Encryption for the working journalist: Communicating securely

The UK government published its draft investigatory powers bill on Wednesday, which gives police and security services new surveillance powers. The bill promoted some criticism from media lawyers highlighting how it could be used to spy on journalists and their source.

But it's not just UK-based journalists who should be aware of the tools and techniques they can use to protect themselves and their sources from surveillance, especially if they are working on investigative projects and speaking to whistle-blowers.

The following is an extract from Data journalism: Inside the global future, edited by Tom Felle, John Mair and Damian Radcliffe, published with permission. It forms part of a chapter on information security by Gabriel Keeble-Gagnère.

Beginning the journey towards encryption
                   
Journalists, not usually known for their computing skills, may be unsure how to go about familiarising themselves with the various techniques for encrypting their communications and data. This section, therefore, hopes to introduce a number of tools and concepts, together with resources for continued learning; hopefully, it can provide the basis for journalists to begin the journey.
                   
All the tools detailed below, unless stated otherwise, are open-source and freely available for Windows, Mac OS X and Linux operating systems. Given the high chance that Windows and Mac OS X are compromised, it is recommended to use Linux in situations where security is critical.

Naturally, as with all software, bugs and security problems are constantly being found (and hopefully fixed); it goes without saying that the latest (stable) version of all the following tools should always be used, and security warnings on the developers’ websites checked regularly.
                   
For critical applications, one should already be familiar with the tools in question to avoid potential errors that could compromise security. Most of the tools described below provide comprehensive guides that should be studied carefully.
                                 
A note on passwords
                   
Many of the encryption methods detailed below involve the use of a password. The importance of using good passwords cannot be overstated. This is true also for passwords linked to email and other online accounts, though one should take particular care in picking good passwords for encryption as this will determine its reliability.

For example, using a strong encryption method but with ‘abc’ as password is hardly better than using no encryption at all, at least in situations beyond the most trivial. A good password is one that is relatively long (more than 10 characters), involving upper- and lower-case characters, numbers, special characters such as # and *, and not using any words that can be obviously linked to you. As Snowden allegedly told Poitras in their initial exchange, ‘assume that your adversary is capable of a trillion guesses a second'.
                   
Communicating securely
                   
The most widespread tool for encryption of emails is PGP (Pretty Good Privacy), and its open source implementation GPG (GNU Privacy Guard). These tools use the encryption algorithm known as RSA, named after its creators Rivest, Shamir and Adelman.

This method relies on two keys: one, the public key, is usually shared online (for example, via a personal homepage or through key servers such as this one) and enables third parties to encrypt messages they wish to send; and the private key, without which the encrypted message cannot be decrypted and read.

Note that the sender of the encrypted message need not have ever met the recipient; however, they must at least trust that the public key (and associated email address) genuinely belongs to them.
                   
It is important to understand that the strength of RSA relies on a mathematical belief: that very large integers (with hundreds of digits) are difficult to factor (that is, reduce to its prime components).

While no known method exists to do this in any reasonable space of time, this does not preclude the possibility that one will be found in the future. Still, the Snowden leaks seem to have confirmed that the NSA has not yet been able to ‘crack’ the underlying mathematics of RSA.
                   
One important factor in the security of RSA is the key size used (measured in bits), which are generally powers of 2 greater than 1024. To be safe, a key size of 4096 bits or more is advised. Another consideration is the implementation of RSA being used.

A Swiss study found that an alarming number of public keys available on the internet shared common factors; the likely reason being sloppy implementations and small key sizes. Given their wide use and history, PGP and GPG can be assumed to be among the most reliable implementations at present.
                   
Another capability of RSA besides encryption is that of digitally signing emails and data (this involves using your private key to encrypt – then your public key can be used by anyone to decrypt it and check that the result is the same as the message in question).

Such a signature can be used by the recipient of data to confirm that the email has not been tampered with in transit. This is particularly important if an email account is hacked, as it can be used to prove that an account has been compromised.

Instant messenger
                   
For real-time communications, an account on the real-time messaging network Jabber, together with an open- source chat client such as Pidgin, allows encryption of messages using the OTR (‘off the record’) plugin. Documents indicate that the NSA is unable to decrypt OTR-encrypted chats.
                   
With both methods described above, communications are only safe once keys have been exchanged and verified via a different communication channel (voice- based is preferable as it is difficult to imitate), where the identity of the intended recipient can be confirmed.

This is to avoid so-called man-in-the-middle attacks, which may best be explained with an example. Say that Alice and Bob wish to communicate securely, and are presently in physically different locations.

If Alice emails Bob requesting his public key (in order to send him an encrypted email), Alice has no way of knowing if Bob’s email account has been hacked (by Eve, say) and an alternate public key (for which Eve owns the private key) sent in the reply instead.
                   
If Alice simply uses this key to send an encrypted email with sensitive information, Eve will be able to decrypt it. Hence the importance of verifying keys through another channel – in this case, Alice can simply call Bob and verify the key he emailed is, indeed, his own key.

Note that this channel need not be encrypted – in fact, even if Eve is listening in, unless she can change Bob’s voice in real-time in a way that convinces Alice, there is no problem (so long as this channel is only used to verify keys). In practice, it is not the key that is verified but its fingerprint, a much shorter string of characters that is used to identify the key itself.

Read part two here and find out how to encrypting files and anonymously browse the internet. 'Data journalism: Inside the global future' is available on Amazon.

Free daily newsletter

If you like our news and feature articles, you can sign up to receive our free daily (Mon-Fri) email newsletter (mobile friendly).