5 ms·

If you're going to whistleblow on your local government online (be that a legitimate government, or a violent drug cartel), the only reasonably safe way to do i

If you're going to whistleblow on your local government online (be that a legitimate government, or a violent drug cartel), the only reasonably safe way to do it is from outside the country AND using Tor. It amazes me that people don't take these basic precautions. Mexican cartels are known to have infiltrated ISPs, where they were able to tie IP addresses to identities. Using encryption is the only way. EDIT: may I ask why the downvotes? Did I say something offensive or break the HN rules?

tomengland 12y ago
I'm not sure how you're going to get out real journalism about the events going on within your city from another country... Did you read the article?
- jamornh 12y ago
  I wonder if the safest way to do this is to have a friend outside of the country help run the social media and you, as the insider, provide the information and direct the friend from within the country/city instead.
- VexXtreme 12y ago
  I did, and it clearly says that other citizens were sending her information to post online. I don't know much about her situation, but presumably that wouldn't require her to be in the country. And even if that's not the case, using Tor and not linking your online vigilante identity to your real identity (e.g. by having your whistleblower twitter account linked to your personal phone) is a very basic precaution. I REALLY don't want to sound insensitive, but if people are going to use technology to fight people who wield the power of physical violence, they DO need to learn how to apply it properly.
  - mkal_tsr 12y ago
    No, see, people call that "victim-blaming" and not "educating yourself about the risks by utilizing the global sum of all human knowledge". The only way people are going to be safe is if they're educated about the risks/rewards to using technology. Lately it's gotten very weird in that anyone that falls prey to predators and become victims could never ever possibly ever have made any possible mistakes/misteps, for they are the immaculate victim that must not ever have any responsibility for their actions. This flies completely contrary to precautionary measures and utilizing knowledge/education as a barrier to attack. The sooner society gets away from the "that's 'victim-blaming'" mentality and embraces education for all, the sooner everyone is better of for it. It's not saying, "yeah, they had this coming, this is their fault" but rather, "let's analyze the situation and provide mitigation for the future"
  - PhasmaFelis 12y ago
    > I REALLY don't want to sound insensitive Then try to use less insensitive language. "It amazes me that people don't take these basic precautions" sounds an awful lot like "Look at this poor misguided savage, killed because she was too stupid to know what an Onion Router is." Maybe try something like "We need to educate whistleblowers about security technology to avoid tragedies like this."
danso 12y ago
I think you were downvoted because people suspected you of glossing over the subject at hand (for the record, I upvoted you). I would say that for some of these local journalists, you're correct in suspecting that their technical expertise isn't high...however, it's not easy to report on dangerous local conditions from outside that locality. For one thing, you've introduced another attack vector for a MITM attack -- between the local stringer and the international point-of-contact who then publishes the content. But the bigger problem is this: the people most passionate about this kind of local reporting, well, they're passionate about it because it is in their town or neighborhood. It's generally not feasible to be a long-time resident (the type who really gives a shit about the terror that's going on in the neighborhood) and then uproot so that you can do reporting safely. For one thing, you're just not as connected to the events once you've left the area.
- VexXtreme 12y ago
  That's a very good point. Perhaps being overseas is not an option. In that case, I guess the best she could do is use a disposable OS (Tails) and VPN at the time of posting sensitive information online, and never use her whistleblower identity/handle outside that very narrow context. Some newspapers (correct me if I'm wrong, I think it was NY Times) have even started running an .onion website where people can leave so called "dead drops".
  - monochr 12y ago
    >VPN Are a terrible idea. You need to trust the operator that they won't screw you by keeping logs. Since these are centralized they are always at the whims of cartels and the like. Just stop and think for a second if you won't give everything you have to them if they took your children hostage as an extreme example. The only way to deal with a situation like the one in Mexico is to get the whole community to use something like Tor. The cartels already are so they can't kill all such connections, and if everyone uses it all the time then you can't target anyone for using it. The reporters are protected by the crowd they hide in. This is the same reason why tor isn't blocked in the first world. It gives all the alphabet soup agencies proper anonymity that doesn't raise red flags when used in other countries which might not be friendly.
coldtea 12y ago
>If you're going to whistleblow on your local government online (be that a legitimate government, or a violent drug cartel), the only reasonably safe way to do it is from outside the country AND using Tor. Unless, you know, the "outside country" is one participating in those surveillance schemes, like 5-eyes, and is in bed with your local goverment and not beyond sending a tip or two (or even supporting its own thugs acting on the ground in your country). More or less like it has been throughtout the 20th century in Latin America.
cynicalkane 12y ago
Tweeting outside the country is probably not an option, and it's unlikely defeating encryption is a sufficient safeguard against cartels that kidnap and torture people. Kidnapping, by the way, is how they allegedly found their target according to the article.
Kiro 12y ago
People downvote based on disagreement, just as they upvote based on agreement. https://news.ycombinator.com/item?id=117171 https://news.ycombinator.com/item?id=117171
vacri 12y ago
Because if a cartel member is looking for a whistleblower and sees that you use Tor, they're just going to respect your right to privacy and move along? Anyway, tor wouldn't have helped the woman in the article; she was found by them going through her local app.
shkkmo 12y ago
I agree. What this woman did was not "reasonably safe". This woman is a hero for the work she did for her community and because of the risks she took to do so. I find this level of bravery amazing as well. (Also upvoted you.)
PhasmaFelis 12y ago
I'm downvoting you because you're sitting in your safe, comfortable chair and smugly mocking a woman who knowingly risked death for the good of her people, because she didn't take the "basic precaution" of leaving the country she was trying to protect first.

tomengland 12y ago

I'm not sure how you're going to get out real journalism about the events going on within your city from another country... Did you read the article?

jamornh 12y ago
I wonder if the safest way to do this is to have a friend outside of the country help run the social media and you, as the insider, provide the information and direct the friend from within the country/city instead.
VexXtreme 12y ago
I did, and it clearly says that other citizens were sending her information to post online. I don't know much about her situation, but presumably that wouldn't require her to be in the country. And even if that's not the case, using Tor and not linking your online vigilante identity to your real identity (e.g. by having your whistleblower twitter account linked to your personal phone) is a very basic precaution. I REALLY don't want to sound insensitive, but if people are going to use technology to fight people who wield the power of physical violence, they DO need to learn how to apply it properly.
- mkal_tsr 12y ago
  No, see, people call that "victim-blaming" and not "educating yourself about the risks by utilizing the global sum of all human knowledge". The only way people are going to be safe is if they're educated about the risks/rewards to using technology. Lately it's gotten very weird in that anyone that falls prey to predators and become victims could never ever possibly ever have made any possible mistakes/misteps, for they are the immaculate victim that must not ever have any responsibility for their actions. This flies completely contrary to precautionary measures and utilizing knowledge/education as a barrier to attack. The sooner society gets away from the "that's 'victim-blaming'" mentality and embraces education for all, the sooner everyone is better of for it. It's not saying, "yeah, they had this coming, this is their fault" but rather, "let's analyze the situation and provide mitigation for the future"
- PhasmaFelis 12y ago
  > I REALLY don't want to sound insensitive Then try to use less insensitive language. "It amazes me that people don't take these basic precautions" sounds an awful lot like "Look at this poor misguided savage, killed because she was too stupid to know what an Onion Router is." Maybe try something like "We need to educate whistleblowers about security technology to avoid tragedies like this."

danso 12y ago

I think you were downvoted because people suspected you of glossing over the subject at hand (for the record, I upvoted you). I would say that for some of these local journalists, you're correct in suspecting that their technical expertise isn't high...however, it's not easy to report on dangerous local conditions from outside that locality. For one thing, you've introduced another attack vector for a MITM attack -- between the local stringer and the international point-of-contact who then publishes the content. But the bigger problem is this: the people most passionate about this kind of local reporting, well, they're passionate about it because it is in their town or neighborhood. It's generally not feasible to be a long-time resident (the type who really gives a shit about the terror that's going on in the neighborhood) and then uproot so that you can do reporting safely. For one thing, you're just not as connected to the events once you've left the area.

VexXtreme 12y ago
That's a very good point. Perhaps being overseas is not an option. In that case, I guess the best she could do is use a disposable OS (Tails) and VPN at the time of posting sensitive information online, and never use her whistleblower identity/handle outside that very narrow context. Some newspapers (correct me if I'm wrong, I think it was NY Times) have even started running an .onion website where people can leave so called "dead drops".
- monochr 12y ago
  >VPN Are a terrible idea. You need to trust the operator that they won't screw you by keeping logs. Since these are centralized they are always at the whims of cartels and the like. Just stop and think for a second if you won't give everything you have to them if they took your children hostage as an extreme example. The only way to deal with a situation like the one in Mexico is to get the whole community to use something like Tor. The cartels already are so they can't kill all such connections, and if everyone uses it all the time then you can't target anyone for using it. The reporters are protected by the crowd they hide in. This is the same reason why tor isn't blocked in the first world. It gives all the alphabet soup agencies proper anonymity that doesn't raise red flags when used in other countries which might not be friendly.

coldtea 12y ago

>If you're going to whistleblow on your local government online (be that a legitimate government, or a violent drug cartel), the only reasonably safe way to do it is from outside the country AND using Tor. Unless, you know, the "outside country" is one participating in those surveillance schemes, like 5-eyes, and is in bed with your local goverment and not beyond sending a tip or two (or even supporting its own thugs acting on the ground in your country). More or less like it has been throughtout the 20th century in Latin America.

cynicalkane 12y ago

Tweeting outside the country is probably not an option, and it's unlikely defeating encryption is a sufficient safeguard against cartels that kidnap and torture people. Kidnapping, by the way, is how they allegedly found their target according to the article.

Kiro 12y ago

People downvote based on disagreement, just as they upvote based on agreement. https://news.ycombinator.com/item?id=117171 https://news.ycombinator.com/item?id=117171

vacri 12y ago

Because if a cartel member is looking for a whistleblower and sees that you use Tor, they're just going to respect your right to privacy and move along? Anyway, tor wouldn't have helped the woman in the article; she was found by them going through her local app.

shkkmo 12y ago

I agree. What this woman did was not "reasonably safe". This woman is a hero for the work she did for her community and because of the risks she took to do so. I find this level of bravery amazing as well. (Also upvoted you.)

PhasmaFelis 12y ago

I'm downvoting you because you're sitting in your safe, comfortable chair and smugly mocking a woman who knowingly risked death for the good of her people, because she didn't take the "basic precaution" of leaving the country she was trying to protect first.