Privacy and Security
Both Privacy and security are wide and complex subjects. In this article I want to review the handling of data for organizing RC events and gatherings only.
Disclaimer: Any claims about technology securing rc.org is only viable for rc.org and www.rc.org. Other RC sites are hosted in different places and do not provide the kind of protection and tools that are presented here.
To discharge about
The patterns in society, make us greedy for data. Data hoarding is a distress that can make us vulnerable. Many kinds of data can be vulnerable for abuse when landing into the wrong hands. That we find it hard to imagine how such data can be abused doesn’t mean that it won’t happen. Also many of us live privileged lives, in relatively safe countries. We have many community members who don’t have that same luxury. Our ignorance about personal data can bring people in other countries in danger without us becoming aware of it.
And we ourselves cannot know what our future governments will do with data that is hoarded now, until it is too late. When Trump came to power many people sought safer platforms to communicate.
Companies develop technologies that increasingly draw more and more far reaching conclusions from aggregated data. People are now fleeing from Whats-app and Facebook for incidents that came to light in recent years. Too late? maybe not!
Do’s and don’ts in organizing
The RC Community Guidelines contain some chapters about the use of Internet Services (and the number of to-addresses in e-mails) (See chapters K, M, and the lengthy notes in the Guidelines). Generally 2 ideas:
-
Store sensitive data only in RC servers.
-
Limit the number of ‘to’-addresses in e-mails to max 15, if group conversation is necessary.
Working With Services on the Internet
Companies who make profit on creating profiles and selling services based on those profiles will not use such data for your benefit (only). Unfortunately it is not only your data, but also the privacy of the people that you are connected with that you are paying the ‘free’ services with.
Companies that abuse personal data and infringe privacy are not only the big technical multinationals. Also think about companies like MailChimp, SalesForce, SurveyMonkey. Banks and insurance companies are increasingly trying to assemble profiles about people and selling services based on those profiles. Of all banks PayPal is probably the most untrustworthy, also notorious in blocking activists and liberation organizations access to their money.
We have to carefully avoid putting (to much) information into the hands of companies and governments that may at one point use such data against us or against members of our communities. Convenience and ignorance are our biggest enemies.
Don’t use Internet Services (like Google Docs) for any personal data or data that can be connected to people. And if you cannot avoid some, identify the once that are the least danger and offer the service you really need. For all the convenience Google, Microsoft, Apple and others offer we pay a high price. The damaging effects of manipulation of news and science made possible by huge collections of personal data have become much more visible over the last 2 years.
RCCR owns the server that runs rc.org and no one else can put their hands on the data in the website unless we are sloppy. Follow the guidelines in this article.
We as users of data are key
The first important tool to protect data is us. We ourselves have to handle data in a secure way. Here are key aspects you should learn to understand and apply:
-
Limit the kinds of data we keep: do we really need all the data we ask from people? Only ask what you really plan to use.
-
Limit the time we store data: here we need to make a distinction by the vulnerability of data. An e-mail address may be less vulnerable than class, religion, sexual identity, constituency. Please keep no other data than peoples names, (email) addresses, phone numbers, longer than absolutely necessary. Clean up files holding personal data shortly after the job ends.
-
Think about where you store data. Keep data within the RC website. When exported, store it with a password. In many places the security depends on the integrity of the company that owns the storage.
-
Don not reuse vulnerable data. We have to learn to let go off data that is up to people themselves to share when they decide to, with whom they decide to.
-
To whom do we give access to data? People only need to see data they need for their task and as long that lasts. We have a tool to make sensitive data only available to people who need it. Clean up after the work.
We also have to be aware that sharing accounts or passwords are making us vulnerable. Use your RC web account only for yourself and encourage others to get their own account. Your account will become a valuable asset, especially when you are an organizer for international events. ARP’s and RRP’s can play a role in account creation.
Here are some tasks you have in securing data:
(1) Limit the export of data. The tools in www.rc.org allow you to have multiple people to access the data. There are almost no reasons to export data. Learn to work with the tools available.
(2) Limit the number of people who get access to the data. Remove team members when their task is done and over.
(3) If you really need to export data, secure the file(s) with a password, also if you only keep the files in your own device(s). Clean up the files when the organizing is finished. Instruct/remember team members to cleanup their files when the organizing is over (lingering files are a security hazard).
(4) With exporting data you also introduce a versioning problem. The exported data will not stay in line with changed data in the website (and vice versa).
(4) Preferably send those files via secure apps (like Signal), or share them via the RC website. Avoid sending files as e-mail attachments. The www.rc.org website protects against deep linking, so search engines like Google cannot grab these files.
(5) Learn to secure your computer and devices.
Secure your computer with a password. If you share a computer make a different account for each of the users. Use an add-blocker (like uBlock). Use a password manager (browsers have built in ones). Use DuckDuckGo as search engine and privacy tool. Learn about the settings in your device(s) that prevent involuntary sharing information. The defaults are often benefiting big tech and violating legal requirements.
Technology and Tools
In the wide world, many people are working to develop and improve and reviews tools. There is an enormous international community working on improving our security and protect our privacy, and go against the many attacks on the freedom that the founders of Internet had intended. It is also a fight against oppression (and capitalism).
Many tools have been developed in times where we didn’t understand security as we do know. It is an ongoing development. What is safe today, may not be secure enough tomorrow. New tools will emerge. We will have to be flexible, decide to discharge about the fear of changing and the fear of learning new things. We will have to learn to use different tools and think about the implications of what we use them for.
Beware of tools/services that depend on companies or governments who have then access to your data.
Devices
Companies like Google, Microsoft and Apple consider the device you bought as a service they are delivering. You think you are the owner when you buy a device with Windows, OSX, Android or iPhone. But you are not! This also has the implication that these companies can always decide to gain access to the data on your computer. Can you stop them? Maybe if you learn to maintain the settings and keep data out of their hands. You may also want to switch to some version of Linux.
E-mail and messaging
E-mail is very unsafe. It’s like a postcard that can be read by anyone seeing it come by. But because e-mail is such a simple protocol it is very popular and still useful. We have to be very careful in what we send over e-mail. Especially when we also use e-mail encryption (like Protonmail or PGP). Because we then tend to forget that not everything is always encrypted. Using encryption in e-mail requires that you understand how it works and what the limitations are.
Chatting apps like Whats-app are very different from e-mail. Many of them are very vulnerable and can like e-mail be used to hack into your devices. Each of these ‘platforms’ has different ways to protect communication (end-to-end encryption). Some technologies have back doors and allow the servicing companies to access the content or the meta data of the communication. A common problem is that back doors are often pretended to be program bugs when revealed. Most chat apps have functions for internet audio or video calls and also support limited group calls.
Whats-app has been used for many forms of social engineering aside technical hacks to take over smart phones. Their end-to-end encryption is known to have many problems. And Whats-app makes you a target of many attempts to hack your device(s).
Telegram Messenger has encryption on demand (you have to turn it on per connection). They have a proven track record in holding up against government pressure to hand in data.
Signal Messenger has a strong encryption technology with no proven back doors so far, and also keeps meta data like identities of users (connections) hidden/anonymous. Signal had some usability problems caused by the enormous numbers of extra users in the first month of 2021.
There are many more tools and communication platforms. To many to discuss here.
The World Wide Web (WWW)
The World Wide Web (www) has enormously developed over 3 decades. Fortunately the developments have not stopped. Because there are still problems to be solved.
Like with e-mail www originally communicated via naked readable text over the networks. It works with a protocol called: http (HyperText Transmission Protocol). When we started to use websites for data that was not suitable for postcard communication this protocol was extended with a secure version: https (http Secured). To symbolize this we see a padlock icon left of the address of the website. Different browsers (like Firefox, Chrome, Safari, Internet Explorer) have different choices in how to display the link-address of the website. This can be confusing and you have to learn how you can identify the website and the way it is secured in the browser you are using.
The RC’s www.rc.org is best supported on Firefox and Chrome. Opera and Explorer seems to work well these days. Safari still has challenges. On smart phones there are any others that may have many incompatibilities. For these reasons we cannot support the use of the Back Office in www.rc.org in every browser, and limit ourselves to Firefox and Chrome. Though newer versions of Microsoft Edge and Apple Safari are improving.
Unfortunately https provides only an encryption of the communication between the web-server and your computer. A necessity, but not enough. The use of https does not guarantee you are communicating with the real www.rc.org. This is a challenging issue and we will always have to remain on guard for signs that we are not talking (directly) with www.rc.org: Regularly check the URL you are using is https://www.rc.org/ optionally followed by the locations within the website. Small changes in the wording may indicate a man-in-the-middle-attack.
Malicious code from different kinds can easily be imported via your work in the RC website. Especially Google, Microsoft and Apple try to track content that has been passed through their services or software. Rc.org has been equipped to keep this malicious coding out. In some places you’ll find “Remove markup” buttons. Use these after you have copy-pasted contents from other sources.
Be aware of links (like for Zoom-meetings) you receive through e-mail or web sites controlled by other companies. Such links are often wrapped in another link allowing ‘them’ to track the users and collect data.
A special kind of possible malicious code are Browser Extensions. One example is Google Translate. Google translate can be used to automatically translate (the rc.org) websites. Google will then also record what you are doing. If you keep that automatic translation while going into the back office you will leak personal data to Google. Do not use this kind of service.
Chrome, Internet Explorer, Edge, Safari have known ‘phone home’ ‘features’ telling their makers what you are doing. Often these ‘features’ can be turned off, but you have to know how and keep track of any changes (find out). In this aspect Firefox is until now the most trustworthy product.
February 2020