Edward Snowden's statement in support of Reset the Net
Edward Snowden issued this statement via his attorney in support of Reset the Net:
"One year ago, we learned that the internet is under surveillance, and our activities are being monitored to create permanent records of our private lives -- no matter how innocent or ordinary those lives might be.
Today, we can begin the work of effectively shutting down the collection of our online communications, even if the US Congress fails to do the same. That's why I'm asking you to join me on June 5th for Reset the Net, when people and companies all over the world will come together to implement the technological solutions that can put an end to the mass surveillance programs of any government. This is the beginning of a moment where we the people begin to protect our universal human rights with the laws of nature rather than the laws of nations.
We have the technology, and adopting encryption is the first effective step that everyone can take to end mass surveillance. That's why I am excited for Reset the Net -- it will mark the moment when we turn political expression into practical action, and protect ourselves on a large scale.
Join us on June 5th, and don't ask for your privacy. Take it back."
We need everyone's help to kick off Reset the Net on June 5th. Whether you're an individual with 20 friends or an organization with 2 million members, please use the materials below to spread the word.
Scroll down to the bottom for sample email text to send to lists.
Step 1:
Please join this Thunderclap with your Twitter, Facebook or Tumblr to help promote the privacy pack on June 5th: https://www.thunderclap.it/projects/10619-reset-the-net
Step 2:
Please tweet about your participation in Reset the Net using #ResetTheNet:
Sample tweet text:
The countdown has started! Less than a week before we #ResetTheNet and take back our privacy. Join us on June 5th! http://ResetTheNet.org
On June 5th we will #ResetTheNet and turn off government surveillance. Are you in? http://ResetTheNet.org
We’re joining #ResetTheNet to shut down mass surveillance with technology and action. Learn more: http://resetthenet.org
On June 5th we will #ResetTheNet to make mass surveillance too expensive to continue. Join us! http://resetthenet.org
Stop the oppression and take back your privacy. Join the movement to #ResetTheNet - https://www.resetthenet.org/
Are you ready to take back your privacy?Join the movement to #ResetTheNet and end mass spying: http://www.resetthenet.org pic.twitter.com/FIOWMJDAVh
On June 5th, we take back our privacy. #ResetTheNet to end mass surveillance. RT & Join us: https://www.resetthenet.org/ pic.twitter.com/9Vt8wi2r2T
Enough is enough. Time to take our privacy back. #ResetTheNet. http://resetthenet.org
The more we learn about #NSA, the clearer it is that tweaks & fixes are not enough. we have to http://ResetTheNet.org
Step 3:
Please post one of these graphics to Facebook linking back to http://resetthenet.org
Share on Facebook
Share on Facebook
Share on Facebook
Share on Facebook
Share on Facebook
Share on Facebook
Share on Facebook
Share on Facebook
Step 4: Send this email to everyone you can
One year ago today, the way we think about the Internet changed forever.
Edward Snowden blew the whistle on one of the worst human rights abuses in history: the U.S. government has been secretly monitoring our phone calls, webcams, texts, chats, real-time location, and reading habits -- literally everything we do online and with our phones.
Finally, there’s something you can do about it that will make a difference right now.
Click here to join Reset the Net and kick the government off of your computer and phone.
In the year since we first learned the lurid details of the NSA’s dragnet spying operation, a massive wave of opposition has echoed across the globe. Millions have taken action online and in the streets with one clear message: mass surveillance by any government is illegitimate. It violates our right to be ourselves, and undermines freedom of speech and democracy.
Despite the massive public outcry, a whole year after the revelations Congress has done nothing. The NSA is still tapping our phones and computers, while politicians endlessly debate our rights away.
We have no choice but to take matters into our own hands. Click here to learn how you can help Reset the Net.
We have to power to protect our privacy -- and reclaim the Internet – right now. The Snowden documents show that the NSA is relentless and corrupt, but they're not invincible. We know encryption works -- the proof is in the fact that the U.S. government still doesn’t know what documents Edward Snowden took.
Most of us haven’t tried using privacy tools yet. We use the Internet and feel icky knowing the government is watching and recording our every move. But the reality is that it’s easier than you think to take a few simple steps and protect your privacy and the privacy of your loved ones. The more of us that use basic encryption tools, the safer we all are.
Click here to get the Reset the Net “Privacy Pack” -- easy to use tools to protect your freedom.
Today thousands of people -- and some of the most popular websites and apps on the web -- are taking concrete steps to secure their part of the Internet and make suspicionless, dragnet-style surveillance exponentially more difficult and expensive for governments to conduct.
Today we’re coming together to make a better, safer web, and a better, freer world. Everyone has a role to play. Tell your friends.
Tech companies, diverse organizations and thousands of individuals announce plan to “Reset the Net” on anniversary of first Snowden surveillance story
Popular companies and sites including reddit, imgur, DuckDuckGo, CREDO Mobile, and BoingBoing stand with diverse coalition of organizations, plan to announce security improvements while thousands of Internet users oppose mass surveillance by adopting encryption technology
Today, a coalition of thousands of Internet users, companies and organizations launched a campaign for a day of action to “Reset The Net” on June 5th, 2014, the anniversary of the first NSA surveillance story revealed by whistleblower Edward Snowden. Tens of thousands of internet activists, companies and organizations committed to preserving free speech and basic rights on the Internet by taking steps to shutting off the government’s mass surveillance capabilities.
Watch the campaign video and see a full list of participants here: http://ResetTheNet.org
More than 20 organizations and companies support the launch of the campaign including Fight For The Future (who initiated the campaign) along with reddit, CREDO Mobile, Imgur, Greenpeace, Libertarian Party, FireDogLake, Thunderclap, DuckDuckGo, Disconnect.Me, Demand Progress, Access, Free Press, Restore the Fourth, AIDS Policy Project, PolitiHacks, OpenMedia, Free Software Foundation, Bill of Rights Defense Committee, Code Pink, Popular Resistance, Participatory Politics Foundation, BoingBoing, Public Knowledge, Amicus, New America Foundation’s Open Technology Institute, Progressive Change Campaign Committee, Student Net Alliance, and the Center for Democracy and Technology.
Organizations and companies across the technology industry and political spectrum oppose the bulk collection of data on all internet users. Reset The Net is a day of action to secure and encrypt the web to shut out the government’s mass surveillance capabilities.
The Reset The Net website details the coalition of companies and organizations which are participating, either by improving their own security for users or promoting privacy tools to their members. Internet users are invited to join in on the day of Reset The Net to install privacy and encryption tools and secure their personal digital footprint against intrusive surveillance.
Below are statements by representatives of several organizations participating in Reset The Net.
For a complete list, go to https://www.resetthenet.org/
To schedule an interview with an organizer from one of these groups, contact:
Tiffiniy Cheng or Evan Greer, Fight for the Future
“Freedom to be yourself is everything. No government can take that away from us, so we're going to use the power we have to take it back,” said Tiffiniy Cheng, co-founder of Fight for the Future, “Now that we know how mass surveillance works, we know how to stop it. That's why people all over the world are going to work together to use encryption everywhere and make it too hard for any government to conduct mass surveillance. There are moments in history where people and organizations must choose whether to stand on the side of freedom or tyranny. On June 5th, the Internet will show which side it’s on.”
"We can take back control of our personal and private data one website, one device, one Internet user at a time," said Erik Martin, General Manager of reddit, "We're proud to stand up for our users' rights and help Reset the Net."
"A year after Snowden's shocking revelations, the NSA is still spying on innocent Americans without a warrant," said Michael Kieschnick CEO of CREDO Mobile. "CREDO will continue to demand Congress and the president take action to stop unconstitutional mass warrantless surveillance, and until we win real reform, we will encourage users to adopt encryption tools to protect their personal communications from government abuse of the 1st and 4th amendment."
“A year ago, the world awakened to the reality that the freedom, openness, and security of the internet is gravely at risk. In the wake of mass spying revelations, it is becoming ever more clear that robust encryption practices must be used by all internet platforms in order to protect the privacy of internet users,” said Amie Stepanovich, Senior Policy Counsel at Access. “Access has launched the Data Security Action Plan, which outlines actionable steps that can be taken to protect against unauthorized surveillance - we hope that companies will use the Action Plan as a guide as they look for ways to help Reset the Net.”
"As the NSA and other intelligence authorities continue to undermine the basic security of the Internet ecosystem, it's become clear that we need to build new legal and technical firewalls against overreaching government surveillance," said Kevin Bankston, Policy Director of New America Foundation's Open Technology Institute. "The Open Technology Institute is excited to support Reset the Net and highlight the need for all of us--both individual internet users and the companies that serve them--to take full advantage of encryption and other security tools that can help protect our private data against snoops, spies, criminals and creeps."
“The Libertarian Party enthusiastically joins Reset the Net,” said Carla Howell, Political Director for the Libertarian National Committee. “Over thirty Libertarian candidates running for federal office this year have pledged to shut down the NSA and invite Edward Snowden to return home a free man. He should be granted an immediate presidential pardon, awarded the American Medal of Freedom, and applauded for blowing the whistle on the NSA’s abuse of the Constitution.”
Joe Hall of Center for Democracy and Technology said, "Legal and architectural changes to push back against mass surveillance happen very slowly, but all of us with a computer, an app, or a website can take matters in our own hands now and Reset the Net from the bottom up."
Steve Anderson, Executive Director of OpenMedia.org, said: “At the end of the day, we’re going to have to create accountability for governments that are spying on their citizens. And it’s sad that people feel they need to route around what their government is doing - this shows just how far governments have grown out of touch with their citizens. It’s so important that people speak out in any way they can about surveillance, and using encryption technologies is one way to do that.”
###
Fight for the Future works to excite the Internet to fight for the public good, our basic rights and freedoms. Founded in 2011, we're known for effective, viral organizing and mass engagement through the distributed organizing platforms we've built, including the SOPA protests in the winter of 2012-2013 and the Internet Defense League. For more information, visit www.fightforthefuture.org or our Facebook and Twitter pages.
Since the NSA and other governments are attacking our privacy from so many angles, it's hard to see a path forward, and it's easy to slide into paralyzing skepticism.
But we can't let skepticism or a sense or that the NSA is omnipotent (they aren't) become an excuse for doing nothing.
The Snowden docs have given us the best blueprint you could ever have of a secretive institution's inner workings. Experts have analyzed this blueprint and, like the Death Star, there is a weakness: we can't stop targeted hacking, but we can stop mass surveillance, by taking some straightforward steps, together.
Skepticism and paranoia are welcome here, to a point. This FAQ is our attempt to shine a light through some common doubts, and show a path forward. We hope it helps. Read on...
If you have any comments, feedback, or other questions, email us here.
Do these privacy tools really work? Don't we need new laws?
We do need new laws, but it will take years to get the protections we need. It may never happen. And it will take even longer to get strong privacy protections worldwide. Right now, our best chance at legal reform in the US is the USA Freedom Act, which would protect Americans only from having their call records handed to the NSA. We should push for it, but it's not enough.
Can't we sue the government, and force the NSA to follow the US Constitution?
Yes, and groups like the ACLU and the EFF are working on this. The trouble is, a victory could get undermined at the last minute by Congress making changes to the law. And it's unlikely whatever Constitutional protections we win will apply to people outside the US (even though they should!). That's just not good enough.
Why should I care about privacy when I have nothing to hide?
Good question. Read our response, and if a friend asks you, send it to them.
Can't the NSA just hack our phones and computers anyway?
Yes they can, unfortunately. But security experts agree that there’s literally no one on the planet right now who has any good, practical idea what to do about that problem. The software we use every day is complex, it gets more complex everyday, and bugs that hackers (with enough time and energy) can exploit just come with the territory.
It’s easier to hack than defend. Anyone with enough time, skill, and/or money can do it. We’re just going to have to live with that, for a while.
Fortunately, we know that governments can’t use this approach to spy on everyone. We know from the Snowden leaks that the NSA is extremely careful to not overuse its hacking tricks (zero-day exploits) because if they do, other governments will learn them, and they’ll have to get fixed.
And remember, governments have always been able to follow you around, break into houses, bug phones, etc. Hacking makes it much cheaper, but not infinitely so. We still have the power to stop mass surveillance.
I heard the NSA could break encryption. What's the deal with that?
They can, sometimes, and in some cases. But they usually do it by finding a flaw in the code that makes the encryption work, or just hacking the target in question and bugging their computer. As the security community finds and fixes bugs like Heartbleed and gotofail, the NSA has fewer and fewer options when it comes to getting around encryption.
You really don't think the NSA has some secret technology that lets them break encryption?
No, we don’t. Seriously, we’re surprised too. The NSA hires so many math geniuses, everybody suspected they had some secret magic math that could break encryption much faster than any known method. But they don’t. All they have is budget, which they use to methodically and tirelessly find flaws in specific tools (like OpenSSL) and turn those into practical attacks that get around encryption.
If encryption doesn't guarantee privacy, why use it?
There’s no such thing as guaranteed perfect security. Not on the Internet, not anywhere. That can feel demoralizing, but it’s not. Security just has to be good enough to protect against a given set of attackers. Now that the NSA has joined that list, and given other governments a blueprint for how to spy on the world, we have to step our game up.
If we all use SSL, can't the NSA just access Google, Facebook, and Apple directly through the courts?
Yes, the NSA can compel companies legally with secret court orders. But this approach has more limits in law. Even if the process gives the NSA too much power, it at least forces them to get a court order. Companies have a chance to push back in courts or be a hero, like Lavabit. Also (and in the age of leaks, this matters a lot) some people outside the NSA learn about their tactics in the process, and have an opportunity to become whistleblowers.
But when the NSA collects data directly from the open Internet by breaking SSL, they can use a special legal trick: they can collect everything, and then make their own rules for searching it, based on a loose and self-serving interpretation of the law. There's no adversarial process, no checks. And there's no outside companies who can object in court or leak word to journalists. Meanwhile, rogue employees could break the rules and grab whatever data they want to pursue a personal or political agenda (imagine an evil Snowden). The NSA itself often ignores its own rules for data it collects.
The vast majority of the Snowden leaks described programs based on collecting data directly. That’s where the NSA gets their best access. Securing data sent over the Internet is hugely important, even if the NSA can request data from US companies.
Of course, end-to-end encryption based on free software is the best solution. That way, even the NSA's unconstitutional warrants won't work.
Can't the NSA just hack Facebook and Google and get all our data that way?
Yes they probably can, and that's what they have been doing, though Google's recent steps to secure the links between its servers may have fixed it.
For perspective, Google and Facebook are probably tougher targets than almost anyone else-- even most governments-- especially now that they know how hard the NSA was, erm, hacking them. But giving a few huge companies access to all our data is obviously not a great idea.
End-to-end encryption in open source software is the best solution. That way, if the NSA wants your data, they have to hack you. Since targeted hacking doesn't scale, mass surveillance becomes impossible.
What about the Certificate Authority system? Can't the NSA make fake certificates?
Yes they can, but if they tried to do mass surveillance using this technique we’d catch them. The EFF’s SSL Observatory exists for this. Cert pinning is also a defense.
The Certificate Authority system is horribly broken, but everybody knows it, and there are good people working on finding a solution (see: tack.io). Once that happens, expect it to show up in Firefox and Chrome fast.
What about journalists, activists, and elected leaders? How do they protect themselves?
There’s no perfect answer to this. It really depends on what governments you think might be attacking you, for what kinds of reasons, and what kind of information you’re protecting. If you’re very careful you can make yourself a hard target. But whatever you do, if the stakes are high for you for any reason, don’t trust any single form of protection. You need to talk to experts, get a full set of recommendations, and practice extreme care with full knowledge of the risks. Your attackers only need you to mess up once.
How did we do? Any comments, feedback, or other questions? Email us here.
Why should I care about privacy, when I have nothing to hide?
We get this a lot. There are a million answers (our favorite short one is "Nothing to hide? Really?") but here's something thoughtful and comprehensive to share with a friend the next time it comes up. The short version? None of the freedom and progress we've won over the past century would have been possible without the freedom to change things (starting with our own lives first) that privacy gives us.
Imagine a world where you were constantly being judged by everyone around you, suffering immediately, or years down the road, for anything you did or said that was unusual, unpopular, or against the rules. In that kind of world, social and economic progress grinds to a halt, because everyone's afraid to rock the boat!
Social progress
Gay rights. Interracial marriage. Medical marijuana. None of these would exist now if people were unable to break the rules in the privacy of their own home, building momentum and legitimacy until they could show the world what change looked like, that it wasn't so scary, and that it could make the world a better place.
We owe massive amounts of social and economic progress to privacy. Think about it. Don't take it for granted.
Liberty & even beer
Think about the prohibition of alcohol that took hold in the 1920s. Prohibition crumbled because people defied it, raising the social cost of enforcement. If prohibition had been 100% enforceable due to mass surveillance, it would have been much harder to get rid of.
You probably wouldn't even be able to drink alcohol in the US, if people couldn't privately defy prohibition. Remember that, the next time you crack open a cold beer on a hot day.
A ticking time bomb
The NSA's current capability extends beyond privacy invasion. Right now, the NSA's access give it the power to secretly undermine the work of journalists and elected leaders around the globe, intimidating sources and tipping elections. The NSA abuses this secrecy to undermine the systems (like Congressional oversight) meant to keep it in check. It's hard to imagine something someone with the power Edward Snowden had couldn't do in total secrecy. This capability to subvert democratic systems is a timebomb, waiting to go off.
And it will, if we let it continue to exist.
The worst part? When the NSA does subvert our democratic institutions, we might not even know it happened until it's already too late.
So the next time you hear somebody say "I've got nothing to hide," send them this.
If we can get the Internet's most popular websites and apps to step up security, the NSA is in serious trouble. Especially if we can get them to add end-to-end encryption.
We've got to start somewhere. Here’s a list of tweets with a a few things major companies should totally do as soon as they can to protect our privacy. Who knows? To limit the damage the NSA has done to their reputations, they might listen.
Start your engines... here's the list!
Hey @Amazon, add SSL everywhere to protect our privacy while we shop. #ResetTheNet
Hey @Google, require Android apps in the Play Store to add SSL w/ cert pinning, to protect privacy #ResetTheNet
Hey @Apple, you should require iPhone apps to use SSL w/ cert pinning, to protect our privacy. #ResetTheNet
Hey @Facebook, adding end-to-end encryption as an option for mobile-to-mobile chats. It's awesome. Why not? #ResetTheNet
Hey @Mozilla and @TOR, you guys should get together and build TOR into Firefox as an option for privacy protection. #ResetTheNet
Hey @Samsung, start shipping phones with built-in Textsecure for solid private texting. #ResetTheNet
Hey @LG, start shipping phones with built-in Textsecure for solid private texting. #ResetTheNet
.@Apple should add PGP privacy to Mail for Mac & iOS. #ResetTheNet
Hey @Yahoo @Apple @Microsoft add START-TLS encryption so the NSA can't grab all our emails.
Hey @Samsung @LG and @HTC force carriers to push security updates to the phones you sell. It’s too easy for governments to hack phones.
Have other ideas of obvious things companies should do, to not play into the NSA's surveillance operation? Get 'em down to 140 characters, and send them our way.
Are you a developer? Here are some software projects that actually threaten the NSA.
This is a quick and by no means exhaustive list. But here are some projects that can project us against mass surveillance, at scale.
Here are our top picks, in terms of where a small number of people with serious skills could have an impact.
LEAP / Bitmask - Wish you could use encryption seamlessly and effortlessly in any email app? Bitmask is a local mailserver that sits between you and an IMAP/SMTP server and encrypts all outgoing email whenever it can.
Briar - Briar is encrypted messaging for some of the worst situations imaginable. It's 100% p2p and even works over Wifi and Bluetooth when Internet access is blocked. This project is bad-ass and it needs your help.
WebRTC with ZRTP - Skype betrayed us all and needs to die. Browsers now have built-in p2p videochat and tons of cool services use it, but the WebRTC standard doesn't offer protection against government man-in-the-middle attacks. ZRTP does. Help make it happen!
GPGtools - Compared to webmail and mobile apps, not that many people use Mail.app on Mac. But it's a really influential (and important) userbase. GPG needs to be more viral, and this is the best place to start.Mailpile - Encryption-friendly email in a familiar gmail-like interface.
Mailvelope - GPG encryption for Gmail, as a Chrome extension.
Textsecure - Seamless encrypted mobile messaging, used by over 10 million Cyanogen users. It's rock solid already. Help make it viral!
Redphone - Secure calls for Android and (soon) iOS.
Adium / Pidgin / OTR - OTR in clients like Adium and Pidgin (formerly GAIM) was the first encrypted communication tool that was even remotely easy to use. It works over Google Hangouts, Facebook, MSN, and Yahoo. There is a huge opportunity to make it more viral, by automatically inviting friends to install OTR-compatible clients, and simplifying installation. We also hear it could be made more secure against hacking attempts.
Chatsecure is OTR encryption for iPhone and Android. Help make it awesome.
Tails - Tails has the honor of actually being mentioned in leaked NSA slides as a huge headache to deal with. Go Tails!
Tor - It matters a lot, and needs to keep improving.
Enigmail - Somebody has to figure out a way to make GPG more viral. Start with this, and with GPG tools.
In order to be effective as a hacker working to make communications more secure, you'll need to build skills and experience on how these systems can work well, and how they can go wrong. We'd recommend looking closely at several, picking one to hack on that you're most excited about, and reading the relevant literature. Expect to spend some time learning from
the developer community around these projects before you dive in.
There's tons of things we've left out. Got a project you'd like to add to this list? Be in touch.
First, there are tons of ways to fight back against NSA surveillance. Anything that makes the Internet or individuals using it safer and more secure makes mass surveillance harder, for the NSA and for any other government.
It can start with you. These super-easy encryption tools let you talk, chat, and text with pretty strong privacy. If everyone used them, that would go a long way to shutting down mass surveillance. So, be the first. And tell your friends. In the end, beating the NSA could be that simple.
At the same time, we need to think about scale: how can we get absolutely massive numbers of people using end-to-end encryption? What's your best soapbox? What's the biggest circle of people you can get to where, if you showed them a way to take back their privacy, they'd listen, and try it out? Here are some specifics.
Are you a musician or performer? Shout out privacy tools from the stage.
Do you have a website, blog, or tumblr? Run our splash screen.
Everybody's got friends on Facebook & Twitter. Join the Thunderclap.
Are you a student? Learn how to organize at your school, and get your school to add NSA-resistant privacy to its services.
Do you work in a political organization or NGO? Distribute the privacy pack to your members.
Finally, the most powerful way to make privacy scale is to build it in everywhere, and do it so well, it's almost invisible. If you're a developer, that's what you should work for. There's no reason the videochat or messaging platform of the future can't be free, open source, and end-to-end encrypted. There's no reason why we can't build end-to-end crypto into the web. Here our thoughts on how web and mobile app developers can fight back against government surveillance.
Developers can do. So. Much.
Have an existing project? Be a hero and build in end-to-end encryption, ideally using an open standard like ZRTP (for voice/video), OTR, or Textsecure (for messaging).
Have an idea for a new project? Get to work.
Just looking to contribute your time and talent? Here's a list of potentially game-changing privacy projects that could benefit from your help.
The Reset the Net privacy pack will be a selection of software and tips tailored to common computers, phones, and tablets that literally anyone can use.
Our goal is to accommodate literally everyone, and offer bonus tools and instructions for more technical users. Since the tools will be pretty much universal, it should be easy for people to share the privacy packs with friends.
It'll provide tools and tips for iPhone, Android, Mac, Windows, and GNU/Linux, and everything will be free software.
Here's what we're offering...
Adium & Pidgin for private (OTR) chat over Gtalk, Facebook, Yahoo, MSN, XMPP / Duck Duck Go and others.
Textsecure and Redphone for Android and iPhone (we hope), for private SMS and voice calls.
HTTPS Everywhere for browsers
GPGtools and Enigmail (as a bonus for more sophisticated users)
Tor (as a bonus for sophisticated users or those with anonymity needs)
Tips on how to enable full disk encryption on your computers, phones, and tablets, for easy, strong protection in extreme situations.
We decided to only offer free software tools in the privacy packs because they make it easy for outsiders to verify (and improve) their security, and because the freedom they give users helps advance the state of the art. Given how the US government induced once private tools like Skype to add backdoors, we feel that's important. It also narrows the choices a lot to ensure we aren't seen as playing favorites.
(One important note on the inclusion of Pidgin, Adium, and OTR: if you believe you may be the specific target of surveillance, these aren't the tools for you. Pidgin has had a large number of remotely exploitable vulnerabilites
recently, and auditors looking at the code believe there are likely to be many more. Still, these tools are effective against passive mass surveillance, and they're unusually easy to use.)
On June 5th, we're asking sites, apps, organizations, and everyone to promote the privacy packs to everybody you can reach. Getting serious about popularizing secure tools is one of our best weapons against mass surveillance. We'll be making a splash screen with code you can add to your site.
Can your site or app promote the privacy pack on June 5th? Sign up here.
If you have any thoughts on how to improve the privacy pack, be in touch.(Though be aware that we don't have a lot of flexibility here. We need tools that a broad community of experts can get behind.)
If you have a website (or a mobile app!) run the “Reset the Net” splash screen or banner as a part of the biggest backlash against mass surveillance on June 5th, to help protect as much of the Internet as possible and take a stand for privacy. Link them to the privacy pack.
Splash screen:
Add this script right before the </body> tag. (See demo)
You won't see it right away because it is set to go live at midnight on June 5th. To see it on your site, you can also add ?_idl_test=1 to the end of any page URL configured to display the alert and see it pop up, e.g. http://www.fightforthefuture.org/?_idl_test=1
For further instructions or plugins for WordPress etc., click here.
Banner:
For a smaller banner at the bottom of your page, add this script right before the </body> tag. (See demo)
The script is set to hide until the day of. So it’s working properly if you don’t see anything.
To see what your page will look like with the alternate splash screen on, (re)load your page with #ALWAYS_SHOW_RTN_WIDGET in the URL. For example: https://www.thunderclap.it/#ALWAYS_SHOW_RTN_WIDGET
Can your site run the splash screen? Email us now, or sign up on Reset the Net
How we secure our phones (SSL, cert pinning, PFS & more)
As big a deal as the web is, phones and tablets are even bigger. The number of mobile devices out there already dwarfs the number of desktops. Smartphones are getting so useful and so cheap, it’s clear we’re heading to a world where every family and then every person on the planet has one. That means right now, every mobile app maker shares in the responsibility for the future privacy of everyone on the planet. The good news? Mobile apps are in a position to make mass surveillance extremely difficult for government spies.
If we make the right moves now, the explosive growth of smartphones can become the NSA's worst nightmare. Here's how.
1. Make security & privacy a priority
Mobile security is arguably more important than the web. There’s more surveillance data at stake. Your phone is always on, it’s always in your pocket, and it has access to all kinds of data (your calls, your real time location, etc.) that your laptop wouldn’t usually have.
But the fast growing space is extremely chaotic. Apps grow in popularity so quickly, and app makers are still figuring out how to do it well and make money. Some data collection tricks that would never fly in a mature market are still common in mobile apps, and security has lagged behind. This is a shame because, for a few technical reasons, apps are in a much better position than sites to protect user privacy and block mass surveillance.
This section is less about any single technical step and more about moral framing. When you’ve got millions of users, it’s a simple question of your responsibility to all those people.
2. Don't send data unprotected. Use SSL
SSL is the basic technology we use to send data securely over the Internet. It’s what makes HTTPS websites secure, and you use it every day without noticing it, to buy anything online, or on sites that take security seriously.
Some apps keep all your data safe on your phone. But if a mobile app talks to a server--to send a message to a friend, post a photo, or share your high score--that data gets sent over the open Internet. If the app doesn’t use SSL to protect that connection, anyone can spy on that data. Police can do it. The FBI can do it. Really clueless governments can do it. Even random creepy dudes on the same public wifi network as you can do it. For the NSA, it’s a freebie.
Even a game like Angry Birds might send a ton of information about you back to servers with no protection, including your real-time location. Does the NSA really grab that data? You bet.
But if an app uses SSL for all the data, spying on that data is hard. When apps take another precaution called “cert pinning” (keep reading) it’s really hard. Mobile apps should probably be much more careful about what data they collect and send, but that’s a balancing act. One thing is certain: mobile apps must use SSL to protect the data they send from prying eyes.
3. Apps can be more secure than websites, with “cert pinning”.
In a lot of ways, mobile apps are in a better position to secure the data they send than web browsers. Certificate or “cert” pinning takes advantage of that, to make SSL much harder to break.
The easiest way to break HTTPS or SSL encryption is a man-in-the middle attack. You type “facebook.com” into your browser, but somebody else tells your computer “I’m facebook.com”. You may think you’re talking to Facebook, but really you’re talking to the NSA.
Cryptography provides some rock solid ways to know who you’re talking to, but to make that easy to use and update, you have to trust somebody. On the web, we trust the certificate authority system to tell us who’s who. If a CA says “yes, this site is really Facebook” we’ll trust it.
The problem is, the CA system is terrible, and it is really easy for government spies to hand out fake certificates. They can hack CA’s, and many are CA’s. The US Department of Homeland Security is a CA. China is a CA.
On the web, we’re a little screwed right now (though good people are working on it and it will get fixed). But on mobile, the outlook is brighter: you can stick the certificate in your app (hence “pinning”). That way, the app only trusts the certificate it’s supposed to.
Pinning of certs can go wrong if something like Heartbleed (or worse) forces the cert you pinned to be revoked. So people implementing pinning need to have a plan to make sure that their certs are revocable and that revocation won't cause an outage in their app. But there are well-understood ways to do this, like forcing an update, or including a backup key. See this guide.
Another way to look at it is: it is absolutely brain dead for apps to trust the broken CA system used on the web. Apps don’t need to, and doing so is a huge gift to every government spy agency.
4. High standards for third party code (like ads & analytics).
Say a developer reads this article and is convinced. She carefully adds SSL & cert pinning to her app, pushes an update, and thinks, “Awesome, I just made the NSA’s life a little harder.”
But along the way, she used a bunch of different third party code. Code for displaying ads, say. Or analytics code to tell her how well each feature worked. Even though her code was secure, these third party tools are still cranking along without good security, leaking piles of user info to the NSA.
This means two things. First, we need to hold developers of code intended to be used by many apps (like advertising and analytics providers) to the highest standard when it comes to security. Their tools have a really wide reach. And they’re often the weakest link.
Second, app developers need to pick third party tools that do security right, and ask tough questions when shopping around. If you want your app to respect user privacy, you have to choose libraries and third party tools that do too.
5. Don't forget Perfect Forward Secrecy (PFS).
The security of any SSL connection depends on the security of private keys. Once the NSA or any attacker gets these keys, they can break SSL encryption until the site switches to new keys.
Losing control of private keys is a catastrophe every app tries to avoid. But the security version of Murphy’s Law says it will happen eventually. Recently, the “Heartbleed” bug meant that a huge number of servers could have leaked their private keys.
So it’s good to think about how to limit the damage when it happens. Perfect Forward Secrecy (PFS) limits damage, by protecting all the data sent before the keys leaked.
To government spies an HTTPS connection could look like a bunch of encrypted, incomprehensible gobbledygook. But they can still collect it! With PFS, that old data is still safe. Only the new stuff is vulnerable.
PFS for mobile apps isn’t our main focus, since there are much bigger privacy weaknesses in the mobile app world. Still, any app developer who wants to do things right should look into it.
6. Bring out the big guns: end-to-end encryption.
Another place where mobile apps are way better positioned to support privacy is in end-to-end encryption.
“End-to-end” means encryption from you, all the way to the person you’re talking to. When done right, it means anyone trying to listen in is out of luck, unless they hack your phone, or break into your house and bug it.
On the web, end-to-end encryption is hard and weird for users. But mobile apps can do it really well. In fact, some of the easiest and most NSA-resistant ways to communicate are mobile apps (see: Textsecure).
Now, just because it's a cool project doesn't mean developers should write their own end-to-end encryption code. It is well documented that 99.9% of coders will make subtle but fatal mistakes when they try to implement encryption. Look to established projects like Textsecure and The Guardian Project for guidance and well-tested libraries to use.
End-to-end encryption with free, open source code is the gold standard for user privacy. When done right it’s really hard for the NSA to handle, and absolutely impossible for nearly any other government. Plus it’s great for businesses. If the FBI or NSA forces you to hand over all your app’s data, the content of those messages will be safe.
Why this is so important.
Mobile is the most important battleground, and it’s the one where we’re best positioned to win. The web depends on the weak CA system, but mobile apps can easily use cert pinning. End-to-end encryption on mobile is way more practical than on the web.
There are big problems with mobile security, but phones are still way more secure than, say, Windows was in its heyday.
In many ways we’re already winning. When people made calls and sent texts on old feature phones, their home governments saw *all* of that, and so did the NSA. Cellphone carriers were happy to hand it over. Now, when people use Facebook chat, or Hangouts, or iMessages, or Facetime, all that data is encrypted back to companies’ servers, so the NSA has to wrangle with tech companies, who are much less compliant than phone companies (and who will usually ignore sketchy requests from foreign governments!) to do something as simple as a wiretap.
End-to-end encryption is already taking off on mobile. We can accelerate it. There’s no reason why the next Snapchat or Whatsapp can’t have NSA-resistant privacy built-in. And there's no reason why it can't be verifiably secure free software. That's the NSA's worst nightmare. Let's make it happen!
See anything here that you would change? Email [email protected] with feedback.
For many of us, communicating, reading, working, and socializing on the Internet starts and ends with the web. So, any push to end mass surveillance must start there.
HTTPS, HSTS, and PFS (perfect forward secrecy) are powerful tools that make mass spying much more difficult. Until websites use them, we're sunk: agencies like the NSA can spy on everything. Once they're ubiquitous, mass surveillance is much harder and more precarious--even if you're the NSA.
Here's how sites can do their part to end mass surveillance, what it gets us, and why it matters so much to Reset the Net and the overall fight.
1. Sites need to use HTTPS
The basic technology we use to secure the web is HTTPS, and we all use it every day, without even noticing it. You know that lock icon you see in your browser, especially on shopping sites but now, increasingly, everywhere? That’s HTTPS!
If a site isn’t 100% HTTPS, anyone can spy on you. Police can do it. The FBI can do it. Really clueless governments can do it. Even random creepy dudes on the same public wifi network as you can do it.
(And through a sort of strange quirk of how “logging in” works on the web, attackers can do even more than just spy: they can access your password-protected accounts as you.)
Adding HTTPS is pretty easy to do. Unless you’re running a huge site it’s very inexpensive. If you are running a huge site, then with success comes responsibility: your site is too important not to have it.
2. Sites also need to use HSTS
Now, the NSA has ways to keep on spying even when sites do the right thing and add HTTPS protection. Some of these methods are difficult or impossible to defend against. But right now, the hands-down easiest way to break HTTPS encryption is to trick people into not even using it, with a technique called SSLstrip.
Here’s how it works. You type “facebook.com” into your browser, but somebody else tells your computer “I’m facebook.com”. You may think you’re talking to Facebook, but really you’re talking to the NSA. If you typed, “https://facebook.com” every time you went to Facebook, SSLstrip wouldn’t work. But who does that? Nobody.
In theory, you could notice it was happening. But usually, nobody does. Even skilled hackers get tricked by SSLstrip.
This is where HSTS comes to the rescue. HSTS tells every browser, “Hey, this site always uses HTTPS. If you ever get a version of this page that doesn’t, don’t load it, it’s fake.” The best thing about HSTS is that it’s easy to add, and doesn’t cost anything.
As a stopgap measure, individuals can (and should!) install the HTTPS Everywhere browser addon. But to resist the NSA, the web needs privacy built-in. We can’t depend on optional extras.
3. Sites should use Perfect Forward Secrecy (PFS).
The security of any HTTPS connection depends on the security of private keys. Once the NSA or any attacker gets these keys, they can break HTTPS encryption until the site switches to new keys.
Losing control of private keys is a catastrophe every site tries to avoid. But the security version of Murphy’s Law says it will happen eventually. Recently, the “Heartbleed” bug meant as many as 2 out of 3 sites on the Internet could have leaked their keys.
So, it’s good to think about how to limit the damage when it happens. Perfect Forward Secrecy (PFS) limits damage, by protecting all the data sent before the keys leaked.
To government spies an HTTPS connection could look like a bunch of encrypted, incomprehensible gobbledygook. But they can still collect it! With PFS, that old data is still safe. Only the new stuff is vulnerable. PFS even offers some protection after keys have leaked, by forcing attackers to perform active man-in-the-middle attacks rather than just decrypting traffic they collect with passive surveillance methods.
In the case of a public bug like Heartbleed, sites will freak out and change their keys pretty fast. So in that common scenario, you only lose privacy for a short amount of time.
Note: if you're adding PFS on your site, there are some pretty significant problems with many implementations of PFS that could make sites easier to spy on. Whether you're considering adding it or you already have, you should read this paper.
Why everyone needs to do this.
There’s no way to tell exactly how much HTTPS with HSTS and PFS limits the NSA’s ability to spy on the web. But we do know a few things.
First, there are some known victories. HTTPS keeps data out of the hands of surveillance-friendly ISPs (telephone & cable companies) who are always the worst when it comes to handing over data. And it puts almost every government on the planet out of the mass surveillance business; only the most sophisticated governments, if any, can spy on HTTPS traffic.
Second, we know that if the NSA can crack HTTPS on a large scale without being detected, it’s by exploiting specific bugs. If we can get every site using the latest security measures, they’ll upgrade when bugs are discovered.
Then the NSA is in a precarious position. Once all traffic is encrypted, their mass surveillance apparatus depends on an ever-dwindling number of bugs in a small number of tools, extremely valuable bugs they are racing with other governments, organized crime, and security experts to discover.
Once we get there, governments are always just a few technical fixes away from losing their mass surveillance capabilities. At that point, the odds tip in our favor, and victory becomes possible.
For more information on the steps you should take to protect your service and your users from government surveillance, see the Data Security Action Plan from Access and their "Encrypt all the Things" campaign.
By June 5th, do something to reset your part of the web. Figure out how you can shut off the parts the government has invaded and start using new technology that directly interferes with dragnet surveillance. Don't just do it alone, tell everyone that you're helping to Reset the Net.
No data should be sent in the clear. Ever.
Websites can add SSL. Email services can add START-TLS. Large companies must encrypt links between data centers.
End-to-end crypto can be massively popular.
There is no reason why a free software app with end-to-end crypto can’t get as popular as Skype or Whatsapp. Got the skills? Start fresh now, help make an existing app more popular & viral, or add strong crypto to an already-popular product. For inspiration: Adium, Pidgin, OTR, TextSecure,LEAP, ChatSecure, SecureDrop, Tor, DuckDuckGo, Disconnect.Me, GPGtools.
Users have power.
You don’t have to be an engineer to join the fight. We can push companies to do the right thing and vote with our feet, by evangelizing the best secure tools.
Be a hero.
Don’t just run down a checklist. Think about where your skills & relationships can potentially protect millions. Where can you and your friends use crypto to hit the NSA the hardest?
tangentwithtanner
janainaart
titsay
snowghoul
stormborns
kaledo-art
gummygunk
pixelskylines
discoholicmusic