Privacy Under Pressure (With Harlo Holmes)

0:05Sam:Hello, and welcome to another interview episode of the 404 Media podcast. 404 Media is a journalist-founded company and needs your support. To subscribe, go to 404media.co. As well as bonus content every single week, subscribers also get early access to episodes like this one. Gain access to that content at 404media.co. This week, I'm joined by Harlo Holmes. Harlow is the Chief Security Programs Officer at Freedom of the Press Foundation. She's also a media scholar, software programmer, and activist. Hi, Harlow. I'm so excited to be here. Thank you for having me. Oh my gosh. So good to see you.

0:43Sam:You too. Yeah. So I was just saying off mic that all the things we're going to talk about today are so timely. And so they feel very urgent and pressing. Yeah. And your job has never been more crucial. So I'd love to just kind of start out with an introduction to the Freedom of the Press Foundation, what the work of the foundation is. Folks who are familiar with 404 are probably also familiar with Freedom of the Press, but just to give us an idea of what it is and then also what you do within the foundation. Sure.

1:19Harlo Holmes:I mean, I hope for our listeners are as familiar with us as we are with y 'all. But so Freedom of the Press Foundation is a almost 14 year old 501c3 based here in the United States. And we support press freedom in all of the ways that we can. And right now we do it in three ways. You probably have been most familiar with our advocacy team, which is comprised of legal scholars, lawyers, and audience people, and journalists who track down every instance, large or small, where members of the press have had their right to report trampled upon. And we advocate for them. We file amicus briefs. We issue statements of support.

2:11Harlo Holmes:We hop in on legal cases. We have a newsroom called the U.S. Press Freedom Tracker where that is documented and our reporters there will literally like, you know, go with the case from start to finish with, you know, of course, the consent of anybody involved in order to keep not only like a journalistic record, but also a data record of instances that we've been seeing. And we've been doing this work for, I mean, like, you know, relatively like a long time. And so it's a really, really excellent place to watch the trends in terms of tactics that are waged against members of the press, in terms of like, you know, the chilling effects that it has, and in terms of like where that has been happening across the United States.

3:00Harlo Holmes:So that's one thing that we do. And then maybe you've heard of various like engineering efforts of ours, like SecureDrop, which is the most famous, which is a technical appliance that a number of newsrooms like install in their offices. and that enables technical anonymity between sources and journalists at those newsrooms. But we also have like a number of other things like Danger Zone, which is a really cool tool in order to help you like scrub particular nasties like malware and trackers and stuff like that out of documents that you might come across during a typical day at a newsroom. So you can look at them in safety and share them safely and stuff like that.

3:41Harlo Holmes:And then my team is the security training team where we have like a whole bunch of, you know, writing. So if you want a primer, if you want the blog post, if you want a, it's Valentine's Day coming up, we have these like signal stickers or whatever. Like these are efforts that we perform and we do a number of trainings, consultations, organizational security audits and stuff like that, centered wherever journalism needs us most. And right now it's right at home.

4:11Sam:Yeah, yeah, it's definitely, it's not a far flung issue. And it never has been, but, you know, I think more than ever, many more journalists who maybe weren't like security aware before, probably including myself. I probably am more security aware than a lot of just like members of the public who aren't journalists. But even among like journalists, it's like there's definitely like a gradation of like Joseph Cox is probably the extreme end of most secure journalists. I'm probably somewhere in the middle, but it's, you know, it's dependent on like the things you cover. I actually hadn't heard of Danger Zone.

4:42Sam:I need to check that out. It's definitely something that I need to get up on. And we used SecureDrop at Vice quite a bit. And I think if you're not familiar with SecureDrop, it's actually like a physical thing that you have to go log on to. You have to get access to in a physical space. So it's installed in the office. So I just remember Lorenzo Franceschi Bigrai, who used to work with us at Vice, was the SecureDrop keeper. So yeah, I think I usually need like a refresher or to get up to date and up to speed using Freedom of Press' tools in my work too, because I think, I don't know, I'm like somewhere in the middle of the threat model from extreme to least extreme.

5:31Sam:But who knows? Honestly, it's better to be safe than sorry. Yeah. So as we just talked about, this has been something that is more and more pressing and like urgent for journalists in the U.S., especially under this administration and some of the attacks we've seen against journalists here in the States. are there digital insecurity practices that journalists are using or that have used for years that normal people in the U.S., like people who aren't journalists, should be implementing? Because at this point, if you're at a protest, if you're just walking down the street in a lot of cities in the U.S., you could get your phone taken from you.

6:13Sam:You could be questioned. It's It's something where it feels like a threat to a lot more people than it ever was before. It's not just like you're a journalist doing a sensitive investigation. You're just someone who's recording the police within your right. And you could be at risk of being targeted and having your devices taken away or whatever it is. So are there things that average people should be doing that they're not? What are you seeing in the landscape right now? Yeah.

6:47Harlo Holmes:So I would say that for any person, even if you are a journalist and you're just like being a citizen today, as we are, just situational awareness, I think, goes a long way. And that might not be something that people are used to practicing, especially like, you know, where phones are concerned. if a phone is seized, you definitely do want to make sure that people have an answer to the question, am I using like a really like fantastic, you know, like complex passcode, which is really great in the event that your phone enters into, you know, like some sort of like computer assisted, you know, like a reconnaissance type of situation where there are tools that law enforcement may use in order to extract data from your phone versus do I want to make sure that when I'm walking out in the streets and there might be chaos that I can really, really quickly open up my phone, like with my face, with my fingerprint or with like, you know, like, I don't know, six little digits, like zero, zero, zero, zero or something like that in order to open it up.

8:05Harlo Holmes:And neither of these answers are correct, really. Like one of them is like correct in terms of extraction devices. Another one is correct in terms of keeping yourself as safe as possible and as nimble as possible when, you know, your situation changes on a dime. And instead of just being like a person going to the grocery store, you have to kick into citizen journalism mode. And so finding that sweet spot that makes sense for you, for where you are, and also knowing that that's negotiable. Because if I were a resident of Minneapolis, my calculus would be different than I feel in Brooklyn. you know?

8:46Harlo Holmes:And so all of these things are just like knowing exactly like where the levers are that you need to push and pull, where the toggles that you need to switch in order to make those own calculations for yourself is something that it's like so boring. It's so boring, but it is something that people might want to have to think about. And also, this isn't the first time that we've thought about what it means to participate in democracy, what it means to participate in holding on dearly to your First Amendment rights as a citizenry. And so let's all think back to what it was like in 2020, in 2016, right?

9:33Harlo Holmes:These are all moments where we have felt that. And it's just about remembering.

9:39Sam:Yeah. I mean, I'm definitely getting a lot of like 2020 flashbacks as far as, you know, that's just like refreshers on like your rights at a protest, your right to film the police, your digital safety when you're out, not even just like at a protest or filming a protest, but just, you know, going through your day. And it's definitely something that I also need the reminder of too. It's like your digital security practices aren't fixed for your life. It's like you didn't, you don't have to just like set your pin and never change it. You don't have to like set your password, never change it. You can maybe, and I think this is a really good point that you made.

10:15Sam:It's you can say, I need to be able to get, I need to prioritize getting into my phone very quickly. And maybe that is my fingerprint in this particular day or situation or errand that I'm running, whatever it is, um, versus, you know, not wanting authorities to be able to use your fingerprint against you and because they will because they will and they can they legally can which is such a i mean i think when i first learned that i was

10:44Harlo Holmes:like that's a really wild situation well so i'm i'm not a lawyer but um actually highly recommend going to uh people like jen nelson at reporters committee for free press right um where she makes the very, very clear and kind of dystopian distinction between like, there is definitely precedent that, you know, biometrics can be sought, like specifically, like within a warrant, like we've seen in, you know, like the Washington Post example of just like, you know, two weeks ago. But the law has always been like, you know, kind of like shifting on whether or not that's in breach of our constitutional rights.

11:24Harlo Holmes:Passcode, however, that is. But the thing is, is that in the moment, the damage will already have been done. Whether or not testimony of that kind can be compelled out of you, like that is for a court to decide. But when you're on the street, there's no one to arbitrate that for you. And so you might as well consider. And we also now have increasingly more precedent where there's like, it feels like, you know, that ship has sailed. you should consider biometrics as being something that can be compelled out of you. And so in which case, go through the passcode. And so in which case, one of the things that we would love people to be aware of is, one, if you don't want to use biometrics, okay, don't.

12:11Harlo Holmes:But please don't make it like a stupid passcode that's just easily breakable, right? Because that's another type of damage that you cannot contain at all. But know that at least on all of our various devices, there are gestures that you can learn and within under 10 seconds, if not less, you can kind of toggle between, I'm happy strolling in biometrics mode, walking the dog. And now I fear for my safety and I fear for my possession of my devices. And so now I'm going to wipe biometrics out of the secure enclave, like the local hardware. So it's no longer accessible. And that passcode needs to be introduced again in order to further interrogate a device.

13:03Harlo Holmes:and that's not 100 perfect because you know we're still looking at a state where the phone has been unlocked right so there is a certain amount of information that can be taken out of the device but depending on the device that you have um you know you still have more of a fighting chance

13:21Sam:yeah yeah for sure i mean that's and i think that's something that's really interesting and people should know is just like you can you can actually make that switch on the fly i mean you

13:32Harlo Holmes:You can also power it off too. I mean, the same gesture, like on a typical iPhone, actually, the same gesture that will clear out your biometrics is one that will power off your phone. And that brings you to the state where even better than having a non-biometrically unlockable phone, you're bringing it back to what's called the BFU or the before unlock state, which means that it is entirely encrypted. Absolutely everything is encrypted with some little exceptions but they're like trivial in this case and that even gives you more protection and but that said these are the trade-offs it's like okay like do i want to turn my phone completely off or do i actually need this phone to film this right now so in which case you want like biometrics off and then you just like swipe to the right and you put your you take your camera out you know or whatever and like you know these are the trade-offs that you have to make yeah yeah i

14:25Sam:mean it's definitely um especially filming and being at protests and in 2020 2021 it was something that I think a lot more people were thinking about more seriously was, do I leave my phone home? Do I trade off that security and safety of having my phone with me in case something goes down and I need to record? Or if I need to meet up with the people that I'm with for safety reasons? I might not be able to just head home at the end of the day without my phone. I might need to link up with these people later and make sure we're all good. Or you're getting information in real time on like WhatsApp or Signal or something.

15:02Sam:Yeah, yeah.

15:03Harlo Holmes:Or in your various groups.

15:05Sam:Yeah. So it just felt like such a fraught decision to have to make whether or not to leave the phone home or to bring it. I think most people probably brought it because we are so attached. Yeah. A lot of people do. Yeah. Yeah. And that kind of brings me to something else that I heard you say on the EFF's How to Fix the Internet podcast, which is such a good podcast. And it was a really good conversation about just this topic in general, but you mentioned that the attitudes around digital security and protections are actually very political and they vary between countries and cultures. Can you elaborate on that a little more?

15:45Harlo Holmes:Yeah, I mean, I strongly believe that. And also like my views on that are starting to not evolve, but also like just starting to see more of like historicity around these particular theories. And there are like beliefs or attitudes held by like certain, you know, like cultures that have definitely evolved in recent years in ways that are like incredibly impressive as well. But ultimately it comes to, you know, like how optimistic or pessimistic people are using, you know, the technologies that we pretty much all have in the face of the political climate that is their lived reality. And so that's really, really fascinating.

16:31Harlo Holmes:And so, you know, I would say like maybe, you know, like 10 years ago, there were a number of folks in Central and Eastern Europe who might have felt really, really disenfranchised by technology because they did not necessarily know like, you know, was in control of building it and they didn't have any say in like what that meant for them as people were incredibly like surprised by uh the extent to which their data had been like taken from them and used you know like against them uh and stuff like that um but now i see a lot of like kind of optimism, especially in places where there's more like change in government that just like, on the whole, gives people more, more hope.

17:22Harlo Holmes:Also, this doesn't have to do with like Central and Eastern Europe in particular, but like, there is a really, really interesting, like, recharge of, you know, open source software, Linux based software and stuff within the European Union that has to do with like, you know, clawing back their data from, you know, the big giants who have hegemony or who have like this hegemony in the United States. And in literally like the past year and a half, we've seen the persistent threat, not only of political upheaval, but also like what that means in terms of data sovereignty. And so people like really feeling like it is, you know, like our duty on this continent in order to like center around these particular ideals in order to build a better software and to build a better tomorrow for our data.

18:12Harlo Holmes:That also doesn't come without like, you know, it's downfalls because we're looking at, you know, issues having to do with like ID and verification and things like that in order to access web content and the censorship issues that that entails. But I don't know, like that's just one thing. It used to be really, really simplistic to say that in countries in Central and South America, there's a lot of nihilism about, you know, whether or not, uh, communicating digitally was any better or like provided any like, you know, reasonable benefit to the act of journalism because the stakes are incredibly high, um, in terms of violence against journalism often to, you know, like really, really, um, horrible extremes in my like last couple of years encountering and listening to exactly what that looks like.

19:06Harlo Holmes:And encountering that resistance to certain types of technologies, especially like end-to-end technologies or circumvention tech, like VPNs, you know, things like that was really, really palpable. And it evolves. I have like ideas about what, you know, the American story looks like as well, or, you know, like within the United States, especially during these times, I feel like in the United States, and it's something that I will super duper admit to. I wouldn't say like arrogance is the word, but definitely like an optimism about, you know, like how, like, oh, it's okay. Like the, this tech is definitely going to save us in order to like quote Paris Marx there, you know?

19:54Harlo Holmes:Just like an optimism that we were afforded until recently. We were afforded that optimism. And now I still do believe it, but I don't have the optimism and now it's more of a fight. So yeah. And may that fight be baked into the technical American ethos.

20:22Sam:Every group has someone who insists on doing things the hard way. That friend still paying for a subscription they forgot they had. That one refusing to update their phone because it still works. The person still doing the same stuff they've always done. I used to be that person too, especially when it came to overpaying for wireless. I finally got some sense and switched to Mint Mobile, and I'm so glad I did. I got to feel like I had made some major change, but the only thing that really changed was the bill I was paying. Stop paying way too much for wireless just because, well, that's how it's always been.

20:56Sam:Mint exists purely to fix that. Same coverage, same speed, just without the inflated price tag. The premium wireless you expect. Unlimited talk, text, and data, but at a fraction of what others charge. And for a limited time, get 50 % off 3, 6, or 12-month plans of unlimited premium wireless. Bring your own phone and number, activate with eSIM in minutes, and start saving immediately. No long-term contracts, no hassle. With a 7-day money-back guarantee and customer satisfaction ratings in the mid-90s, Mint makes it easy to try it and see why people don't go back. Again, when you switch to Mint Mobile, you'll notice a smaller bill while still having great wireless service.

21:37Sam:Ready to stop paying more than you have to? New customers can make the switch today and for a limited time, get unlimited premium wireless for just$15 per month. Switch now at mintmobile.com slash 404media. That's mintmobile.com slash 404media. Upfront payment of$45 for three months,$90 for six months, or$180 for 12-month plan required. That's$15 a month equivalent. Taxes and fees extra. Initial plan term only. Over 50 gigabytes may slow when network is busy. Capable device required. Availability, speed, and coverage varies. Additional terms apply. See mintmobile.com. Starting something new isn't just hard.

22:17Sam:It's terrifying. When we started 404 Media, we remembered thinking, what if no one subscribes? What if people hate our podcast? What if this fails? What if no one even knows we tried? But taking that leap ended up being one of the best decisions we've ever made. And honestly, having the right tools makes taking that leap way less scary. That's where Shopify comes in. Shopify is the commerce platform behind millions of businesses around the world and about 10 % of all e-commerce in the US. From huge brands to people just getting started to businesses like ours. With Shopify, you can build a beautiful online store using ready-to-use templates, helping you get your store up and running in a matter of minutes.

22:59Sam:With Shopify, you can run email and social campaigns like you've got a full marketing team behind you. And Shopify helps you manage everything. Inventory, payments, shipping, analytics, all in one place. And that iconic purple ShopPay button, it's the best converting checkout on the planet, meaning fewer abandoned carts and more sales. It's time to turn those what-ifs into... With Shopify today. Sign up for your$1 per month trial today at shopify.com.media. Go to shopify.com slash media. That's shopify.com slash media.

23:46Sam:I'm curious if you think that there could be a world or a future, you know, 10, 20 years from now, when we also experienced that sort of like going back to open source or building out open source, returning to things like Linux. Linux never went away, so we're only returning if you've abandoned it. This year is the year of the desktop. It is. Okay. Okay. Say more about that, please. Because I think every time I bring up Linux on this podcast, people email me. So please, let's do it.

24:22Harlo Holmes:Well, I mean, what is there to say? You know, it is a fantastic alternative for a number of reasons that I've seen. And I don't necessarily know if this resonates. It definitely doesn't resonate with like clients of mine. I still have to talk in Mac and Windows. I really do. But there are a couple of things I think are interesting. A, absurgence in like maker culture, right? And so using Linux systems is actually like the easiest like path forward if you aren't already like a Windows user in order to like really, really dig deep into a lot of like these systems. When we're looking at, you know, the like, kind of like drastic changes to Windows in particular, regarding how they've like dug 10 toes down into AI and like aggressively pushing at it.

25:12Harlo Holmes:There are a number of people for whom that is like, pretty much like unattainable, because like, they cannot necessarily afford that hardware. I'm sure it's notwithstanding. And also just like, unsustainable, like they don't want it, they revolt. And so there are a number of folks who are like, actually, no, if I learn Linux, I can actually learn to build something on my own terms.