> "And finally, keep in mind that after all this, Twitter can always kick you off for their own reasons."
The problem with
anonymous e-mail address +
burner phone +
always use TOR to access the account
is that this doesn't play out well in the medium term. This triggers various automatic "anti-abuse" measures on Twitters side. Those measures include: random prompt for re-verification of the phone number, which fails with the burner phone number used to create the account.
It's hard (if not impossible) to maintain such an account in the long run while protecting ones identity.
It is indeed hard to maintain Twitter accounts via Tor. Establishing accounts via Tor, using burner phones for verification, isn't hard. And there's no problem reading feeds via Tor. But tweeting via Tor, in my experience, is indeed a crap shoot. So is tweeting via commercial VPN services.
What seems to work is tweeting via private VPNs, running on anonymously-leased VPS. To route that VPN through Tor, you just run the VPN server (in TCP mode) on the VPS as an onion service.
But there's still the risk of cellphone re-verification. So for long-term accounts, you need a persistent number. One solution is to have trusted friends in other jurisdictions, who can activate the number for you when needed.
> One solution is to have trusted friends in other jurisdictions, who can activate the number for you when needed.
If you have a trusted friend in an independent jurisdiction, the whole complicated dance with burner phones and so on becomes unnecessary. Just have the trusted friend create the account for you and hand you the password.
Or you could keep creating new accounts with new phones, tweeting the next account as the last tweet of the previous one. You won't get an easy to digest single thread of tweets, but you can maintain a chain of trust, insofar as the accounts are trusted to begin with.
Almost all numbers from free "burner apps"[0] I came across are already burned for all major Social Networks (probably because someone else already used those numbers for registration).
I don't know if it works with paid services, but then you have the problem of paying for it anonymously.
[0] I guess you mean those services which offers some mobile numbers for receiving SMS to anyone without registering.
Virtual phone numbers are flagged as such and all of the major providers will refuse to use them for verification purposes. Social media companies already thought of this.
One of my Twitter accounts is a Friends Only twitter account that has only been used via twitter + bitlbee connected to the internet via a tor proxy, plus IRC client
> "which fails with the burner phone number used to create the account."
Maybe I expressed that a bit unclear: I didn't mean it fails because you have no longer access to the number (= you burned the burner). It fails because Twitter don't accept this same number which worked while sign-up anymore for re-verfification.
To be honest: I'm not sure if Twitter accepts any other number in that case or if the prompt for phone number re-verification is just an obscure way of saying "Your account is permanently locked for any reason."
It would be very irresponsible to recommend buying a burner phone to people trying to stay anonymous. At the very least, it would give away your location even if you somehow manage to remain unrecorded by street CCTVs in the vicinity of the shop at the time of purchase. Assuming it is even possible to buy one without providing full personal details, as is required by law in most of the EU.
Twitter now not only gives platform to powerful demagogues, it is also actively stifling dissent by effectively disallowing anonymity.
FWIW, in the UK you can buy a burner phone and SIM in cash without giving away any personal details at most supermarkets (at least Tesco and Sainsbury's). With the new EU regulations removing roaming charges, you can fly to London on holiday, and buy a UK burner phone anonymously with two years of data on it that's enough for heavy Twitter use in all of the EU for £240 + phone cost.
If you're under enough surveillance that your adversary will follow you on holiday and track all your supermarket purchases, you have bigger problems.
> If you're under enough surveillance that your adversary will follow you on holiday and track all your supermarket purchases, you have bigger problems.
Problem with modern surveillance is not that somebody is actively tracking you, it's the ability to retroactively track you back with perfect accuracy soon as you become become an inconvenience.
Sure, for digital surveillance I get this concern. But when we're talking about identifying that "on holiday, subject X spent some of that cash he withdrew on a burner phone at a random supermarket he visited, not just on ice cream and beer", then you really need significant HUMINT resources.
In the context of maintaining digital anonymity against a state-level adversary, I think that considering retroactive unmasking as part of the threat landscape is quite reasonable.
The situation one is trying to avoid is:
- Tyrant in power
- You try to be anonymous
- You fail, because you didn't take enough steps to protect your tracks (when buying the phone, leasing the VPS, accessing the VPS, etc) from retroactive investigation
- You are now fired / jailed
Surveillance is ubiquitous enough that I suspect anonymity is nearly binary in nature.
>Security cameras will probably record your face at the store. Most stores delete old footage on a regular basis, overwriting it with new footage. If possible, wait a week or two before you start tweeting so that the footage is already deleted by the time anyone tries to figure out your real identity.
This addresses shop cameras, not street-level government surveillance that would be accessible for 10+ years and is trivially addressable by the time and location of the transaction.
Probably, but doing it correctly would require a whole different type of opsec expertise that should not realistically be expected from someone who is getting their security tips from The Intercept.
Just a hunch, but I would guess that a poor disguise would be more suspicious than no disguise. If I was a shopkeeper and government agents came to me asking if I remembered anyone suspicious in the past month, I'd probably recall the guy with the obviously fake mustache and prosthetics.
On the other hand, an effective disguise can be trivial: enter a store dressed a certain way, make purchase, exit dressed significantly different. Reversible jacket, headgear swap and glasses can go a long way, in a crowd under low-res cameras.
This is the solution, right? You get someone else to buy the phone for you. This necessarily will practically speaking be probably be someone who knows you, but it adds a layer of indirection.
The unregulated pharmaceuticals distribution market relies on burner phones and seems pretty solid despite effectively continuous attempts to conduct surveillance on them.
Perhaps not something insanely obvious like Grouch Marx moustache and glasses, but more subtle? I'm not really very well aware of how advanced face recognition, etc. is at this point in time though. But I'd guess anyone who cares enough about opsec to go through this process might also be decent at passable disguise techniques.
you can always hire someone down-and-out or someone that doesn't take part in the normal economy to buy the phone for you, though of course there are risks with that too
Thanks for the suggestion, we'll add a pricing page that doesn't require logging in. The "starting price" is just the price of our cheapest numbers (pricing varies by country). We maybe should think of a less scammy-sounding way to describe that.
Probably the way you just described it would work, "pricing varies by country, starting at ___". This is a service I have been looking for, but I don't like the idea that I need to buy into one or another of the internet-money fads. Do you foresee offering this service for regular money? If not, do you know anyone who might?
Anveo sells SMS capable numbers in a variety of countries. You have to pay for a month, but they are cheap. There are other VoIP providers as well. Two things to watch for though, not all sell SMS capable numbers, and some services check that the verification number is an actual mobile number...versus a VoIP number that can do SMS.
At the moment, we only plan to offer Bitcoin and Monero payment. There's a lot of other improvements I'd like to spend time on first before getting into fiat currency payment.
What does all those letters I see mean? I see only flags of France, Germany and the UK. Maybe it has to do something with fonts installed on my computer.
The Unicode symbols for flags consist of a special set of combining country-code letters that when used in two-character combinations compose into flags. That solution ensures that the Unicode standard doesn't hard-code the existing list of countries and country codes. In addition to future-proofing, that also avoids dealing with disputed regions that not everyone recognizes as countries.
When I imagine, in my head, "hmm, how can I present a string of 20 x 2 chars, what is the best way I can confuse the reader?" this is the exact solution I come up with, also.
It's on the roadmap, but we need to integrate with another provider to support them. Most major communications services that verify your number don't mind which country it's from, but we realise there are good use cases for having a number from a specific country.
No, we don't offer free trials, as they would be abused. However, you can just rent a number and cancel it immediately if it doesn't work for you -- we charge the rental by the minute so you would only spend a very small amount of money in the case that it didn't work for you.
Sure! At the moment we integrate with the Twilio API for our numbers, although we have a few more providers on the way. We don't offer all countries that Twilio does because we test the numbers out to make sure they work with most services before whitelisting a country to appear on our service. Our software is written in Rust and uses the Iron framework for the webapp. PostgreSQL keeps the records. nginx sits in front.
It depends on the country the number belongs to, and sometimes on the specific number, but we only list countries where we've tested a few numbers from that country and found they work with most services. We can't guarantee anything about which services will or won't accept our numbers, but we only bill by the minute so it's very cheap to try it out and cancel after a minute or two if it doesn't work out.
The twitter accounts are presumably run by people who are employed by agencies funded by the US government. They could lose their jobs or have funding problems because of this.
I think a more fair comparison would be to when scientists were gagged in Canada, under the Prime Minister Harper era.
It's meant to instruct hypothetical government employees working for agencies that were silenced, and wish to continue their public outreach, educating the public on issues that the current administration might disagree with.
It has an audience bigger than that (who will not likely need to go to such lengths to publicly voice dissent), but it's fairly clear about its intent.
Ah, okay. Too bad there's not some simple way to also prove it is associated with a muzzled govt employee. These accounts could be somewhat muzzled themselves by creating lots of fake dissenters tweeting inaccurate info.
It's actually quite hard to write meaningful tweets that could fool someone with a bit of knowledge of the organisation, such as a journalist who has had it in his portfolio for a while.
Plus, a journalist would have the contacts to verify the information. Traditionally, the government doesn't lie to American journalists – they may decline to comment, or give you a convoluted answer that doesn't actually answer your question. But they wouldn't lie. Considering these organisations are supposedly full of people sharing the leaker's point of view, it shouldn't be difficult to get confirmation at least off-the-record.
Of course all that requires a certain amount of trust in the media.
Example: the was a State Department "dissent memo" against Obama's unwillingness to bomb/send ground troupes to Syria. Result: they got an answer (basically "this decision is hard, we share your concerns, but ultimately decided against a new war...") and that was it.
Same situation now: Spicer: "If you don't agree with us, you should quit. Diplomats should either get with the program or they can go.”
You need to turn off the phone and take out the battery every time you use the burner phone. They will be tracking the cell towers that you use, so going back and forth to the same cell towers means they can figure out pretty closely where you work and live.
Well it's another security/anonymity guide for beginners. ("An IP address is a set of numbers that identifies a computer...")
I'm always torn on these... like is a little info better than none, or worse than none? Example: "Tor is better than a VPN." Sure, except when the exit node is compromised, and the VPN service is a "no log" service. (Granted you would have to verify or trust any such claim.)
I may regret commenting in my real name, but I still have a vestige of belief in open opposition. For now, though, I cannot enter the US without giving my Facebook password. I have no doubts that as the new government settles in, it will up the ante on everything which could be construed as active opposition. This IS a fascist regime. It just hasn’t gotten hold of its true tools yet.
Canada went through this a few years ago with a conservative government.
It wasn't that scientists were not allowed to communicate with the public, it was that they had to work through the PR department. The PR arm of the institutions would delay, filter, and even edit publications that touched on sensitive areas (eg. Anything remotely connected to climate change--like even fisheries related data).
Fortunately, Canada came through this period. But we did see the closure of research stations and destruction of scientific data.
So, to answer your question, many legal steps can be taken to stop, slow, of even eliminate scientific communication.
Yes it is legal for the head of the executive branch to set rules on how his underlings are allowed to communicate (except as otherwise prescribed by federal law).
None of these acts will amount to treason. That's because treason is rather strictly defined: not just in terms of the actions required (start a war against the US or aid&give comfort to the enemy). It also requires the specific motivation of "adhering to the enemy".
Even the actions of Edward Snowden fall far short of this requirement. You could publish the IP address and password[0] for that Windows 95 box running the nuclear launch infrastructure without committing treason, as long as you can make a reasonable case that you did it for any other reason than to help a current "enemy" of the US. "Enemy" was probably meant as the opposing party in an actual war originally, but Russia/China/IS should probably do.
This is cool, and stuff, but what does it accomplish to have just a Twitter account? The hard part, I think, is protecting key datasets. Which now means leaking them. That takes some real OpSec.
> As soon as you power on your burner phone, it will connect to cell phone towers, and the phone company will know your location. So, don’t activate your phone, or keep it powered on at all, at your home or office — instead, go to a public place, like a coffee shop, before activating your new phone. Keep it powered off while you’re not using it.
Actually, don't go to a coffee-shop, either. They might have security cameras that can record you, that police can use to find out who you are.
Go into the park or forest, or any place without security cameras when using your burner phone.
And don't carry another phone while you're doing this. Or, if you do, turn the power off.
(If turning the power off isn't enough to protect you, then you're probably in that group of people for whom none of these measures will wholly suffice.)
> Remember all the people who got disappeared right after the election because they tweeted at Trump with their real name Twitter account?
You're comparing apples and oranges here. If you work in government (and I'm in no way convinced most of these rogue accounts actually do), then the Trump administration can absolutely "disappear" your job if they trace the account back to you.
The dangers of using a real name account are very different for private citizens than they are for government employees. This is in no way specific to Trump.
It is illegal for many government employees to express many political views in writing or in public (under certain circumstances), and those laws have been in place for some time. I believe that the stated intent of those laws are to ensure public and political confidence that the bureaucracy will enact the law in a non-partisan way. Whether the laws were a good idea or not, I cannot say, but it seems like government employees should either comply with their legal obligations, campaign for the law to be changed, or quit.
Well, presenting evidence for human-caused climate change is arguably not a political act, except to the extent that the current administration has defined it as such. US civil servants with sufficient tenure won't lose their jobs over that. Consider James Hansen's experience during the Reagan administration. But others, with less support, found themselves transferred to boring, dead-end positions.
Every administration draws the line as it likes. But some staff, I've worked with through five administrations. Sometimes, they could talk freely. Other times, it was more like Deep Throat ;)
There also seem to be 'Trump-resistant' factions in various other agencies, notably including the intelligence community, and possibly including the Departments of Education and Health and Human Services.
The First Amendment protections afforded to government employees are more limited than those possessed by the average citizen. The latest SCOTUS case on this (which I am aware of) is Lane v. Franks.[1]
Sure. If anything that makes the OPs point even more ridiculous - "remember the non-Uber employees being fired when they criticized Uber's CEO on their named social media accounts?"
While the example content of the article was slightly irreverent I think the bigger point is that there are people such as government workers and contractors, family members of them, etc, who want to talk about sensitive issues anonymously. No one has to disappear to CIA black sites for people to feel threatened, merely the threat of loosing your job is enough to silence many.
Those are political appointees, not civil servants. The former serve at the pleasure of the President. The latter are professionals. Granted, part of the implicit bargain for the latter's relative untouchability is their apoliticality.
> Granted, part of the implicit bargain for the latter's relative untouchability is their apoliticality.
Apoliticality and silence are two different things.
See: the longstanding bargain struck at the EPA that "scientists can do science" but "only administrators make policy decisions"
Which, seen in best light, means that policy decisions sometimes need to be made against scientific advice, due to other priorities. In worst light (and more true), so that administrators can push whatever agenda they want regardless of scientific consensus.
Our government's relationship with actual facts has always been at the whim of politics. Trump's just making it worse instead of better.
How about taking all these steps so you can publicly air an informed opinion about your field of expertise without getting fired for it by a president whose catchphrase is literally "you're fired"?
At an individual scientist out of hundreds of thousands because he posted a chart or graph about climate change? It seems unlikely that Trump would even be aware of it, much less act.
That said do you think Obama endeavored to keep around many statisticians and sociologists whom did polls like the Pew study that proved that 12% of US Muslims believe that suicide bombing of civilian "enemies of Islam" can be justified[0]? Politicians fund research that benefits their agenda obviously.
I wonder what percentage of Americans would say that "drone strikes in other countries against civilians suspected of being enemies of America can be justified"?
I guess it was just Obama's luck that science tended to agree with his views. What a coincidence!
The difference is quite apparent, though:
[Obama Era]: "[...] established scientific integrity standards and previous media guidance “encouraging, but not requiring, USDA scientists to communicate with the media about their scientific findings.”
[Trump memo]: “Starting immediately and until further notice, ARS will not release any public-facing documents. This includes, but is not limited to, news releases, photos, fact sheets, news feeds, and social media content,”
That latter memo was amended/rescinded/watered down a day later after it got to the media. But it probably shows quite clearly what the thinking in the WH is.
> Politicians fund research that benefits their agenda obviously.
That is not obvious, and it is largely wrong. It's the sort of negative stereotype of politicians that got us into this mess.
Most federally funded scientific research is funded through the National Science Foundation. It evaluates grant applications as follows:
"Reviews are carried out by ad hoc reviewers and panels of independent scientists, engineers, and educators who are experts in the relevant fields of study, and who are selected by the NSF with particular attention to avoiding conflicts of interest. For example, reviewers cannot work at the NSF itself, nor for the institution that employs the proposing researchers. All proposal evaluations are confidential: the proposing researchers may see them, but they do not see the names of the reviewers" (https://en.wikipedia.org/wiki/National_Science_Foundation#Gr...)
Then, there are directly-funded institutions, mostly in defence-related subjects. Examples are DARPA, the Jet Propulsion Laboratory, NASA, Lawrence Livermore etc. 99% of what these institutions do is not "Study: what is worse? Handguns or Muslims?". Instead, it's basic research, the overwhelming majority of which is neither liberal nor conservative. In any case, there are 10 layers of admin between a scientist and the White House, all filled with career scientists who would resist attempts of undue influence and some of which have the phone number of their Congressman or some guy at the Wall Street Journal.
The US executive is also not a single monolithic hierarchy. Witness the episode where the acting Attorney General refused to instruct her lawyers to defend the "muslim ban": the president does not actually have the authority to overrule her. He is required to fire her, and keep firing until he gets an AG who complies.
That may seem like a roundabout way to get to the same result. But in practice, it makes it almost impossible to directly tell the scientists in the trenches what to do. You'd need to to fire everyone in the chain of command, and keep doing so until they all happen to agree with you. And only the very top of these institutions are appointed by the WH.
Research institutions are usually also organised as public-private partnerships with a structure much more independent than the Justice Department outlined above. Here's Lawrence Livermore's:
"The LLNL Director reports to the Lawrence Livermore National Security, LLC (LLNS) Board of Governors, a group of key scientific, academic, national security and business leaders from the LLNS partner companies that jointly own and control LLNS. The LLNS Board of Governors has a total of 16 positions, with six of these Governors constituting an Executive Committee. All decisions of the Board are made by the Governors on the Executive Committee. The other Governors are advisory to the Executive Committee and do not have voting rights.
The University of California is entitled to appoint three Governors to the Executive Committee, including the Chair. Bechtel is also entitled to appoint three Governors to the Executive Committee, including the Vice Chair. One of the Bechtel Governors must be a representative of Babcock & Wilcox (B&W) or the Washington Division of URS Corporation (URS), who is nominated jointly by B&W and URS each year, and who must be approved and appointed by Bechtel. The Executive Committee has a seventh Governor who is appointed by Battelle; they are non-voting and advisory to the Executive Committee. The remaining Board positions are known as Independent Governors (also referred to as Outside Governors), and are selected from among individuals, preferably of national stature, and can not be employees or officers of the partner companies."
I half agree with you -- I think Trump absolutely would act on it if it became a popular social media post... just like other presidents have.
So I think these steps are useful, but not "because Trump". Rather, "because presidents".
(Also, not sure why you're being downvoted. HN has taken to suppressing political views that are valid viewpoints, but one group or another doesn't agree with. If we're going to talk politics, we should actually talk about it -- not shut down views we don't like.)
I'd be interested to see what you would do had you been in such a position. Getting fired from a government position is a bigger deal than you think, especially if you have a family to support.
I am not discounting it. But it is an equation: The questionable benefit of learning e.g. some publicly available datapoint pales in comparison to the damage to our nation. This isn't some banana republic. Why do you accept that it is? This isn't Turkey, thank God.
Executive is doing something illegal? Take them to court!
Why get fired? Why not send it to wikileaks? Why not pick up the phone and contact NYTimes? Heck, there are legions of representatives in congress and senate who would love to talk to you and give you immunity to boot!
These people -- /whoever they are/ -- are creating the perception of alternative governmental outlets. No one who cares about this nation would do that.
Lots of companies have anti-Tweet policies. Enforcing such policy at these companies is not usually called "retaliation". It's just called HR doing its job.
I'm not comparing anything, merely reacting against any attempts to trivialize the very real need for a platform for anonymous dissent.
From the lives of the people involved to the stability of the democratic institutions themselves, those are very real and very high stakes. It would be extremely disingenuous and insulting to pretend that the intent of the article was to anonymously tweet "trump is a poop".
The "stability of democratic institutions" are under attack when anonymous entities fan hysteria by disseminating information in the guise of "Rogue Gov" agencies, institutions, etc. That is not dissent.
Actual, factual, courageous, whistle blowing and dirty laundry airing:
Even if I were to accept the official Watergate story (which I do not considering that the star reporter was Naval Intelligence just 2 years prior to his 'big break') "Deep Throat" was not running an alternative information outlet in public.
Accepting this makes it trivial for non-governmental elements, or foreign governments, to put up e.g. @AltStateDepartment for every single governmental org. That is not going to promote "stability" of our system. In fact, this is precisely what I would do if I wanted to entirely demoralize Jane/Joe public and undermine /the public and democractic state/.
It seems everything from the left has to have this faux "resistance" air to it. The truth is they are pushing the same narratives that the FBI, CIA, NSA, numerous billionaires, the majority of the media and the majority of the voting electorate push. Conservatism is the counter-culture movement now. It's like the left grew up and decided to become "the man" that they had railed against in my youth.
The key word is counter-culture. The GOP may have the majority in federal government seats, but the majority of mainstream American media, and the overall position of the Overton window in general, is left of center at the moment. The cultural aspects of politics change slowly over time, and not overnight with a vote, as the status of the formal offices do.
I guess it depends on what you think center is. I think the general culture, including mainstream media, is currently swung right of center.
For example, the Affordable Care Act was essentially a copy of a plan originally put forth by Republicans, but now conservatives oppose it as some type of radical leftist socialism. The EPA was created by a Republican administration. Reagan granted amnesty to millions of undocumented immigrants. The Republican party has moved to the right and dragged the culture with it.
I know it's easier to solicit donations and energize the base by pretending you're in some counter-culture fight against those powerful elites, but that is not the truth I see.
Each side in this conflict has allies among members of the intelligence community, a billionaire or two, and powerful media outlets. Only one side in addition has control (imminently) of all three branches of the government and control over state legislatures where a majority of Americans live. It seems that disparity would tip the scales of which side is the 'resistance'?
Anyway not much is resolved by figuring out which side is a resistance, trying to resolve it definitively is like resolving a kaleidoscope, which in turn makes one susceptible to superficial narratives or whims. Even iron-fisted Stalin could say he was really the underdog against global capitalism; nothing was gained by those who believed him. Much better to insist on interpreting who's in the right based on accuracy, principles, and consequences.
They've lost Congress and the oval office and soon they will lose more Supreme Court seats. The only power they have left is obstuctionism though media, liberal judges a la 9th circuit, and Obama loyalists held over from the last administration. Will be interesting to see how the 2018 midterm elections go.
The right did a very deft Judo move, made themselves the oppressed, the dis-enfranchised and then mimed all of the lefts rhetorical technique right back it. The left is now the counter revolutionary that right wants to purge. The human race is insane.
The problem with
anonymous e-mail address + burner phone + always use TOR to access the account
is that this doesn't play out well in the medium term. This triggers various automatic "anti-abuse" measures on Twitters side. Those measures include: random prompt for re-verification of the phone number, which fails with the burner phone number used to create the account.
It's hard (if not impossible) to maintain such an account in the long run while protecting ones identity.