Journalists are used to working in dangerous situations, but there's no need to take unnecessary risks with your data
and communications. With this playlist, you can learn how to understand your threat model, communicate safely with others, and circumvent online censorship.
Trying to protect all your data from everyone all the time is impractical and exhausting. But, have no fear! Security is a process, and through thoughtful planning, you can put together a plan that’s right for you. Security isn’t just about the tools you use or the software you download. It begins with understanding the unique threats you face and how you can counter those threats.
In computer security, a threat is a potential event that could undermine your efforts to defend your data. You can counter the threats you face by determining what you need to protect and from whom you need to protect it. This is the process of security planning, often referred to as “threat modeling.”
This guide will teach you how to make a security plan for your digital information and how to determine what solutions are best for you.
What does a security plan look like? Let’s say you want to keep your house and possessions safe. Here are a few questions you might ask:
What do I have inside my home that is worth protecting?
could include: jewelry, electronics, financial documents, passports, or photosWho do I want to protect it from?
How likely is it that I will need to protect it?
How bad are the consequences if I fail?
How much trouble am I willing to go through to prevent these consequences?
Once you have asked yourself these questions, you are in a position to assess what measures to take. If your possessions are valuable, but the probability of a break-in is low, then you may not want to invest too much money in a lock. But, if the probability of a break-in is high, you’ll want to get the best lock on the market, and consider adding a security system.
Making a security plan will help you to understand the threats that are unique to you and to evaluate your assets, your adversaries, and your adversaries’ capabilities, along with the likelihood of risks you face.
Security planning helps you to identify what could happen to the things you value and determine from whom you need to protect them. When building a security plan answer these five questions:
Let’s take a closer look at each of these questions.
An “asset” is something you value and want to protect. In the context of digital security, an asset is usually some kind of information. For example, your emails, contact lists, instant messages, location, and files are all possible assets. Your devices may also be assets.
Make a list of your assets: data that you keep, where it’s kept, who has access to it, and what stops others from accessing it.
To answer this question, it’s important to identify who might want to target you or your information. A person or entity that poses a threat to your assets is an “adversary.” Examples of potential adversaries are your boss, your former partner, your business competition, your government, or a hacker on a public network.
Make a list of your adversaries, or those who might want to get ahold of your assets. Your list may include individuals, a government agency, or corporations.
Depending on who your adversaries are, under some circumstances this list might be something you want to destroy after you’re done security planning.
There are many ways that an adversary could gain access to your data. For example, an adversary can read your private communications as they pass through the network, or they can delete or corrupt your data.
The motives of adversaries differ widely, as do their tactics. A government trying to prevent the spread of a video showing police violence may be content to simply delete or reduce the availability of that video. In contrast, a political opponent may wish to gain access to secret content and publish that content without you knowing.
Security planning involves understanding how bad the consequences could be if an adversary successfully gains access to one of your assets. To determine this, you should consider the capability of your adversary. For example, your mobile phone provider has access to all your phone records. A hacker on an open Wi-Fi network can access your unencrypted communications. Your government might have stronger capabilities.
Write down what your adversary might want to do with your private data.
Risk is the likelihood that a particular threat against a particular asset will actually occur. It goes hand-in-hand with capability. While your mobile phone provider has the capability to access all of your data, the risk of them posting your private data online to harm your reputation is low.
It is important to distinguish between what might happen and the probability it may happen. For instance, there is a threat that your building might collapse, but the risk of this happening is far greater in San Francisco (where earthquakes are common) than in Stockholm (where they are not).
Assessing risks is both a personal and a subjective process. Many people find certain threats unacceptable no matter the likelihood they will occur because the mere presence of the threat at any likelihood is not worth the cost. In other cases, people disregard high risks because they don’t view the threat as a problem.
Write down which threats you are going to take seriously, and which may be too rare or too harmless (or too difficult to combat) to worry about.
There is no perfect option for security. Not everyone has the same priorities, concerns, or access to resources. Your risk assessment will allow you to plan the right strategy for you, balancing convenience, cost, and privacy.
For example, an attorney representing a client in a national security case may be willing to go to greater lengths to protect communications about that case, such as using encrypted email, than a mother who regularly emails her daughter funny cat videos.
Write down what options you have available to you to help mitigate your unique threats. Note if you have any financial constraints, technical constraints, or social constraints.
Keep in mind your security plan can change as your situation changes. Thus, revisiting your security plan frequently is good practice.
Create your own security plan based on your own unique situation. Then mark your calendar for a date in the future. This will prompt you to review your plan and check back in to determine whether it’s still relevant to your situation.
Telecommunication networks and the Internet have made communicating with people easier than ever, but have also made surveillance more prevalent. Without taking extra steps to protect your privacy, every phone call, text message, email, instant message, video and audio chat, and social media message could be vulnerable to eavesdroppers.
Often the most privacy-protective way to communicate with others is in person, without computers or phones being involved at all. Because this isn’t always possible, the next best thing is to use end-to-end encryption.
Work?End-to-end encryption ensures that information is turned into a secret message by its original sender (the first “end”), and decoded only by its final recipient (the second “end”). This means that no one can “listen in” and eavesdrop on your activity, including wifi cafe snoops, your Internet service provider, and even the website or app you are using itself. Somewhat counter-intuitively, just because you access messages in an app on your phone or information from a website on your computer does not mean that the app company or website platform itself can see them. This is a core characteristic of good encryption: even the people who design and deploy it cannot themselves break it.
All the tools that have guides on the SSD site use end-to-end encryption. You can use end-to-end encryption for any kind of communication — including voice and video calls, messaging and chat, and email.
(Not to be confused with end-to-end encryption is transport-layer encryption. While end-to-end encryption protects messages, for example, all the way from you to your recipient, transport-layer encryption only protects them as they travel from your device to the app’s servers and from the app’s servers to your recipient’s device. In the middle, your messaging service provider—or the website you are browsing, or the app you are using—can see unencrypted copies of your messages.)
Under the hood, end-to-end encryption works like this: When two people want to communicate via end-to-end encryption (for example, Akiko and Boris) they must each generate pieces of data, called keys. These keys can be used to turn data that anyone can read into data that can be only read by someone who has a matching key. Before Akiko sends a message to Boris, she encrypts it to Boris's key so that only Boris can decrypt it. Then she sends this encrypted message across the Internet. If anyone is eavesdropping on Akiko and Boris—even if they have access to the service that Akiko is using to send this message (such as her email account)—they will only see the encrypted data and will be unable to read the message. When Boris receives it, he must use his key to decrypt it into a readable message.
Some services, like Google Hangouts, advertise “encryption,” but use keys that are created and controlled by Google, not the sender and final receiver of the message. This is not end-to-end encryption. To be truly secure, only the “ends” of the conversation should have the keys that let them encrypt and decrypt. If the service you use controls the keys, that is transport layer-encryption instead.
End-to-end encryption means that users must keep their keys secret. It can also mean doing work to make sure the keys used to encrypt and decrypt belong to the right people. Using end-to-end encryption can involve some effort—from simply choosing to download an app that offers it to proactively verifying keys—but it's the best way for users to verify the security of their communications without having to trust the platform that they're both using.
Learn more about encryption in What Should I know About Encryption?, Key Concepts in Encryption, and Different Types of Encryption. We also explain one particular kind of end-to-end encryption—called “public key encryption”—in more detail in A Deep Dive on End-to-End Encryption.
When you make a call from a landline or a mobile phone, your call is not end-to-end encrypted. When you send a text message (also known as SMS) on a phone, the text is not encrypted at all. Both allow governments or anyone else with power over the phone company to read your messages or record your calls. If your risk assessment includes government interception, you may prefer to use encrypted alternatives that operate over the Internet. As a bonus, many of these encrypted alternatives also offer video.
Some examples of services or software that offer end-to-end encrypted texting and voice and video calls include:
Some examples of services that do not offer end-to-end encryption by default include:
And some services, like Facebook Messenger and Telegram, only offer end-to-end encryption if you deliberately turn it on. Others, like iMessage, only offer end-to-end encryption when both users are using a particular device (in the case of iMessage, both users need to be using an iPhone).
End-to-end encryption can defend you against surveillance by governments, hackers, and the messaging service itself. But all of those groups might be able to make secret changes in the software you use so that even if it claims to use end-to-end encryption, it is really sending your data unencrypted or with weakened encryption.
Many groups, including EFF, spend time watching well-known providers (like WhatsApp, which is owned by Facebook, or Signal) to make sure they really are providing the end-to-end encryption they promise. But if you are concerned about these risks, you can use tools that use publicly known and reviewed encryption techniques and are designed to be independent of the transport systems they use. OTR and PGP are two examples. These systems rely on user expertise to operate, are often less user-friendly, and are older protocols that don’t use all of the modern best encryption techniques.
Off-the-Record (OTR) is an end-to-end encryption protocol for real-time text conversations that can be used on top of a variety of instant messaging services. Some tools that incorporate OTR include:
PGP (or Pretty Good Privacy) is the standard for end-to-end encryption of email. For detailed instructions on how to install and use PGP encryption for your email, see:
PGP for email is best-suited for technically experienced users communicating with other technically experienced users who are well aware of PGP’s complexities and limitations.
End-to-end encryption only protects the content of your communication, not the fact that you are communicating in the first place. It does not protect your metadata, which includes, for example, the subject line of an email, who you are communicating with, and when. If you are making a call from a cell phone, information about your location is also metadata.
Metadata can provide extremely revealing information about you even when the content of your communication remains secret.
Metadata about your phone calls can give away some very intimate and sensitive information. For example:
End-to-end encryption is only one of many features that may be important to you in secure communication. As described above, end-to-end encryption is great for preventing companies and governments from accessing your messages. But for many people, companies and governments are not the biggest threat, and therefore end-to-end encryption might not be the biggest priority.
For example, if someone is worried about a spouse, parent, or employer with physical access to their device, the ability to send ephemeral, “disappearing” messages might be their deciding factor in choosing a messenger. Someone else might be worried about giving their phone number out, and so the ability to use a non-phone-number “alias” might be important.
More generally, security and privacy features are not the only variables that matter in choosing a secure communications method. An app with great security features is worthless if none of your friends and contacts use it, and the most popular and widely used apps can vary significantly by country and community. Poor quality of service or having to pay for an app can also make a messenger unsuitable for some people.
The more clearly you understand what you want and need out of a secure communication method, the easier it will be to navigate the wealth of extensive, conflicting, and sometimes outdated information available.
If you have a smartphone, laptop, or tablet, you’re carrying a massive amount of data with you at all times. Your social contacts, private communications, personal documents and personal photos (many of which have confidential information of dozens, even thousands of people) are just some examples of things you may store on your digital devices. Because we store and carry so much data, it can be hard to keep it safe—especially because it can be taken from you relatively easily.
Your data can be seized at the border, taken from you in the street, or burgled from your house and copied in seconds. Unfortunately, locking your device with passwords, PINs, or gestures may not protect your data if the device itself is seized. It’s relatively easy to bypass such locks because your data is stored in an easily-readable form within the device. An adversary would just need to access the storage directly in order to copy or examine your data without your password.
With that said, you can make it harder for those who physically steal your data to unlock its secrets. Here are a few ways you can help keep your data safe.
Your DataIf you use encryption, your adversary needs both your device and your password to unscramble the encrypted data. Therefore, it's safest to encrypt all of your data, not just a few folders. Most smartphones and computers offer complete, full-disk encryption as an option.
For smartphones and tablets:
For computers:
BitLocker's code is closed and proprietary, which means it is hard for external reviewers to know exactly how secure it is. Using BitLocker requires you trust Microsoft provides a secure storage system without hidden vulnerabilities. On the other hand, if you're already using Windows, you are already trusting Microsoft to the same extent. If you are worried about surveillance from the kind of adversaries who might know of or benefit from a backdoor in either Windows or BitLocker, consider an alternative open-source operating system such as GNU/Linux or BSD, especially a version that has been hardened against security attacks, such as Tails or Qubes OS. Alternatively, consider installing an alternative disk encryption software, Veracrypt, to encrypt your hard drive.
Remember: Whatever your device calls it, encryption is only as good as your password. If an adversary has your device, they have all the time in the world to figure out your passwords. An effective way of creating a strong and memorable password is to use dice and a word list to randomly choose words. Together, these words form your “passphrase.” A “passphrase” is a type of password that is longer for added security. For disk encryption we recommend selecting a minimum of six words. Check out our guide to Creating Strong Passwords for more information.
It may be unrealistic for you to learn and enter a long passphrase on your smartphone or mobile device. So, while encryption can be useful to prevent casual access, you should preserve truly confidential data by keeping it hidden from physical access by adversaries, or cordoned away on a much more secure device.
Maintaining a secure environment can be hard. At best, you have to change passwords, habits, and perhaps the software you use on your main computer or device. At worst, you have to constantly think about whether you're leaking confidential information or using unsafe practices. Even when you know the problems, you may not be able to employ solutions because sometimes people with whom you need to communicate use unsafe digital security practices. For instance, work colleagues might want you to open email attachments from them, even though you know your adversaries could impersonate them and send you malware.
So what’s the solution? Consider cordoning off valuable data and communications onto a more secure device. You can use the secure device to keep the primary copy of your confidential data. Only use this device occasionally and, when you do, consciously take much more care over your actions. If you need to open attachments, or use insecure software, do it on another machine.
An extra, secure computer may not be as expensive an option as you think. A computer that is seldom used, and only runs a few programs, does not need to be particularly fast or new. You can buy an older netbook for a fraction of the price of a modern laptop or phone. Older machines also have the advantage that secure software like Tails may be more likely to work with them than newer models. Some general advice is almost always true: When you buy a device or an operating system, keep it up-to-date with software updates. Updates will often fix security problems in older code that attacks can exploit. Note that some older operating systems may no longer be supported, even for security updates.
your computer’s hard drive with a strong passphrase so that if it is stolen, the data will remain unreadable without the passphrase.” between the computer and the rest of the world. While extreme, this can be an option if you want to protect data that you rarely access, but never want to lose (such as an encryption key, a list of passwords, or a backup copy of someone else's private data that has been entrusted to you). In most of these cases, you might want to consider just having a hidden storage device, rather than a full computer. An encrypted USB key kept safely hidden, for example, is probably as useful (or as useless) as a complete computer unplugged from the Internet. hidden from those services. If someone is choosing to specifically target your identity with malware, or is only intercepting your communications, separate accounts and Tor can help break the link between your identity, and this particular machine.While having one secure device that contains important, confidential information may help protect it from adversaries, it also creates an obvious target. There’s also a risk of losing the only copy of your data if the machine is destroyed. If your adversary would benefit from you losing all your data, don't keep it in just one place, no matter how secure. Encrypt a copy and keep it somewhere else.
A variation on the idea of a secure machine is to have an insecure machine: a device that you only use when going into a dangerous place or attempting a risky operation. Many journalists and activists, for instance, take a basic netbook with them when they travel. This computer does not have any of their documents or usual contact or email information on it so there’s minimal loss if it is confiscated or scanned. You can apply the same strategy to mobile phones. If you usually use a smartphone, consider buying a cheap throwaway or burner phone when travelling for specific communications.
ManagersReusing passwords is an exceptionally bad security practice. If a bad actor gets ahold of a password that you've reused across multiple services, they can gain access to many of your accounts. This is why having multiple, strong, unique passwords is so important.
Fortunately, a password manager can help. A password manager is a tool that creates and stores passwords for you, so you can use many different passwords on different sites and services without having to memorize them. Password managers:
store several passwords (and responses to security questions) safely.
protect all of your passwords with a single master password (or passphrase).
KeePassXC is an example of a password manager that is open-source and free. You can keep this tool on your desktop or integrate it into your web browser. KeePassXC does not automatically save changes you make when using it, so if it crashes after you've added some passwords, you can lose them forever. You can change this in the settings.
Wondering whether a password manager is the right tool for you? If a powerful adversary like a government is targeting you, it might not be.
Remember:
using a password manager creates a single point of failure.
password managers are an obvious target for adversaries.
research suggests that many password managers have vulnerabilities.
If you’re worried about expensive digital attacks, consider something more low-tech. You can create strong passwords manually (see “Creating strong passwords using dice” below), write them down, and keep them somewhere safe on your person.
Wait, aren’t we supposed to keep passwords in our heads and never write them down? Actually, writing them down, and keeping them somewhere like your wallet, is useful so you’ll at least know if your written passwords go missing or get stolen.
There are a few passwords that you should memorize and that need to be particularly strong. These include:
(like full-disk encryption),” for your password managerOne of many difficulties when people choose passwords themselves is that people aren't very good at making random, unpredictable choices. An effective way of creating a strong and memorable password is to use dice and a word list to randomly choose words. Together, these words form your “passphrase.” A "passphrase" is a type of password that is longer for added security. For disk encryption and your password manager, we recommend selecting a minimum of six words.
Why use a minimum of six words? Why use dice to pick words in a phrase randomly? The longer and more random the password, the harder it is for both computers and humans to guess. To find out why you need such a long, hard-to-guess password, here’s a video explainer.
Try making a passphrase using one of EFF's word lists.
If your computer or device gets compromised and spyware is installed, the spyware can watch you type your master password and could steal the contents of the password manager. So it's still very important to keep your computer and other devices clean of malware when using a password manager.
Beware of the “security questions” that websites use to confirm your identity. Honest answers to these questions are often publicly discoverable facts that a determined adversary can easily find and use to bypass your password entirely.
Instead, give fictional answers that no one knows but you. For example, if the security question asks:
“What was the name of your first pet?”
Your answer could be a random password generated from your password manager. You can store these fictional answers in your password manager.
Think of sites where you’ve used security questions and consider changing your responses. Do not use the same passwords or security question answers for multiple accounts on different websites or services.
Many password managers allow you to access your passwords across devices through a password-synchronizing feature. This means when you sync your password file on one device, it will update it on all of your devices.
Password managers can store your passwords “in the cloud,” meaning encrypted on a remote server. When you need your passwords, these managers will retrieve and decrypt the passwords for you automatically. Password managers that use their own servers to store or help synchronize your passwords are more convenient, but are slightly more vulnerable to attacks. If your passwords are stored both on your computer and in the cloud, an attacker does not need to take over your computer to find out your passwords. (They will need to break your password manager’s passphrase though.)
If this is concerning, don't sync your passwords to the cloud and instead opt to store them on just your devices.
Keep a backup of your password database just in case. Having a backup is useful if you lose your password database in a crash, or if your device is taken away from you. Password managers usually have a way to make a backup file, or you can use your regular backup program.
and One-Time PasswordsStrong, unique passwords make it much harder for bad actors to access your accounts. To further protect your accounts, enable two-factor authentication.
Some services offer two-factor authentication (also called 2FA, multi-factor authentication, or two-step verification), which requires users to possess two components (a password and a second factor) to gain access to their account. The second factor could be a one-off secret code or a number generated by a program running on a mobile device.
Two-factor authentication using a mobile phone can be done in one of two ways:
If you have a choice, pick the authenticator application or stand-alone hardware device instead of receiving codes by text message. It’s easier for an attacker to redirect these codes to their own phone than it is to bypass the authenticator.
Some services, such as Google, also allow you to generate a list of one-time passwords, also called single-use passwords. These are meant to be printed or written down on paper and carried with you. Each of these passwords works only once, so if one is stolen by spyware when you enter it, the thief won't be able to use it for anything in the future.
If you or your organization run your own communications infrastructure, there's free software available that can be used to enable two-factor authentication for accessing your systems. Look for software offering implementations of the open standard “Time-Based One-Time Passwords” or RFC 6238.
Laws about revealing passwords differ from place to place. In some jurisdictions you may be able to legally challenge a demand for your password while in others, local laws allow the government to demand disclosure — and even imprison you on the suspicion that you may know a password or key. Threats of physical harm can be used to force someone to give up their password. Or you may find yourself in a situation, such as travelling across a border, where the authorities can delay you or seize your devices if you refuse to give up a password or unlock your device.
We have a separate guide to crossing the U.S. border that gives advice on how to deal with requests for access to devices while travelling to or from the United States. In other situations, you should think about how someone might force you or others to give up your passwords, and what the consequences would be.
This is a short overview to circumventing online censorship, but is by no means comprehensive.
Governments, companies, schools, and Internet providers sometimes use software to prevent their users from accessing certain websites and services. This is called Internet filtering or blocking, and it is a form of censorship. Filtering comes in different forms. Censors can block individual web pages, or even entire websites. Sometimes, content is blocked based on the keywords it contains.
There are different ways of beating Internet censorship. Some protect you from surveillance, but many do not. When someone who controls your net connection filters or blocks a site, you can almost always use a circumvention tool to get to the information you need. Note: Circumvention tools that promise privacy or security are not always private or secure. And tools that use terms like “anonymizer” do not always keeps your identity completely secret.
The circumvention tool that is best for you depends on your threat model. If you’re not sure what your threat model is, start here.
In this article, we'll talk about four ways to circumvent censorship:
(VPN) to access blocked websites or services.Circumvention tools usually work by diverting your web traffic so it avoids the machines that do the blocking or filtering. A service that redirects your Internet connection past these blocks is sometimes called a proxy.
HTTPS is the secure version of the HTTP protocol you use to access websites. Sometimes a censor will only block the insecure (HTTP) version of a site. That means you can access the blocked site simply by entering the version of the web address that starts with HTTPS.
This is useful if the censorship you are fighting blocks individual web pages based on their contents. HTTPS stops censors from reading your web traffic, so they cannot tell what keywords are being sent, or which individual web page you are visiting.
Censors can still see the domain names of all websites you visit. So, for example, if you visit “eff.org/https-everywhere” censors can see that you are on “eff.org” but not that you are on the “https-everywhere” page.
If you suspect this type of simple blocking, try entering https:// before the domain in place of http:
Try installing EFF’s HTTPS Everywhere extension to automatically turn on HTTPS where possible.
Another way that you may be able to circumvent basic censorship techniques is by trying an alternate domain name or URL. For example, instead of visiting http://twitter.com, you might try the mobile version of the site at http://m.twitter.com. Censors that block websites or web pages work from a blacklist of banned websites, so anything that is not on that blacklist will get through. They might not know of all different versions of a particular website's name—especially if the administrators of the site know it is blocked and register more than one domain.
A web-based proxy (such as http://proxy.org/) is a website that lets its users access other blocked or censored websites. It is therefore a good way to circumvent censorship. In order to use a web-based proxy, visit the proxy and enter the web address that you want to see; the proxy will then display the web page you asked for.
However, web-based proxies don’t provide any security and will be a poor choice if your threat model includes someone monitoring your internet connection. They will not help you to use blocked services such as your instant messaging apps. The web-based proxy will have a complete record of everything you do online, which can be a privacy risk for some users depending on their threat model.
Numerous proxy tools utilize encryption to provide an additional layer of security on top of the ability to bypass filtering. The connection is encrypted so others cannot see what you are visiting. While encrypted proxies are generally more secure than plain web-based proxies, the tool provider may have information about you. They might have your name and email address in their records, for instance. That means that these tools do not provide full anonymity.
The simplest form of an encrypted web proxy is one that starts with “https”— this will use the encryption usually provided by secure websites. However, be cautious—the owners of these proxies can see the data you send to and from other secure websites. Ultrasurf and Psiphon are examples of these tools.
A Virtual Private Network (VPN) encrypts and sends all Internet data from your computer through another computer. This computer could belong to a commercial or nonprofit VPN service, your company, or a trusted contact. Once a VPN service is correctly configured, you can use it to access webpages, e-mail, instant messaging, VoIP, and any other Internet service. A VPN protects your traffic from being spied on locally, but your VPN provider can still keep logs of the websites you access, or even let a third party snoop directly on your web browsing. Depending on your threat model, the possibility of a government listening in on your VPN connection or getting hold of VPN logs may be a significant risk. For some users, this could outweigh the short-term benefits of using a VPN.
For information about specific VPN services, click here.
We at EFF cannot vouch for this rating of VPNs. Some VPNs with exemplary privacy policies could be run by devious people. Do not use a VPN that you do not trust.
Tor is open-source software designed to give you anonymity on the web. Tor Browser is a web browser built on top of the Tor anonymity network. Because of how Tor routes your web browsing traffic, it also allows you to circumvent censorship. (See our How to: Use Tor guides for Linux, macOS and Windows).
When you first start the Tor Browser, you can choose an option specifying that you are on a network that is censored:
Tor will not only bypass almost all national censorship, but, if properly configured, can also protect your identity from an adversary listening in on your country’s networks. It can, however, be slow and difficult to use.
To learn how to use Tor on a desktop machine, click here for Linux, here for macOS, or here for Windows, but please be sure to tap “Configure” instead of “Connect” in the window displayed above.
VPN stands for “Virtual Private Network.” When you connect to a VPN, all data that you send (such as the requests to servers when browsing the web) appears to originate from the VPN itself, rather than your own ISP. This masks your IP address, which can be an important tool for protecting your privacy, since your IP address provides an indication of your general location and can therefore be used to identify you.
In practice, VPNs can:
at your office while you’re traveling abroad, at home, or any other time you are out of the office.One common misconception is that VPNs are just for desktop computers. Logging in to strange or unfamiliar Wi-Fi connections from your phone can be just as risky as logging onto a strange Wi-Fi network from your computer. You can have a VPN on your phone to encrypt traffic from your carrier and Internet Service Provider, or ISP.
There is no one-size-fits-all solution when it comes to VPNs. Just like email, there are many VPN services out there and you should choose the service that works best for you. Depending on which one you choose, you can benefit from an increased level of security when connected to networks you wouldn’t ordinarily trust. This does mean, however, that you will be placing your trust in the VPN itself.
So do you need a VPN? And which VPN should you use? The answer to these questions are packed with various considerations and nuances. This guide will help you think through what tools are right for you, and what factors you should consider in your search for a VPN.
This explainer by the Center for Democracy & Technology describes a VPN as a tool that creates “a sort of tunnel for your internet traffic [in order to] prevent outsiders from monitoring or modifying your traffic. Traffic in the tunnel is encrypted and sent to your VPN, which makes it much harder for third parties like internet service providers (ISPs) or hackers on public Wi-Fi to snoop on a VPN users’ traffic or execute man-in-the-middle attacks. The traffic then leaves the VPN to its ultimate destination, masking that user’s original IP address. This helps to disguise a user’s physical location for anyone looking at traffic after it leaves the VPN.”
We recommend reading the Center for Democracy & Technology’s entire article before continuing on to better understand what VPNs are and how they work.
A VPN protects your Internet traffic from surveillance on the public network, but it does not protect your data from the private network you’re using. If you are using a corporate VPN, then whoever runs the corporate network will see your traffic. If you are using a commercial VPN, whoever runs the service will be able to see your traffic.
A disreputable VPN service might do this deliberately, to collect personal information or other valuable data.
The manager of your corporate or commercial VPN may also be subject to pressure from governments or law enforcement to turn over information about the data you have sent over the network. You should review your VPN provider’s privacy policy for information about the circumstances under which your VPN provider may turn your data over to governments or law enforcement.
You should also take note of the countries in which the VPN provider does business. The provider will be subject to the laws of those countries, including laws governing government requests for information. Laws vary from country to country, and sometimes those laws allow officials to collect information without notifying you or giving you an opportunity to contest it. The VPN provider may also be subject to legal requests for information from countries with whom the countries in which it operates have a legal assistance treaty.
Most commercial VPNs require you to pay using a credit card, which includes information about you that you may not want to disclose to your VPN provider, as it can easily be linked back to your identity. If you would like to keep your credit card number from your commercial VPN provider, use a VPN provider that accepts bitcoin or gift cards, or use temporary or disposable credit card numbers. Also, note that the VPN provider may still collect your IP address when you use the service, which can also be used to identify you, even if you use an alternative payment method. If you would like to hide your IP address from your VPN provider, you could use Tor when connecting to your VPN, or connect to the VPN only from a public Wi-Fi network.
That’s Right For Me?Everyone has different needs for how they hope to use a VPN. And the range and quality of VPNs varies a lot from one service to another. To find the VPN that’s right for you, you can evaluate VPNs based on the following criteria:
Is the VPN provider making claims about their product or services? Maybe they claim not to log any user connection data (see data collection below), or they claim not to share or sell data. Remember that a claim is not a guarantee, so be sure you verify these claims. Dig deep into a VPN provider’s privacy policy to uncover details about how your data is monetized, even if the VPN doesn’t sell it to third parties directly.
Even if a VPN isn’t selling your data, it must be able to stay in operation somehow. If the VPN doesn’t sell its service, how is it keeping its business afloat? Does it solicit donations? What is the business model for the service? Some VPNs run on a “freemium” model, meaning they are free to join, but after you transfer a certain amount of data they will charge you. If your budget is constrained, this is useful information to know.
It is worthwhile to do a search on the people and organizations associated with the VPN. Is it endorsed by security professionals? Does the VPN have news articles written about it? If the VPN was established by people known in the information security community, it is more likely to be trustworthy. Be skeptical of a VPN offering a service that no one wants to stake their personal reputation on, or one that is run by a company that no one knows about.
A service that does not collect data in the first place will not be able to sell that data. When looking through the privacy policy, see whether the VPN actually collects user data. If it doesn’t explicitly state that user connection data is not being logged, chances are that it is. And, depending on jurisdiction, a government can demand that data or issue a subpoena for it.
Even if a company claims not to log connection data, this may not always be a guarantee of good behavior. We encourage you to investigate instances where a VPN has been mentioned in the media. They may have been caught misleading or lying to their customers. A simple search can go a long way.
You might choose a VPN based on where its headquarters are based. Choosing a VPN based on the data privacy laws of that country may be an important factor, but please note that laws and policies can change.
How safe is the VPN encryption? If a VPN is using broken encryption—such as Point-to-Point Tunneling Protocol (PPTP) or weak encryption ciphers—any data flowing through it can be easily decrypted and viewed by your ISP or country. If you’re using a work VPN, contact your IT department and inquire about the security of the connection. Evaluating the strength of encryption in a VPN can be difficult to do, so you may want to check out this VPN comparison chart by That One Privacy Site, which analyzes almost 200 VPN providers based on their jurisdictions and policies.
EFF cannot vouch for these or any VPN ratings. Some VPNs with exemplary privacy policies could be run by devious people. Do not use a VPN that you do not trust.
Remember: There is no one-size-fits-all VPN. There are many factors to consider when choosing a VPN. Always remember to consider your security plan before making any decisions about the tools you use to protect your digital security.
Planning on crossing the border into the United States anytime soon? Did you know that the government has the right to, without a warrant, search travelers at the border—including when they land at international airports—as part of its traditional power to control the flow of items into the country? (Note that although some of the same legal justifications exist for searches of those leaving the U.S. and that such searches are possible, travelers are not routinely searched on their way out of the country.)
For a more in-depth treatment of this issue, check out EFF's guide, Digital Privacy at the U.S. Border: Protecting the Data On Your Devices.
Border agents may demand your digital data. Consider your individual risk assessment factors. Your immigration status, travel history, the sensitivity of your data, and other factors may influence your choices.
Be aware that unusual precautions may make border agents suspicious.
over or getting a new number when you arrive at your destination. your devices. We recommend using full-disk encryption on your devices (laptops, mobile phones, etc.) and choosing secure passphrases. , you do not have to comply. Only a judge can force you to reveal such information. However, refusal to comply could bear consequences: for noncitizens, you may be refused entry into the country; for citizens, your device may be seized or you may be detained for several hours. or other biometric locks; they are weaker than passwords.Not sure you’ll remember these tips? Check out EFF’s Border Search Pocket Guide, designed to be printed, folded, and carried in your pocket while traveling.
Note: Modern versions of macOS will prompt you to use FileVault 2 to encrypt your entire drive. We highly recommend you take this step to protect your data. If you encrypt your entire drive, you don’t have to worry much about doing secure deletion since the master encryption key is protected with a password that you control, and that you can change or erase to make data on the drive irretrievable. More information is available on encrypting with FileVault 2.
The instructions below should only be used for securely deleting data from spinning drives. These instructions apply only to traditional disk drives, and not to Solid State Drives (SSDs), which are standard in modern computers, USB keys/USB thumb drives, or SD cards/flash memory cards. Secure deletion on SSDs, USB flash drives, and SD cards is very hard! This is because these types of drives use a technique called wear leveling and do not provide low-level access to the bits as stored on the drive. (You can read more about why this causes problems for secure deletion here.) If you’re using an SSD or a USB flash drive, you can jump to the section below.
Did you know that when you move a file on your computer into your computer's trash folder and empty the trash, the file is not completely erased? Computers normally don't “delete” files; when you move a file to the trash, your computer just makes the file invisible and allows the space it took up to be overwritten by something else sometime in the future. Therefore, it may be weeks, months, or even years before that file is overwritten. Until this happens, that “deleted” file is still on your disk; it’s just invisible to normal operations. And with a little work and the right tools (such as “undelete” software or forensic methods), that “deleted” file can be retrieved.
So, what’s the best way to delete a file forever? Ensure it gets overwritten immediately. This makes it difficult to retrieve what used to be written there. Your operating system probably already has software that can do this for you—software that can overwrite all of the “empty” space on your disk with gibberish and thereby protect the confidentiality of deleted data.
On OS X 10.4 to 10.10, you can securely delete files by moving them to the Trash and then selecting Finder > Secure Empty Trash.
The Secure Empty Trash feature was removed in OS X 10.11 because Apple felt that it could not guarantee secure deletion on the fast flash (SSD) drives that most of its modern models now use.
If you use a traditional hard drive with OS X 10.11, and are comfortable with the command line, you can use the Mac's srm command to overwrite the file. Fuller instructions (in English) are available here.
srm was removed in OS X 10.12, but it is still possible to install.
In the latest versions of macOS, you can use rm -P to overwrite the file. This command overwrites the file contents several times.
Remember that the advice above only deletes files on the disk of the computer you’re using. None of the tools above will delete backups that were made to somewhere else on your computer, another disk or USB drive, a “Time Machine,” on an email server, in the cloud, or sent to your contacts. In order to securely delete a file, you must delete every copy of that file, everywhere it was stored or sent. Additionally, once a file is stored in the cloud (e.g. via Dropbox or some other file-sharing service) there’s usually no way to guarantee that it will be deleted forever.
Unfortunately, there’s also another limitation to secure deletion tools. Even if you follow the advice above and you’ve deleted all copies of a file, there is a chance that certain traces of deleted files may persist on your computer, not because the files themselves haven't been properly deleted, but because some part of the operating system or some other program keeps a deliberate record of them.
There are many ways in which this could occur, but two examples should suffice to convey the possibility. On Windows or macOS, Microsoft Office may retain a reference to the name of a file in the “Recent Documents” menu, even if the file has been deleted (Office might sometimes even keep temporary files containing the contents of the file). LibreOffice may keep as many records as Microsoft Office, and a user's shell history file may contain commands that include the file's name, even though the file has been securely deleted. In practice, there may be dozens of programs that behave like this.
It's hard to know how to respond to this problem. It is safe to assume that even if a file has been securely deleted, its name will probably continue to exist for some time on your computer. Overwriting the entire disk is the only way to be 100% sure the name is gone. Some of you may be wondering, “Could I search the raw data on the disk to see if there are any copies of the data anywhere?” The answer is yes and no. Searching the disk will tell you if the data is present in plaintext, but it won't tell you if some program has compressed or otherwise coded references to it. Also, be careful that the search itself does not leave a record! The probability that the file's contents may persist is lower, but not impossible. Overwriting the entire disk and installing a fresh operating system is the only way to be 100% certain that records of a file have been erased.
If you want to throw a piece of hardware away or sell it on eBay, you'll want to make sure no one can retrieve your data from it. Studies have repeatedly found that computer owners usually fail to do this―hard drives are often resold chock-full of highly sensitive information. So, before selling or recycling a computer, be sure to overwrite its storage media with gibberish first. And even if you're not getting rid of it right away, if you have a computer that has reached the end of its life and is no longer in use, it's also safer to wipe the hard drive before stashing the machine in a corner or a closet. Darik's Boot and Nuke is a tool designed for this purpose, and there are a variety of tutorials on how to use it across the web (including here).
Some full-disk encryption software has the ability to destroy the master key, rendering a hard drive's encrypted contents permanently incomprehensible. Since the key is a tiny amount of data and can be destroyed almost instantaneously, this represents a much faster alternative to overwriting with software like Darik's Boot and Nuke, which can be quite time-consuming for larger drives. However, this option is only feasible if the hard drive was always encrypted. If you weren't using full-disk encryption ahead of time, you'll need to overwrite the whole drive before getting rid of it.
When it comes to CD- or DVD-ROMs, you should do the same thing you do with paper―shred them. There are inexpensive shredders that will chew them up. Never just toss a CD- or DVD-ROM in the garbage unless you're absolutely sure there's nothing sensitive on it.
Unfortunately, due to the way SSDs, USB flash drives, and SD cards work, it is difficult, if not impossible, to securely delete both individual files and free space. As a result, your best bet in terms of protection is to use encryption. That way, even if the file is still on the disk, it will at least look like gibberish to anyone who gets ahold of it and can’t force you to decrypt it. At this point in time, we cannot provide a good general procedure that will definitely remove your data from an SSD. If you want to know why it’s so hard to delete data, read on.
As we mentioned above, SSDs and USB flash drives use a technique called wear leveling. At a high level, wear leveling works as follows. The space on every disk is divided into blocks, kind of like the pages in a book. When a file is written to disk, it’s assigned to a certain block or set of blocks (pages). If you wanted to overwrite the file, then all you would have to do is tell the disk to overwrite those blocks. But in SSDs and USB drives, erasing and re-writing the same block can wear it out. Each block can only be erased and rewritten a limited number of times before that block just won’t work anymore (the same way if you keep writing and erasing with a pencil and paper, eventually the paper might rip and be useless). To counteract this, SSDs and USB drives will try to make sure that the amount of times each block has been erased and rewritten is about the same, so that the drive will last as long as possible (thus the term wear leveling). As a side effect, sometimes instead of erasing and writing the block a file was originally stored on, the drive will instead leave that block alone, mark it as invalid, and just write the modified file to a different block. This is kind of like leaving the page in the book unchanged, writing the modified file on a different page, and then just updating the book’s table of contents to point to the new page. All of this occurs at a very low level in the electronics of the disk, so the operating system doesn’t even realize it’s happened. This means, however, that even if you try to overwrite a file, there’s no guarantee the drive will actually overwrite it, and that’s why secure deletion with SSDs is so much harder.
The instructions below should only be used for securely deleting data from spinning drives. These instructions apply only to traditional disk drives, and not to Solid State Drives (SSDs), which are standard in modern computers, USB keys/USB thumb drives, or SD cards/flash memory cards. Secure deletion on SSDs, USB flash drives, and SD cards is very hard! This is because these types of drives use a technique called wear leveling and do not provide low-level access to the bits as stored on the drive. (You can read more about why this causes problems for secure deletion here.) If you’re using an SSD or a USB flash drive, jump to this section below.
Did you know that when you move a file on your computer into your computer's trash folder and empty the trash, the file is not completely erased? Computers normally don't “delete” files; when you move a file to the trash, your computer just makes the file invisible and allows the space it took up to be overwritten by something else sometime in the future. Therefore, it may be weeks, months, or even years before that file is overwritten. Until this happens, that “deleted” file is still on your disk; it’s just invisible to normal operations. And with a little work and the right tools (such as “undelete” software or forensic methods), that “deleted” file can be retrieved.
So, what’s the best way to delete a file forever? Ensure it gets overwritten immediately. This makes it difficult to retrieve what used to be written there. Your operating system probably already has software that can do this for you—software that can overwrite all of the “empty” space on your disk with gibberish and thereby protect the confidentiality of deleted data.
On Windows, we currently suggest using BleachBit, an open-source secure deletion tool for Linux and Windows. BleachBit can be used to quickly and easily target individual files for secure deletion, or to implement periodic secure deletion policies. It is also possible to write custom file deletion instructions. You can find further information in the documentation.
You can get BleachBit on Windows by downloading the installer from the BleachBit download page
Click on the BleachBit installer .exe link. You'll be taken to the download page.
Many browsers will ask you to confirm whether you want to download this file. Microsoft Edge 40 shows a bar at the bottom of the browser window with a blue border.
For any browser it is best to first save the file before proceeding, so click the “Save” button. By default, most browsers save downloaded files in the Downloads folder.
Keep the Windows Explorer window open and double-click on BleachBit-2.0-setup. You'll be asked if you want to allow the installation of this program. Click the “Yes” button.
A window will open asking you to select an installation language. Select the language you want and click the OK button.
The next window will show you the GNU General Public License. Click “I Agree.”
In the next window BleachBit shows some customization options. You may leave the options as they are. We recommend removing the check mark from the Desktop option. Click the Next button.
Now BleachBit will ask you to confirm where you want to install. Click the Install button.
Finally, the BleachBit installer shows a window telling you the installation is complete. Click the Next button.
The last window in the installer asks whether you want to run BleachBit. Remove the checkmark from the Run BleachBit option. Click the Finish button.
Go to the Start menu, click the Windows icon, and select BleachBit from the menu.
A small window will open and confirm you want to open BleachBit. Click the "Yes" button.
The main BleachBit window will open. BleachBit will detect several commonly installed programs and show special options for each program.
BleachBit can wipe the traces Internet Explorer leaves behind using the Internet Explorer preset. Check the box next to Internet Explorer. Notice how all the boxes belonging to Cookies, Form history, History, and Temporary files are also checked. You can uncheck them as needed. Click the Clean button.
BleachBit will now clean up certain files and show you the progress.
Click the File menu and select Shred Folders.
A small window will open. Select the folder you want to shred.
BleachBit will ask you to confirm whether you want to permanently delete the files you selected. Click the Delete button.
BleachBit will now show you the files you deleted. Notice that BleachBit securely deletes each file in the folder, then securely deletes the folder.
Click the File menu and select Shred Files.
A file selection window will open. Select the files you want to shred.
BleachBit will ask you to confirm whether you want to permanently delete the files you selected. Click the Delete button.
BleachBit has a number of other features. The most useful one may be wiping free space. This will attempt to remove any traces of files you have already deleted. Often Linux will leave all or part of the data from deleted files in the remaining free space left on the hard drive. Wiping free space will overwrite these supposedly empty parts of the hard drive with random data. Wiping free space can take a lot of time, depending on how much spare capacity your drive has.
Remember that the advice above only deletes files on the disk of the computer you’re using. None of the tools above will delete backups that were made to somewhere else on your computer, another disk or USB drive, a “Time Machine,” on an email server, in the cloud, or sent to your contacts. In order to securely delete a file, you must delete every copy of that file, everywhere it was stored or sent. Additionally, once a file is stored in the cloud (e.g. via Dropbox or some other file-sharing service) there’s usually no way to guarantee that it will be deleted forever.
Unfortunately, there’s also another limitation to secure deletion tools. Even if you follow the advice above and you’ve deleted all copies of a file, there is a chance that certain traces of deleted files may persist on your computer, not because the files themselves haven't been properly deleted, but because some part of the operating system or some other program keeps a deliberate record of them.
There are many ways in which this could occur, but two examples should suffice to convey the possibility. On Windows or macOS, Microsoft Office may retain a reference to the name of a file in the “Recent Documents” menu, even if the file has been deleted (Office might sometimes even keep temporary files containing the contents of the file). LibreOffice may keep as many records as Microsoft Office, and a user's shell history file may contain commands that include the file's name, even though the file has been securely deleted. In practice, there may be dozens of programs that behave like this.
It's hard to know how to respond to this problem. It is safe to assume that even if a file has been securely deleted, its name will probably continue to exist for some time on your computer. Overwriting the entire disk is the only way to be 100% sure the name is gone. Some of you may be wondering, “Could I search the raw data on the disk to see if there are any copies of the data anywhere?” The answer is yes and no. Searching the disk will tell you if the data is present in plaintext, but it won't tell you if some program has compressed or otherwise coded references to it. Also, be careful that the search itself does not leave a record! The probability that the file's contents may persist is lower, but not impossible. Overwriting the entire disk and installing a fresh operating system is the only way to be 100% certain that records of a file have been erased.
If you want to throw a piece of hardware away or sell it on eBay, you'll want to make sure no one can retrieve your data from it. Studies have repeatedly found that computer owners usually fail to do this―hard drives are often resold chock-full of highly sensitive information. So, before selling or recycling a computer, be sure to overwrite its storage media with gibberish first. And even if you're not getting rid of it right away, if you have a computer that has reached the end of its life and is no longer in use, it's also safer to wipe the hard drive before stashing the machine in a corner or a closet. Darik's Boot and Nuke is a tool designed for this purpose, and there are a variety of tutorials on how to use it across the web (including here).
Some full-disk encryption software has the ability to destroy the master key, rendering a hard drive's encrypted contents permanently incomprehensible. Since the key is a tiny amount of data and can be destroyed almost instantaneously, this represents a much faster alternative to overwriting with software like Darik's Boot and Nuke, which can be quite time-consuming for larger drives. However, this option is only feasible if the hard drive was always encrypted. If you weren't using full-disk encryption ahead of time, you'll need to overwrite the whole drive before getting rid of it.
When it comes to CD- or DVD-ROMs, you should do the same thing you do with paper―shred them. There are inexpensive shredders that will chew them up. Never just toss a CD- or DVD-ROM in the garbage unless you're absolutely sure there's nothing sensitive on it.
Unfortunately, due to the way SSDs, USB flash drives, and SD cards work, it is difficult, if not impossible, to securely delete both individual files and free space. As a result, your best bet in terms of protection is to use encryption. That way, even if the file is still on the disk, it will at least look like gibberish to anyone who gets ahold of it and can’t force you to decrypt it. At this point in time, we cannot provide a good general procedure that will definitely remove your data from an SSD. If you want to know why it’s so hard to delete data, read on.
As we mentioned above, SSDs and USB flash drives use a technique called wear leveling. At a high level, wear leveling works as follows. The space on every disk is divided into blocks, kind of like the pages in a book. When a file is written to disk, it’s assigned to a certain block or set of blocks (pages). If you wanted to overwrite the file, then all you would have to do is tell the disk to overwrite those blocks. But in SSDs and USB drives, erasing and re-writing the same block can wear it out. Each block can only be erased and rewritten a limited number of times before that block just won’t work anymore (the same way if you keep writing and erasing with a pencil and paper, eventually the paper might rip and be useless). To counteract this, SSDs and USB drives will try to make sure that the amount of times each block has been erased and rewritten is about the same, so that the drive will last as long as possible (thus the term wear leveling). As a side effect, sometimes instead of erasing and writing the block a file was originally stored on, the drive will instead leave that block alone, mark it as invalid, and just write the modified file to a different block. This is kind of like leaving the page in the book unchanged, writing the modified file on a different page, and then just updating the book’s table of contents to point to the new page. All of this occurs at a very low level in the electronics of the disk, so the operating system doesn’t even realize it’s happened. This means, however, that even if you try to overwrite a file, there’s no guarantee the drive will actually overwrite it, and that’s why secure deletion with SSDs is so much harder.
The instructions below should only be used for securely deleting data from spinning drives. These instructions apply only to traditional disk drives, and not to Solid State Drives (SSDs), which are standard in modern computers, USB keys/USB thumb drives, or SD cards/flash memory cards. Secure deletion on SSDs, USB flash drives, and SD cards is very hard! This is because these types of drives use a technique called wear leveling and do not provide low-level access to the bits as stored on the drive. (You can read more about why this causes problems for secure deletion here.) If you’re using an SSD or a USB flash drive, jump to this section below.
Did you know that when you move a file on your computer into your computer's trash folder and empty the trash, the file is not completely erased? Computers normally don't “delete” files; when you move a file to the trash, your computer just makes the file invisible and allows the space it took up to be overwritten by something else sometime in the future. Therefore, it may be weeks, months, or even years before that file is overwritten. Until this happens, that “deleted” file is still on your disk; it’s just invisible to normal operations. And with a little work and the right tools (such as “undelete” software or forensic methods), that “deleted” file can be retrieved.
So, what’s the best way to delete a file forever? Ensure it gets overwritten immediately. This makes it difficult to retrieve what used to be written there. Your operating system probably already has software that can do this for you—software that can overwrite all of the “empty” space on your disk with gibberish and thereby protect the confidentiality of deleted data.
On Linux, we currently suggest using BleachBit, an open-source secure deletion tool for Linux and Windows. It’s much more sophisticated than the built-in “shred.” BleachBit can be used to quickly and easily target individual files for secure deletion, or to implement periodic secure deletion policies. It is also possible to write custom file deletion instructions. You can find further information in the documentation.
You can get BleachBit on Ubuntu by using the Ubuntu Software application. If it’s in your favorite applications, you can click on it on the left-hand side of the screen.
Otherwise, click on the application button in the lower left-hand side of the screen and use the search field.
Type “software” in the search field and click the Ubuntu Software icon.
By default, BleachBit will not be listed. To ensure that it is listed, enable community-maintained packages by clicking “Ubuntu Software” in the top menu and then clicking “Software & Updates.”
In the new window, make sure the box next to “Community-maintained free and open-source software (universe)” is checked, then click “Close” and “Reload.” If it is already checked, you may just click “Close.”
You can now browse through Ubuntu Software to look for BleachBit, but searching for it is faster. Use the search field by clicking the magnifying glass in the top-right corner of the window.
Then enter “BleachBit” in the search field.
Click on BleachBit and click the Install button.
Ubuntu Software will ask for your password for permission. Enter your password and click the Authenticate button.
The Ubuntu Software Center will install BleachBit and show you a small progress bar. When the installation is done you will see a “Launch” and “Remove” button.
You can also get BleachBit on Ubuntu by using the Terminal. Click on the application button in the lower left-hand side of the screen and use the search field.
Type “terminal” in the search field and click the Terminal icon.
Type “sudo apt-get install bleachbit” and press Enter.
You’ll be asked to enter your password to verify that you want to install BleachBit. Enter your password and press Enter.
Now you'll see the progress of the installation of BleachBit and when it is done you should be back at the command line where you started.
Click on the application button in the lower left-hand side of the screen and use the search field.
Type “bleach” in the search field and two options will appear: BleachBit and BleachBit (as root).
Only use the BleachBit (as root) option if you know what you are doing because it can cause irreparable harm if you use it to delete files needed by the operating system.
Right-click on BleachBit and select “Add to Favorites.”
Click on the BleachBit icon from your Favorites on the left side of the screen.
The main BleachBit window will open and BleachBit will give you an overview of the preferences. We recommend checking the “Overwrite contents of files to prevent recovery” option.
Click the “Close” button.
BleachBit will detect several commonly installed programs and will show special options for each program.
Some software leaves behind records of when and how it was used. Two important examples that merely begin to illustrate this widespread issue are Recent Documents and web browser history. Software that tracks the recently-edited documents leaves a record of the names of files you've been working with, even if those files themselves have been deleted. And web browsers usually keep detailed records of what sites you've visited recently, and even keep cached copies of pages and images from those sites to make them load faster next time you visit.
BleachBit provides “presets” that can remove some of these records for you, based on the BleachBit authors' research about locations of records on your computer that tend to reveal your previous activity. We'll describe using just two of these presets so you can get an idea of how they work.
Check the box next to System. Notice that this marks all the checkboxes under the System category. Uncheck the System box and check the following boxes: Recent document list and Trash. Click the “Clean” button.
BleachBit will now ask you for confirmation. Click the Delete button.
BleachBit will now clean up certain files and show you the progress.
Click the “File” menu and select “Shred Folders.”
A small window will open. Select the folder you want to shred.
BleachBit will ask you to confirm whether you want to permanently delete the files you selected. Click the “Delete” button.
BleachBit will show you the files you deleted. Notice that BleachBit securely deletes each file in the folder, then securely deletes the folder.
Click the File menu and select Shred Files.
A file selection window will open. Select the files you want to shred.
BleachBit will ask you to confirm whether you want to permanently delete the files you selected. Click the “Delete” button.
BleachBit has a number of other features. The most useful one may be wiping free space. This will attempt to remove any traces of files you have already deleted. Often Linux will leave all or part of the data from deleted files in the remaining free space left on the hard drive. Wiping free space will overwrite these supposedly empty parts of the hard drive with random data. Wiping free space can take a lot of time, depending on how much spare capacity your drive has.
Remember that the advice above only deletes files on the disk of the computer you’re using. None of the tools above will delete backups that were made to somewhere else on your computer, another disk or USB drive, a “Time Machine,” on an email server, in the cloud, or sent to your contacts. In order to securely delete a file, you must delete every copy of that file, everywhere it was stored or sent. Additionally, once a file is stored in the cloud (e.g. via Dropbox or some other file-sharing service) there’s usually no way to guarantee that it will be deleted forever.
Unfortunately, there’s also another limitation to secure deletion tools. Even if you follow the advice above and you’ve deleted all copies of a file, there is a chance that certain traces of deleted files may persist on your computer, not because the files themselves haven't been properly deleted, but because some part of the operating system or some other program keeps a deliberate record of them.
There are many ways in which this could occur, but two examples should suffice to convey the possibility. On Windows or macOS, Microsoft Office may retain a reference to the name of a file in the “Recent Documents” menu, even if the file has been deleted (Office might sometimes even keep temporary files containing the contents of the file). LibreOffice may keep as many records as Microsoft Office, and a user's shell history file may contain commands that include the file's name, even though the file has been securely deleted. In practice, there may be dozens of programs that behave like this.
It's hard to know how to respond to this problem. It is safe to assume that even if a file has been securely deleted, its name will probably continue to exist for some time on your computer. Overwriting the entire disk is the only way to be 100% sure the name is gone. Some of you may be wondering, “Could I search the raw data on the disk to see if there are any copies of the data anywhere?” The answer is yes and no. Searching the disk (e.g. by using a command like grep -ab /dev/ on Linux) will tell you if the data is present in plaintext, but it won't tell you if some program has compressed or otherwise coded references to it. Also, be careful that the search itself does not leave a record! The probability that the file's contents may persist is lower, but not impossible. Overwriting the entire disk and installing a fresh operating system is the only way to be 100% certain that records of a file have been erased.
If you want to throw a piece of hardware away or sell it on eBay, you'll want to make sure no one can retrieve your data from it. Studies have repeatedly found that computer owners usually fail to do this―hard drives are often resold chock-full of highly sensitive information. So, before selling or recycling a computer, be sure to overwrite its storage media with gibberish first. And even if you're not getting rid of it right away, if you have a computer that has reached the end of its life and is no longer in use, it's also safer to wipe the hard drive before stashing the machine in a corner or a closet. Darik's Boot and Nuke is a tool designed for this purpose, and there are a variety of tutorials on how to use it across the web (including here).
Some full-disk encryption software has the ability to destroy the master key, rendering a hard drive's encrypted contents permanently incomprehensible. Since the key is a tiny amount of data and can be destroyed almost instantaneously, this represents a much faster alternative to overwriting with software like Darik's Boot and Nuke, which can be quite time-consuming for larger drives. However, this option is only feasible if the hard drive was always encrypted. If you weren't using full-disk encryption ahead of time, you'll need to overwrite the whole drive before getting rid of it.
When it comes to CD- or DVD-ROMs, you should do the same thing you do with paper―shred them. There are inexpensive shredders that will chew them up. Never just toss a CD or DVD-ROM in the garbage unless you're absolutely sure there's nothing sensitive on it.
Unfortunately, due to the way SSDs, USB flash drives, and SD cards work, it is difficult, if not impossible, to securely delete both individual files and free space. As a result, your best bet in terms of protection is to use encryption. That way, even if the file is still on the disk, it will at least look like gibberish to anyone who gets ahold of it and can’t force you to decrypt it. At this point in time, we cannot provide a good general procedure that will definitely remove your data from an SSD. If you want to know why it’s so hard to delete data, read on.
As we mentioned above, SSDs and USB flash drives use a technique called wear leveling. At a high level, wear leveling works as follows. The space on every disk is divided into blocks, kind of like the pages in a book. When a file is written to disk, it’s assigned to a certain block or set of blocks (pages). If you wanted to overwrite the file, then all you would have to do is tell the disk to overwrite those blocks. But in SSDs and USB drives, erasing and re-writing the same block can wear it out. Each block can only be erased and rewritten a limited number of times before that block just won’t work anymore (the same way if you keep writing and erasing with a pencil and paper, eventually the paper might rip and be useless). To counteract this, SSDs and USB drives will try to make sure that the amount of times each block has been erased and rewritten is about the same, so that the drive will last as long as possible (thus the term wear leveling). As a side effect, sometimes instead of erasing and writing the block a file was originally stored on, the drive will instead leave that block alone, mark it as invalid, and just write the modified file to a different block. This is kind of like leaving the page in the book unchanged, writing the modified file on a different page, and then just updating the book’s table of contents to point to the new page. All of this occurs at a very low level in the electronics of the disk, so the operating system doesn’t even realize it’s happened. This means, however, that even if you try to overwrite a file, there’s no guarantee the drive will actually overwrite it, and that’s why secure deletion with SSDs is so much harder.
For quick reference, we've created a handy guide designed to be printed, folded, and carried in your pocket (PDF download).
Now, more than ever, citizens must be able to hold those in power accountable and inspire others through the act of protest.
Protecting your electronic devices and digital assets
before, during, and after a protest is vital to keeping yourself and your information safe, as well as getting your message out. Theft, damage, confiscation, or forced deletion of media can disrupt your ability to publish your experiences. At the same time, those engaging in protest may be subject to search or arrest, or have their movements and associations mapped. They could become targets of surveillance and repression.
There are risks associated with attending a protest, and taking steps to mitigate them can go a long way in ensuring you—and the data you value—are kept safe. This guide outlines steps you can take before, during, and after a protest that will help maximize your effectiveness and keep yourself and your data more secure.
Remember that these tips are general suggestions for better data security and do not constitute legal advice or counseling. If you have specific legal concerns, seek the advice of a licensed attorney.
on your deviceFull-disk encryption ensures that the files across your entire device are encrypted. This is a form of encryption that protects data at rest—not to be confused with “in-transit encryption,” which protects data that is transferred over the Internet. Full-disk encryption can help protect everything from your local database of text messages to the passwords stored in your browser. If your device is confiscated by police, or if it is lost or stolen, full-disk encryption can help protect the data stored on your device. Protest situations are often unpredictable, so losing your phone is a distinct possibility.
Android and iOS have long required full-disk encryption capabilities to be built into devices. These should be protected by a strong password: 8-12 random characters that are easy to remember and type in when you unlock your device. If devices are not protected by a strong password, the encryption may be easier to break using a brute-force attack. The iPhone 5s and later have specialized hardware to protect against this type of attack, but a complex, strong password is still the best practice.
It is important to note that encrypting your device will likely not encrypt external storage media such as SD or flash memory cards. You have to encrypt these separately, and may not be able to encrypt them at all. You might want to investigate where files are stored on your device using a file browsing app, or remove external storage media from your device altogether.
In addition, many digital cameras lack the ability to encrypt. It is safe to assume that photos and videos taken with digital cameras will be stored unencrypted, unless explicitly stated otherwise.
unlock and FaceIDToday, both iOS and Android allow users to unlock (and decrypt) their devices with their fingerprint, and the iPhone X’s FaceID allows users to do the same with facial recognition. While these settings may seem appealing as convenient ways to enjoy the benefits of full-disk encryption, enabling them means an officer could physically force you to unlock your device with your fingerprint or face. In protest situations in particular—or in any other situation in which you may be more likely to encounter a government demand to search your phone (such as at a border crossing)—we suggest you turn this functionality off.
In the U.S., using a biometric—like your face scan or fingerprint—to unlock your phone may compromise protections for the contents of your phone afforded to you under the Fifth Amendment privilege against compelled incrimination. A police officer may try to intimidate you into “consenting” to unlock your phone, whether you use a biometric or a memorized passcode. But if you exercise your right to refuse and biometric unlocking functionality is turned on, an officer may physically force you to biometrically unlock your device. Under current U.S. law—which is still in flux—using a memorized passcode generally provides a stronger legal footing to push back in court against compelled device unlocking/decryption. While EFF continues to fight against attempts by law enforcement to compel people to decrypt their devices, there is currently less protection against compelled face and fingerprint unlocking than there is against compelled password disclosure.
Signal is an app available on both iOS and Android that offers strong encryption to protect both text messages and voice calls. This type of protection is called end-to-end encryption, which secures your communications in transit.
In addition to encrypting one-to-one communication, Signal enables encrypted group chats. The app also recently added the functionality of having messages disappear anywhere from 10 seconds to a week after they are first read. In contrast to some other services like SnapChat, these ephemeral messages will never be stored on any server, and are removed from your device after disappearing.
In 2016, a grand jury in the Eastern District of Virginia issued a subpoena to Open Whisper Systems, the developers of Signal. Because of the architecture of Signal, which limits the user metadata stored on the company’s servers, the only data they were able to provide was "the date and time a user registered with Signal and the last date of a user's connectivity to the Signal service."
In the context of a protest, you might send relevant photos and videos to friends who are remote using Signal, so that if your phone is confiscated you have a way to retrieve the media later.
Take precautions to limit the potential costs of losing access to your device, whether it’s lost, stolen or confiscated by law enforcement. Back up your data regularly and store that backup in a safe place to save yourself from a headache later on.
In the United States, federal regulation does not require you to show your ID to purchase a prepaid SIM card (but your state might). Most countries require you to provide a form of ID to purchase a prepaid SIM card, thus linking the card to your identity and removing the possibility of anonymity.
If you're concerned about protecting the data stored on your device, don't bring it to the protest. Instead, purchase a prepaid mobile phone. These devices can be purchased along with a SIM card at most large retail stores. Let your friends know your temporary number, and use this to coordinate activities. Remember that the location of mobile devices can be determined by the cell towers they connect to. So, if you don't want your identity and location known, turn off your prepaid device before going home or anywhere that might reveal your identity. Using GPS should be safe, since GPS is a receiver and does not transmit any information. However, keep in mind that your device may store your coordinates. For this reason, we suggest you turn off location services before you travel to the protest, and leave it off until you return. Turning off location services may make it difficult to navigate if you are not familiar with the route to and from the protest. You may want to download a local copy of the area map you will be traveling in.
When you're done with the phone, it can be safely recycled or discarded from a location that is not linked to you. Keep in mind that if you carry both your regular device and a prepaid one with you, the location of these devices can be correlated and compromise your anonymity.
Many law enforcement agencies have access to sophisticated surveillance technology that can be used to identify people attending a protest. To protect yourself, it’s important to dress in ways that preserve your anonymity and protect your physical safety.
Wearing the same clothing as everyone in your group can help hide your identity during the protest and keep you from being identified and tracked afterwards. This not only helps preserve your anonymity, but also protects your fellow protestors from being identified and surveilled as well. Dressing in dark, monochrome colors will help you blend into a crowd. Be aware that you may not be as visible to cars in the dark, and should take extra precaution when crossing streets or walking near moving vehicles.
If you are able, bring a change of clothes for after the protest is over. You may be exposed to irritants such as pepper spray or tear gas during the protest, and it’s wise to change into clothing that won’t cause discomfort or harm on your return journey.
If you have visible tattoos or bright unconventional hair colors, cover them up. Tattoos can be used to identify you later, and may be added to databases for tattoo recognition. Dark monochrome hats, scarves, gloves, long sleeves, and full-length clothing will help cover these identifying features so you blend more easily into a crowd.
Wear a mask! It will help protect you from airborne illnesses, face recognition technologies, and being identified in photos of the protest after it ends. Goggles are also useful for keeping your eyes safe from projectiles or irritants, and tinted ones may be useful for circumventing face recognition systems (but this strategy is not foolproof). Gloves will help protect your hands from irritants and contact with infectious diseases. If you are able to use medical gloves, use nitrile instead of latex gloves, as some people have latex allergies. Note that gloves will interfere with some phone functions. We also recommend wearing sturdy shoes that are comfortable to move around in for extended periods of time.
Catching that perfect image is something you want to be ready for, and powerful images can help support your cause. If you've chosen a strong password, entering it into the device takes precious time, and you risk the moment passing before you're able to take the picture. Luckily, iOS and Android allow you to take photos and videos without unlocking your device.
If you are taking photos or videos of people at the protest, be mindful of what you post. If you post photos online where protestors or bystanders’ faces are identifiable, law enforcement or vigilantes might track them down and arrest or harass them. Consider obscuring the faces of anyone who has their eyes or mouth visible. You can edit photos in the default Android or iOS photo editing apps. Be sure to black out or blur other identifying features as well such as tattoos or unique clothing (blurring can sometimes be reversed so blacking out is better if you have the option). On Android, consider using the ObscuraCam app by The Guardian Project to edit photos, which will automatically blur faces. There is also a useful tool called Image Scrubber that can be used on any mobile device, including iOS or your PC.
on photosOnce you are ready to post your photos, it’s a good idea to scrub the metadata contained in the image files if you don't want to leak personally identifying information. Metadata on photos can include information such as the model of camera the photo was taken on, the exact time and location where the photo was taken, and even your name.
Automated License Plate Reader Systems (ALPRs) automatically record the license plates of cars driving through an area, along with the exact time, date, and location they were encountered. This technology is often used by law enforcement in the United States and many other countries, or employed by private companies such as Vigilant and MVTrac who then share license plate data with law enforcement and other entities. Amassed in huge databases, this data is retained for lengthy periods of time. These companies have lobbied and litigated vigorously against statutes that would ban the private collection of license plate data or otherwise regulate ALPRs. Essentially, your location can be tracked over time based on the driving history of any car registered to you, with very few legal limits in place as to how this data can be collected, accessed, shared, and retained.
Read more in our Street Level Surveillance guide on ALPRs.
Be careful when traveling to and from the protest location. If you’re using payment methods or transit cards that are linked to you, law enforcement may be able to determine you attended the protest and track your movements. Consider using alternative means of public transportation if you would prefer that your movements and associations remain private.
If you are able, consider biking or walking to and from the protest to minimize exposure to these types of surveillance risks.
Airplane mode ensures that your device will not be transmitting for the duration of your time at the protest, and prevents your location from being tracked. Unfortunately, this also means that you won't be able to message or call your friends, so plan accordingly. Before going to the protest, agree on a spot where you and your friends can meet if you get separated. As mentioned earlier in this guide, you may also want to turn off location services before you travel to the protest, and leave it off until you return.
Some apps allow you to navigate without having network access. Since GPS is a receive-only system, you can selectively turn GPS on after enabling airplane mode. Be sure to download a map of the area of the protest beforehand.
If you are detained and questioned by police, you have a right to remain silent, and to speak with an attorney before and during any questioning. It is best to say “I want my attorney and I choose to remain silent” and then refuse to answer questions until you have a chance to talk to a lawyer.
If you answer questions, be sure to tell the truth. It is a crime to lie to a police officer and you may find yourself in more trouble for lying to law enforcement than for whatever it was they wanted to talk to you about in the first place.
If the police ask to see your phone, you can tell them that you do not consent to a search of your device. They might respond by seizing your phone and trying to search it later, but at least it will be clear that you did not give them permission to do so.
If the police ask for the password to unlock your electronic device (or ask you to unlock it directly), you can refuse. You may suffer adverse consequences at the hands of law enforcement—from having your phone seized to being booked into custody—for refusing to provide your password or biometric key. Every arrest situation is different, however, and you will need to consider your own threat model.
If your device has been confiscated, you may have legal recourse to get it back. In the U.S., your attorney can file a motion for the return of your property if it is not being held as evidence in a pending case. If the police believe that evidence of a crime was found on your electronic device, including in your photos or videos, then the police can keep it as evidence. They may also attempt to end your ownership of your electronic device, but you can challenge such asset forfeiture in court.
You can also revoke access for some services that are logged in on your device. For instance, on Twitter if you go to Settings and privacy -> Apps and devices, you can revoke access for devices that have permission to connect to your Twitter account. For other services, simply changing your password or passphrase will prompt the app to log out. But beware that revoking law enforcement access may expose you to the risk of being charged with obstruction of justice or the destruction of evidence. You should always speak to your attorney first before deciding how to proceed. Online services may provide logs of recent log-ins for your account. If you are worried your device is being used to access accounts without your consent, it might be useful for you to see if such logs are available and monitor them. If law enforcement confiscates your device, they may use a “forensic” tool such as “Cellebrite” to try to extract data from your device, such as images, contacts, messages, and location history. This is more likely to be successful if your phone is older or unencrypted. For this reason, it’s important to carry the bare minimum of data with you, and use the strongest level of encryption, when going into a risky situation like a protest.