Quick thread with some real talk re: phone hacking etc. The reality is that Pegasus is just the one that got caught. It's pretty sophisticated, but it's not the only hacking tool/cyber weapon out there. The US, several European countries, China, Iran, etc all have their own
The reality is that if a state actor wants to get into your devices - *yours* specifically - and they're willing to spend enough time and resources, it's likely that they'll get in eventually. It's not inevitable, and you shouldn't be cynical about your security, but this is fact
You can make it harder, you can make it brief, you can make the info they steal less intelligible or less useful. But eventually you have to contend with the possibility that they'll get in one way or another. Which is why we have to talk about *what* they're trying to get on you
Getting into your phone is only half the story. Once they're in, what are they gonna do? They could live-surveil you, which is bad enough - but this is normally reserved to the highest-value targets. Most likely they'll download enormous amounts of data from your device
I mean of course the most dangerous kind of hacking is when they're surveilling you in order to physically harm you. Some people are in that very unenviable position. But luckily very few people are. I was in that position but thankfully I'm under protection in Norway.
But for most people - 99% of people out there - they're not trying to kill or capture or assault you. They're trying to get into your devices in order to get information - conversations, contacts, chat logs, files, pictures, documentas, etc. That's basically several GB's of data.
Which is where they'll face this problem - who's gonna make sense of all the gigabytes of data? If they know specifically what they're looking for, that's one thing. But if they just want to get in and look around, they need *good analysts*. Not all intel services have those.
All of this is to say - it's not enough to try to prevent the hack. It's necessary but not sufficient. You must figure what info is most damaging or sensitive to you and what info your adversaries are most likely to look for. Then make that info hard to find, understand, and use
You know your own work, your own plans, your own connections, your own projects. You also know your own vulnerabilities and what is most likely to hurt you. You also know your adversaries and what they care about. Create a plan that works for you. Create contingency plans too.
Make a list of the top ten most damaging pieces of info they can get on you, how to protect them, and what to do if they leak. Make a list of your adversaries and what they're most likely to be looking to get on you, how to protect that info, and what to do in case they get it
For highly sensitive stuff, your most trusty friends are a paper notepad and a non-smart phone. It's kinda nuts but to defend against high tech cyber weapons, sometimes the best thing to do is to go low-tech/no-tech. Working on something sensitive? Use a paper pad and a landline.
All of this shouldn't *replace* good digital hygiene and a common sense plan to try and prevent the hack (or make it more difficult, or make it brief, or make it more likely to discover). I'm just saying, also think *what if they get in*. That should be part of your plans too.
Final note - journalists and activists living in safe countries, please *protect your sources who do not*. A major target for dictators when they hack our phones is to figure out who our sources are and who they can arrest. Spend enough time figuring out safe communications.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
