Skip to content

Commit

Permalink
Update index.html
Browse files Browse the repository at this point in the history
  • Loading branch information
glenn-sorrentino committed Apr 11, 2024
1 parent ab07738 commit 6e34696
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions index.html
Original file line number Diff line number Diff line change
Expand Up @@ -179,8 +179,8 @@ <h4><a href="#" class="faq-question"><img class="arrow" src="design-system/image
<p>Neither us scrubbing IPs nor you using Tor and Signal are silver bullets, and there are many ways to out yourself. <a href="https://github.com/scidsg/project-info/blob/main/hush-line/5.%20Research/2.%20Legal/apple-v-andrew-aude.pdf" target="_blank" rel="noopener noreferrer">Take, for example, the case of Apple v. Andrew Aude</a>. He was using Signal on a work-issued phone. Even if he was using Tor in combination, if your employer can just take screenshots of your device, no amount of encryption or technology will keep you private.</p>
<p>The lesson: never use your work-issued devices for anything you want to remain private or an employer-owned network to connect to a site you want to keep private.</p>
<p>When thinking about blowing the whistle, always consider: What are you protecting, and who are you protecting it from? Is it a message to the local newspaper about the noisy neighborhood construction, an abusive business owner, or a corrupt local official? You can connect using our clearnet address and have confidence you'll remain anonymous.</p>
<p>Or are you sharing national security secrets from within an authoritarian government that censors their internet? This is not legal advice, but a reasonable, though possibly prohibitively complex, way to ensure anonymity may be to use a Tor-only amnesiac operating system like Tails or Qubes with a Whonix disposable VM on an uncompromised burner device where you'll encrypt your message locally before ever connecting the device to the internet. When you connect to the Hush Line Onion service, it should be on an uncompromised network you do not own, to which you are not related, and that isn't near your residence. Oh, and don't go anywhere that uses surveillance cameras or biometric identification, only use cash and don't go to an ATM near where you'll buy the device, leave your primary cell phone at home, don't check in to any location requiring your real name or ID, and if you have a car with a GPS in it, don't drive it. Reasonable, right? This might sound like a lot, but no matter what tool you use to send a message, if you share sensitive enough information about an individual or entity with enough time, money, and power, operational security will always be critically important.</p>
<p>Sometimes, you can get in trouble by just being in the wrong place at the wrong time, <a href="https://www.nbcnews.com/news/us-news/google-tracked-his-bike-ride-past-burglarized-home-made-him-n1151761" target="_blank" rel="noopener noreferrer">like when this guy was arrested for riding his bike past a crime scene and became a suspect</a>. Law enforcement subpoenaed Google for information about any device in that location in a given time period, and that was enough to bring the cops to his door. This raises the question: If you're sharing information of great enough importance, should you use a phone or operating system built by a major corporation that could be subject to such subpoenas?</p>
<p>Or are you sharing national security secrets from within an authoritarian government that censors their internet and murders journalists? This is not legal advice, but a reasonable, though possibly prohibitively complex, way to ensure anonymity may be to somehow acquire and use a Tor-only amnesiac operating system like Tails or Qubes with a Whonix disposable VM on an uncompromised burner device where you'll encrypt your message locally before ever connecting the device to the internet. When you connect to the Hush Line Onion service, it should be on an uncompromised network you do not own, to which you are not related, and that isn't near your residence. Oh, and don't go anywhere that uses surveillance cameras or biometric identification, only use cash and don't go to an ATM near where you'll buy the device, leave your primary cell phone at home, don't check in to any location requiring your real name or ID, and if you have a car with a GPS in it, don't drive it. Reasonable, right? This might sound like a lot, but the point is that there is no one way to use Hush Line or "perfect" anonymity. You must consider your own situation uniquely. No matter what tool you use to send a message, if you share sensitive enough information about an individual or entity with enough time, money, and power, operational security will always be critically important.</p>
<p>Sometimes, you can get in trouble by just being in the wrong place at the wrong time, <a href="https://www.nbcnews.com/news/us-news/google-tracked-his-bike-ride-past-burglarized-home-made-him-n1151761" target="_blank" rel="noopener noreferrer">like when this guy was arrested for riding his bike past a crime scene and became a suspect</a>. Law enforcement subpoenaed Google for information about any device in that location in a given time period, and that was enough to bring the cops to his door. This raises the question: If you're sharing information of great enough importance, should you use a computer, phone, or operating system built by a major corporation that could be subject to such subpoenas?</p>
<p>Sometimes, just having software on your phone is enough to make you suspicious, <a href="https://twitter.com/olabini/status/1776585700663611868" target="_blank" rel="noopener noreferrer">like in the recent case against Ola Bini in Ecuador</a>.</p>
<p>If you are considering blowing the whistle, it's always good to seek the advice of a legal professional familiar with your country's laws. If you do not have anyone you can contact locally, you may contact a firm specializing in whistleblower cases, which might be able to connect you to someone who can help.</p>
</div>
Expand Down

0 comments on commit 6e34696

Please sign in to comment.