It’s the digital security training team at Freedom of the Press Foundation (FPF), with security news that keeps you, your sources, and your devices safe. If someone shared this newsletter with you, please subscribe here.

Android 16 drops — and with it, Advanced Protection mode

Journalists and other at-risk users sometimes need stronger protections than those in the phone’s default settings. Starting with the release of iOS 16 back in 2022, Apple has offered users its hardened Lockdown Mode, which limits security risks by suspending certain device features known to be exploited in previous attacks, such as link previews in Messages, as well as restricting certain web technologies when browsing.

Now, in Android 16, released this month, Google is expanding its long-standing Advanced Protection program to include hardened security settings as well.

You can see the long list of features affected by Advanced Protection. But I want to highlight a couple of things that jumped out at me: Advanced Protection will enable end-to-end encrypted security logging to help facilitate investigations of potential device breaches. It also includes some compelling features if your device is ever stolen or seized, blocking unknown USB connections and rebooting the device after 72 hours, which will also have the benefit of encrypting the device. By default, it further prevents certain technologies from activating in apps, web browsing, messages, calls, and network connections. Read more in this write-up from Thorin Klosowski at the Electronic Frontier Foundation.

What you can do

  • Decide if it’s right for you. It’s important to note that Advanced Protection may break certain websites and the way you prefer to use certain apps, such as your messaging app. But this might be a worthwhile trade-off for the peace of mind of upgrading your device’s security.
  • Turn on Advanced Protection. Note that not all Android devices have access to Android 16, and the update will be made available as a phased rollout across manufacturers, starting with Google Pixel phones. If you want to try out Advanced Protection, Google Pixel devices should be able to download Android 16 now by navigating here: Settings app > Security and Privacy > Advanced Protection.
  • iPhone users, consider Lockdown Mode. Learn more about this feature before deciding. But I can speak from experience that it does break certain websites, and has blocked messages from certain people I hadn’t previously contacted, particularly those using Android. It’s otherwise been a surprisingly normal experience, so for me this has been a decent compromise. If you want to try it out, navigate here: Settings app > Privacy & Security > Lockdown Mode > Turn On Lockdown Mode.

Updates from our team

  • J-school professors: We’re thrilled to share the launch of the most recent addition to our U.S. J-school Digital Security Curriculum! In collaboration with the Electronic Frontier Foundation, the University of Texas at El Paso, and Borderzine, we’re offering a new digital security module focused on the needs of journalists living and working in the U.S. southern border region. Read our press release. If you are a journalism instructor and want any help with questions about the materials, or even just want to share how you are using them in the wild, please be sure to reach out here to tell us all about it!
  • In keeping with the theme of border security readiness, my colleague Davis Erin Anderson released a new advice column examining password management strategies when you are traveling. Give it a read.
  • Reminder for U.S.-based southern border journalists: In partnership with the Centre For Investigative Journalism in the U.K., our Source Protection Program has joined forces with ACOS Alliance and the Electronic Frontier Foundation to offer two opportunities for intensive safety and security training this August for journalists covering immigration, migration, and related issues on the border. This training program is designed to strengthen the safety skills of participants, and will cover digital, physical, psychosocial, and legal safety. Apply by July 3 to be considered for participation. We have two options for training dates and location: Aug. 15 in Albuquerque, New Mexico (one full day), and Aug. 18-19 in El Paso, Texas (two full days). The training is for U.S.-based journalists only. Space will be allocated according to need, training is free to participants, and limited travel grants may be available. Space is limited, so don’t wait! Apply here.

Our team is always ready to assist journalists with digital security concerns. Reach out here, and stay safe and secure out there.

Best,
Martin

–

Martin Shelton
Deputy Director of Digital Security
Freedom of the Press Foundation