Cellebrite Can Now Unlock iPhones for the US Government

According to Forbes: "The Feds Can Now (Probably) Unlock Every iPhone Model In Existence". In a February 26, 2018 article we read: "In what appears to be a major breakthrough for law enforcement, and a possible privacy problem for Apple customers, a major U.S. government contractor claims to have found a way to unlock pretty much every iPhone on the market. Cellebrite, a Petah Tikva, Israel-based vendor that's become the U.S. government's company of choice when it comes to unlocking mobile devices, is this month telling customers its engineers currently have the ability to get around the security of devices running iOS 11. That includes the iPhone X... Indeed, the company's literature for its Advanced Unlocking and Extraction Services offering now notes the company can break the security of "Apple iOS devices and operating systems, including iPhone, iPad, iPad mini, iPad Pro and iPod touch, running iOS 5 to iOS 11."

What Can My ISP See?

Unless you are paying your bill or having connectivity issues, you probably don’t give much thought to your Internet Service Provider (ISP). But, you might want to take a minute to think about what your ISP knows about you. Despite the privacy precautions you take, your ISP may be able to see everything that you do on-line.

Of course, there probably isn’t someone sitting behind his desk at your ISP watching every click you make, but that doesn’t mean your browsing history isn’t getting stored somewhere on their systems. Your ISP tracks your clicks for a number of reasons. For them, your browsing history is a revenue stream. Many ISPs compile anonymous browsing logs and sell them to marketing companies.  What’s more, the data your ISP collects may be accessed by outside organizations, such as the police department or another government agency. If provided with a subpoena, your ISP is legally required to provide whatever information they have on you.  

Some of the things that your ISP knows about you include:

1. The exact web-sites you visit
If the web-sites you visit are unencrypted, (i.e., they still use HTTP and not HTTPS), your ISP will know the exact sites you visit. If the web-sites you visit use HTTPS, all your ISP will see is that you visited the site, but not what you do on it.

2. Your emails
If you use an email service that doesn’t use Transport Layer Security (TLS) encryption, your ISP can likely see the contents of your emails, and if your ISP is also your email service provider, they definitely can.

3. Whether you’re using BitTorrent
Your ISP can see when you use BitTorrent to download files, even if they are legal (a game update, for instance). While they may not care so much about the contents you’re torrenting as much as some corporations (who can see your IP address from the torrent, mind you), once the ISP notices you’re using bandwidth for torrenting they might throttle your download speeds.

Your ISP can see all unencrypted data that you send and receive. Remember this, and take precautions to mask your on-line activities from your ISP.

Using a Virtual Private Network (VPN) can keep your ISP from seeing what sites you are connecting to on-line, as can connecting through TOR.  While your ISP will be able to tell that you connected to the TOR network (you can mitigate this by using bridges), they can't know what hidden services you're visiting, nor what content you are sending or receiving through the Tor network.  Accessing the Internet through an anonymous proxy, using an HTTPS connection can also help mask your on-line activities.  

Check that every site has HTTPS. Use HTTPS Everywhere. Use an email with TLS encryption. Better yet, use an email service that won’t keep track of your messages. Using an encrypted e-mail service such as Protonmail or Tutanota can help safeguard the content of your e-mail messages. Create inbound traffic by playing audio streams when you’re not at home, and create outbound traffic by sharing popular files through file-sharing services.

Controversial ‘Stalkerware’ Used by the Police and Military

Consumer spyware is popular not just with the general population, but also with members of the US government.

According to a February 23, 2018 article on Motherboard: "Dozens of employees from US federal law enforcement agencies and the armed forces have bought smartphone malware that can, in some cases, intercept Facebook messages, track GPS locations, and remotely activate a device’s microphone, according to a large cache of data stolen by a hacker and obtained by Motherboard."

The spyware company in question is Mobistealth, which sells its products to monitor children and employees, but has also marketed malware to spy on spouses suspected of having an affair. Some label the malware as spouseware or stalkerware.

Contained in the Mobistealth data are customer accounts linked to email addresses from the FBI, DHS, TSA, ICE, and several different branches of the military. It’s not clear whether the individuals paid for the malware themselves or through their respective organizations.

But at least 40 of the Mobistealth accounts were connected to the US Army.
--
This isn't the first time there have been reports of the government using spyware. In 2015, RT News reported that "Internal documents of the Italian malware maker Hacking Team, leaked online in a hacker attack, show that the FBI, Drug Enforcement Agency and the US Army all made use of its controversial spyware known as Remote Control System, or Galileo."

A 2017 article in the Huffington Post reported: "The US Army has admitted to eavesdropping on a confidential listserv of defendants and their legal counsel, taking sensitive information from the listserv vital to a pending criminal trial and passing it on... to local prosecutors, forcing a mistrial in a case the defense was winning handily. The case was later dismissed for prosecutorial misconduct. Even after US Army employees were reprimanded for this illegal activity, in a 2014 deposition the Army admitted that it "continued to anonymously spy on email listservs of political activists."

And just this month we saw reports of Social Media Surveillance of U.S. Persons by the Police and Military. 

Whether the police and military are acting within the law, and within the scope of their duties, when conducting these types of activities, is a question that can't be answered in a blog post. It is certainly possible to find government employees knowing violating law and regulation - keeping hidden files on government computer networks, ordering secret psychiatric evaluations, filing false police reports as part of harassment campaigns (In the words of the government agencies involved, they aimed to neutralize [those individuals they targeted] through a pattern of false arrests and detentions, and attacks on homes and friendships...) (Boghosian, 2013).

There can however be no question that this type of activity breeds fear and mistrust of the government. According to a 2015 Gallup Poll, 75% of Americans see widespread corruption in their government (Gallup, 2015). It is not just a belief that the government is corrupt, but an actual fear of this corruption by the majority of Americans that raises the greatest concern. According to the Chapman University Survey of American Fears: "Of the 89 potential fears the survey asked about, the one that the highest share of Americans said they were either "afraid" or "very afraid" of was federal government corruption. It was also the only fear that a majority of Americans said they shared." (Rampell, 2015) Within the top fears of Americans, after fear of corruption of government officials, the Chapman University Survey found that Americans also feared, cyber-terrorism, corporate tracking of personal information, government tracking of personal information, and identity theft (Zolfagharifard, 2015). The Pew Research Center conducted a study of public trust in government between 1958 and 2014 and found that Americans’ trust of their government was at an all-time low in 2014 (Pew Research Center, 2014).

And, now in 2018 let us ask ourselves... has our trust of government improved?

Equifax Data Breach - Even Worse

Equifax hack put more info at risk than consumers knew.

According to a February 2018 article in the Washington Post: The Equifax data breach exposed more of consumers’ personal information than the company first disclosed last year, according to documents given to lawmakers.

The credit reporting company announced in September that the personal information of 145.5 million consumers had been compromised in a data breach. It originally said that the information accessed included names, Social Security numbers, birth dates, addresses and - in some cases - driver’s license numbers and credit card numbers.

However, Atlanta-based Equifax Inc. recently disclosed in a document submitted to the Senate Banking Committee, that a forensic investigation found criminals accessed other information from company records... that included tax identification numbers, email addresses and phone numbers. Finer details, such as the expiration dates for credit cards or issuing states for driver’s licenses, were also included in the list.

Equifax’s disclosure, which it has not made directly to consumers, underscores the depth of detail the company keeps on individuals that it may have put at risk.
 ---

To help protect yourself, you may want to consider adding a Freeze to your credit reports.

List of Consumer Reporting Companies

You may know that your credit record affects your ability to get an affordable loan, a job, an apartment, or many other essentials of daily life. But, do you know where and how to actually request your credit report and what you can do once you order your consumer reports?

The list of consumer reporting companies, updated for 2018, provides information about consumer reporting companies that collect information and provide reports to other companies about you. Companies then use these reports to inform decisions about providing you with credit, employment, residential rental housing, insurance, and in other decision making situations.

The list includes the three nationwide consumer reporting companies and several other reporting companies that focus on certain market areas and consumer segments. The list gives you tips so you can determine which of these companies may be important to you. It also makes it easier for you to take advantage of your legal rights to obtain the information in your consumer reports, and  dispute suspected report inaccuracies with companies as needed.

Download a copy of the List of Consumer Reporting Companies.    (Alternate Link).

Where possible I recommend adding a Freeze to your record with any consumer reporting agency.

WSU Data Breach - Class Action Lawsuit

Lawsuit claims WSU was negligent with data

Washington State University faces a class-action lawsuit over allegations that its negligence led to a burglary that put the names, Social Security numbers, health records and other personal data of nearly 1.2 million people at risk.

Earlier this year WSU had a backup hard drive containing confidential information, including Social Security numbers, from more than 1 million people. The hard drive was stored in a $126-a-month, 8-by-10 self-storage locker in Olympia, inside a $159, 86-pound safe that you can buy at Home Depot.

This burglary and data breach occurred in April 2017. The alleged negligence of WSU in failing to secure the personal data of 1.2 million people is the foundation of the class-action suit.

Credit Freeze for Privacy and Security

If you’re concerned about identity theft, those reported mega-data breaches, or someone gaining access to your credit report without your permission, you might consider placing a credit freeze on your report. When you place a credit freeze with each of the credit reporting agencies (Equifax, Experian, Innovis, and Transunion), access to your credit file is restricted / "frozen" until you re-contact each of the credit reporting agencies and lift the freeze.

A credit freeze will prevent potential lenders from accessing your credit report, thereby stopping a thief from opening an account or getting credit in your name - even if they have your personal information. Most creditors will not open an account and establish credit for anyone until they check your credit history, and a credit freeze prevents this from happening.

To place a credit freeze on your accounts, you will need to contact each of the credit reporting agencies, request the freeze, and pay a small fee – around $10.00.  Once the credit freeze is established each credit reporting agency provides you with a security code / PIN that you will need to lift the credit freeze (don’t lose these numbers).

I recommend having a credit freeze in place with each of the credit reporting agencies, but there are some potential issues of which you should be aware. Running your credit isn’t just about borrowing money. If you try to rent an apartment, establish an account with a utility company, or set up service with a new cellular telephone provider they may run a credit check. Employers conducting a background check on a new hire may also run a credit check. With a credit freeze in place these checks won’t go through. A credit freeze can delay you when you are legitimately trying to do something that requires the check to be completed. A credit check doesn’t just keep the bad guys from accessing your credit report - it stops all new inquires. Note here that a credit freeze won’t stop hackers from taking control of your current accounts - only from opening new ones.

If you are in the process of renting an apartment, buying a new car, or anything else that is going to require a credit check, then you should wait until that is done before establishing a credit freeze. On the other hand, if you don’t plan on applying for credit anytime soon, then definitely get that credit freeze in place and lock down your accounts.

A credit freeze does not affect your current credit score, and if you decide to apply for credit sometime in the future you can always lift your credit freeze with the credit reporting agency where the check is being run. Remember to put it back in place when the credit check is complete. 

The Federal Trade Commission (FTC) provides more information about credit freezes on its consumer web-site. 

Consumer Reports has an article "Security Freeze vs. Fraud Alert: Deciding the Best Option" that will give you more information. The article states: "A security freeze placed on your credit file will block most lenders from seeing your credit history. That makes a freeze the single most effective way to protect against fraud."

Need Help? - Crisis Hotlines

 

Veterans Crisis Line

 

There are 3 easy steps

 

1. Fill out a brief Self-Check Quiz, which takes about 10 minutes.

2. A VA Chat Responder will review it and leave a personal response for you on this secure website, usually within 10-15 minutes. If the volume is especially high, it may take up to 30 minutes. The Responder's note will offer options for follow-up if it's felt that could be helpful.

3. You decide what's next. You may enter the online Veterans Chat and continue talking with a Responder without identifying yourself. You may want to get a referral to see someone in person. Or, you can decide to do nothing further at this time. It's all up to you. No follow-up services will be provided unless you request them.

 

Protecting your privacy

You will not be asked to provide your name or any other information that identifies you.
You will be automatically assigned a unique identifying number called a "Reference Code" which will appear on the upper right-hand corner of your screen. Your Reference Code will also be provided on a page that you will see immediately after you submit the Self-Check Quiz. You will need to make a note of your Reference Code, because you'll need it to get the Responder's note to your Quiz.

Do you need help? Are you thinking about suicide, a victim of domestic violence, struggling with an addiction? National Hotlines will connect you to someone who will listen, and help connect you with resources you need in your local area. The first step in getting help is to simply pick up the phone and ask. You are not alone!

Suicide Prevention Lifeline - 1-800-273-TALK (8255)
The National Suicide Prevention Lifeline is a national network of local crisis centers that provides free and confidential emotional support to people in suicidal crisis or emotional distress 24 hours a day, 7 days a week.


National Domestic Violence Hotline - 1-800-799-SAFE (7233)
National Domestic Violence Hotline has been the vital link to safety for women, men, children and families affected by domestic violence. With the help of our dedicated advocates and staff, we respond to calls 24/7, 365 days a year.


National Sexual Assault Hotline 1-800-656-HOPE (4673)
The National Sexual Assault Hotline is available 24/7. You'll be connected to a trained staff member from a local sexual assault service provider in your area.


National Hotline for Crime Victims - 1-855-4-VICTIM (1-855-484-2846)
The Victim Connect Resource Center is a referral helpline where crime victims can learn about their rights and options confidentially and compassionately.


National Drug Helpline - 1-877-709-2389
The National Drug Helpline offers free, 24/7 drug and alcohol help to those struggling with addiction. Call the national hotline today to receive information regarding treatment and recovery.


Mental Health & Substance Abuse National Helpline - 1-800-662-HELP (4357)
SAMHSA’s National Helpline is a free, confidential, 24/7, 365-day-a-year treatment referral and information service for individuals and families facing mental and/or substance use disorders.

Warning Signs

Suicide

 

Domestic Violence

 

Workplace Violence

 

 

Signs Of A Dangerous Person

Difficulty getting along with others: Inappropriate conduct and outbursts - yelling at co-workers (profanities or threats), and passive aggressive conduct ("I'm not talking to you.").

Clinical paranoia:  They may not yet be diagnosed, but they think others are out to get them. "Every time I hear a noise I have to check to be sure someone is not there to hurt me or my family. - If someone showed up with a high-power rifle we would be sitting ducks."

Litigious nature: Filing false police reports and grievances is their way of virtually controlling others. Everything is blown out of proportion.

Victim attitudes: They never take responsibility for their behaviors, faults, mistakes or actions. They always blame others; it’s always someone else’s fault.

Controlling behaviors: Keeping secret / hidden files about co-workers or others they believe are "out to get them". Deliberately disrupting the work of others - deleting files being used by another employee.

Vindictive references: They say things like, "He will get his someday," or "What comes around goes around," or "One of these days I’ll have my say."

 

Who Watches the Watchmen?

Who Watches the Watchmen?
The Conflict Between National Security and Freedom of the Press
by: Gary Ross, National Intelligence University, Washington, DC, July 2011

Those who surrender true liberty to a false security defend nothing worth preserving, while those who abandon real security to an illusory liberty protect nothing worth safeguarding.

"Since the founding of this nation, the U.S. press has been committed to promoting democracy through an informed citizenry. From the "lone pamphleteers" of 1776 to major metropolitan newspaper editors of 2011, each has recognized the significance of disseminating essential information to the public. This includes publishing information concerning government actions conducted on behalf of its citizens as well as exposing corrupt or illegal activity committed by its elected representatives. This free flow of information allows individuals to remain engaged with their government."

An interesting book, available as a free download from the National Intelligence University.

There are certainly things that governments must do in secret to accomplish the functions of government - no one expects to see classified national defense information published on the front page of the New York Times.

At the same time, government secrecy can also be used to cover up illegal activity. When a government agency seeks to hide its actions from public view, by sealing court records, denying FOIA requests, and keeping secret / hidden files, one must ask just what type of official misconduct and wrong-doing they are trying to cover up!

Washington State Lawmakers Exempt Themselves from Public Records Law

When a government agency seeks to hide its actions from public view, by sealing court records, denying FOIA requests, and keeping secret / hidden files, one must ask just what type of official misconduct and wrong-doing they are trying to cover up!

OLYMPIA, Wash. (AP) - Washington state lawmakers have overwhelmingly approved legislation that will circumvent a recent court ruling that found they were fully subject to the state’s public disclosure laws. The measure retroactively removes the legislative branch from the state’s voter-approved Public Records Act so that lawmakers are able to attempt to shield records sought by a coalition of media groups, led by The Associated Press, who prevailed in court last month. The Legislature is appealing the Jan. 19 ruling of Thurston County Superior Court Judge Chris Lanese, who ruled state representatives and senators and their offices are fully subject to the same broad public disclosure requirements that cover other local and state elected officials and employees at state agencies.

The Evil Maid Attack

An evil maid attack is a security exploit that targets a computing device that has been shut down and left unattended.  An evil maid attack is characterized by the attacker's ability to physically access the target multiple times without the owner's knowledge.

Besides giving this type of attack a very catchy name, Polish security researcher Joanna Rutkowska successfully demonstrated in 2009 that even full disk encryption (FDE) cannot be counted on to protect a laptop when an attacker has physically access the device. Since then, the name "evil maid" has caught on with security professionals and the label has been used in a general fashion to describe scenarios in which the attacker doesn't simply steal the device -- or access it once to clone the hard drive -- but instead, returns multiple times to wreak havoc.

Basically, the attack works like this:

Step 1: Attacker gains access to your shut-down computer and boots it from a separate volume. The attacker writes a hacked bootloader onto your system, then shuts it down.

Step 2: You boot your computer using the attacker's hacked bootloader, entering your encryption key. Once the disk is unlocked, the hacked bootloader does its mischief. It might install malware to capture your encryption key and send it over the Internet somewhere, or store it in some location on the disk to be retrieved later.

You can see why it's called the "evil maid" attack; a likely scenario is that you leave your encrypted computer in your hotel room when you go out to dinner, and the maid sneaks in and installs the hacked bootloader. The same maid could even sneak back the next night and erase any traces of her actions.

Defeating the Evil Maid

No security product on the market today can protect you if the underlying computer has been compromised by malware with root level administrative privileges. If someone has physical access to your computer, we assume that that person has complete access to everything on your computer.
Putting your data on a thumb drive and taking it with you doesn't work; when you return you're plugging your thumb into a corrupted machine.

That being said, there are some common sense defenses against the "Evil Maid":

The defenses include two-factor authentication: a token you don't leave in your hotel room for the maid to find and use. The maid could still corrupt the machine, but it's more work.

Setting a BIOS password to prevent your laptop from being booted with external media. Remember though that a BIOS password can be removed by clearing dip switches, jumpers, jumping BIOS, or replacing BIOS - and other techniques. Some people super-glue the screws that hold their laptop together. This prevents the case from being easily opened.

Have a secure locking case in which to store your laptop while it is unattended, such as PacSafe, or a Pelican Laptop Case.

The simplest measure may be to always keep your device with you instead of leaving it in a hotel room or other unattended location.

Joanna Rutkowska's Anti Evil Maid article (Sept 7, 2011) provides a more technical look at defense against the Evil Maid.

People who encrypt their hard drives, or partitions on their hard drives, have to realize that the encryption gives them less protection than they probably believe. It protects against someone confiscating or stealing their computer and then trying to get at the data. It does not protect against an attacker who has access to your computer over a period of time during which you use it, too.

Anarchists, Activists, and Saboteurs

Are you worried about government agents keeping secret files about you? Are you concerned that government agents are violating the civil rights of thousands of Americans by conducting an intensive, invasive, and illegal intelligence-gathering operation against people who oppose current government policy? Do you believe that government employees would submit false reports to local law enforcement about you, reports to be used in harassment campaigns that includes preemptive arrests and physical attacks on peaceful demonstrations; reports aimed at neutralizing the activities of individuals and political organizations through a pattern of false arrests and detentions, attacks on homes and friendships, and attempting to impede people from peacefully assembling and demonstrating against the government, anywhere and at any time? Do you believe they are Spying on Democracy?

Most of us probably do not concern ourselves with such things. But there is a part of our society that sees these things as a very real threat. These individuals oppose what they see as the illegal actions of big government and the crimes of big business. This opposition may be through political activity, civil disobedience, or even violent direct action. An April 28, 2017 article, "So You Want to Protest: A Beginner's Guide" in the Seattle Weekly pointed out that "asking nicely for change doesn't always work. To be effective, protesters must sometimes force a crisis-that is, interrupt some vital piece of social machinery like a highway or place of business, so that leaders are unable to ignore their demands. The squeaky wheel gets the grease, as the saying goes."

The culture that opposes Big Brother and Big Business can be very well-organized, and these groups publish manuals and guides on security culture, resistance, and direct action. Some of these manuals and guides are available at the following links. This is only a small sample what can be found on-line, and this doesn’t take into account what else may be available on the "dark web". But reading what's here will give you some understanding of the culture and provide you leads to other resources.

An Activist's Guide to Information Security

Animal Liberation Front: Guide to Direct Action

Black Cat Sabotage Manual

CrimethInc

Ecodefense: A Field Guide to Monkeywrenching

Family Guardian

Frontline Defenders

If An Agent Knocks

Rage University

Rats! Your guide to protecting yourself against snitches, informers, informants, agents provocateurs, narcs, finks, and similar vermin. - Claire Wolfe

Resistance Manual

Revolutionary Resources

Rise Up

Ruckus Society

Sprout Distro

Tactical Technology Collective

Warrior Publications

If you are responsible for the security of a business likely to be targeted by these groups, or maybe you live in a city that sees regular civil disturbances, it would be of value to understand the mindset and the tactics of this part of our society and our communities. Are you a police officer, or a government agent? There is a sub-culture of society that opposes you simply because of your chosen profession. Understanding the tactics that these individuals may employ against you will contribute to your personal safety.

           

It is however essential that we recognize that Americans have constitutionally protected rights to assemble, speak, and petition the government. Potential criminality exhibited by certain members of a group does not negate the constitutional rights of the group itself or its law-abiding participants to exercise their individual liberties under the First Amendment to the U.S. Constitution.

Microsoft Office Encryption

MS Office allows you to protect documents (Word), spreadsheets (Excel), databases (Access), and presentations (PowerPoint) with a password. When MS Office products are protected, they are encrypted and a password is required to open and read them. The default encryption values for MS Office 2013 are AES (Advanced Encryption Standard), 128-bit key length, SHA1, and CBC (cipher block chaining).  This provides reasonably good security for the content of your products, but you must ensure that you are using a strong password. (The 40-bit key RC4 protection used in earlier versions of MS Office, 97-2003, can typically be bypassed with password hacking software.)

To add a password to an MS Office product, click on the ‘File Tab’, choose the ‘Info’ Menu, and then click on the ‘Protect Document’ (‘Protect Workbook’, etc.) Button, and choose "Encrypt with Password" from the drop-down menu. Add a password to the open dialog box, confirm the password, and now your MS Office product will require a password the next time it is opened.

While MS Office Encryption provides good security for personal use, you should be aware of a potential security vulnerability if you use MS Office on a network. This vulnerability is a Microsoft tool called DocRecrypt.

Network administrators can use Group Policy to push registry changes that associate a certificate with password-protected documents. This certificate information is embedded in the file header. Later, if the password is forgotten or lost, use the DocRecrypt command line tool and the private key to unlock the file and, optionally, assign a new password.

Now, DocRecrypt won't recover the password for an encrypted document before this policy was established on the network, but once it is installed any MS Office encrypted documents you create thereafter will be able to be decrypted using the DocRecrypt tool.

One way to defeat the DocRecrypt tool is to create an encrypted document outside of the network and e-mail it to yourself. DocRecrypt shouldn't be able to add a decryption header to an already encrypted document.

While there are certainly better encryption tools than MS Office, the password-to-open / encryption function available in MS Office adds an additional layer of security to your documents, spreadsheets, databases, and presentations that is certainly far better than having no security at all. Would I use MS Office encryption to protect my most sensitive documents? No, probably not. At least not as my only form of encryption. Do I use MS Office encryption as an additional layer of security? Yes! It will keep most individuals and many local level agencies from accessing your data - when used with a strong password.

Diplomatic and Consular Immunity

 

 

 

To combat the myths surrounding immunity, the U.S. Department of State has released a video companion to its publication: Diplomatic and Consular Immunity: Guidance for Law Enforcement and Judicial Authorities. This short video, entitled Diplomats and the Law: Dispelling the Myths shows dramatizations of three scenarios common to law enforcement officers and the very real consequences that diplomatic and consular personnel face, even after immunity may have prevented arrest and/or prosecution.

The produced video and a companion quiz consisting of 10 questions to test your knowledge can be found at http://www.state.gov/ofm/resource/ile/index.htm

The publication, Diplomatic and Consular Immunity: Guidance for Law Enforcement and Judicial Authorities can be found at http://www.state.gov/documents/organization/149734.pdf

NotSharingMyInfo Is No More

Sorry! NotSharingMyInfo is no more :-(

We'll try to keep forwarding mail for existing addresses for as long as possible, but it's unclear how long that will be, so it's best to stop using them ASAP.

F.A.Q.

Q: What is NotSharingMyInfo anyway?
A: NotSharingMyInfo was a free email forwarding service.

Q: How much longer will my @notsharingmy.info addresses last?
A: There's currently no plan to shut down forwarding for existing addresses, but please be advised that it can happen any time. It's best to switch now if you can.

Q: I am not receiving mail sent to my @notsharingmy.info address. Can you look into it?
A: Unfortunately not.

Q: Can I buy this website?
A: No.

Q: Can I cancel my @notsharingmy.info address?
A: Yes, you can cancel it.

Q: How can I contact you?
A: Email hello@notsharingmy.info

Private Disposable Telephone Numbers

 

Sometimes you may want to communicate with someone by telephone, but you may not be comfortable giving out your personal and private telephone number. Maybe you are signing up for an on-line account or service and need to receive a text message to complete your registration. Maybe you are selling an item on Craigslist or e-Bay and want to let potential buyers contact you, but don't want to put your personal telephone number out on the Internet. You might want to provide a telephone number in a developing social situation, but if things do work out do you want that person to have your real telephone number. There are many reasons why you might not want to disclose your personal telephone number, and this is where disposable telephone numbers come into play.

Some of the most popular apps for disposable telephone number are:

Sudo App – I wrote about Sudo App in December 2017 and use Sudo regularly. The only disadvantage I see with Sudo is that it is currently only available for iOS (Apple), and thus if you have an Android phone you can’t take advantage of Sudo’s great services. Sudo is free, and gives you nine (9) telephone numbers.

Hushed App – Available for both iOS and Android, Hushed plans start at $1.99 per month. Calls between Hushed numbers are free, so you could set up a calling circle with friends and family for free as long as everyone signed up for a Hushed number.

Burner App - Your Burner App numbers works as a forwarding service to your private cellular telephone number. Plans cost at $4.99 per month / per line. Burner gives you the choice of a subscription or a simple pay-as-you-go option.

Number Proxy - Based in Canada, Number Proxy works similar to other disposable telephone number services. To create a telephone number with Number Proxy you purchase credits using either Bitcoin or PayPal.

It may be that you need to just receive a text message to sign up for an account or on-line service. SMS Receive Free and Free Phone Number both receive text messages and post those received text message to their web-pages. The received text messages are visible to anyone looking at the site, so you wouldn’t want to receive sensitive information there, but to just receive an activation code these sites may be an option to avoid tying a registration to your personal cell-phone number. The downside to this type of text message receiving site is that the telephone numbers can get overloaded.

Disposable telephone numbers and text message receiving web-sites help you add layers of privacy to your personal life. It is one more thing that an adversary will need to overcome in order to find the "real you".

While not designed as a disposable telephone number, Google Voice can have useful applications to ensure that you can always be contacted by those who have this number.

Google Voice (Google's VOIP telephone service) was established in 2009 and is free for anyone to use. With Google Voice, users can obtain a single phone number to be used on all of their devices. No longer do you have to give out an office, cell and home number - with Google Voice, whenever your number is dialed it will ring each phone and device you sync to the service.

One of Google Voice’s major selling points is the ability to route all of your devices under just one single phone number. Upon creating a Google Voice account, you are provided with a dedicated Google Voice phone number. This new dedicated number can then be linked to your cell phone, house phone, work phone or any additional lines. Whenever someone calls your Google Voice number, it will ring every device linked to your account. You can of course also make outgoing calls from all of these devices as well, even including your computer. No matter which device you dial from, the receiver’s caller ID will see your new Google Voice number.

Since Google Voice numbers aren't listed in phone books or connected to physical addresses, they're difficult to trace. When you call contacts from your Google Voice number, it shows up on their caller ID, but standard phone traces don't reveal your identity. If law enforcement agencies become involved, Google provides them with your account information, including the IP address from which you created the account and placed calls. (Security Tip: Always connect through a VPN.)

A government agency can request your data from Google by providing a subpoena, court order or search warrant. However, Google claims to take users' privacy very seriously and doesn't give information to authorities unless the request passes a rigorous internal process. If authorities have requested your data from Google, you receive an email notifying you of the request. If Google finds a subpoena, court order or search warrant valid, it provides the government agency with specific account information, including your IP address, which can reveal your physical location.

If someone enters your Google Voice number in an online directory, such as White Pages, Switchboard, or AnyWho, the search returns the Bandwidth headquarters, the company that issues VoIP numbers to Google Voice users. Since Bandwidth has many headquarters across the country, your Google Voice area code determines which building the search finds on a map. Finding your location and identity from this information is impossible, especially since you can choose any area code for your Google Voice number.

How to Survive A School Shooting

Following the shooting at Marjory Stoneman Douglas High School in Parkland, Florida on February 14, 2018 the gun-control group "Everytown for Gun Safety" reported that there had been eighteen (18) school shootings in the United States since the beginning of the year.

This fake statistic was quickly debunked by web-sites like Snopes, and USA Today published an article No, there have not been 18 school shootings already this year on February 16, 2018 in which they stated "Fake stats like that make finding a solution to the real problem of gun violence, which has actually struck American schools at least six times this year, that much harder. Amping up fears, and muddying the search for fixes that can cut back the senseless violence, only undermines efforts to reconcile the real concerns of parents and the legitimate desire of civil rights advocates to protect the Bill of Rights. Everytown for Gun Safety, the gun-control advocacy group responsible for spreading this bogus statistic, should be ashamed of its blatant dishonesty."

As USA Today reported, the truth is that since the beginning of 2018, there have been six (6) school shootings in the United States. Now, I do not say just six school shootings, or only six school shootings, because even one school shooting is one too many, but it is important to have the facts as we search for solutions to violence in our schools, and on our streets.

Gun-control groups claim that the answer school violence (and other mass-shootings) is to somehow ban, or at least severely restrict, all firearms ownership. At the other end of the spectrum, we see memes suggesting that local governments should hire three or four armed veterans to protect every school. Military service, while certainly honorable, does not necessarily make one skilled with firearms (although all veterans have basic firearms familiarization). Nor does military service make one particularly qualified to assess this type of threat. Whether the fake reports are from Everytown for Gun Safety, or anyone else with a political or personal agenda, such reporting undermines the credibility of the organization, and impedes the search for solutions to actual threats of violence in our communities.

 

How to Survive A School (or Workplace) Shooting

According to Police Magazine "Department of Homeland Security research reveals that the average duration of an active shooter incident at a school is 12.5 minutes. In contrast, the average response time for law enforcement is 18 minutes." This means that on average the shooter will have fled the scene or committed suicide on scene before the arrival of law enforcement.

If we accept the Department of Homeland Security statistics as accurate, police are not going to be able to respond quickly enough to save you (your children) from an active shooter in a school.

To survive a school shooting you will need to escape the area without crossing the path of the shooter thus becoming a target, hide and avoid detection by the shooter for an average of 18 minutes until arrival of police, or if confronted and attacked by the shooter fight back – which means having the tools and skills to do so.

The Department of Homeland Security has published a guide on how to respond to an active shooter. In November 2017, I provided links to Active Shooter awareness resources, saying: “Active shooter situations are unpredictable and evolve quickly. Because active shooter situations are often over within 10 to 15 minutes, before law enforcement arrives on the scene, individuals must be prepared both mentally and physically to deal with an active shooter situation.”

wikiHow has a useful guide on How to Survive a School or Workplace Shooting, and I found the February 18, 2018, TownHall article 7 Simple Steps to Eliminate School Shootings Overnight to provide useful recommendations and observations.

Surviving An Active Shooter - LA County Sheriff (YouTube Video)

San Antonio Police Department-Civilian Response to Active Shooter (YouTube Video)

Some students are even beginning to carry backpacks with a bullet-resistant insert to help protect themselves in case of a school shooting. While I question the effectiveness of these backpacks - the ballistic panel will certainly stop some bullets, but when fleeing an active shooter students will be required to leave their personal items (i.e. the backpack) behind - you may find that this type of item fits into your personal threat model.

School shootings are different than mass-shootings in other places, because children may lack the maturity and understanding to quickly recognize and respond to a threat (this could be said of some adults as well). Sill, as children get older and become more mature it is important to talk with them about the possibility of an active shooter in their school and how to respond to that threat.

Do you know what the active shooter plan is at your children's school? Does the school even have a plan? Does the school conduct active shooter awareness training or drills?

There is no simple answer to school shootings. Recognizing that this threat is a possibility (no matter how small that possibility may actually be), and having a plan to respond is essential. Those plans must be made based on clearly defined facts, avoiding fake statistics and firearms hysteria intended to advance political and personal agendas.

Lt. Col. Dave Grossman, a Pulitzer Prize nominated author, West Point psychology professor, and one of the world’s foremost experts on human aggression and violence made the following recommendations to prevent and respond to school shootings, in Police One, back in May 2010:

1. Denial - Denial is the enemy and it has no survival value, said Grossman.

2. Deter - Put police officers in schools, because with just one officer assigned to a school, the probability of a mass murder in that school drops to almost zero.

3. Detect - We’re talking about plain old fashioned police work here. The ultimate achievement for law enforcement is the crime that didn’t happen, so giving teachers and administrators regular access to cops is paramount.

4. Delay - Various simple mechanisms can be used by teachers and cops to put time and distance between the killers and the kids.

     a. Ensure that the school/classroom have just a single point of entry. Simply locking the back door helps create a hard target.

     b. Conduct your active shooter drills within (and in partnership with) the schools in your city so teachers know how to respond, and know what it looks like when you do your response.

5. Destroy - Police officers and agencies should consider the following:

     a. Carry off duty. No one would tell a firefighter who has a fire extinguisher in his trunk that he’s crazy or paranoid.

     b. Equip every cop in America with a patrol rifle. One chief of police, upon getting rifles for all his officers once said, "If an active killer strikes in my town, the response time will be measured in feet per second."

     c. Put smoke grenades in the trunk of every cop car in America. Any infantryman who needs to attack across open terrain or perform a rescue under fire deploys a smoke grenade. A fire extinguisher will do a decent job in some cases, but a smoke grenade is designed to perform the function.

     d. Have a "go-to-war bag" filled with lots of loaded magazines and supplies for tactical combat casualty care.

     e. Use helicopters. Somewhere in your county you probably have one or more of the following: medevac, media, private, national guard, coast guard rotors.

     f. Employ the crew-served, continuous-feed, weapon you already have available to you (a fire hose) by integrating the fire service into your active shooter training. It is virtually impossible for a killer to put well-placed shots on target while also being blasted with water at 300 pounds per square inch.

     g. Armed citizens can help.  Think United 93. Whatever your personal take on gun control, it is all but certain that a killer set on killing is more likely to attack a target where the citizens are unarmed, rather than one where they are likely to encounter an armed citizen response.

Postal Re-Mailing for Privacy

When you send a letter through the United States Postal Service (USPS) a postmark from the post office where it was mailed (or more likely the area postal processing center) is affixed to the letter, canceling the stamp and showing the general area where the letter was mailed.

While a postmark does not reveal the address of the sender of a letter, it does reveal the general area in which you live, or at least where you were when you mailed the letter. If you are trying to conceal your location, you will need to take steps to ensure that a postmark does not give you away.

As one re-mailing service says: "There are many legitimate reasons [that you might want to use a re-mailing service]. Maybe you are a whistleblower using your legal protection of anonymity to report something important while avoiding retaliation. Perhaps you're an absentee parent or estranged family member hoping to update a child or other relative without revealing your whereabouts. You may be a person trying to expand an online relationship with a personal letter and do not yet wish to reveal your physical location to your online friend."

The reasons for using a re-mailing service goes on:

• Providing important information to someone anonymously
• Privacy of your real location or address while travelling
• Correspondence with friends or family without revealing your location
• Get a letter to an ex-spouse without disclosing where you live
• Report an illegal activity to law enforcement

and... many other reasons that may apply to your personal situation and privacy requirements.

 

There are postal re-mailing services that will re-mail your letters and packages for a fee of around $2.00 per letter and $5.00 per package.

It is interesting to note that the USPS also provides a simple re-mailing service for people who want a postmark as part of a special occasion or holiday. For example, if you would like a postmark from a town with a "romantic" name for Valentine’s Day, the USPS provides this service. The USPS says: "Post Offices with Valentine’s Day Names. Interested customers can write to these Post Offices for postmarks to keep or to share with friends.  Enclose a stamped, addressed card or letter in another envelope or box labeled "Valentine re-mailing" and address it to the postmaster of one of the towns listed below. Please allow enough time for postmarking, re-mailing, and delivery."

You don’t have to wait for Valentine’s Day, or some other holiday to use this re-mailing technique for privacy purposes. Although not the most common of hobbies, people do collect postmarks from different locations. Using the Valentine’s Day technique, you can have a letter re-mailed from any post office at any time. Just, enclose a stamped, addressed card or letter in another envelope and send it to the Post Master of the post office from where you would like it re-mailed. When the Post Master opens the outer envelope, he or she has the inner envelope which is properly addressed with the required postage affixed, and it must be entered into the mail as any other letter.

Sending a letter to the Post Master for re-mailing works well for sending letters, but for re-mailing of packages, as well as having other services related to re-mailing, you will need to work with a re-mailing service. A few postal re-mailing services are listed below.

Rapid Remailer
Radicarian LLC
25878 SE Hwy 19
Old Town, Florida 32680
http://www.rapidremailer.com/
$2.00 per letter
$5.00 per package

Chicago Re-mailing Service
2413 W. Algonquin Road, Suite 422
Algonquin, IL 60102
http://chicagoremailingservice.com
$2.00 per letter
$5.00 per package

Midwest Remailer
DDB Solns
PO Box 220
Harrison, OH 45030
http://midwestremailer.com/index.html
$2.00 per letter or three for $5.00

TTI Mail Services
Post Office Box 675
Occoquan, VA  22125-0675
https://www.snailmailforwarding.com
$2.00 per letter re-mailed from N. VA
$3.00 per letter re-mailed from Washington, DC

Rapid Remailers
c/o 9414 West 120th Terrace # 15
Overland Park, KS 66213
https://postmarkhere.com
$1.00 per letter

 

Receiving Mail Without Disclosing Your Address

Sending mail from an alternate location (having a letter re-mailed) is fairly easy, but how do you receive mail without disclosing your actual address? 

One way to do this is General Delivery mail.

According to the United States Postal Service web-site:

Get your mail even if you’re on the road, new to town, or between permanent addresses. Mail addressed to you at General Delivery will be held at the area’s main Post Office for up to 30 days. All you have to do is pick it up.

General Delivery is a great choice if you don’t have a permanent address. People can send you mail by using the town name and ZIP Code, like this...

JOHN DOE
GENERAL DELIVERY
ANYTOWN, NY 12345-9999

In medium to large cities with multiple ZIP Codes, you’ll want to make sure senders use the ZIP Code for the area’s main Post Office. The ZIP+4 extension 9999 indicates general delivery.

The advantage of General Delivery is that you don’t have to have a permanent or local address to use it. In fact, it is designed for people who don’t have a permanent address. When picking up General Delivery mail you will be asked to show ID that matches the name on the mail you are picking up. If you regularly receive General Delivery mail, the post office may require you to fill out  PS Form 1527 "Application for General Delivery Service", but there are no fees to pay for General Delivery. Whether you are asked to fill out the PS 1527 or not, you can receive mail by General Delivery without disclosing your real address to the sender. Normally only the main post office in an area will provide General Delivery service, but it's a simple matter to check with your local post master to find out where you can receive General Delivery mail.

I have previously written about using the Street Addressing option offered by some post offices when a 'street address' is required, and of course just having a PO Box at a post office adds a layer of privacy to your actual physical address.

Another option is to use a mail forwarding service that meets the needs of frequent travelers. Once such service is the Escapees RV Club - Mail Forwarding Service. With this type of service you can have a mailing address in a different state. The service receives and holds your mail, and then forwards it to you upon receiving your instruction to do so. Escapees RV Club is a commercial mail receiving agent (CMRA) and like many CMRA charge around $200 per year for their services. Still, as a way to conceal your physical location, and as a way to receive postal mail while traveling, this type of service may be worth the money.

If you want to receive packages without disclosing your address to the sender, both FedEx and UPS have hold for pick up options at any FedEx or UPS location respectively. When using a hold for pick up option it's important to know for sure what carrier will be delivering your package. You don't want to end up with a hold at FedEx location package addressed to your local UPS Store.

Combining a CMRA with a USPS street addressing option, or a hold at a FedEx or UPS location can add multiple layers of privacy around your true physical location. However, the more layers your mail must pass through, the longer it will take for you to receive it.

Five + Five Digital Security Tools

Five digital security tools to protect your work and sources
An article from the International Consortium of Investigative Journalists

1. Signal and other end-to-end encrypted apps
2. Secure file storage and encrypted sharing
3. Password managers
4. Two-factor authentication and its innovations
5. Slack alternatives for your office

. and .

Five EFF Tools to Help You Protect Yourself Online

1. Privacy Badger
2. Panopticlick
3. Https:// Everywhere
4. Certbot
5. Surveillance Self-Defense

Spying on Democracy

Spying on Democracy:
Government Surveillance, Corporate Power and Public Resistance

By Heidi Boghosian

"In Spying on Democracy, National Lawyers Guild Executive Director Heidi Boghosian documents the disturbing increase in surveillance of ordinary citizens and the danger it poses to our privacy, our civil liberties, and to the future of democracy itself. Boghosian reveals how technology is being used to categorize and monitor people based on their associations, their movements, their purchases, and their perceived political beliefs. She shows how corporations and government intelligence agencies mine data from sources as diverse as surveillance cameras and unmanned drones to iris scans and medical records, while combing websites, email, phone records and social media for resale to third parties, including U.S. intelligence agencies."

* (pp. 108-109)  A civilian employee of the Fort Lewis Force Protection Division in Washington State, struck up friendships with many peace activists. For at least two years he posed as an activist... He gave information... to his supervisor Thomas Rudd, who wrote threat assessments that local law enforcement officials used in harassment campaigns that included "preemptive arrests and physical attacks on peaceful demonstrations, as well as other harassment." In the words of the government agencies involved, they aimed to neutralize PMR [a local political / activist group] through a pattern of false arrest and detentions, attacks on homes and friendships, and attempting to impede members from peacefully assembling and demonstrating anywhere, at any time."

I thought that "Spying on Democracy: Government Surveillance, Corporate Power and Public Resistance" was very well-written and highlights concerns that many in our communities have about invasions of our personal privacy and abuse of our civil liberties.