Simple privacy guide for repressive countries

Published on 24 April 2020 - Tags: privacy, tor

There’s quite a lot of misinformation going around regarding internet privacy, which can be quite dangerous to those whose lives depend on it. I’ve written this blog post to clear some things up. Specifically, this is tailored to minorities who are persecuted in countries such as Pakistan and Saudi Arabia.

What the government can already track

First, let’s go over what the government/ISP (internet service provider) can track. Assuming you’re using HTTPS, your government can track which websites you’re using and when. This means that they will be able to know you accessed www.facebook.com at 7:38 PM, but they won’t know what pages or profiles you visited. They’ll only know you visited www.facebook.com.

If you’re not using HTTPS, your government will also be able to track what you send to the website. This includes passwords, pages visited, and posts submitted.

How do you know if you’re using HTTPS? Well, usually, your browser will display a lock symbol as shown below when you’re browsing using HTTPS.

HTTPS lock symbol

HTTPS works by encrypting the data between your browser and the website. This means that it uses mathematical algorithms to make sure that this data is unreadable while it is in transit.

What the government can track with the help of website owners

However, HTTPS does not prevent the website from giving your data to the police. Every single website you access on the internet can see your IP address. If a website decides to give the government the IP address behind your account, they can use it to find your real address. It’s important to make sure that the authorities cannot find the IP address behind your online accounts.

Big websites such as Facebook, Reddit, and Google have procedures in place to handle government requests for user data. This process is usually somewhat transparent and fair, as they generally ignore laws of authoritarian governments. Google, for example, processed 3 Egyptian user data requests between 2014 and 2018. They denied all of them.

Hiding your identity from websites

However, it’s not a smart idea to put your safety in the hands of multinational for-profit corporations. If you live in a country where your safety is at risk if your identity is revealed, it’s a good idea to use Tor. Tor hides your IP address by sending your internet traffic through other computers before it gets to the website. The website will be able to see the IP of the last computer instead of yours. Your government will know that you’re accessing Tor, but they won’t know what you’re sending through it.

Tor isn’t infallible. If the government knows your approximate location and the website owner tells them that you’re using Tor, they can check who accessed Tor at that place at the same time you viewed the website to obtain your real identity. The FBI has done this before, but it should rarely be an issue. If you’re concerned about this, you can use public WiFi.

Side note: VPNs aren’t as effective as Tor at keeping you anonymous online.

The obvious

What usually gets people caught isn’t that the government obtains their IP address. It’s that they submit something to the internet that reveals their identity or reveal their identity to their friend. Dumb mistakes are what get people caught. Here are a few examples of things you should always do:

  1. When submitting stories, be vague and make up details. A small piece of information, such as the number of siblings you have, can be used to uncover your identity.
  2. Be very careful when submitting photos to the internet. Scrub EXIF data from all photos you upload and verify that there are no details that may be used to identify you.
  3. If other people use your computer, make sure your browsing history isn’t saved. Don’t save anything to your computer that may give away your identity.
  4. Don’t use your real name to sign up for the accounts you use for your anonymous identity.
  5. Don’t reveal your online identity to people you know in real life.
  6. Don’t reveal your real identity to people you know online.

You get the gist.

Conclusion

Generally, using HTTPS and not being stupid is enough to keep you safe when using well-known websites such as YouTube and Reddit. However, if you are willing to take extra precautions to protect your identity, consider using Tor. PrivacyTools is a good resource for learning how to stay private online.