It is surprising that most people do not realise how vulnerable they are to having their private data compromised or seized, not just by legal authorities, but even by private people with court orders. Police or Taxation Department officers can literally burst into your home, take your documents, files and computers and rummage through them, learn your most precious secrets and even if they find nothing compromising, they can merely return your goods with barely an apology. That is bad enough, but what is worse is that even private people armed with Anton Pillar orders issued by a court can literally march into your home uninvited and take away documents, files and your computer to examine what is on the hard disk drive and use it against you in private civil court actions.
Most people have never heard of an Anton Pillar order. It is literally legal permission granted by a court for a private individual or a company to literally march into somebody's premises without notice and seize whatever is described on the order, whether it is hard copy, computer files, DVDs and CDs, tapes and anything else that they think could be useful to them. They can examine the material to their heart's content and use what they find against the owner in court action. Such orders are mostly granted to companies who claim that somebody has pirated software or illegal copies of music in their possession, however Anton Pillar orders have occasionally been granted to people who have tried to use them for obtaining private sensitive information to which they had no right.
I personally was the target of an attempt by a person to have an Anton Pillar order taken against me, to have my personal computer and data files seized in a Supreme Court defamation trial. This had nothing to do with copyrighted software, pirated music, or anything illegal in the slightest - it was merely a cunning manoeuvre by my adversary to gain access to my computer hard drive and try to find something that he could use against me in other court actions if needed.
Fortunately for me, I showed the judge that the application for the Anton Pillar order was totally without merit and my adversary failed to obtain it, even though there was nothing on my computer that would have assisted his cause in any way except for my private notes and strategies on how to defeat him and his worthless allegations against me. Obviously such files were confidential and I could not allow them to fall into his hands. If he had obtained the Anton Pillar order, he could have seized those notes and strategies before I could erase them and that may have altered the entire outcome of the trial.
However, I was outraged at this blatant misuse of a legal mechanism by a person who was maliciously trying to sue me, to allow him to plunder my personal files, even accessing data that had nothing to do with him. I considered this to be the legal equivalent of being raped. Due to a lot of hard work and research, coupled with the fact that there was no case that could be made against me, I comprehensively won that Supreme Court action and my adversary paid a fortune in court costs and damages to me. I feel that this long-winded explanation was worth making to show how dangerous an Anton Pillar order can be.
I regard an Anton Pillar order to be a disgraceful abrogation of a person's privacy and on principle, I will take every measure possible to prevent such things from ever happening to me in the future. I believe that I have the right to secure my private computer files from anybody whatsoever and I advise everybody to ensure that their computer data is unable to be seized or compromised in any way. In a civilised modern society, we are all entitled to privacy and even the government has brought in the Privacy Act to protect us. But an Anton Pillar order is one gaping loophole that individuals can plug by ensuring that even if somebody succeeds in taking out such an order against them, nothing will be found that can be used against them.
Always remember - a secret is only a secret if only you know it - as soon as you tell one other person that secret, it ceases to be a secret any more. And don't ever think that your best friend at that time won't turn on you in the future, either due to personal conflict, revenge after a disagreement or by being forced to testify against you in court. If you want to keep something totally confidential, just don't ever tell anybody else about it - it's that simple. Don't even talk about it in your own house or car, because premises and vehicles can easily be bugged. Don't even discuss your secrets out in the open, because a person some distance away with a shotgun or parabolic microphone can listen and record your conversation.
There are many people sitting in jail right now because they just could not keep their mouths shut, but spilled compromising information that was picked up by bugs or by people who were planted to extract such information by ingratiating themselves as friends. It seems to be a psychological flaw with most people that they need to confide in others or boast about something that is secret, expecting that the information will remain secret. Well it doesn't. It is most important to never volunteer information. If questioned by somebody about sensitive matters that you don't want revealed, just say nothing.
It's very hard to remain disciplined when being interrogated under stress and threats, but one slip of the tongue can mean disaster for you. So no matter what people threaten you with, there's not a lot they can do if they have nothing on you. Don't imagine that if you are told that if you spill the beans, you will get a better deal, because if you do reveal a secret that can compromise you, then you are literally making a confession. But if that information remains a secret, then there's no deal to be made because nobody will have anything on you. Without hard data or admissions from you, there's little anybody can do to you. So just remember - a secret is only a secret if only one person knows it.
The case of Australian Wikileaks founder Julian Assange being pursued by the Americans for exposing their dirty laundry shows how important it is to ensure that all links to sensitive information and communications be prevented from being accessed by authorities and courts. For instance, a person's Internet communications can easily be traced via email account information, IP addresses and other means.
Confidential data on social networking facilities such as Facebook and Twitter are subject to legal intrusion, as was seen in March 2011, when a US federal judge ruled that the US government may demand that associates of Julian Assange hand over Twitter account information in the investigation by the Americans into Wikileaks. Because Facebook and Twitter are physically located in the USA, they fall under US jurisdiction and confidential material can be obtained by court orders or warrants.
There is one major lesson to be learned from this. If you don't want authorities and courts tracking your communications and getting access to your Internet activities, then you have to cut the links that show what you have been doing and where you have been browsing. The best way to do this is to use an anonymous proxy server or a Virtual Private Network (VPN). Most people do not have access to a VPN, but anybody can access a myriad of anonymous proxy servers all over the world.
So let's say that you have sensitive information that you want to leak to newspapers or whistleblower websites such as Wikileaks. If you send this material via regular emails, this can easily be tracked. But if you log onto an anonymous proxy server that is physically located outside Australian jurisdiction, then transmit the confidential information to the recipient, the link from you to that recipient is completely broken by the anonymous proxy server.
There are many of these facilities right out of the clutches of the sort of nations that would demand your confidential data by court order, such as the USA, Britain and Australia, so the only evidence that they could find is that you visited an anonymous proxy server, but would have no way of discovering what you did via that facility. A partial list of anonymous proxy servers can be found on the Anonymous Proxy Servers page on this website.
Even better, if you can access an offshore anonymous proxy server from an anonymous computer to send that confidential data, the more secure you will be. There are a number of measures that you can take to cover your tracks completely.
Websites such as Wikileaks have shown the value of such whistleblowing websites and the conniving and illegal activities of governments, major corporations and individuals. They are doing us all a favour by exposing such travesties, but of course whistleblowers always face the real risk of persecution and even attempts to concoct false charges against them.
Of course if all tracks between whistleblowers and recipients such as Wikileaks are completely eradicated by sending encrypted data through anonymous proxy servers accessed from anonymous computers, then the risks of exposure to legal action by way of warrants and court orders are minimised or completely negated. Everybody has the right to privacy and protecting oneself from prosecution is paramount.
The easiest data for others to seize is printed material or CDs and DVDs containing correspondence, documents and bank statements, especially those from accounts that you wish to keep from prying eyes, or diaries and records of your activities. Obviously the best place for such items is nowhere near your premises, so if you need to retain original documents, CDs and DVDs, hide them well away from where you live and do not tell anybody else where they are. Do not put such material in bank safety deposit boxes or any other place linked to your name.
For documents that do not need to be retained as originals, store them as encrypted computer files. Scan and save those documents using at least 256 bit encryption and there is very little chance that anybody can crack them within the foreseeable future. As long as you remember the passwords, you can always view or print those items, but others cannot gain access to them. Ensure that you shred the originals completely and burn the shredded paper. CDs and DVDs can be destroyed by cutting them up and burning them. There is no way anybody can recover sensitive data after it is destroyed in such a comprehensive manner.
These days, the most obvious and vulnerable item that can be seized is your computer, complete with the hard disk drive that contains your data. Logically then, if you have sensitive data, do not ever keep it on your computer's hard disk drive - it's that simple. There are many ways of accessing data without it actually being on your computer, such as removable media, storing it on remote webservers and many other methods.
If you use removable media such as an external hard disk drive for storing sensitive data, it is obvious that others should not be able to gain access to it. The problem with physically large external hard disk drives is that they are easily found and they are not able to be quickly destroyed if necessary. The trick is to always keep physically large data storage devices right off your premises and only use them for periodic backup, not for day-to-day access to sensitive data.
Many computer users seem to completely disregard the threat of intrusions when connected to the Internet. For instance, very few people outside the IT business realise that on a single Internet connection, there are over 65,000 ports, most of which can be entered by hackers if they are not protected. So it is vital that any connections to a computer are made so they cannot be penetrated. The method to secure Internet connections from hacking is called a firewall. These can be hardware of software based.
Surveys have found that very few computers in Australia used a firewall of any description. Of course not having a firewall on a computer connected to the Internet is just begging for it to be compromised by malware, viruses or Trojan Horse software that turns the computer into a zombie machine controlled by criminals, who will use it as part of a bot-net to attack websites or to launch millions of spam emails or to steal passwords and bank details.
Most versions of Windows operating system comes with a free software firewall and there are many free or very cheap commercial firewalls available, so there is absolutely no excuse for anybody not to have a firewall installed on every computer they own. If people are so stupid or ignorant as to not secure their computers from very well-publicised risks, then they really deserve to suffer the consequences. The following steps will generally offer protection against being hacked.
One of the most effective ways to keep your Internet connection secure is to use either a hardware firewall or a router. If you connect to the Internet using just a modem, the only protection your computer has against hackers is a software firewall and some of those are not very secure. Not only that, software firewalls can be disabled or erased by malware that is inadvertently loaded by the user. It is always important to have a software firewall operating, however the cheapest and most effective hardware-based hacker prevention these days is a router, because most good routers have features that make them act as hardware firewalls. Routers cannot easily be compromised by software on the computers that they service.
Ensure that you only use a router with built-in Dynamic Host Configuration Protocol (DHCP) servers, Network Address (NAT) and Stateful Packet Inspection (SPI) if possible. All these functions act as a hardware firewall and most good modern routers have these features. However, this is just the beginning of the measures to be taken to secure your system. Configuring the router settings away from their defaults is critically vital. Also it is most advisable to use a software firewall, such as ZoneAlarm or Windows Firewall - it adds yet another layer of security.
It is vital to change the default settings of your router, because criminals who manage to hack into it by using the well-known default usernames and passwords can change settings that can cause disasters. This can happen simply because routers are programmed via a browser, using an Internet Protocol (IP) address that is allocated from a block reserved for this purpose. In most cases, both the default username and password are "admin" and most domestic users never bother to change them. This leaves their routers wide open for criminals to exploit. For instance, a hacker who gets into your router settings menu can change the Domain Name Services (DNS) table and seamlessly redirect you from a legitimate banking website to a bogus phishing site that will steal your banking username and password, even when you enter the legitimate banking website's URL into your browser address line manually.
Securing a router is quite simple. Follow these steps:
Once the new router is secure, then you can enter your ISP's connection settings, plug in the phone line or cable from a modem and connect to the Internet. Always be very careful of which programs you allow to operate through the firewall and check that they are legitimate and not malware. Never be complacent about security, because every day, hackers find new tricks that can compromise your computer and data.
On average, a whopping 25% of computers in the USA are infected by malware. It is estimated that 59 million users in the USA have spyware or other types of malware on their computers, Cyber criminals can control those computers and use them to send out millions of spam emails and also to blackmail companies into paying ransoms so that the criminals do not launch Distributed Denial Of Service (DDOS) attacks to bombard their websites and make them crash, thus affecting their trading.
Even worse, criminals who control those computers can install keylogging software that secretly harvests usernames and passwords of people who make bank and business transactions on the Internet and clean out their accounts. Once a computer is compromised by malware, anything could happen.
Always ensure that no spyware is loaded onto your computer. Install a good antivirus program and make sure it is always active whenever you are connected to the Internet. Install a spyware checker and scan your hard disk for malware at least every few days. But the best precaution against malware is to not install any software that is suspicious or that is obtained via links in emails. In fact, clicking on email links is a nice piece of social engineering used to full advantage by cyber criminals, who know that most people are tempted to click on interesting sounding links.
One of the best ways to prevent sensitive computer data from being hacked or read by others is to encrypt it. There are many encryption programs available and some of the better ones cannot be broken even by the world's most powerful supercomputers. Use encryption software that has a 256 bit algorithm and if it does not have a backdoor built in, it will be next to impossible to break, even by the most sophisticated and powerful computers.
It is vitally important to use passwords that are very unusual and that would be hard to crack. Even though heavily encrypted files are virtually impossible to crack, password-cracking software that uses brute force methods of running through every possible letter and number combination in the alphabet can eventually guess a password only used by these characters.
To make it nearly impossible for anybody to succeed in cracking your password, use characters that are not available by normal keystrokes. Most people do not realise that a vast range of computer characters, such as foreign language letters and strange graphic and mathematical symbols can be typed using American Standard Code for Information Interchange (ASCII) codes. These can be generated on any keyboard by holding down the "Alt" key and typing in the particular ASCII number for the characters you wish to use. You can download an ASCII table with the characters and keystrokes from many websites on the Internet. Here are just a few extended ASCII characters:
If you invent passwords using such unusual characters and symbols, it will make it immeasurably harder for even sophisticated software to guess your passwords, even by brute force. The odds of software-cracking passwords having to try such a massive number of character combinations is monumental, compared with the comparatively easy task of trying to crack passwords composed of standard alphanumeric characters.
The stuff of science fiction, quantum encryption, has now arrived. Quantum cryptography, or quantum key distribution (QKD), uses quantum mechanics to guarantee secure communication. It enables two parties to produce a shared random bit string known only to them, which can be used as a key to encrypt and decrypt messages.
An important and unique property of quantum cryptography is the ability of the two communicating users to detect the presence of any third party trying to gain knowledge of the key. This results from a fundamental part of quantum mechanics - the process of measuring a quantum system in general disturbs the system. A third party trying to eavesdrop on the key must in some way measure it, thus introducing detectable anomalies. By using quantum superpositions or quantum entanglement and transmitting information in quantum states, a communication system can be implemented that detects eavesdropping. If the level of eavesdropping is below a certain threshold a key can be produced which is guaranteed as secure, otherwise no secure key is possible and communication is aborted.
The security of quantum cryptography relies on the foundations of quantum mechanics, in contrast to traditional public key cryptography, which relies on the computational difficulty of certain mathematical functions and cannot provide any indication of eavesdropping or guarantee of key security. Quantum cryptography is only used to produce and distribute a key, not to transmit any message data. This key can then be used with any chosen encryption algorithm to encrypt and decrypt a message, which can then be transmitted over a standard communication channel. The algorithm most commonly associated with QKD is the one-time pad, as it is provably secure when used with a secret random key.
Funded by the European Union to counter espionage by the American Echelon espionage system, the first network protected by quantum encryption went live on 10 October 2008. When commercial or public domain versions of such unbreakable quantum encryption technology become available, every person or organisation that has sensitive data or communications should immediately employ it.
If you decide to use an external hard disk drive for data backup, hide it away from your premises if it contains data that you want to keep secret. One quick way to erase data is to install a batch file that will irreparably trash your hard disk with a quick click or keystroke if you get the dreaded knock on the door. Also defragment the hard disk regularly and make sure that it also permanently erases all unused disk space and any unused clusters containing data. These steps are simple and virtually do not cost anything, but will prevent most entities wishing to intrude upon your privacy getting their hands on your secret data. However, this is the least secure way to delete files and will not stop determined people with computer knowledge from recovering erased data.
Do not ever labour under the delusion that if you erase data from a hard disk drive, that it cannot be recovered. Always be aware that there are very sophisticated devices that can recover data from hard disks that have been overwritten and reformatted many times. Deleting files normally does not remove them from your hard disk - you have to use special software to completely remove them. But even when special security software is used to delete files to make them unrecoverable, some parts of them can be reconstituted by using a device called a Spinstand Tester that can read magnetic data that has leaked onto media between the hard disk tracks that have been completely erased. If you have very sensitive data and you really want to make sure that it has been completely destroyed, remove the hard disk drive from your PC, open up its case, pass a powerful magnet over the disk platters and then physically hack the platters beyond recognition.
Most webmail services such as Hotmail or Google Gmail allow you to store files. Therefore if there are files that you don't want others to see, you should not keep them on your personal computer, but upload them to an offshore webmail account. But always remember that others can often gain access to offshore accounts, so this is not entirely secure unless you store your files on a webserver in a nation that has no treaties with Australia and that will rebuff any attempts by Australian entities to access your data on their servers. However, you must ensure that you thoroughly delete the original files from your computer, or better still, keep them on removable media while you are editing and uploading them. It is important to encrypt those sensitive files using encryption software that is known to be unbreakable and that has no backdoor built in so that somebody else can decrypt your data.
One of the best ways to keep sensitive computer files away from others is to never save them to the hard disk drive in the first place. With the advent of inexpensive USB flash RAM drives, often called memory sticks or pen drives, you can keep your sensitive files on a USB memory stick, edit them as required, then unplug the memory stick from the computer. If you set the computer's parameters to never cache files on the hard disk, then once the computer is switched off, any data in the computer's memory pertaining to the files on the USB memory stick is lost permanently. The nice thing about USB flash memory sticks is that they are very cheap, very small, easy to hide and easy to completely destroy very quickly if necessary.
USB flash RAM memory sticks may be small and portable, but the ultimate removable device for data storage, concealment or instant destruction at this time has to be the microSD flash memory card. If you have not seen a microSD card in the flesh, check it out - you won't believe how tiny it is. It is only 15mm x 11mm and fractionally under 1mm thick. Just to give you a size comparison, a microSD card is less than a quarter of the area of an average 35mm x 20mm Australian postage stamp. In fact a microSD card is smaller than the average man's thumbnail.
With capacities up to 64GB at the moment, plenty of sensitive data can be stored and accessed on microSD cards and hidden so that nobody will ever find them. For instance, on just one 64GB microSD card, you can store a whopping 32,000 2MB video clips, or 128,000 images of 500kb size - on a device smaller than your thumbnail.
In case of an unexpected raid, a microSD card with sensitive information can be immediately crushed completely, thus destroying any hope of recovering data from it, In fact, a microSD card can be chewed and swallowed instantly. An encrypted backup of the data on the microSD card should be kept on an offshore server that is not accessible to anybody else, especially authorities or people who could use the information against you legally.
A microSD card is used like an external hard disk drive. Plug it into your card reader or a USB adaptor and store all your sensitive files on it and view them, edit them, do whatever you want with them, then remove the microSD card from your computer and there's nothing left there for anybody to see. The microSD card is so small that it can be hidden anywhere and would be almost impossible to find if you were creative.
There are already gadgets available to conceal microSD cards in the most unlikely places. For instance, a hollowed-out coin containing that microSD card can be thrown into a jar of foreign coins and even if a searcher examined the jar, he would not try and test every coin to see if it was indeed a fake coin containing the sensitive material. This is just one of many ways to conceal a microSD card. Another good way if you are travelling is to literally stick it to yourself under a plastic Band-Aid type strip, put it inside the back of a watch or even in the centre of a cream biscuit in your lunchbox. The possibilities for secure concealment are endless.
But the idea is to not be caught at all with anything that is embarrassing. You might say that you could store those sensitive files on an offshore website and access them via the Internet. Yes that's right, but you may be some place where you need to use those files but don't have Internet access, such as travelling in a remote area with your laptop. However, you can always carry the microSD card with you and use it wherever you want, but in an extreme case where you have no choice but to not be caught with sensitive data, you can destroy the microSD card instantly literally by chewing it up and there's nothing anybody can do to recover it or the data on it.
So let's say you are sitting at your PC looking at some sensitive files that are on the microSD card and you get the dreaded knock on the door. If somebody bursts in to search your premises, seize your computer and look for anything incriminating, you can just chew the microSD card up on the spot like a small wafer and swallow it. If you chew the tiny card up, nobody will ever recover anything from it. But you need to have a backup of your files, or you will lose them totally in such a scenario. This is what to do.
Using microSD cards is a great way to have easily accessible data files and other sensitive material that can be kept out of the hands of others or used against you. They are relatively inexpensive, but whatever it costs you is far cheaper than the consequences of being embarrassed or prosecuted for having material that you don't want to be caught with, or for anybody else to see. I am a firm believer that a person's privacy is sacrosanct and I protect my own privacy with a vengeance, even though I have nothing whatsoever to hide. It's a point of principle with me and I consider that everybody should learn how to protect themselves against invasions of privacy.
There are many good and often free email encryption programs available that can be used to prevent the reading of your sensitive emails if they are intercepted. Software such as Pretty Good Privacy (PGP) is excellent and easy to use. After Phil Zimmerman, the legendary encryption genius put PGP onto the market, the US government tried to legislate to force encryption software authors to put backdoors into all encryption programs so that they could decrypt data and emails that they considered to be sensitive or vital to US interests, however they were defeated. In any case, users still need to ascertain that the encryption software they choose does not have any backdoors or spyware that can compromise their computers.
This is the way to communicate securely with another person using email facilities, which does not involve actually transmitting emails. This is what to do:
The beauty of this method is that nothing is sent, therefore there is nothing for anybody to intercept. Neither you nor your contact are saving any data on your personal computers, so if they are seized, nothing will be found. If you use this method, ensure that your browsing history is always deleted by setting the history cache to zero as the default and manually erasing any temporary Internet files.
Of course this method relies on both you and your contact maintaining complete secrecy and never divulging the URL, log-in details or encryption passwords to anybody. Hopefully both you and your contact will delete all messages immediately after reading them, so that even if authorities somehow manage to get into that dead drop email account, they will find nothing.
Possibly even better than the email dead drop account is the video call message technique. This is so simple that it is ludicrous, yet if you and your contact maintain security, you will never be caught or compromised. Here is the way to do it.
How simple is that? Unless the authorities actually intercept the actual video feed, which is highly unlikely, as Skype is encrypted on the fly, then nothing is sent or received and the paper that the messages are written on can be destroyed on the spot. Even if authorities install surveillance malware such as a keylogger, this method beats it completely, as the keyboard is not used to send any part of the messages.
With smartphones such as the RIM BlackBerry, the HTC PDA phone range, Apple iPhone and other PDA phones that have the capability of storing huge amounts of data, as well as being able to connect to the Internet and Wi-Fi hotspots, users of such devices need to ensure that nobody can get any information from them.
If a smartphone is stolen, it's not just its loss that hurts, because buying a new smartphone is not that expensive any more. However, if the data in the phone's memory is sensitive, it could cost the owner a fortune and even bring down a company. It is critical to ensure that if such a smartphone is lost or stolen, that it literally becomes nothing more than a brick in whoever's hands it falls into.
Here are some important measures that every owner of a smartphone should implement.
Mobile phones are transmitters that constantly send location information to the cells nearby. Nearly everybody forgets that their location can be pinpointed wherever they are at any time and this information is stored in the phone service provider's logs. Many criminals have been nailed by the police because their mobile phones put them in the vicinity of their crimes at the time they were committed and shot down their phoney alibis. The well-known case of murderer Phuong Ngo relied on his mobile phone records placing him at the scene of the murder of politican John Newman.
So if you want to go somewhere and do something that you don't want anybody to find out about, either leave your mobile phone at home, or if you need to take it with you, just pull the SIM card and battery out of it. If you have a mobile phone without a removable battery, such as an iPhone, simply remove the SIM card from it and switch the phone off.
Always remember that your private data is only as secure as you want it to be. If you take all precautions to keep your private files out of the hands of others, then chances are that anything sensitive that could land you in trouble will not be found. Being paranoid does not mean that you don't have real enemies, so never be complacent about securing sensitive data. And never forget that your best friend can suddenly become your worst enemy, so if you want to keep something secret, don't tell anybody, not even your best friend.