(202) 656-6430‬

Establishing Secure Comms

A critical step in your overall security strategy is to develop secure comms. That means developing a capability to communicate with your support system and allies without being detected. This guide will walk you through the process of establishing secure methods to communicate with chosen recipients. Note that those you’re communicating with may need compatible software or apps in some cases.

Remember that sudden changes in behavior, or any deviation from the norm, can be an indicator that something’s going on. Make sure that you can either hide or explain any security changes if asked about them. Because of recent security incidents in the news, this may be one way to explain your interest in securing your devices. Or, perhaps you recently had mandatory security training at your workplace. Whatever you choose, just make sure that you can reasonably explain any new apps or configuration changes.

Secure Communications Plan

While there’s no way to guarantee complete communications security, you can take prudent and reasonable measures to better protect your private discussions. As with any security concept, the first thing to do is to figure out what information you need to hide, who you need to hide it from, and what they’re capabilities are to intercept or obtain your messages. That way, you can make sure you’re effectively protecting the right information in the right way.

For starters, use trusted, third-party tools for communication. Don’t rely on the tools built into your computer or phone whenever possible. Here’s a few tools to consider:

  • Mobile and computer
    • Telegram (https://telegram.org/). Telegram is a secure messaging platform that works a lot like text messaging. Allows for secret chats, encryption, and self-distracting messages
    • Private Internet Access VPN (https://www.privateinternetaccess.com/). Secure, easily configured VPN service. There is an annual fee for this service. Note that one account can be used across multiple devices
  • Computer only
    • TOR Browser Bundle (https://www.torproject.org/projects/torbrowser.html.en). East to use and pre-configured. Contains a secured browser and that routes across the encrypted TOR network. Does not record browser history
    • Tails (https://tails.boum.org/). Tails stands for The Amnesiac Incognito Live System. It’s an entire operating system that’s loaded to a thumb drive or CD, and allows you to use the computer while bypassing the hard drive completely and leaving zero trace on the system. Using Tails, you can use the internet anonymously and easily encrypt any files, emails, and messages.
  • Mobile only
    • If your phone supports it, use the password-protected secure folder. Many Samsung devices, for example, have a secure folder function that you can rename and hide
    • Guardian Project apps (https://guardianproject.info/apps/). Offers secure communications for your phone, to include secure browsing, secure chat, and the ability to hide messages in pictures (which someone can read only with a password and the same app)

Here’s a few more specific tips to help ensure your privacy:

  • For apps that require an account, uninstall them in between use. You can always download the app again and log in, but that way the app will only be present when you’re using it
  • Use an app locker to password-protect apps. Try to find one that has secret functionality to access the protected apps, for example a pattern that you have to use to get to the login screen. Otherwise, it just appears that the app has crashed
  • Create and maintain a secret email account that is not connected to you in any other way. Use a fake name and use fake password security questions if prompted to establish any. Do not use gmail for this; instead, use a secure email platform like ProtonMail.com. Always use the web interface and do not save the login info- type it out every time. Make sure you log out when done
  • Do not reuse passwords, especially with your secure communication channels. Use strong passwords that aren’t easy to guess by someone that knows a lot about you
  • Take time to explore and configure the security and privacy settings on all accounts. Many services, like Facebook and Google offer a “privacy checkup” feature that will walk you through the settings
  • Enable two-factor authentication (2FA) whenever possible
  • TURN OFF notifications for any secure messaging platforms
  • Use a new Skype or Google voice account for phone calls
  • Remember that if your phone connects to wifi, your traffic is visible just as if you were using your computer

Your PACE plan:

Always have a backup communications plan. Do not rely only on one method, because that method may later become unsafe or unavailable. Develop backup plans and make sure that your support system is aware of them. A good strategy is to develop what’s called a PACE plan; that is, defining your Primary, Alternate, Contingency, and Emergency communication.

  • Primary: The best and preferred method of communication. For you, this might be text, phone, VOIP, or any other popular method of communication
  • Alternate: A common, but less-preferred communication method. Often, the alternate form of communication is also checked regularly. If text is your primary, your alternate might be email for example
  • Contingency: A method that isn’t always convenient or easy to use but will work in a pinch. This might include communicating via drafts in secure email accounts or a trusted intermediary
  • Emergency: A method of last resort, only used when other means fail. This might include visiting in person, purchasing a new prepaid (burner) phone, or other methods.

A note on “burner phones”

In some cases, it’s advisable to maintain a second prepaid cell phone, often referred to as a “burner phone.” This means that you don’t have to worry about phone records or other traces. However, remember that the existence of a burner phone is a huge indication that something’s being planned. If you can’t conceal it or explain it, don’t take the risk. If possible, keep the burner phone outside the house, perhaps at work or with a trusted friend, in a place where you can access it when needed but won’t ever be found by someone you can’t trust.

———————————————- 

Risks and concerns

Just as important as understanding the tactics and technologies behind a secure communications plan is to understand the security concerns that might compromise your plan. This section will discuss common issues and recommend countermeasures.

Smart phones

While a smart phone, like an iPhone or Android devices, are a great way to stay in touch, it’s important to understand the security risks related to such devices. If your abuser ever had access to the device, know that it could be configured to track your activity or location.

Call/text records

Your bill and cell carrier’s online records will show all phone numbers you call or text when you’re using the phone’s native calling and texting app. Using trusted third-party apps as discussed in the previous section can avoid that risk. If there is any concern that your abusive partner may be watching your phone records, do not call or text any shelters or elements of your support system unless you’ve taken the proper precautions.

Browser and keyboard history

  • Even on your phone, your browser history will show sites that you’ve visited and when. You can avoid this by using your browser’s incognito / private browsing mode. Alternately, you can download a third-party browser like Chrome or Firefox and delete it after each use
  • Your keyboard stores frequently used words and phrases. This is how it can recommend words as you’re typing. Clear your keyboard’s cache in your phone or app settings, as appropriate to the keyboard you’re using

Spy apps

There are apps that are designed to spy on the user. They can do multiple things, such as collecting your location (if using GPS, it’s very accurate. If GPS is disabled, it will use other methods that will show your general location), text messages, images, and other activities. They can also alert whoever installed it when certain keywords are entered or record all keystrokes. Here are some ways to detect spy apps on your phone:

  • Look through your installed apps for anything you don’t recognize. If you don’t need it or don’t remember installing it, uninstall it
  • Is your battery draining faster than usual? Look at your battery settings to find out which apps are drawing more battery power
  • Look at your phones security settings > phone administrators. If somethings fishy, disable admin for it
  • If all else fails, you can perform a factory reset on your phone before installing only apps you trust, or take your phone to the retailer and ask for assistance

Computers

Other guides cover specific computer security risks and concepts related to computers, but here are a few things to keep in mind:

Network equipment

Your home router may keep track of what websites you’re visiting. Sometimes, even home networks may have a web server to manage and monitor internet traffic. Here’s a few things you can do to avoid this:

  • If your data plan allows it, use the tethering option on your phone. Your bill will still show data being used, but it won’t show which sites you’re visiting (assuming your phone is secure)
  • Use a known trusted computer whenever possible, such as one owned and controlled by a member of your support system
  • Use a virtual private network, or VPN. VPNs encrypt all your data so it can’t be seen by intermediary devices. It’s still possible to see that encrypted data is being sent over the network, but it won’t show where you’re going. Make sure that your VPN software protects DNS queries and will disconnect your internet access if accidentally turned off. Private Internet Access (PIA) does both of those easily

Remember that a workplace IT department can also view your internet traffic.

Malware

Malicious software, or malware, is any software that has an unintended or undesirable effect on your system. This can include viruses, spyware, ransomware, trojans, or other similar things. Make sure to install and run anti-malware software. Current windows-based operating systems, for example, have Windows Defender built in, which is adequate.

Here are some signs that you may have a virus:

  • Your computer starts working slowly or erratically
  • It takes longer than usual to startup
  • You see unauthorized icons, programs, folders, or startup items (open Start > Run > “Msconfig”>Startup)
  • New toolbars or tray icons
  • You get an antivirus alert
  • Your browser keeps crashing or changing your homepage
  • You can no longer access your task manager by hitting ctrl+alt+del or right-clicking on your taskbar
  • You can access task manager, but your CPU usage is very high when no programs are running

If you detect any of those signs or symptoms, stop doing any sensitive work and run a virus scan. Ideally, use an external web-based virus scanner like the one at eset.com. If you’re unable to remove the virus yourself, take your computer to a qualified computer repair shop if possible.

History and browser tracking

Remember that your computer keeps a record of the sites you visit. Instructions for removing your history and avoiding this is available in other security guides on this site. Remember to clear out your recent files if you access any sensitive files and use incognito or private browsing mode whenever possible. Understand that private browsing isn’t bulletproof, so additional security measures may be required depending on your unique situation. Again, please refer to the other guides on this site as needed.