Cybersecurity II : Secure, protect, investigate
The European Federation of Journalists (EFJ) and the European Trade Union Institute (ETUI) have successfully organised a 3-day training (25-27 May) in Leuven (Belgium) on Cybersecurity for journalists : Secure, protect, investigate. This was the second edition of a course organized 2015 along four days about Cybersecurity for journalists and with the same practical approach. The course aimed to facilitate technical skills to journalists helping them to protect themselves, their work and their sources.
13 journalists and / or unionists coming from 11 countries took part to the training, with an important participation of participants coming from countries of the South East of Europe (Montenegro, Serbia, Cyprus, Turkey, Bulgaria, Romania) but also from the North East (Denmark, Finland, Poland) and the South West (Spain, France).
Main objectives of the course are :
- To enable participants to implement measures to protect their communications, including to encrypt their emails and documents;
- To train participants in storing and protecting their sensitive information, creating strong passwords and using new tools to avoid surveillance, to delete or undelete information on disks, to create modify or delete metadata and to create backdoors or traps to fool others;
- To improve capacity to investigate and have a critical approach on security on the web
The investigative journalist Duncan Campbell (member of the NUJ, EFJ affiliate) exposed the structure and dynamic of a master-class about challenges that journalism faces in an era of surveillance and recording and about mining, forensic and big data. Using VPN, processing cloud computing and setting virtual computers were shown to participants. He alternated his explanations with some moments for questions and answers. The work in plenary took the longest part of the day followed by a last session dedicated to a group work about 4 different journalistic scenarios (Moldavia, Russia, France, Pakistan) based on real examples were participants had to debate and find answers to the problems.
The big differences between journalists and intelligence agencies are that journalists work to bring the information to the public opinion, their methods are subject to ethical standards and their targets will read and respond to their reports. (Duncan Campbell)
The second day, the sessions were organised by the expert Alain Jennotte (journalist at Le Soir and member of AJP, EFJ affiliate) in 3 parts concerning the security of accessing platforms (Keepass), security of communications (PGP keys) and security of contents (Veracrypt).
Stealing passwords doesn’t necessarily need computer intervention. If a hacker is able to read your post-it on your desktop, use educated guess (birthdays, simple texts), try social engineering based on your social profiles, try dictionaries or use brute force, there is a great chance that your security will be compromised if you don’t use strong passphrases (Alain Jennotte)
The last day, the sessions were dedicated to the presentation of 3 cases studies (Denmark, Finland and France) by different participants.
- Finland : (not satirical) Fake news business is growing and more and more affecting people’s life. A Black student nurse was the victim of a hate compaign in Finland. Why do people believe these sort of fake news ? First, there is a confirmation biais as most users share links on social network only after reading the headlines. People tend to read articles that are confirming their opinions. What can journalists do to debunk fake news ? Make sure that you don’t make the problem even worse, provide explanation to counter the fake part, use visual and graphic to broaden the impact and challenge the fake ideas not the individuals.
- Denmark : Danish police used software of hacking team to hack phone of journalists. All sources, meetings, private life and communications of targetted journalists were affected as police was able to live track and take pictures and video any time. Whistleblower at the Danish Defense revealed cases of torture used by Danish soldiers during the Irak war. Danish Union of Journalists (DJ, EFJ affiliate) and Prosa (IT union) launched a campaign to promote crypto parties and the use of tools to protect communication. Digital technology became popular and hype among students. DJ also adopted cybersecurity guidelines during its congress to raise awareness for digital protection among Danish journalists. Freja Wedenborg authored, with the help of experts, a specific Crypto Guide (financially supported by press funds) and organised seminars and meetings with local branches of the journalists union in Denmark. Later, the seminar became part of the curriculum at the universities in Denmark.
- France : 2015 was a “annus horribilis” for press freedom in France with the killing of Charlie Hebdo colleagues but also the terrible reaction of political actors. A new law on intelligence has been adopted in July 2015 enabling the French authorities to record, listen, keep, geolocate, trace any act of individuals in France without even warrant normally issued by a judge. Another legislative reform attacked the law on the protection of sources, followed by the application of military programs, followed by a restrictive law voted by the Senate, followed by another attack on press law of 1881, trade secrets directive at the EU level, etc. The very balance of power in France (legislative, executive and judiciary) is in danger now and journalists should react in order to defend democratic principles.
Photo Credit : Ricard Bellera – ETUI
Disclaimer : This 3-day workshop on Cybersecurity for journalists was organised by ETUI-EFJ thanks to the financial support of the European Commission (EC). All responsibilities regarding the contents and the actions belong to the authors only and should not be considered as reflecting the views of the European Union.