At protests you should not bring your smartphone but instead rely on anonymous drvices such as Meshtastic.
If you want to bring your smartphone to a protest, set Airplane mode and communicate with others through Bluetooth or WiFi networks using Briar or Bitchat
Bluetooth and WiFi can be tracked as well, even with “anonymized” WiFi MAC addresses.
Meshtastic with 3 jumps would be stretching for actual communication. Plus Bluetooth is even worse for security. Direct connection might be a better way to use the device.
I’ve had meshtastic for about 2 ish years now and its still being worked on.
What is unsafe about cell communication is that there is virtually no way to prevent being tracked. Bluetooth is not necessarily more secure but has several advantages:
- Its Mac address can be easily changed. With a fake Mac address it’s more difficult to track someone down, albeit it needs some “technical skills” (going in the developer settings)
- With these apps communication is encrypted by default unlike cell tower communication
- The range is limited. If police listens over Bluetooth they’ll be able to track less people down
This is exactly why I was railing against some of the earlier protests which featured politicians openly asking protestors to take out their phones and send texts to opt-in for fundraisers. Besides all the obvious bullshit, it put those protestors who didn’t know better at serious risk.
Thankfully, I haven’t seen too much of that at the protests I’ve been to recently, but this is a good reminder that we have to keep educating people to leave their phone at home.
When I go to a protest with friends/family we leave our phones at home and then use basic walkie talkies. It’s open channel, so no privacy, but the main goal is to just communicate basics like “I’m safe.” We predetermine a couple of locations to meet up at if things get rough and we’re separated.
Those circumstances include immediate threats to national security and situations where a person is in danger of death or serious injury.
Well I see a problem there. It doesn’t specify the cause of the danger or the reason the person is in danger in the first place.
I don’t understand why cell phones don’t authenticate the towers they connect to. Is this really just a “standards lag behind modern security” thing, or is it on purpose to allow these Stingray devices to be used?
I assume it’s the same as the Internet (or more specifically HTTP): It wasn’t designed with security in mind.
Unlike HTTP, for some reason it wasn’t included in a new specification, though. My guess is that’s because of the more centralized nature of cellular networks. The barrier for entry is a lot higher as well so there are few but big players who have little incentive to improve over the bare minimum.
IIRC encryption was initially proposed to be part of 5G but got shot down in the process.
I flashed a $10 orbic to take to local protests.
ELI5?
Cops use devices to pretend to be a celltower, so your phone connects to it, and then they use it to spy on you. Rayhunter looks for this behaviour and warns you if it detects a suspicious tower that behaves like cops pretending to be a tower.
What do you do if it comes up positive? Presumably if you know it’s a risk, you’d leave your phone in airplane mode or at home, and if you know it’s happening you’ve already been recorded?
At the moment, about all you can do is let others know and submit the log to EFF so they can better understand how these stingrays are being used.
Or I guess if you’re feeling froggy; look around for a van/trailer with suspicious antenna(s).
