J-school security curriculum: a refreshed resource pack!

Hello again!

It’s Evan, senior digital security trainer at Freedom of the Press Foundation (FPF), with our regular update on the U.S. journalism school digital security curriculum.

J-school security curriculum update

• Following our revamp of the digital security 101 module this past summer, we also updated its accompanying resource pack.
• We refreshed the end-to-end encryption for files module to remove some outdated tooling recommendations.
• To make navigation simpler, we updated a handful of links to the handy Security Education Companion, which we reference across a number of our modules, including the one on threat modeling on behalf of sources.

Highlights from digital security in the news

Federal investigators obtained warrants authorizing the use of cell-site simulators to locate and arrest Jerome Richardson, a producer for journalist Don Lemon, following their coverage of an ICE-related protest at a church in Minnesota earlier this year. According to court records, judges in Minnesota and Pennsylvania authorized agents to deploy the location-tracking devices targeting Richardson, who was charged alongside Lemon, journalist Georgia Fort, and others in connection with the demonstration. Investigators also applied for cell-site simulator warrants targeting Fort and a Minnesota state senate candidate. In addition to the potential use of cell-site simulators, Department of Homeland Security agents sought the journalists’ phone and YouTube records through the misapplication of customs summons. They also sought pen register orders, which are typically used to collect the numbers a given phone contacts, against Fort’s phone and a number tied to Lemon. Read more about the wide-ranging surveillance.

Driver’s licenses and other government ID records belonging to more than 150 million people in the U.S. and Canada were stolen by hackers after a breach of IDScan, a large identity verification company. According to reports, the hacked records were posted on a searchable online database, allowing essentially anyone to look up stolen license numbers, full names, addresses, passport numbers, and even photos. The records included the information of high-profile individuals, including U.S. Secretary of Defense Pete Hegseth. IDScan provides identity verification software that is widely used by corporations and entertainment venues to check customer IDs. Read more about the breach.

In recent months, a social engineering technique known as “ClickFix,” which aims to infect computers by tricking users into manually executing malicious terminal commands, has been rapidly proliferating. The attacks often begin on compromised websites that display fake CAPTCHA prompts, including those masquerading as security checks. When a target interacts with the prompt, they are then instructed to copy a command, often obscured as a line of blurry text, and paste it directly into their device’s terminal. The hacking technique has been widely adopted by a range of malicious actors, including state-sponsored groups, because it bypasses some of the resource-intensive infrastructure typically needed for successful attacks by convincing users to voluntarily execute malicious commands themselves. Read more about the attacks.

What we’re reading

We’ve been poring over a landmark report from The Citizen Lab released earlier this month that provides the first public technical confirmation of a long-suspected threat: targeted, zero-click spyware delivered directly through the online advertising ecosystem. The investigation details how the structures that underpin targeted digital advertising, both through our browsers and mobile apps, have been weaponized to silently profile users and execute malware. The report specifically details cases targeting journalists working at Al Jazeera over the past few years, diving deep into the mechanics of the attacks, which require no action on the part of the target. The research also sheds light on the intricate corporate networks and web of partnerships connecting ad-tech brokers to mercenary spyware vendors, while outlining actionable recommendations for defenders to mitigate the risk of this type of highly-targeted attack. You can read the full report.

As always, let me and our team know how you’re using the curriculum, what’s useful, and how it can be improved! Feel free to respond to this email or to [email protected].

Thanks so much,
Evan Summers
Senior Digital Security Trainer
Freedom of the Press Foundation