Protect protesters' data, and provide an offensive strategy

[BarayeHamamoon]

ForPeople App - a specific application for protesters. Only for collecting and spreading data during protests.

• This app must be open source
• And need a server app
  • To collect data
  • To handle encryption – all the process should be automatic (content handling, key exchange, and publishing contents)

Defense:

1. We know the first thing they are doing after arresting someone is that they are getting into the phone to collect and prepare documents against protesters.

• Solution: There is a possibility to provide an application that makes it impossible for the authority to gain access to the captured data.
  • Username: this app doesn’t need or request user information including username.
    • A random username string will be generated automatically in the background and stored encrypted to support some functionalities like SOS messages.
  • Password and Access policy: the most important thing here is the safety of the person. If by any chance, the device is in the authority’s hand, all data should be immediately purged!!! This can be achieved in two different ways if all the voice recordings, pictures, and videos are captured through the app:
    • By pressing the power button several times.
    • Or by entering any password other than the chosen one in the beginning.
  • When the person makes the app active, during activation, the app is always recording voices unless the user changes the setting or stop the process.
  • All the picture and videos should be captured by this application. They should be immediately encrypted and uploaded if a secure net is available, if not they will be saved locally encrypted.
  • Spread data even when the Internet is broken or the protester tuned the flight mode on – using anonymous peer sharing, possibly the app should find a peer automatically and spread data with encryption – through Bluetooth or WIFI. This can make the application interesting, considering following scenario:
    • One of the approaches that the government finds people is that they are looking for the protest timing and track everyone that are connected to the phone providers in that location and time. If the people who lives in the nearby can collect the data (through the app automatically in the background) and to spread them later, then we have protection for protesters since they don’t need to be connected to the phone providers, and, we have a backup of the data in others phone (say we keep two copies in other devices).
  • SOS messages and location: Android and iOS have features to provide SOS functionality for selected people (say I select my father to send an SOS message when I am in trouble). But the issue is that when we ask people to set their phone in flight mode, then there is no access to providers to send SMS. What we can do, is again by encrypting (using exchanged key for pairs) and sending data (an SOS message, the last location, …) to nearby devices who have the app and send the info indirectly to the server. When server gets an SOS message, it will send it to the pairs.
    • Beforehand, pair accounts can be provided and be collected in the server app. Then, the server app will push the data back to the paired accounts when necessary.
    • When accounts are paring, a key will be generated and be stored encrypted in the two apps locally (maybe we can keep that in server). To avoid key lost, pairing with multiple accounts is recommended.
    • Pairing can happen only though the Bluetooth or WIFI since there is no access to the username/account – accounts can be paired if they are close enough to make a Bluetooth or WIFI connection.

2. Implementation considerations/possibility:

• If they filter the app server then to connect the client app to the server app there would be a need for a proxy/VPN. To avoid this, we can use “tor project” (an open-source project provided by The Guardian). They have open-source projects (like tor-android) and this can provide a tor daemon for the client application. Then, we can provide built-in proxied network for the client app which is also more secure.

The server app (including the offensive part):

1. TODO: I am going to continue this