<no title> — Digital security and privacy workshop documentation

title: ‘Secure Your Phone’ slug: secure_your_phone

# A SECURE PHONE IS ALWAYS THE FOUNDATION!

Your phone is one of the most critical components of your digital ecosystem. Phones are essential to communication, strategizing, and community organizing. Most people around the world communicate primarily through their mobile phone, followed by their computers and tablets. However, for these very reasons, governments and corporations throughout the world use data collected through our phones to perform extensive surveillance.

As useful as it is, it is better for you to think about your phone less like an assistant and more like a frenemy. Your phone in the wrong hands can be a portal to serious violations of your privacy and security. Below is a graphic that shares all the different ways your phone collects and shares your personal data with cell phone service providers and phone manufacturers. This vulnerability may allow governments and hackers to access information about your physical location at any time, even when it’s turned off.

        <div class="well none" style="border-radius:0">
              <span class="warn-icon"><i class="fa fa-exclamation-triangle" ></i></span> <span class="warn-highlight">WARNING: </span><span class="warn-text" markdown="1">Are you aware that your phone's camera and microphone can be used without your consent? Governments or malicious individuals can turn on your phone’s microphone and camera to listen and film you you even when your device is inactive. Protect yourself from these kind of attacks by covering your camera with a sticker and being concious of where you store your phone in relationship to your sensitive conversations. </span>
            </div>
         </div>

Today, law enforcement agencies use technology that provide police with data about the identity, activity, and location of any phone that connects to targeted cell phone towers over a set span of time. A typical broad data search covers multiple towers and wireless providers and can net information from thousands of phones—without the need for warrants.¹

Organizations such as the American Civil Liberties Union (ACLU) and Electronic Privacy Information Center (EPIC), say that the power of even small-town police departments to quickly obtain cell phone data results in the erosion of privacy and the violation of Fourth Amendment protections against unreasonable search and seizure. But thanks to a unanimous Supreme Court decision in Riley v. California, this practice is now officially legal.²

In extreme circumstances, to prevent all tracking of your location from your phone the best option is to leave your phone at home. If that is not an option then shut the phone down and remove the battery. This is the easiest way to ensure that you can’t be tracked,but it comes at the price of not being able to use your phone at all. If you need access to any data on your phone, back it up to a notebook or a computer before you power down your device.

If your phone’s battery cannot be removed, another option is using a Faraday Bag. A Faraday bag is a bag which blocks the transmision of electronic fields.³ Not all faraday bags are created equal and in order to use a faraday bag effectively you should test the bag. You want to confirm that, at a minimum, cell and GPS services are blocked.

To begin testing place the phone as close as you can to your router. If your phone does not receive the texts then the faraday bag is effectively blocking your cell transmissions. Do the same by testing a GPS enable application. If you find that the phone is blocking that as well then the bag is working. If you are unsure about how to do this process please work with a digital security professional as you do not want to risk being wrong. before putting the bag to use in everyday life.⁴

In addition to these scenarios, we face threats of information leaks during the everyday use of our phones. There are several simple safe practices that can be adopted to keep ourselves and our information safe. In the following section, we will explore a few of them.

NOTE: The “Secure Your Phone” section is broken up to address actions for Androids and iPhones separately. Please find the section that works for your device and begin.

# SECURE YOUR ANDROID

## 1. LOCK YOUR SIM

If your phone uses a SIM card, you can set a lock on the card so it cannot be used by anyone who does not know the code. If your SIM is stolen, this measure can protect your identity.

Enable Lock SIM card by going to Settings → Personal → Security → Set up SIM card lock. Now, each time your phone is turned on it will require a PIN in order to unlock your SIM card. No one will be able to make calls using your device without the PIN.

![](/images/Curriculum_img_13.jpg)

## 2. SET UP YOUR PIN AND ACTIVATE A SCREENLOCK

We recommended setting your phone by using the PIN or password option to secure who can enter your phone. A PIN or password offers more protection then fingerprint ID’s against law enforcement or theives. A good PIN/PASSWORD would be at least six digits long and does not use any of the following items:

Simple number sequences like 1234 or 0000 (including repetition: 1122 or 2233)
Significant dates such as your birth year or spouse’s birthday.
Any part of your Social Security Number.
Any part of your address or phone number.
Longer PINs are safer than shorter PINs because there are more ways to mix the numbers together. For example, if you use a four digit PIN, there are 10,000 possible variations (starting with 0000, 0001, 0002, and so on). With a six-digit PIN, there are one million possible codes, so it’s harder for thieves and computer programs to successfully guess your PIN.

Set up a screen lock by accessing Settings → Personal → Security → Screen Lock, to ensure that lists, pictures, and a code, pattern, or password need to be entered in order to unlock the screen.

NOTE: We highly recommend that people DO NOT use the fingerprint login, as you could be forced or manipulated into putting your finger on your screen. There are also more legal protections for the PIN versus the fingerprint login or even swipe access to one's phone. Finally, it is never a good idea to give your biometric data like a fingerprint to a corporation if you can avoid it. So when in doubt use a PIN!

## 3. ACTIVATE A SECURITY LOCK TIMER

Once you have set your PIN/Password the next step is to activate your security lock timer. This determines the amount of time your phone will be open before the phone locks itself. You will vary this time based on the risk of your current activity. For maximum security, always choose the shortest possible time frame that suits you without becoming too taxing. You can always adapt your times to your activities as well. So if you use your phone for recipes keep security lock timer off, but then turn it back on when you resume regular activity. Use your risk assessment to figure out what makes the most sense for you.

Go to Settings → Display → Sleep. Different versions of the firmware use different names for this menu so you will have to find the one that matches your phone. Now select a time period that is appropriate to your usage habits in the pop-up menu that appears. The change will take place immediately.

## 4. ANDROID ENCRYPTION

With Androids, encrypting your phone is one of the best ways to protect your data if the device is ever stolen, seized, or confiscated. Encryption in the simplest of terms means the scrambling of data with complex math. The purpose of encryption is to ensure that only someone who is authorized to access your phone’s data will be able to read it using the decryption key.

When your phone is encrypted, its data is stored in an unreadable jumbled form. To If your phone is stolen, confiscated, or lost, this feature can protect data like your home address, email, bank accounts, communications, and other sensitive data because your phone cannot be used unless the encryption is unscambled by your PIN/Password.

When you enter your PIN or your pattern on the lock screen, your phone decrypts the data, making it understandable and accessible to you. Without the encryption PIN or password, a malicious actor can’t access your data. This is why Encryption is one of key building blocks of securing your phone.

NOTE: Before starting the encryption process, ensure your phone is backed up, fully charged, and plugged into a power source. This ensures that the encrypting process is not interrupted. If it is interrupted, and your data is lost or damaged, you will have a backup of all of your data.

To begin encryption find out whether or not your Android has Encryption enabled. Some versions of Android come with Encryption already set up while others need to set it up manually. To discover where your phone is at please first visit Settings → Personal → Security → Encryption.

If Encryption is enabled it will say it here clearly. If not then your next step will require you to set a screen lock password (described above).

Once your PIN is selected make sure you phone is fully charged and backed up as you will not want to disturb the Encryption process. A back up also ensures that if anything goes wrong during encryption that your data is protected and your phone can be restored.

Once the phone is ready and plugged in, please begin by hitting Encrypt. The process should last anywhere from 30 min to a couple of hours.

## 5. ADJUST YOUR NETWORK SETTINGS

We recommend keeping most networks turned off and only manually enabling them when necessary. One example is Bluetooth.

If your device supports Near Field Communication (NFC), it will be switched on by default and must be disabled manually.
Finally also, ensure that tethering and portable hotspots are switched off when not in use.

## 6. YOUR LOCATION SETTINGS

Many people do not realize how much location information your phone is sharing with both phone manufactures and the companies who create the apps you use. One way to begin minimizing this information is to monitor and change your location settings on your phone. You can do this in your Android by going to the following settings.

Switch off **wireless **and GPS location (under Location Services) and mobile data (under Settings → Personal → Location)

NOTE: Only turn on location settings if necessary. When these services aren’t running by default in the background, it reduces the risk of location tracking, saves battery power, and prevents unwanted data streams initiated by applications or your mobile carrier.Keep in mind this only minimizes the sharing of your information with corporations. It does not however to prevent government surveillance of your locations. If you are concerned about this please review the faraday bag section.

## 7. HIDING CALLER ID

You can hide your phone number from showing up to the person you are calling by adjusting this setting on your Android.⁵ However, you should note that your phone carrier and legal authorities will still have full access to logs showing who you called and when.

Go to Settings and then tap on Call → Additional Settings → Caller ID → Hide Number and it will be blocked.

## 7. UPDATE YOUR ANDROID

To ensure that your phone remains secure, we strongly recommend you keep your phone and its software updated. These updates are crucial to keep the phone functioning and more importantly contain software patches to address the most recent malware threats. Keep in mind that before you update always always backup your data! There are two types of updates to check for:

Updates for the phone’s operating system. Go to Settings → About phone → Updates → Check for Updates
Updates to individual apps you have installed: Open the Google Play Store app, and select My Apps from the side menu.

NOTE: It is important to always update your phone’s software from a trusted location—such as your Internet connection at home—somewhere like an Internet cafe or coffee shop.

##8. ADD APPLOCK FOR EXTRA PROTECTION

Security needs can arise from simple scenarios. You might hand your phone to someone so they can make a call or look at a picture. You might even be stopped by the police or have your phone confiscated. While you have consented to allow these users to use one application you may want to be able to have additional discretion about whether they can access other apps that you have not given them permission to use.

Fortunately, there are ways to keep certain applications readily available while others are locked down. Keeping a password lock through an app like Applock8 on your phone prevents casual snooping through your contact numbers, texts, and data. In addition to requiring a passcode to unlock your phone, you can also download software that allows you to set a code for individual apps.

We recommend using AppLock8 on Androids. AppLock is a free app that extends your phone’s access controls to specific applications.

Once you download, install, and open AppLock, you will be prompted to create a password. This is used whenever you re-open AppLock, as well as when you want to access any of the apps you will be protecting, so make sure it's a password you can easily remember. You'll also need to provide a security e-mail address.

After that, you are all set to start locking individual apps, such as Phone, Messenger, Facebook, and so on. If you want to lock the Camera app, for example, you'll simply tap the lock icon.

Now it is locked, and if you want to access your phone's camera, you will be prompted to enter your passcode.

## 9. DEALING WITH METADATA ON PHOTOS

Photos we take on all electronic devices can often carry data that can be used to pinpoint our location and gather other information about us.

This information can be intercepted and gathered as part of the surveillance of our movements and habits. These details are often shared through the metadata of the picture. Metadata simply means data that provides information about other data. The Metadata in our phone photos will have additional data that would be useful to categorizing, locating, or describing a file.

Many of the files we use and create on our phones have metadata, including emails, text messages, and photos. So one of the ways we can secure our phones is by minimizing the metadata our phones share while we communicate.

The metadata in photographs are known as the Exchangeable Image File Format, or EXIF. This can reveal much about you, your subject, and where a photo was taken. Metadata embedded in a photo includes the following:

Key identifying information, such as camera or cell phone user, GPS coordinates, and the time and date the photo was taken.
Camera settings, including static information such as the camera model and make, and information that varies with each image such as orientation (rotation), aperture, shutter speed, focal length, metering mode, and ISO speed information.
A thumbnail preview of the picture on the camera’s LCD screen, in file managers, or in photo manipulation software.
Descriptions of a photograph’s content.
Copyright information.

The metadata of an image is not always bad or always good. It really depends on your user needs. For example if you are shooting content that might be used to document a protest or even a police brutality incident then metadata could be a very crucial layer of additional information that further be used to establish the historicty of your image and bolster its use as evidence. Other times we don’t want to share metadata because it can reveal sensitive information or feed corporate tracking of our lives. Only you can decide and it is our hope that these two workflows can help restore your consent to the way your photos are used.

NOTE: Different versions of Android may have different ways to get to the settings described in this section. We describe the general method but do a little searching around the settings areas of your particular version of phone to make sure you achieve the same.

SWITCH OFF LOCATION TAGGING FOR YOUR CAMERA The first step to minimizing the metadata in your photographs is to change your Camera app setting and disable geolocation. You can find that setting by opening the Camera app and tap the circle to the right of the shutter button. From the resulting menu, tap the Settings icon. Now, in the settings menu, tap the “Location” button. You can tell that geolocation is now disabled because of the icon overlaid on the options button.

INSTALL A THIRD-PARTY APP FOR SCRUBBING METADATA FROM IMAGES

Now we will work to scrub, or remove, existing metadata from images we have taken on our Android. To do this we recommend installing and using Exif Eraser for Android.

After installing Simply pick one or more photos with EXIF information from the Gallery or the app.

Choose whether you want to replace the photo, create a new copy, or simply share the photo (e.g. to Facebook).

Then, you are free to share your EXIF-free photos without compromising your privacy.

# SECURE YOUR IPHONE

## 1. ACTIVATE YOUR PIN AND SCREEN LOCK

We recommended setting your phone by using the PIN or password option to secure who can enter your phone. A PIN or password offers more protection then fingerprint ID’s against law enforcement or theives. A good PIN/PASSWORD would be at least six digits long and does not use any of the following items:

Simple number sequences like 1234 or 0000 (including repetition: 1122 or 2233)
Significant dates such as your birth year or spouse’s birthday.
Any part of your Social Security Number.
Any part of your address or phone number.
Longer PINs are safer than shorter PINs because there are more ways to mix the numbers together. For example, if you use a four digit PIN, there are 10,000 possible variations (starting with 0000, 0001, 0002, and so on). With a six-digit PIN, there are one million possible codes, so it’s harder for thieves and computer programs to successfully guess your PIN.

So lets get started with setting up your iPhone. The first step is to set up the PIN passcode. Some phones may also allow you to set your fingerprint as your password through Touch ID. We absolutley do not recommend setting up Touch ID, as there are more protections for PIN Passcodes then there are for Touch Id. Further you can be physically compelled to open your device against your will. That is why we recommend setting a strong PIN and consider creating one that is alphanumeric.

To set these up, go to **Settings → Touch ID & Passcode**. On devices without Touch ID, go to Settings → Passcode.

Tap Turn Passcode On. Then, tap Passcode Options to switch to a four-digit numeric code, a custom numeric code, or a custom alphanumeric code.

You should choose a code that is at least six digits long. If you have simple code selected, tap Change Passcode, enter your current code, then choose a harder sequence. Enter your passcode again to verify and activate it.

Additionally, when you set up your passcode, there is an option to erase data after too many failed attempts. If you have this option selected, your phone will erase all the data after 10 failed passcode attempts. Once this data is erased, it’s gone from your device. However if you’ve been backing up your phone you can restore it from your most recent backup information.

Different versions of iPhones may have different ways to get to the settings described in this section. We describe the general method but do a little searching around the settings areas of your particular phone to make sure you achieve the same results.

Additionally if you want further protection you can also lock your SIM Card. Learn more about how to do that here.⁶

        <div class="well none" style="border-radius:0">
              <span class="warn-icon"><i class="fa fa-exclamation-triangle" ></i></span> <span class="warn-highlight">WARNING: </span><span class="warn-text" markdown="1">We highly recommend that you DO NOT use a fingerprint login, as you can be unwillingly compelled to place your finger on the home button.</span>
            </div>
         </div>

## 2. ACTIVATE YOUR SECURITY LOCK TIMER

Once you have set your PIN/Password the next step is to activate your security lock timer. This determines the amount of time your phone will be open before the phone locks itself. You will vary this time based on the risk of your current activity. For maximum security, always choose the shortest possible time frame that suits you without becoming too taxing. You can always adapt your times to your activities as well. So if you use your phone for recipes keep security lock timer off, but then turn it back on when you resume regular activity. Use your risk assessment to figure out what makes the most sense for you.⁷

Go to the Settings → Display & Brightness → Auto-Lock.

![](/images/Curriculum_img_28.jpg)

Choose the time interval. This means that, if you have not used your phone for the amount of time specified, it will automatically lock. Do not choose “Never”, as that will leave you vulnerable; instead, select an interval between 30 seconds and one minute.

If you are running iOS 9 or iOS 8, the lock screen option is available in Settings → General → Auto-Lock → Time interval.

## 3. IPHONE ENCRYPTION

Encryption is essentially one of the best ways to protect your iPhone’s data if it is stolen, seized, or confiscated. Encryption in the simplest of terms means the scrambling of data with complex math. The purpose of encryption is to ensure that only someone who is authorized to access your iPhone’s data will be able to read it using the decryption key.

When your phone is encrypted, data is stored in an unreadable jumbled form. If your phone is stolen, confiscated, or lost, this feature can protect data like your home address, email, bank accounts, communications, and other sensitive data because your phone cannot be used unless the encryption is unscambled by your PIN/Password.

When you enter your PIN or your pattern on the lock screen, your phone decrypts the data, making it understandable and accessible to you. Without the encryption PIN or password, a malicious actor can’t access your data. This is why Encryption is one of key building blocks of securing your phone

With Androids, you must enable device encryption, but almost all current Apple devices encrypt their contents by default. However, to protect yourself from someone obtaining your data by physically stealing your device, you need to tie that encryption to a passphrase or code that only you know. If you do not have your PIN Passcode activated that Encryption will not be enabled on your phone.

Once your passcode is set your phone is now encrypted. What is crucial then is to only back up to your computer or hard drive and never to icloud.This can be hard for folks because part of the ease of the apple ecosystem is the convenience of syncing content between your different apple devices. However if you backup your content to iCloud you know are allowing Apple to be a third party that can weigh-in on who can access your data. We recommedn that you retain maximum control of your data and break up with iCloud today and move to backing up your phone to an external hard drive.

Once you’ve set a passcode, scroll down to the bottom of the Touch ID

&

Passcode Settings page. You should see a message reading “Data protection is enabled.” This means that the device’s encryption is now tied to your passcode, and most data on your phone will require that code to unlock.⁸

        <div class="well none" style="border-radius:0">
              <span class="warn-icon"><i class="fa fa-exclamation-triangle" ></i></span> <span class="warn-highlight">WARNING: </span><span class="warn-text" markdown="1">Do not use iCloud to back up your phone. Always back up your content to a hard drive or your own computer. iCloud backups allow Apple and other third parties access to your data. For instance, if they receive a subpoena to release your personal information to the authorities, there is no guarantee they will be successful guards of your content. That is a lot of trust to give to a corporation. Use your risk assessment to decide what is best for you. At Equality Labs we rarely give our data to corporations for this reason.</span>
            </div>
         </div>

## 4. TURN OFF LOCATION SERVICES

Many people do not realize how much location information your iPhone is sharing with both Apple and the companies who create the apps you use. One way to begin minimizing this information is to monitor and change your location settings on your phone.

The first time an app tries to access your location it will ask for your permission, even when it’s running in the background. The app’s developer may also explain how it uses your location.

Some apps will ask to use your location only while the app is in use. An app is considered “in use” when you are actively using it in the foreground or when it’s running idly in the background, which the status bar will indicate. Other apps will ask for access to your location even when they are not in use. Your operating system will remind you which apps have this access with pop-up notifications, triggered when an app uses your location in the background.⁹

You can control your phone’s location settings at Settings → Privacy → Location Services. You can turn Location Services on either during the initial Setup Assistant process or later via the Location Services screen. After this, you will be able to control which individual apps and system services have access to your location data.

When Location Services are turned completely off, no apps can use your location in the foreground or background. This may limit applications like Maps and GPS requiring services like Uber or Lyft. Keep in mind that this workflow only addressed corporate location tracking because your phone can still ping information about your location. If you are concerned about a government agency tracking your locations then the best option is to leave your phone at home or review the section in the curriculum about farraday bags.

NOTE: Only turn on location settings if necessary. When these services aren’t running by default in the background, it reduces the risk of location tracking, saves battery power, and prevents unwanted data streams initiated by applications or your mobile carrier.Keep in mind this only minimizes the sharing of your information with corporations. It does not however to prevent government surveillance of your locations. If you are concerned about this please review the faraday bag section.

## 5. GUIDED ACCESS FOR IPHONES

Whether you’re working for an organization that wants to use iPhones to display information or you’d simply like your child to focus on their homework app, you can use Apple’s Guided Access feature to lock your screen on one specific app.

Built as an Accessibility feature, Guided Accees limits users to one specific app, preventing them from switching to another program or returning to the Home screen. This can be extremely useful in a number of settings, including organizing,research, and businesses. Whatever the task Guided Access helps make sure that all attention remains on that app. It also prevents you from accidentally exiting to the Home screen or another app when you don’t mean to.

Guided Access can even be used to create a “guest mode,” allowing you to hand your device to someone so that they can use Safari, iBooks, Video, or a game without having to worry that they’ll snoop through your personal information.

This is because Guided Access keeps your iPhone in a single app, lets you disable areas of the screen that aren’t relevant to a task, and disable the hardware buttons. You can even end a session by entering a passcode to return your iPad or iPhone to normal mode.

You can use Guided Access to:

Temporarily restrict your iOS device to a single app.
Disable areas of the screen that aren’t relevant to a task, or areas where an accidental gesture might cause a distraction.
Disable the hardware buttons.

Go to Settings and tap General → Accessibility → Guided Access. Under Guided Access, toggle Guided Access to ON.

This will give you an option for—Passcode Settings. Now, you can set a Guided Access password.

With this, you have successfully enabled the Guided Access feature and can now lock Apps. To do so, open the app you want to lock, for instance, the Camera app.⁹

Next, triple-click the home button. This will give you options to restrict features within an app, as shown below. This is the best part of this feature, you may have already seen apps that lock other applications, but the ability to lock specific features within an app is new and different. Simply circle any areas of the screen you would like to make inaccessible.

Tap on Options in the bottom left corner to choose whether you want to grant access to the sleep/wake button, volume buttons, touch screen, and motion. Tap Done to save your selections. Tap on Start at the top of the screen to begin Guided Access.

Once Guided Access is enabled, anyone trying to use or leave a specific app will require the passcode. Without the code, he or she will not be able to exit Guided Access.

## 6.DEAL WITH THE METADATA IN YOUR PHOTOS

Photos we take on all electronic devices can often carry data that can be used to pinpoint our location and gather other information about us.

This information can be intercepted and gathered as part of the surveillance of our movements and habits. These details are often shared through the metadata of the picture. Metadata simply means data that provides information about other data. The Metadata in our phone photos will have additional data that would be useful to categorizing, locating, or describing a file.

Many of the files we use and create on our phones have metadata, including emails, text messages, and photos. So one of the ways we can secure our phones is by minimizing the metadata our phones share while we communicate.

The metadata in photographs are known as the Exchangeable Image File Format, or EXIF. This can reveal much about you, your subject, and where a photo was taken. Metadata embedded in a photo includes the following:

Key identifying information, such as camera or cell phone user, GPS coordinates, and the time and date the photo was taken.
Camera settings, including static information such as the camera model and make, and information that varies with each image such as orientation (rotation), aperture, shutter speed, focal length, metering mode, and ISO speed information.
A thumbnail preview of the picture on the camera’s LCD screen, in file managers, or in photo manipulation software.
Descriptions of a photograph’s content.
Copyright information.

The metadata of an image is not always bad or always good. It really depends on your user needs. For example if you are shooting content that might be used to document a protest or even a police brutality incident then metadata could be a very crucial layer of additional information that further be used to establish the historicty of your image and bolster its use as evidence. Other times we don’t want to share metadata because it can reveal sensitive information or feed corporate tracking of our lives. Only you can decide and it is our hope that these two workflows can help restore your consent to the way your photos are used.

NOTE: Different versions of iPhones may have different ways to get to the settings described in this section. We describe the general method but do a little searching around the settings areas of your particular version of phone to make sure you achieve the same.

SWITCH OFF LOCATION TAGGING FOR YOUR CAMERA

iPhone: Open the Settings app, then tap Privacy. Tap Location Services, find and tap Camera in the list of apps. Under, Allow Loaction Access, select Never.

INSTALL A THIRD-PARTY APP FOR SCRUBBING METADATA FROM IMAGES Now we will work to scrub, or remove, existing metadata from images we have taken previously on our iPhone. To do this we recommend installing and using PixlMet for iPhones. PixlMet helps return to consent to your understanding of what you are sharing with your metadata by showing you in its library the metadata for any given photo stored on your phone. It also allows you to share the photo to social media with or without this data whne you send it through the app.

NOTE: When removing metadata from a photo that is about to be shared, PixlMet makes a copy of the original photo and only removes metadata from the copy. The original file remains unmodified in your photo library.