything.
- "I'm gonna be going out tonight at about 10 mate, you couldn't give me a ring when I get
back at 3 could you? If I don't answer then could you..." - AKA "I'm doing something a little
risky, if I dont answer I could be in trouble."
- "I'm meeting up with another mate, you wont know em" - AKA "I'm meeting someone that I
don't really wanna talk about"
- "*silence*" - AKA *anything you're not sure about*
Even friends who have the best intentions can pose problems if they get in out of their depth,
and often its just a whole lot easier to tell a few white lies and keep things simple. In some
ways - you owe it to THEM not to drag them into this.
This changes however if you think the surveillance is very real, and they may try approaching
friends next.
You should also think of profiling any friends prior to informing them of anything secretive.
- How do they come across?
* Straight A Geek or Street smart crook? Sometimes the geek is better..
- What do they enjoy?
* Think of their interests
* What do they read? Talk about?
* What do you usually see them doing?
- Who do they associate with?
* What type of people?
* What type of places?
* Any threats or trouble?
- Where are they usually found?
* Workplace?
* Pubs/clubs?
* Friends?
* Girlfriend?
- Disadvantages
* Confidence?
* Lies?
* Nerves?
By profiling them you can make sure you are doing the right decision by informing them, and
you can also look at their own weaknesses and ensure that you can pre-empt any next move.
Now you have profiled some of your friends, we need to profile you! Think about those above
questions and answer them, then determine what bits can be "public" and which bits are
certainly "private". Make sure you drill this profile into you, it needs to be second nature. You
can't risk answering questions with different answers at social occasions, nor can you risk
different people knowing different things. As far as everyone needs to be concerned - you're a
bog standard normal guy with a boring normal life. End Of. All you need to do is work out the
specifics of this cover.