Security on the move: can the Umbrella safety app help freelancers?
There are a lot of safety resources out there, for all shapes and sizes of journalist. When it comes to resources purpose-built for your mobile handset, however, the list gets shorter.
One app that's been on the market for over 6 months is Umbrella - built by Security First. As the first in a series of blogs reviewing new and innovative tools for freelancers, we talked to co-founder and CEO Rory Byrne, to get to grips with how Umbrella actually works. We also talked to freelancer Emma Murray as well as digital security expert Andrew Lyons to see what they thought of the app.
RPT: Tell us a bit more about Umbrella - what does it do, and why did Security First come up with the idea?RB: Umbrella app is an all-in-one guide to security for freelancers and activists on the move. It contains the latest advice on everything from how to send a secure email to how to deal with a kidnapping.
The idea came to us a few years ago when we regularly came up against a number of problems with the tools available for security. They weren’t easy to use, they focused on digital not physical, didn’t really look at prevention, and were highly segmented. Often tools and information were available only on PC – which wasn’t much use to people in a dynamic, moving emergency or who only access the internet on their mobile device. It’s basically the tool we would have wanted when we were working operationally in the field.
How does the app actually work?A user downloads the app from Google, F-Droid or directly. When they open it up they can they then have a menu of various security lessons. They choose which lesson they want and they get to pick beginner, advanced or expert depending on their needs and risks. From there they go through simple security lessons. At the end of each lesson are links to more resources and also checklists – which they can use as a quick reference in future.
They can also go to the security dashboard, where they can input their city or country and get updated security feeds from the UN and Centers for Disease Control.
Anything related to a mobile phone carries some level of risk. They have some inherent security problems compared to a secured PC or using pen and paper. However, they also offer significant amount of useful security depending on your threat model. We’ve built Umbrella using best practices such as allowing password protection, encrypting content on the device, minimal permissions and we don’t have access to any of your information.
Is it safe to use whilst on assignment?
As such, we believe that the advantage of using Umbrella to manage such a wide variety of security issues is higher than any potential risks. For example, freelancers are at higher risk of issues like kidnap, so having something like Umbrella which helps them prevent that or respond to it if it happens to a colleague, is useful.
From your experience, what are the day-to-day digital security challenges for local freelancers?
I think it depends on their environments and threat models - and many often struggle to fully identify and mitigate according to the risk.
As we always say at the start of our security training, the biggest security risk for freelancers is often not the one gaining lots of attention ("The NSA wants to hack my phone!”) but the boringly obvious one – car crash, disease and kidnap/terrorism being the most likely source of injury and death.
Avoiding a feeling of fatalism and trying to really embrace these concepts in ways that don’t create too much disruption to their life and workflow is the biggest challenge they face.
Ironically, a digital-centric approach to everything can also be a challenge.
Too often the focus can become “What software do I use?” when the risk
comes from a physical problem (like an insider threat) and the mitigation is a procedural one (not telling everyone in the newsroom what you're working on).
How does the information the app provides stay up-to-date?The security dashboard information is updated as soon as soon as the feeds from the UN and CDC are updated.
The lessons and content are updated on a regular basis by our content authors and through cooperation with other content creation organisations. We are also helping to building a community project to make it easer for other individuals and organisations to contribute content – without the need for technical skill.
What does Umbrella NOT do?Umbrella doesn’t yet integrate the specific tools that we recommend into it. For example we recommend Signal App but we don’t integrate that into Umbrella itself – as doing so would make Umbrella far too big to download.
Umbrella’s lessons will also never replace the importance and learning utility of hands-on security training. We hope it will be a learning aid to people who do such courses and also a guide for people who will never have the opportunity to do them.
REVIEWS OF UMBRELLA APP
After talking to Rory, we thought it would be useful to get some reviews of the Umbrella App.
First we sought the opinion of ANDREW FORD LYONS, our former digital producer and digital security guru, who knows the app and the threats that freelancers face, online and off. Here's what he said:
"Umbrella is a solid information app to have on a mobile. The checklist function in Umbrella is a particularly useful piece of functionality to help a journalist prepare for an assignment. It’s worth noting that the various advice and guides are best used before starting an assignment or heading off into the field, though.
It is aimed at people who probably haven’t gone through a lot of training, and provides a good amount of practical information, but it’s mostly stuff you’ll want to absorb before starting a project, particularly if you’re going to use some of Umbrella’s guides around encryption or secure communications tools."
We also asked freelancer EMMA MURRAY to take the app for a spin and tell us what she thought:"My first thought after reviewing the whole app was ‘this is some really great information, but not a really great application.’ As a teaching module it’s interesting and informative, but I can see it disappearing pretty quickly when I need to free up some hard-drive space.
There’s a few reasons it doesn’t have much staying power for me – first and foremost being its lack of user customisation. There isn’t any place to synthesise information in-app. While the checklists are a good overview of main points, not being able to make my own makes the app fairly useless to me in the long run.
One thing I really liked was the application (web, mobile, etc) recommendations, especially for encryption. It was nice to have simple suggestions and explanations since it can be an overwhelming space to research if you’re not tech inclined.
Overall, I didn’t really get it as an application but I can see the usefulness of the information presented. I would prefer a pdf or ebook, where I could highlight and take notes. To me, that would be highly valuable."
You can download the Umbrella app here.
Umbrella is one of many tools available for freelancers looking to strengthen their physical and digital security. If you haven't used them before, RPT has extensive digisec resources available online here, and safety advice available in 5 languages.
Elsewhere, the Committee to Protect Journalists can help you secure your technology with their online guides, and Tactical Tech have a number of growing projects to help you protect yourself from evolving threats here. Staying safe is also about staying up-to-date - following blogs like wired.com provide news on new threats and combat strategies as they come up.
Image credit: Flickr, Creative Commons License