Advocacy

FAILfaire Returns to New York on December 14th!

Posted by MarkWeingarten on Oct 28, 2011

The fourth FAILfaire, this time in New York City on December 14th, will be an evening dedicated to those tech and mobile projects that were designed to have a social impact but instead crashed, burned, and FAILED. FAILfaire NYC is presented by MobileActive.org and hosted by the U.S. Fund for UNICEF, with participation from UNICEF's Innovation Unit.

If you do not know about Failfaire, here is some background: Launched in early 2010, there have now been three FAILfaires, events designed to provide a platform for those working in online and mobile technology for social change to openly, honestly (and humorously) discuss our own failures.

As noted in the New York Times’ piece on FAILfaire, “Technology’s potential to bring about social good is widely extolled, but its failures, until now, have rarely been discussed by nonprofits who deploy it.” Well, FAILfaire is changing that, and is doing so in style. The format is informal, the discussions are rich, and the refreshments are adult and, well, refreshing.

Slate.com wrote that FailFaire “...[isn’t] about celebrating failure just for the sake of failure, but about taking lessons from each mistake and using them to create more efficient, economical, and accessible projects that could have a greater effect on a community.” We couldn’t agree more!

To join us, please RSVP here, as the event will fill up quickly.

If you like to be considered as a presenter for the next FAILfaire, go to failfaire.org and submit a note about your failed project and what we can learn from it.

Gibberbot

Posted by ccarlon on Oct 14, 2011
Gibberbot data sheet 1879 Views
Organization that developed the Tool: 
Main Contact: 
info@guardianproject
Problem or Need: 

Gibberbot is designed for people who need to chat securely. If you and the person you are communicating with are both able to use it, secure chat can be used as a replacement for email and text messaging.

Gibberbot should work on any Android phone. It’s probably best for users who are reasonably comfortable chatting and handling their phone, and it’s only currently available in English.

Main Contact Email : 
Brief Description: 

Gibberbot is an instant messaging app for Android phones, developed by The Guardian Project. Gibberbot implements off-the-record messaging (OTR). Off-the-record messaging is a way to conduct an instant messaging conversation with the following attributes

  • Encryption. An eavesdropper cannot read your messages
  • Authentication. You can verify the identity of the person you’re chatting to - or at least of the account they are using.
  • Deniability. It is not possible for a third party to prove that a particular user sent or received a particular message.
  • Perfect forward secrecy. It is not possible for an attacker to decrypt a previous conversation, even if he/she obtains the encryption keys used to encrypt it.

Gibberbot can also use Orbot to route your chats over the Tor network. This prevents an observer from following the source and destination of your messages (effectively, from knowing you are chatting) and provides a way to circumvent web censorship that may involve chat servers being blocked.

Off-the-record messaging only works when both parties in the conversation are using it. This means both parties need to use Gibberbot, another mobile app, or chat software that supports it. Currently Gibberbot is the only option we know of for mobile phones. Off-the-record plugins are available for several PC chat programs, including Pidgin (Windows and Linux), Adium (Mac), Trillian (Windows) and Miranda (Windows).

Tool Category: 
App resides and runs on a mobile phone
App resides and runs on a server
Key Features : 
  • When used with Orbot, Gibberbot combines the security, privacy and anonymity provisions of off-the-record messaging with the additional anonymous browsing and circumvention protection of the Tor network.
  • Gibberbot is currently the only implementation of off-the-record messaging for mobile phones that we are aware of.
  • The code for Gibberbot is open source and freely available for download - there are no costs involved except your airtime while chatting.
  • The project encourages user feedback through a mailing list, feedback form on their website, twitter account and IRC channel.
Main Services: 
Other
Tool Maturity: 
Currently deployed
Platforms: 
Android
Program/Code Language: 
Java/Android
Is the Tool's Code Available?: 
Yes
Is an API available to interface with your tool?: 
Yes
Global Regions: 
Featured?: 
No

SaferMobile: Mobile Email Security, Data Protection, and Anonymous Browsing Guides

Posted by ccarlon on Oct 14, 2011

For many, mobile devices are an indispensable tool for storing and sharing increasingly sensitive information. Contacts, emails, and mobile browsing history can easily be compromised without taking the proper measures to ensure that that information is safely in the right hands... and out of the wrong ones. Newly added to our mDirectory are the following how-to guides on securing mobile email, mobile anonymity, backups, and data deletion from our SaferMobile team: 

  • Securing Your Mobile Email - This guide catalogs the different tactics you can take to keep mobile email safe. It covers email security basics, TLS/SSL enabling, and email encryption. The guide also provides customized tactics and suggestions for Android, Blackberry, iPhone, and Nokia/Symbian phones.
  • Mobile Tools for Backups, Data Deletion and Remote Wipe - Anyone who has ever had their phone stolen knows how frustrating and potentially dangerous that can be. Here we have a comprehensive review of some of the tools out there for data backup and restore, data deletion, and remote wipe.

For all other materials produced by the SaferMobile team, check out this complete list (and watch for a new SaferMobile site soon!)

Mobile Tools for Backups, Data Deletion and Remote Wipe

Posted by MelissaLoudon on Oct 14, 2011
Mobile Tools for Backups, Data Deletion and Remote Wipe data sheet 4112 Views
Author: 
SaferMobile
Abstract: 

Anyone who has had a phone stolen knows the frustration of trying to rebuild your contact list, not to mention data on the phone that is unrecoverable. Worse, the data stored on your phone can be dangerous in the wrong hands. In addition to being able to impersonate you to your mobile contacts, consider the risk of an attacker who has access to some of all of the following:

  • Your saved contacts - names, phone numbers, perhaps also email addresses and physical addresses
  • Call logs - calls made and received
  • Stored text messages
  • A calendar with your appointments, or a task list
  • Your mobile email
  • Your web browser with stored passwords
  • Photos, video and sound recordings stored on the phone and memory card
  • Data stored by applications - notes, social networking contacts and posts

Three kinds of tools can lessen the pain of losing your mobile data, and limit your risk should your phone be lost or stolen.

  • Backup and restore tools allow you to save a backup of contacts and other data stored on your phone
  • Data deletion tools can be used to ‘clean’ a phone completely before disposing of it, giving it away or travelling to a location where you are worried it could be stolen or confiscated
  • Remote wipe tools are set up so that if your phone is lost or stolen, you are able to clean it remotely, deleting sensitive data. Many remote wipe tools also allow you to track the phone provided it has not been turned off.

Anyone who has had a phone stolen knows the frustration of trying to rebuild your contacts list, not to mention data on the phone that is unrecoverable. Worse, the data stored on your phone can be dangerous in the wrong hands. In addition to being able to impersonate you to your mobile contacts, consider the risk of an attacker who has access to some of all of the following:

  • Your saved contacts - names, phone numbers, perhaps also email addresses and physical addresses
  • Call logs - calls made and received
  • Stored text messages
  • A calendar with your appointments, or a task list
  • Your mobile email
  • Your web browser with stored passwords
  • Photos, video and sound recordings stored on the phone and memory card
  • Data stored by applications - notes, social networking contacts and posts

Three kinds of tools can lessen the pain of losing your mobile data, and limit your risk should your phone be lost or stolen.


Securing your Mobile Email

Posted by MelissaLoudon on Oct 14, 2011
Securing your Mobile Email data sheet 4342 Views
Author: 
SaferMobile
Abstract: 

Email wasn’t designed with security in mind. Unless you take steps to protect your communication, emails are sent in plain text - and so are your email account username and password.

At the same time, if you and your recipient are taking the appropriate security precautions, mobile email can be a secure and reliable alternative to other forms of mobile communication. If you have data service for your mobile, encrypted email can replace text messaging, and if you aren’t able to access a website securely to upload content - photos or videos for example - getting it to a trusted contact as an email attachment can be a safer alternative.

Email wasn’t designed with security in mind. Unless you take steps to protect your communication, emails are sent in plain text - and so are your email account username and password.

At the same time, if you and your recipient are taking the appropriate security precautions, mobile email can be a secure and reliable alternative to other forms of mobile communication. If you have data service for your mobile, encrypted email can replace text messaging, and if you aren’t able to access a website securely to upload content - photos or videos for example - getting it to a trusted contact as an email attachment can be a safer alternative.

This article suggests the following tactics for improving the security of your mobile email:

Email security basics

Even if you’re not using encrypted email, you can take some basic precautions to improve your email security. For example


Mobile Anonymity and Censorship Circumvention: How to Browse the Web Anonymously On Your Phone

Posted by MelissaLoudon on Oct 13, 2011
Mobile Anonymity and Censorship Circumvention: How to Browse the Web Anonymously On Your Phone data sheet 7832 Views
Author: 
MelissaLoudon
Abstract: 

If you don’t want someone to know that you were accessing a particular web site (or that you were accessing it at a particular time, such as when inflammatory content was posted), you need to anonymize your mobile browsing. Depending on how your network is set up, the site you are accessing may be able to see and keep a record of your IP address. Your network administrator, Internet Service Provider and/or Mobile Network Operator can see and keep records of the IP addresses of both your Internet-connected mobile device and the sites you are accessing. IP addresses can nearly always be linked to a geographic location, whether a zip code or a city, and your ISP or mobile network provider can link your IP to your individual device.

The first part of this article - Using HTTPS for Secure Mobile Browsing - describes how mobile browsing over HTTPS provides:

  • encryption for you data during transmission
  • verification of the identity of the remote site

However, using HTTPS does not hide your identity. If you don’t want someone to know that you were accessing a particular  web site (or that you were accessing it at a particular time, such as when inflammatory content was posted), you need to anonymize your mobile browsing. Depending on how your network is set up, the site you are accessing may be able to see and keep a record of your IP address. Your network administrator, Internet Service Provider and/or Mobile Network Operator can see and keep records of the IP addresses of both your Internet-connected mobile device and the site you are accessing. IP addresses can nearly always be linked to a geographic location, whether a zip code or a city, and your ISP or mobile network provider can link your IP to your individual device.

Organisations and countries that block websites can do so by blocking communication to and from specific IP addresses. For this reason, anonymizing your browsing is also the first step to circumventing Internet censorship.

This article describes two tactics for anonymous browsing and censorship circumvention - using a proxy, and using a mobile version of the circumvention tool Tor. Both are used on cpmputers as well as mobile devices. Specific tools for mobile phones are described in the second part of the article.

Mobile Tools: 

A User Guide to Orbot - Anonymized Tor Browsing on Your Mobile Phone

Posted by MelissaLoudon on Oct 13, 2011
A User Guide to Orbot - Anonymized Tor Browsing on Your Mobile Phone data sheet 8987 Views
Author: 
SaferMobile
Abstract: 

Orbot is an anonymizing and circumvention app that connects Android phones to the Tor network. Developed by The Guardian Project, it is currently the only way to use Tor on a mobile phone.

Orbot is for Android users who need to browse anonymously or circumvent blocked sites. It should work on both older and new model Android phones, and does not require a rooted phone (although there are some advantages to using it with one). Orbot is designed for proficient Android users.

Orbot is an anonymizing and circumvention app that connects Android phones to the Tor network. Developed by The Guardian Project, it is currently the only way to use Tor on a mobile phone.

Who should use it?

Orbot is for Android users who need to browse anonymously or circumvent blocked sites. It should work on both older and new model Android phones, and does not require a rooted phone (although there are some advantages to using it with one). Orbot is designed for proficient Android users.

How does it work?

Orbot sets up a connection to the Tor network and makes it available to apps through a local proxy.


Secure Chat on Android: Gibberbot, a User Guide

Posted by MelissaLoudon on Oct 13, 2011
Secure Chat on Android: Gibberbot, a User Guide data sheet 4865 Views
Author: 
SaferMobile
Abstract: 

Gibberbot is an instant messaging app for Android phones. Gibberbot implements off-the-record messaging (OTR), a way to conduct an instant messaging conversation with encryption, authentification, deniability, and forward secrecy.

Gibberbot is an instant messaging app for Android phones, developed by The Guardian Project. Gibberbot implements off-the-record messaging (OTR). Off-the-record messaging is a way to conduct an instant messaging conversation with the following attributes

  • Encryption. An eavesdropper cannot read your messages
  • Authentication. You can verify the identity of the person you’re chatting to - or at least of the account they are using.
  • Deniability. It is not possible for a third party to prove that a particular user sent or received a particular message.
  • Perfect forward secrecy. It is not possible for an attacker to decrypt a previous conversation, even if he/she obtains the encryption keys used to encrypt it.

Gibberbot can also use Orbot to route your chats over the Tor network. This prevents an observer from following the source and destination of your messages (effectively, from knowing you are chatting) and provides a way to circumvent web censorship that may involve chat servers being blocked.

Off-the-record messaging only works when both parties in the conversation are using it. This means both parties need to use Gibberbot, another mobile app, or chat software that supports it. Currently Gibberbot is the only option we know of for mobile phones. Off-the-record plugins are available for several PC chat programs, including Pidgin (Windows and Linux), Adium (Mac), Trillian (Windows) and Miranda (Windows).


SMS in Action: Mapping Out SMS Systems for Social Impact

Posted by ccarlon on Sep 30, 2011

SMS in Action is an interactive crowdmap that allows users to submit and search for SMS-based systems that aim (or claim) to have a social impact.  The map can be filtered by categories including Agriculture, Health, Emergency/Disaster Services, Banking, Economic Development, Information and Media, Education, and Governance with many of these categories dividing into further subcategories. Reports may also be filtered by report date.

Corresponding markers on the map can be clicked giving the user the option to zoom in/out or get more information. While clearly still in its early stages, the map has a lot to offer. A quick search for disease programs under medical/health returned over a dozen hits across the map. Additionally, users may subscribe to receive location-specific email alerts whenever a report is posted within 20 miles of a designated area.

SMS in Action

Evaluating Security Apps

Posted by MelissaLoudon on Sep 22, 2011

Particularly for smartphones, there are many apps that promise improved privacy and security for your mobile communications. Like all apps, some are very good, but other are poorly written or overpriced, and may even be malicious. This article will help you evaluate whether you should trust their promises.

Before You Start

Security apps are most useful as part of a coherent security policy covering all your mobile communications. The Mobile Risk Assessment Primer will help you complete an inventory of mobile communications risks, and decide which are most important and most feasible to mitigate.

Once you’ve completed a risk assessment, it’s important to search broadly for security apps. MobileActive is in the process of reviewing many of these from our current list of security apps, but the mobile security landscape changes quickly. Ask friends and colleagues, read about your specific security need online, and search your device’s app marketplace. Once you’ve identified as many options as possible, it’s time to start evaluating your security apps.

Will It Work on Your Phone?

As with computer software, some mobile apps are built to work on one platform - Android, iPhone, Blackberry, Symbian, Java - and may not work on others. There may be other requirements too, such as particular phone models. Make sure the apps you have chosen are all going to work on your device.

Also consider how you will actually get the app - can it be downloaded from a web link that you open on your phone, or can you get it from an app marketplace? Some apps can also be downloaded to a PC and transferred via bluetooth or a data cable. This step sounds obvious, but it can be tricky when you don’t have stable Internet access on your phone or aren’t used to the app install process.

Bad Services? Holding Officials Accountable with SMS, Radio, and TRAC FM

Posted by MelissaUlbricht on Sep 21, 2011
Bad Services? Holding Officials Accountable with SMS, Radio, and TRAC FM data sheet 3310 Views

A recent radio poll at Sanyu FM in Kampala, Uganda, asked listeners what area of service delivery should be a priority: healthcare, education, security, sanitation, or transport. Using a new tool, TRAC FM, the station was able to solicit comments via SMS from listeners, discuss the issue on the air, and create and post online visualizations of the responses. The station received 103 SMS responses which showed that healthcare was the major concern for listeners, which accounted for 65% of responses.

With help from Text to Change and in partnership with local media organizations, TRAC FM provides citizens in Uganda with a platform to monitor, scrutinize, and discuss public service issues via SMS, radio, and online data visualizations. It does this via the TRAC FM software, a tool for Ugandan radio stations that is partially built on RapidSMS, an open source platform originally developed by UNICEF. 

According to the TRAC FM website:

TRAC works in countries affected by poverty and conflict. Its sole purpose is to improve the welfare of people by enabling them to make informed choices and to hold their leaders accountable. TRAC gathers data to enhance transparency and informs people by unleashing the power of mobile communications.

Trac.fm
Basic Information
Organization involved in the project?: 
Project goals: 

TRAC works in countries affected by poverty and conflict. Its sole purpose is to improve the welfare of people by enabling them to make informed choices and to hold their leaders accountable. TRAC gathers data to enhance transparency and informs people by unleashing the power of mobile communications.

Brief description of the project: 

With guidance from Text to Change and in partnership with local media organizations, TRAC FM provides citizens in Uganda with a platform to monitor, scrutinize, and discuss public service issues via SMS, radio, and online data visualizations. It does this via the TRAC FM software, a tool for Ugandan radio stations that is built on an open source platform.

Target audience: 

TRAC FM software is installed and used by radio stations. The target audience for participation is all listeners of a given radio station, as well as anyone who engages online with the station. 

Detailed Information
Status: 
Ongoing
What worked well? : 

The TRAC FM software levarages local languages well. It also uses a multi-platform approach (radio, mobile/SMS, and online) to engage a wide array of people. The software is flexible -- it can be adapted to fit into the existing programming at a station. Recognition functionality helps automate and ensure that most responses are accounted for. 

What did not work? What were the challenges?: 

Dijkstra said that one of the biggest challenges thus far has been streamlining the process with different parties involved in the process of running a poll.


Mobile Stats for Africa: Video Report on the Growth of Mobiles

Posted by AnneryanHeatwole on Sep 15, 2011

The Praekelt Foundation, a South African organization that runs several mobile-based programs in South Africa, recently produced a catchy video infographic of mobile statistics for Africa. Looking at accessibility, growth, and usage, the video gives a good look at how mobiles have taken off in in the continent of Africa.



The video covers a lot of facts about mobiles, from a breakdown of the rapid growth of mobile phones compared to other forms of media (like radio and television) to the huge drop in price points (the first mobile phone cost US $3995 in 1973 compared to roughly US $15 for certain models today). Some facts from the video:

  • "Today the number of SMSs sent and received everyday exceeds the population of the planet"
  • "In 2002 there were 49 million cellphones in Africa, now there are 500 million"
  • "In Africa, over 95% of mobile users are pre-paid subscribers"

The video also covers other uses of mobile phones such as Please Call Me messages (in which pre-paid mobile users who have used up their airtime send a free message requesting a call back from whomever they want to speak to) and mobile payments, reporting that almost 11% of Kenya's GDP goes through the M-PESA system. M-PESA, a mobile money transfer system, registers almost 10,000 new people each day to use mobile phones to transfer money credits.

If you're curious about the mobile situation in Africa, take a few minutes to watch!
 

uReport: Citizen Feedback via SMS in Uganda

Posted by AnneryanHeatwole on Aug 28, 2011
uReport: Citizen Feedback via SMS in Uganda data sheet 6137 Views

For aid organizations, knowing what local communities and beneficiaries want and need is the key to running successful, sustainable programs. In Uganda, UNICEF is using mobile phones and broadcast media to get direct feedback from Ugandans on everything from medication access to water sanitation. The project, called uReport, allows users to sign up via a toll-free shortcode for regular SMS-based polls and messages. Citizen responses are used both in weekly radio talk shows to create discussion on community issues, and shared among UNICEF and other aid organizations to provide a better picture of how services work across Uganda.
 
Sean Blaschke, a Technology for Development specialist at UNICEF Uganda, explains that uReport gathers information from participants and informs citizens of their rights and available services. Recent polls have included questions about school dropouts, water point availability, mosquito net usage, and youth employment, all collected via SMS polls.

The use of SMS makes the program available to all literate mobile users regardless of handset; says Blaschke,

Basic Information
Organization involved in the project?: 
Project goals: 

The project is three-fold:

  • To collect feedback and information directly from beneficiaries of projects in Uganda
  • To create a system to directly communicate with and push messages to uReport members
  • To allow beneficiaries to share their views on a number of different topics
Brief description of the project: 

uReport is a UNICEF project in Uganda that sends SMS polls and messages to subscribers in order to gather feedback about communities across Uganda. The information is then used in broadcast and print media to inform citizens about their rights and available services, while also acting as a means of detecting vulnerabilities in communities.

Target audience: 

The target audience is youth in Uganda who want to share information about their communities and start discussions at a community level about available services and programs.

Detailed Information
Mobile Tools Used: 
Length of Project (in months) : 
3
Status: 
Ongoing
What worked well? : 

The project has seen a huge number of signups (more than 28,000 registered users), and reasonably high response rates (ranging between 18% and 30%). UNICEF also found that the program is mutually beneficial between them and their partner organizations, as partner organizations can use the SMS system to directly target their members, while UNICEF can use the information collected in the polls to get a clearer picture of how services and systems are working in individual communities.

What did not work? What were the challenges?: 

Challenges include:

  • Finding ways to keep uReporters interested in the project so that they answer the polls (UNICEF is currently testing out multiple incentive programs to see how they affect response rates)
  • Finding a balance between the one-to-one contact of mobile communications and the need to share information with a large number of people (partnerships were built with eight local radio stations in different districts so that information could be broadcast regularly to non-mobile owners)

Safer Facebook

Posted by SaferMobile on Aug 09, 2011
Safer Facebook data sheet 7856 Views
Author: 
Melissa Loudon
Abstract: 

Facebook has more than 500 million users, half of which access the site through their mobile phone. Being able to communicate your message to an audience this large is exceptionally valuable. At the same time, your activities on the site generate very detailed information about you and your networks. If you are concerned about surveillance, this information can put you at risk. This how-to explains what those risks are and how to use Facebook on your mobile device more securely. 

Facebook has more 500 million users, half of which access the site through their mobile phones. Being able to communicate your message to an audience this large is exceptionally valuable. At the same time your activities on the site generate very detailed information about you and your networks. If you are concerned about surveillance, this information can put you at risk.

Assess Your Facebook Mobile Risks

Like Twitter, Facebook is a way to get your messages to a potentially large audience. It is not a secure method of communication for sensitive information.

This article offers advice about how to mitigate risks when using Facebook as a dissemination and organizing tool. In particular, we consider the following risks:

  • The risk that your public activities on Facebook reveal compromising information about you or your networks - for example, revealing the identity of supporters or identifying people who were present at a particular event.
  • The risk of your private information being revealed to a third party without your consent.
  • The risk that your account details (username and password) are discovered, and that someone may impersonate you.
  • The risk of your account being deleted or suspended.
  • The risk that Facebook is blocked or becomes inaccessible.

in general, you should only use Facebook to share information that you consider public. Public information can be freely distributed by you, your organization, and your supporters, without any risk to individuals or organizational operations. In communicating public information, you can send and receive this information without taking any precautions.


We Need Your Help: Building a SIM Card Registration Database

Posted by KatrinVerclas on Jul 27, 2011

We are developing a global database of SIM cards registrations by country, and we need your help. Please fill out this short survey. We ask you a few questions about a particular country's requirements.

Note: This survey will not track identifying information. We will publish the complete database on the site shortly with the data that we have gathered to date. The survey is here. Thanks!

Photo courtesy flickr user bfishshadow.

Using HTTPS for Secure Mobile Browsing

Posted by MelissaLoudon on Jul 11, 2011

HTTP, the Hypertext Transfer Protocol, is the data communication protocol you use when you broswe the web - as you probably know if you've noticed that website addresses usually begin with http://. HTTPS is the secure version of HTTP, which you might have seen being used for sensitive transactions like online banking and online shopping. When you are using the secure part of a site, the web address will begin with https://.

When using your mobile phone for sensitive communications, it is important to ensure that your online activities - whether researching or reading about an issue, sending an email, writing a blog post or uploading photos - are done over a secure connection. There are three elements of secure web browsing:

Are Your Apps Trustworthy? 6 Questions to Ask

Posted by MelissaLoudon on Jun 30, 2011

Smartphones (iPhone, Android, Blackberry, Windows Mobile, Symbian) and many feature phones allow you to download and install mobile applications (“apps”). Apps do many useful things. However, some apps (and other types of software, such as your mobile operating system) can also present security risks. These include:

  • Apps and other software may have access to information stored on or generated by your phone.

  • Apps and other software may have the ability to transmit this information using your phone’s Internet connection.

Malicious apps or other mobile software installed on your mobile device can expose you to the following risks:

  • Your conversations may be listened to or recorded without your knowledge.

  • Your text messages, emails and web traffic may be monitored and logged.

  • Data stored on your phone (contacts, calendar entries, photos and video) may be accessed or copied.

  • Passwords stored or entered on your phone may be stolen and used to access your online accounts.

  • Your locationmaybetracked, even when your phone is switched off.

With smartphones gaining market share, malicious apps are beginning to pose a serious threat. In an article titled “Your Apps Are Watching You”, the Wall Street Journal tested popular iPhone and Android apps, and found that of 101 apps tested, 56 transmitted a unique identifier for the phone without informing the user or asking for consent. 47 apps also transmitted the phone’s location, while 5 sent age, gender or other personal details to various companies. The App Genome Project reports that 28% of all apps in the Android Market and 34% of all free apps in the Apple App Store have the capability to access location, while 7.5% of Android Market apps and 11% of Apple App Store apps have the capability to access users’ contacts.

It can be very difficult to tell which apps are safe and which are not. App behaviours that might not bother most users, such as transmitting the phone’s location to an advertising server, can be unacceptable to people with higher privacy and security requirements.

This article offers suggestions on how to assess risks to security and privacy posed by apps.

SaferMobile LockDown Guides

Posted by SaferMobile on Jun 29, 2011

Despite the smartphone craze of the past 5 years, featurephones are still king in much of the world. From the perspective of activists, rights defenders, and journalists, they cannot be ignored. And feature phones have plenty of built-in capability to help users stay safer. During the course of our research, we've uncovered valuable features that even the most experienced users may not be aware of.

As a part of SaferMobile, a project of MobileActive.org, we've focused on documenting the most important ways that a user can lock down a mobile handsets. No external apps or special tools are required, just a charged battery. We've condensed these tips into single-page, device-specific reference guides for a variety of makes & models that get straight to the point. And yes, we made sure to cover smartphones and featurephones.

A Note To Our Readers!

Posted by KatrinVerclas on Jun 29, 2011

Dear MobileActives from around the World. You may have noticed that we have had an inordinate number of funky site issues - slow-loading pages and 406 errors. We have reached the end of the useful life of this site which is three years old and it has gotten creaky. 

We are a small organization and this site has, with the exception of a start-up grant from the amazing Surdna Foundation, NEVER received general funding.  That is to say, we have funded this site from individual contributions, your donations, and overhead charged on contracts and project grants. Clearly, this is not a very sustainable way to run things as the site and readership has grown to more than 3,000 unique readers a day now.

Here is what we are doing:

Tagged With:

Safer Twitter

Posted by SaferMobile on Jun 17, 2011
Safer Twitter data sheet 7133 Views
Author: 
Melissa Loudon
Abstract: 

This article contains information to help you understand and mitigate mobile security risks related to Twitter. As always, remember that risks are context-specific, and depend on the environment you work in as well as whether you are communicating sensitive information. For more information on risk assessment, please review the Guide to Mobile Security Risk Assessment.

Twitter is a way to get your messages to a wider audience.  However, you should know that from any platform (computer or mobile phone), it is not a secure method of communicating sensitive information. Consider the following guidelines: 

  • Your Tweets should only contain information you want to widely and publicly share. This should be public information that can be freely distributed by you, your organization, and your supporters, without any risk to individuals or organizational operations.
  • Even if you protect your tweets so that only followers can see them, followers can easily retweet your messages, or access them over an insecure connection.

June Mobile Tech Salon, NYC: Our Mobile Data Exhaust

Posted by MarkWeingarten on Jun 14, 2011

According to the Wall Street Journal, “[Data produced by the use of mobile phones] generates immense commercial databases that reveal the ways we arrange ourselves into networks of power, money, love and trust.” As mobile phone use increases and applications become increasingly sophisticated, the volume of mobile data we create continues to grow at an incredible rate, creating new possibilities and posing new challenges to notions of privacy.

Businesses want this data for marketing. Congress wants to regulate it. Activists and privacy advocates want to ensure that it is not used to compromise their safety or freedoms. Meanwhile, projects such as UN Global Pulse want to use information gleaned from mobile phone use to detect and prevent slow-onset humanitarian crises. We invite you to join us on the evening of June 30th for our next New York City-based Mobile Tech Salon as we explore these tough questions:

  • How do we determine socially beneficial uses for mobile data?
  • How can the safety, security, and privacy of individuals be respected while using mobile data to benefit them?
  • How can our mobile data be effectively aggregated and anonymized? Or can’t it?

A Guide to Mobile Security Risk Assessment

Posted by SaferMobile on Jun 10, 2011
A Guide to Mobile Security Risk Assessment data sheet 6087 Views
Author: 
SaferMobile
Abstract: 

You are an activist, rights defender, or journalist. You use a mobile device. And you work in sometimes risky situations in your country. This guide will help you implement mobile security practices in your work. It will help you assess the particular risks that face you and then assist you in developing a plan to mitigate those risks.

Location

safetyicon

You are an activist, rights defender, or journalist. You use a mobile device. And you work in sometimes risky situations in your country.

This guide will help you implement mobile security practices in your work. It will help you assess the particular risks that face you and then assist you in developing a plan to mitigate those risks. First, we'll cover some of basic concepts. Then, in the second part of this guide, we'll take you through developing your own risk assessment in 5 steps.

We have previously published a Mobile Risk Primer that describes general security vulnerabilities associated with mobile technology and communication. Read it!

Throughout this guide, we'll also highlight the fictitious case of Asima, a blogger and activist in Egypt. Examples of how Asima might complete the assessment worksheet and create a security plan for her work are highlighted in this guide.

Asima lives in Cairo, Egypt and is a blogger and an activist. She used to maintain a blog on Blogspot, but now mostly uses Facebook and Twitter to follow current events, to share information, and to communicate with colleagues. She tweets from her mobile phone while in traffic and at cafes and protests and from her computer when she is at work or at home.


The Bug in Your Pocket: Remote Listening Applications for Mobile Phones

Posted by MarkWeingarten on Jun 10, 2011

We've heard much recently about information that is being tracked by mobile phone companies (see our recent post) and app developers. However, there are more overt security threats that are potentially more dangerous.

One of these threats is referred to as either a “roving bug” or a “remote listening” application. It is essentially the same concept as a conventional audio bug, except that it requires no hardware other than a smartphone. Once installed, remote listening software enables a 3rd party to call a phone, activate its speakerphone capabilities, and secretly transmit any sounds picked by its microphone to another phone number, where it can be monitored and recorded.

SMSTester for Android

Posted by MarkWeingarten on May 24, 2011
SMSTester for Android data sheet 2531 Views
Organization that developed the Tool: 
Main Contact: 
Katrin Verclas
Problem or Need: 

There are plenty of anecdotal stories of seemingly random delays lasting multiple hours or even days in many countries where we work. While network congestion and growing infrastructure are often to blame for SMS unreliability, there are also legitimate concern that delays may be an indication of deliberate message filtering and monitoring.

What has emerged is an environment in which activists and human rights defenders are unable to clearly understand what networks - and what behavior - is safe or hazardous for themselves or their contacts. The end goal of this research, put simply, is to change this paradigm. Rumors of keyword filtering are not helpful; what is helpful is any evidence of surveillance.

 

Main Contact Email : 
Brief Description: 

SMSTester is a simple Android app that allows a user create a set of keywords to be sent as SMS messages. This allows the user to explore differences in latency for any type of message - from basic, everyday text like ‘milk’ or ‘newspaper’ to politically inflammatory text such as ‘revolution.’

We then set up a logging mechanism to timestamp and record each SMS as it is sent (from the sender side) or received (on the receipt side). By comparing the sent and received timestamps, we’re very easily able to calculate message latency from one SIM to another.

 

Tool Category: 
App resides and runs on a mobile phone
Key Features : 

The application is designed to be installed on both sides of a single SMS conversation: a sender uses the app to automatically transmit a series of messages to the receiver, where incoming messages are logged upon receipt. Diagnostic data from the send side can be optionally included in the message payload itself such that the receive side can parse, analyze and display test results without needing access to data from the send side. This feature drastically improves flexibility and enables effective testing without requiring physical co-location.

Each message sent is coded with a unique GUID by the application so that data sets from both sides can be later combined if necessary. The output of the data is stored on the device SDCard in comma separated value (CSV) format, which makes it easy to import and parse in any office spreadsheet application.

 

Main Services: 
Other
Display tool in profile: 
Yes
Tool Maturity: 
Currently deployed
Release Date: 
2011-04
Platforms: 
Android
Program/Code Language: 
Java
Organizations Using the Tool: 

MobileActive.org

Support Forums: 
https://lab.safermobile.org/wiki/SMSTester
Languages supported: 
Any
Handsets/devices supported: 
SMSTester is currently availble as an Android application only. However, as the application itself does not require a large amount of computational power or high-end hardware, it can be deployed on virtually any Android handset with SMS capabilities, including low-cost options.
Is the Tool's Code Available?: 
Yes
URL for license: 
https://github.com/safermobile/smstester
Is an API available to interface with your tool?: 
No
Countries: 
Featured?: 
Yes

SMSTester for Android: Project and Source Now Open

Posted by SaferMobile on May 18, 2011

One of the main goals of the SaferMobile project is to release software tools that allow activists and rights defenders to use their mobile phones as network monitors and sensors. The goal is to help them, and the mobile developers, human rights organizations and people on the street they work with, to monitor network performance and proactively detect blocking, filtering and censorship. SMSTester is the first tool we are publicly releasing within this category, and it is free, freely licensed and open-source. Our first trial run with Short Message Service Tester (SMSTester) was completed in April 2011. The results are written up here.