Metadata 102 — What is communications metadata and why do we care about it?
Even if we encrypt our chats, they yield metadata — data about our conversations. Let’s talk about why it matters.
Bill expands US spying powers
Last week, Congress reauthorized a controversial surveillance authority, Section 702 of the Foreign Intelligence Surveillance Act. While legislators considered reforms to FISA that would restrain the federal intelligence and law enforcement community’s abilities to spy on American communications without a warrant, they in fact expanded these surveillance powers to subject more electronic communications service providers, such as U.S. cloud computing data centers, to data collection.
That USB drive might not be safe. What now?
To be curious is to be human — including about what’s on that USB drive. But first, let’s think through how to access it safely.
Apple warns iPhone users of targeted malware
On April 10, Apple sent users in 92 countries warning of mercenary malware attacks targeting the iPhone. The notification did not provide details about the identities of the attackers. According to TechCrunch, Apple warned, “This attack is likely targeting you specifically because of who you are or what you do. Although it’s never possible to achieve absolute certainty when detecting such attacks, Apple has high confidence in this warning — please take it seriously.”
Preparing for election-related security issues
Throughout this year, our digital security training team will share our thoughts on navigating security issues during the 2024 election season. Elections around the world experience distinct security issues that may change from year to year, but in the U.S. we look to 2020 for lessons on how to get ahead of likely issues, from surveillance of our sensitive communications to perennial phishing attacks and harassment for political reporting.
Reporting on the 2024 elections? We’re here to help
Our Digital Security team is on hand to help you and your devices stay safe in the 2024 election year
Google to delete old Chrome Incognito data
Following a class-action lawsuit over Google’s handling of user data in its Chrome browser’s “Incognito” private browsing mode, the search company will expunge “billions of event-level data records that reflect class members’ private browsing activities” improperly collected before January 2024. It also updated its Incognito landing page to highlight that even Google can discern your activities in private browsing mode. Additionally, the company will be required to delete data that makes users’ private browsing data personally identifiable, such as IP addresses.
DOJ sues Apple, spotlighting iMessage
The U.S. Department of Justice filed an antitrust lawsuit against Apple, claiming the company engages in monopolistic practices over the smartphone market, preventing competitors by degrading the experience of communicating with non-Apple users in its products. iMessage features prominently in the suit, with the DOJ alleging consumers are disincentivized to leave its “walled garden” and so miss out on unique features built into the iMessage protocol, including end-to-end encryption between Apple users.
Metadata 101: Understanding the basics of media metadata
Learn about the basics of media metadata — the information hidden inside of your files.
Controversy over Mozilla’s anti-data broker service
We recently shared news of Mozilla’s partnership with data removal service Onerep. Through a service it calls Mozilla Monitor Plus, Onerep is designed to automatically scan for personal information on data broker websites. But journalist Brian Krebs has found evidence that the founder of Onerep, purveyor of anti-data broker services, himself created dozens of data broker services. Read more.
WhatsApp now supports messages with third-parties
Under the new European Union law, the Digital Markets Act, Meta is required to allow interoperability between third-party chat software and its WhatsApp and Facebook Messenger apps. These tools offer end-to-end encryption using the Signal protocol, the strong encryption specifications pioneered by the Signal encrypted messaging app.
Post-quantum iMessage
Both in the U.S. and abroad, governments are capturing encrypted connections that pass over the public internet and saving them for later use. Within years or decades, post-quantum computers could meaningfully shorten the amount of time required to unscramble encryption, allowing attackers to read previously private messages. So a growing number of organizations, including Apple, are preparing for attacks like these with post-quantum encryption. Read more in our newsletter.
Avast caught selling browsing data
Aye hearties, gangway — the Avast cor-pirates are walking the plank. That’s because the company sold user data without consumers’ knowledge, according to the Federal Trade Commission, which ordered U.K.-based Avast Limited to pay $16.5 million and will also bar the antivirus company from selling or licensing browser data for advertisements. Read more in our newsletter.
Signal usernames are here!
This week, security nerds are dancing in the streets because Signal, the encrypted messaging app, is finally rolling out usernames. Signal has previously required users to provide their phone number as an identifier, but with this most recent update, users may instead use a username. Read more in our newsletter.
Why journalists should enable Signal usernames
With Signal’s new username and discoverability features, we’re done giving away phone numbers
Mozilla breaks into the anti-data broker game
Hundreds of data brokers aggregate and sell access to personal data, such as phone numbers, emails, addresses, and even purchasing habits collected through loyalty card programs, social media sites, apps, trackers embedded in websites, and more. Mozilla has a new monthly subscription service which automatically scans for your personal data on data broker websites, but there are other ways to make your data less easily searchable. Read more from the Digital Security Team.
Moving from passwords to passkeys
Instead of traditional passwords, where you log into a website with credentials that you know or store in a manager, a passkey is a credential that you store on your device, registered with an online account. Read more in our newsletter.
Journalists targeted with Pegasus yet again
Mercenary spyware firm NSO Group’s Pegasus spyware, designed to remotely access targeted smartphones, is marketed to governments around the world for the purposes of law enforcement and counterterrorism. But in the wild, we’ve seen governments repeatedly abuse this and similar spyware tools to infect journalists, spying on their most sensitive files, communications, and sources.
Harden your iPhone against thieves
Thieves don’t just steal iPhones for the hardware — they may also want access to banking apps and Apple Pay to facilitate fraudulent transfers and purchases. One thing that works in thieves’ favor is that people often use short passwords that are easy to shoulder surf and to memorize — typically only six digits. To minimize this risk, instead of typing in passcodes, where possible and practical consider opting for Face ID or Touch ID when unlocking the phone in public spaces.
Want improved adoption of digital security practices? Tell a good story.
Research concerning digital security narratives in journalism
Check if your account has been breached
If you have found your email in a data breach and the affected account is still active, you’re going to want to change the password for the relevant service right away.
Learn from the social media breach at SEC
On Jan. 9, 2024, the U.S. Securities and Exchange Commission’s account on X, formerly known as Twitter, was hijacked and used to post about the approval of a Bitcoin exchange-traded fund. This could have happened to anyone, whether an individual or a well-resourced organization. Learn how to mitigate similar attacks in this week's edition of our digital security digest
2024 resolution: Get started with security keys
Two-factor authentication (2FA) is great because it helps harden your account security. The strongest 2FA option commonly available today depends on a piece of hardware, a security key — a little device you can plug into your USB port to help log in.
Private browsing isn’t that private
On all major browsers, research suggests many users overestimate the privacy promises of private browsing mode, with many believing that it allows them to hide their IP address, encrypt their web traffic, browse anonymously, and more. That’s why you’ll want to read about what private browsing mode does and doesn’t do.
Audio: Every season is spooky season with Meta’s chatbot AI
October is cybersecurity awareness month and Martin Shelton, principal researcher at Freedom of the Press Foundation (FPF), explores Meta’s new AI chatbot features. What he finds is security news that’s creepier than any ghost and a tool that bleeds more than fake vampire fangs.With Meta releasing AI chatbot abilities …
