FREE TO PROTEST: THE PROTESTOR'S GUIDE TO POLICE SURVEILLANCE AND HOW TO AVOID IT
←
→
Page content transcription
If your browser does not render page correctly, please read the page content below
FREE TO
PROTEST:
THE PROTESTOR’S
GUIDE TO POLICE
SURVEILLANCE AND
HOW TO AVOID IT
privacyinternational.orgA GUIDE ABOUT POLICE SURVEILLANCE OF YOUR DEVICES FREE TO PROTEST: THE PROTESTOR’S GUIDE TO POLICE SURVEILLANCE AND HOW TO AVOID IT (UK Edition) (Last updated June 2021) PRIVACYINTERNATIONAL.ORG
HOW MOBILE PHONE
How might mobile What to think about
EXTRACTION CAN BE USED phone extraction when going to a
AT A PROTEST AND HOW YOU tools be used at a
protest?
protest
• Keeping your phone’s operating
CAN MINIMISE RISKS TO • The majority of UK police forces
have purchased MPE tools
system (Android or iOS) up to date,
which means it will have the latest
security features, is likely the best
YOUR DATA and may use them in a range
of circumstances, including at
way to prevent MPE.
protests. • While the most effective way
of protecting yourself against
• In order to extract the data stored
MPE is to not take your phone
on it, the police would need to
to a protest, this is unlikely to be
physically access your mobile
a realistic solution. Indeed, not
What do mobile phone extraction tools do? phone. The police might take your
phone if you have been detained,
having your phone may leave you
vulnerable in other ways.
• Mobile phone extraction (MPE) tools - location information history; arrested or searched during
are devices that allow the police to a protest, but also if you have • While you should keep your
- wifi network connections (which
extract data from mobile phones, witnessed or are even the victim phone locked, some MPE tools are
can reveal the locations of any
including: of a crime. reportedly designed to access
place where you’ve connected to
- contacts; wifi, such as your workplace or a even locked phones. Their ability
café). to bypass this security does,
- call data (i.e. who you call, when,
however, depend on the phone
and for how long);
• Some MPE tools may also access and its operating system.
- text messages (including who you data stored in the Cloud (so even if
texted and when); you’re very careful about minimising • Before going to a protest, you
- stored files (photos, videos, audio data stored on your device, it may want to consider backing
files, documents etc); can still be accessed if it is stored up your phone data to your
online), or data you don’t even know computer, and then removing that
-app data (including the data data from your phone. But you
exists, and even deleted data.
stored on these apps); should be aware that some MPE
tools are able to recover deleted
data. If you have saved the data
onto a cloud service, some MPE
tools can still access that data.
FREE TO PROTEST: THE PROTESTOR’S GUIDE TO POLICE SURVEILLANCE AND HOW TO AVOID IT (UK Edition) (Last updated June 2021) PRIVACYINTERNATIONAL.ORGHOW ‘CLOUD EXTRACTION’
TOOLS CAN BE USED AT A
PROTEST AND HOW YOU CAN
MINIMISE RISKS TO YOUR DATA What to think about when going to a protest
through WhatsApp, if you back up
• While you could consider leaving
your phone at home, if that is not a your WhatsApp messages to the
realistic solution, you should think Cloud, these encrypted backups
How might cloud about switching off cloud back-up could be accessed by the police
extraction tools be in the applications on your phone using cloud extraction tools on your
that you use, and logging out of all phone.
used at a protest? cloud-based services. This will avoid
data being stored in the Cloud and • Some applications, such as Uber,
• In order to extract your cloud
prevent access to this data from your Twitter, WhatsApp and Facebook will
data, the police would need
mobile phone. allow you to switch off the location
to physically access your
data being stored in the Cloud. This
mobile phone. The police might
• Before going to a protest, you should may prevent the police being able to
confiscate your phone if you have
What are ‘cloud been detained or arrested during be aware that even if you use end- track where you have been.
to-end encrypted messaging
extraction tools’ and a protest, but also if you have
witnessed a crime and even if
what do they do? you are a victim of a crime (See
• Cloud extraction technology also Protest Guide about mobile
enables the police to access data phone extraction).
stored in your ‘Cloud’ via your
• All of this information could be
mobile phone or other devices.
used to identify protesters and
• The use of cloud extraction tools organisers and find out about the
means the police can access data location of protests and actions.
that you store online. Examples
• Your cloud data does not just
of apps that store data in the
reveal information about you, it
Cloud include Slack, Instagram,
can also reveal much about your
Telegram, Twitter, Facebook and
friends, family, and anyone else
Uber.
you interact with online, such as
fellow protestors. For example,
you may have old contacts stored
in the Cloud, which have been
deleted from the phone itself.
FREE TO PROTEST: THE PROTESTOR’S GUIDE TO POLICE SURVEILLANCE AND HOW TO AVOID IT (UK Edition) (Last updated June 2021) PRIVACYINTERNATIONAL.ORGHOW IMSI CATCHERS CAN BE How might IMSI
catchers be used at a
USED AT A PROTEST AND HOW protest?
YOU CAN MINIMISE RISKS • The police can use IMSI catchers
to identify who was at a protest, What to think about
TO YOUR DATA by capturing the IMSI numbers
of all the phones that were in its when going to a
vicinity at that protest.
protest
• Some types of IMSI catchers can • Putting your phone into
even enable the police to disrupt airplane mode or switching it off
or prevent protests before they completely will mean that an IMSI
What is an IMSI catcher? even happen. catcher can’t track you or your
• ‘IMSI’ stands for ‘international mobile • IMSI catchers do not read data stored communications.
• For example, they can be used
subscriber identity’, a number unique on a phone. Instead, these devices
to monitor or block your calls and • If you want to prevent the content
to your SIM card. IMSI catchers are also can be used to try to intercept text
messages and phone calls. messages; edit your messages of your text messages being
known as ‘Stingrays’.
without your knowledge; or tracked by an IMSI catcher, you
• An ‘IMSI catcher’ is a device that locates • Depending on the IMSI catcher’s even write and send someone can use messaging services that
and then tracks all mobile phones that capabilities and on the network your messages pretending to be from use end-to-end encryption, such
are connected to a phone network in phone is connecting to, more advanced you.1 as Signal and WhatsApp. The only
its vicinity, by ‘catching’ the unique IMSI attacks could take place, even information an IMSI catcher could
number. though this is unlikely. Some Stingray potentially collect is the fact that
devices rely on known weaknesses of you are using these messaging
• It does this by pretending to be a mobile communication protocols and can force
apps, not the content itself.
phone tower, tricking mobile phones your phone to downgrade the protocols
nearby to connect to it, enabling it to it is using, to make your communications
• While IMSI catchers do not read
then intercept the data from that phone less secure and more easily accessible
data stored on the phone, do
to the cell tower without the phone (e.g. by downgrading communications
user’s knowledge. over 3G to 2G, because as far as we bear in mind that the police
know, content interception and real- have other technology that does
• The most accessible information about time decryption can only be performed enable them to access data
you in this situation is your location. It is when the target is connected over the on your phone, such as ‘mobile
unavoidable that cell towers know your 2G network). phone extraction’ and hacking
rough location through triangulation - tools.
indeed, this is how they provide you with • IMSI catchers cannot read the contents
their service in the first place. By putting of encrypted messages you exchange
itself between you and the cell tower, through platforms that use end-to-end
an IMSI catcher can work out your rough encryption (e.g. Signal, WhatsApp, Wire). 1.
We don’t know for sure whether British police
location. forces are currently using IMSI catchers with these
kinds of capabilities. As police forces ‘neither
confirm, nor deny’ the use of IMSI catchers, it’s hard
to know what type they are using.
FREE TO PROTEST: THE PROTESTOR’S GUIDE TO POLICE SURVEILLANCE AND HOW TO AVOID IT (UK Edition) (Last updated June 2021) PRIVACYINTERNATIONAL.ORGHOW SOCIAL MEDIA
MONITORING CAN BE USED
AT A PROTEST AND HOW
YOU CAN MINIMISE RISKS TO What to think about when going to a protest
YOUR DATA • If you upload your protest images
to your social media accounts, they
• If you want to upload your protest
images to social media accounts,
may be used to identify and place consider removing the EXIF data
individuals at the scene of a protest. beforehand. EXIF data is metadata
associated with your images that
What is social media How is social media • If your location settings are switched can reveal information such as the
monitoring? monitoring used in on for your social media platforms or
your camera and photo apps, and
location, time and date and device
used.
• Social media monitoring refers relation to protests? you then post online from or near
to the monitoring, gathering and the site of a protest, police may gain • Be wary, footage can still be
• Protest organisers will often use
analysis of information shared on access to that location data. geolocated from background
social media to organise protests,
social media platforms, such as information (e.g. a monument or
communicate with protestors, • If you want to use social media while
Facebook, Twitter, Instagram and landmark). Keep this in mind when
and upload photos and videos of at a protest, you should consider
Reddit. filming your surroundings and try to
protests. switching off your location settings avoid identifiable backgrounds.
• It may include snooping on on the platform(s) you will be using.
• In turn this means the police can
content posted to public or If you do decide to share protest
‘data mine’ social media pages
private groups or pages. It may images, do not tag individuals that
and groups to learn the identities
also involve “scraping” – grabbing were involved in the protest without
and affiliations of the organisers,
all the data from a social media their consent, as this could create a
the location and timing of a
platform, including content trail that police may rely on to place
planned action, and other related
you post and data about your people at the protest.
information.
behaviour (such as what you like
and share). • The police may track social media
posts relating to past or future
• Through scraping and other tools,
protests to identify protesters.
social media monitoring permits
the collection and analysis of a • The police might also apply facial
large pool of social media data, recognition technology or gait
which can be used to generate recognition technology to protest
profiles and predictions about images and videos uploaded to
users. social media to identify protestors.
FREE TO PROTEST: THE PROTESTOR’S GUIDE TO POLICE SURVEILLANCE AND HOW TO AVOID IT (UK Edition) (Last updated June 2021) PRIVACYINTERNATIONAL.ORGHOW HACKING CAN BE USED What to think about
when going to a
AT PROTESTS AND HOW YOU protest
CAN MINIMISE RISKS TO • Keeping your device up to
date is a good way to prevent
YOUR DATA hacking, as hacking often exploits
vulnerabilities that have been
disclosed but not yet patched.
• Ensure that your device is running
What is hacking? the latest available version of its
• Hacking refers to finding
How can hacking be operating system (Android or iOS)
vulnerabilities in electronic used at protests? and that all your apps are up to
systems, either to report and date to improve your security and
• The police are able to hack into minimize the risk of hacking.
repair them, or to exploit them.
communications through the use
• Hacking can help to identify of, for example, ‘IMSI catchers’. • While you should keep your phone
and fix security flaws in devices, But IMSI catchers can only or other electronic devices locked,
networks and services that millions intercept information that is being some hacking techniques can
of people may use. But it can also transmitted between a mobile access even locked devices. Their
be used to access our devices, device and a cell tower; IMSI ability to bypass this security,
collect information about us, and catchers can’t access information does however depend on the
manipulate us and our devices in that is stored on the device. hacking technique used and the
other ways. device it targets.
• So the police can use
• Hacking comprises a range of sophisticated hacking techniques • Before going to a protest, you
ever-evolving techniques. It can to get remote access to may want to consider backing
be done remotely, but it can also information stored on a phone, up your phone data to another
include physical interference with laptop or other internet- device, and then removing that
a device or system – for instance connected device used to data from the devices you take
by forcing a mobile phone to organise or participate in protests, with you. But you should be aware
unlock. even if they are secured with a that some hacking tools are able
password, fingerprint or face to recover deleted data. If you
• It can also involve taking unlock. have saved the data onto a cloud
advantage of people to gain service, some hacking tools can
access to their technology. An • The police may also collect and still access that data.
example would be ‘phishing’, gain access to any devices that
where an attacker impersonates a are dropped, lost or confiscated • You should always be careful
trusted person or organisation to from protesters at a protest. about what links you click, to
send a link or attachment infected avoid ‘phishing’ attacks.
with malware.
FREE TO PROTEST: THE PROTESTOR’S GUIDE TO POLICE SURVEILLANCE AND HOW TO AVOID IT (UK Edition) (Last updated June 2021) PRIVACYINTERNATIONAL.ORGA GUIDE TO SURVEILLANCE OF YOUR FACE AND BODY FREE TO PROTEST: THE PROTESTOR’S GUIDE TO POLICE SURVEILLANCE AND HOW TO AVOID IT (UK Edition) (Last updated June 2021) PRIVACYINTERNATIONAL.ORG
HOW FACIAL RECOGNITION What to think about
TECHNOLOGY CAN BE USED when going to a
protest
AT A PROTEST AND HOW YOU • If you want to try to maintain
your anonymity, you may want to
CAN TRY TO MAINTAIN YOUR consider wearing a face covering
such as a bandana, which may
• As protesters’ face data is
ANONYMITY
make it harder for FRT to capture
collected, this data can then accurate images of your facial
be added to one or more pre- features.
existing watchlists, where it can be
compared against face data from • Other options for disrupting FRT
other sources to find a match. include the use of face paint
and clothes with designs meant
• Such data could also potentially to interfere with accurate facial
What is Facial be used to create a new recognition. FRT is constantly
database of people who attend
Recognition protests for future matching and
changing and improving, however,
so face coverings and these other
Technology? How might it be identification. methods may prove less effective
• Facial recognition technology used in relation to a in the future.
(FRT) collects and processes
data about people’s faces, and
protest? • Police powers to demand the
removal of such coverings and
can be used to identify people. • FRT may be used to monitor,
clothing vary depending on the
FRT matches captured images track and identify people’s faces
context and jurisdiction. At the
with images stored in existing in public spaces, including at
time of writing, we are in the midst
databases or ‘watchlists’. protests. This may be done openly
of the Coronavirus epidemic, so
or surreptitiously, without people
current rules may be subject to
knowing or consenting.
change.
• FRT-enabled cameras can take
• As the police can use FRT
pictures or videos, and identify
to analyse images or video
people in real-time or at a later
recordings on social media,
point. FRT can also be used to
consider this carefully before you
analyse and identify existing
post any images from a protest
images, for example photos and
that feature the faces of other
videos of protests uploaded to
protestors.
social media.
• As such, you may want to consider
using face blurring tools before
posting photos or videos online.
FREE TO PROTEST: THE PROTESTOR’S GUIDE TO POLICE SURVEILLANCE AND HOW TO AVOID IT (UK Edition) (Last updated June 2021) PRIVACYINTERNATIONAL.ORGHOW GAIT RECOGNITION
TECHNOLOGY CAN BE USED What to think about
when going to a
AT A PROTEST AND HOW YOU protest
CAN TRY TO MAINTAIN YOUR • As the police can use GRT
to analyse images or video
ANONYMITY
recordings on social media,
consider this carefully before
you post any images or video
recordings from a protest that
feature other protestors.
What is gait
recognition • To a certain extent, it is possible to
disguise your body shape by, for
technology? example, wearing baggy clothes,
but GRT is sophisticated enough
• Gait recognition technology (GRT)
to pick up the unique movement
can analyse the shape of an
of different people even under
individual’s body and the unique
way in which that body moves
How might it be used during a such disguises. Similarly, changing
how you walk by, for example,
when walking or running, which protest? faking a limp, will not be sufficient
can then be used to identify them.
to fool a GRT system.
• GRT could be used to monitor, • As protesters’ body data
• GRT works in a similar way to track and identify people gets collected, it can then be
facial recognition technology. But by the shape of their bodies added to one or more pre-
the two main differences are: and how they move in public existing watchlists, where this
spaces, including at protests, data can be compared to
–GRT may be used at a fairly long without people knowing or existing body data from other
range (at the time of writing, consenting. sources, to try to find a match.
about 165 feet / 50 metres),
unlike FRT which generally • GRT can be used to take • But it could also potentially
requires more close up, detailed pictures or record videos, and be used to create a new
facial images. identify people in real-time or database of people who
at a later point. It can also be attend protests, for future
–GRT can also accurately identify matching and identification.
used to analyse and identify
an individual even when that
existing images, for example
person’s facial features are
photos and videos of protests
covered, as it doesn’t actually
uploaded to social media.
rely on ‘face data’ at all.
FREE TO PROTEST: THE PROTESTOR’S GUIDE TO POLICE SURVEILLANCE AND HOW TO AVOID IT (UK Edition) (Last updated June 2021) PRIVACYINTERNATIONAL.ORGHOW BODY WORN
VIDEO CAMERAS CAN What to think about
BE USED AT A PROTEST when going to a
protest
• While the Met Police, for example,
claim that BWV cameras act
as an ‘independent witness’,
individual police officers are able
to switch the cameras on and
What do Body Worn How might body worn off or decide where to direct the
camera, so they are in control
Video cameras do? video cameras be of what they record - and don’t
record.
• Body Worn Video (BWV) cameras used at a protest?
can be attached to a police • See our separate ‘Free to Protest’
• BWV cameras may be used at
officer’s clothing – often at chest, guide to Facial Recognition
protests to monitor actions of
shoulder or head level – and Technology, regarding the
protestors.
record video, including sound, processing of BWV camera
from the officer’s perspective. • They do not usually capture the footage by facial recognition
police officer’s own actions. software.
• BWV cameras will probably
be visible to you, and when it’s • Outside the context of protests,
recording, a flashing light should BWV cameras are normally
appear on the device. switched on only at the start of
an incident. But at a protest,
they may remain switched on
throughout.
• Some cameras require the video
to be uploaded to a server
manually afterwards, but some
newer BWV cameras enable the
footage to be live streamed back
to a police station.
• The footage may be processed
afterwards, for example, by facial
recognition software.
FREE TO PROTEST: THE PROTESTOR’S GUIDE TO POLICE SURVEILLANCE AND HOW TO AVOID IT (UK Edition) (Last updated June 2021) PRIVACYINTERNATIONAL.ORGHOW POLICE DRONES
TECHNOLOGY CAN BE USED What to think about
when going to a
AT A PROTEST AND HOW YOU protest
CAN TRY TO MAINTAIN YOUR
• Drones use and impact on with
your anonymity depends on the
technologies they are equipped
ANONYMITY with.
• See our ‘Free to Protest’ guides
about Facial Recognition
Technology and IMSI catchers,
as these are common tools that
What are police a drone could use to monitor the
drones? activities of protestors.
• Drones are remotely controlled How might drones be
Unmanned Aerial Vehicles (UAVs)
of varying sizes.
used during protests?
• Camera-enabled drones may
• They usually come equipped be used to remotely monitor
with cameras and might be and track people’s movements
enabled with Facial Recognition in public spaces, including at
Technology. protests, without them consenting
or even knowing.
• Drones can be equipped with
speakers, surveillance equipment, • Similarly, when equipped with
radar and communications communication interception
interception tools, such as ‘IMSI technologies, drones can be used
catchers’. to monitor and track protestors’
calls and messages, in and
around the area where a protest is
taking place.
• Drones equipped with speakers
may also be used to communicate
with protesters, for example by
giving them orders, instructions or
warnings.1 1
We don’t know for sure what kinds of capabilities the drones
used by British police forces are equipped with.
FREE TO PROTEST: THE PROTESTOR’S GUIDE TO POLICE SURVEILLANCE AND HOW TO AVOID IT (UK Edition) (Last updated June 2021) PRIVACYINTERNATIONAL.ORGA GUIDE TO POLICING DATABASES AND PREDICTIVE POLICING TOOLS FREE TO PROTEST: THE PROTESTOR’S GUIDE TO POLICE SURVEILLANCE AND HOW TO AVOID IT (UK Edition) (Last updated June 2021) PRIVACYINTERNATIONAL.ORG
HOW THE ‘LAW
ENFORCEMENT DATA
SERVICE’ (LEDS) CAN BE What to think of
before you go to a
USED AT PROTESTS protest
• At the time of writing (Spring 2021),
LEDS is not yet operational, so it is
How might LEDS be unlikely to affect your attendance
What is LEDS? used at a protest? at a protest for the time being.
The Home Office expects the first
• If you are stopped at a protest by stage of LEDS to be operational
• LEDS is a new mega-database
the police, officers will be able to by late 2021.
currently being developed by the
search for your details in the LEDS
Home Office. • However, you need to be aware
database (once it is operational).
This will provide much more that the police may still record
• LEDS will replace and combine
information to the police on a your details in other databases,
the existing Police National
single interface than they have such as the PNC and the PND,
Database (PND) and the Police
ever had before. Information which will later become part of
National Computer (PNC). The aim
held about you on LEDS could LEDS.
is to provide police and others
with a super-database, with on- include your immigration status,
driving license information, and • You should also be aware that
demand, at the point of need LEDS will not be open for public
access, containing up-to-date intelligence previously gathered
about you. access and therefore individuals
and linked information about whose information is contained
individuals’ lives. in the system may not have any
• Police officers will be able to
create a record about you in the knowledge that such an entry
• Once your details are in LEDS,
LEDS database if a prior record exists, let alone be able to correct
numerous agencies will have
does not already exist. any errors.
access to that information (e.g.
HMRC and DVLA), which can then
• Further, images that are stored
be utilised in a way that could
in LEDS may also be used as
negatively affect individuals’ lives,
watchlists, which police can use
employment, state benefits and
at protests. Once operational,
immigration status.
images from LEDS may also be
analysed by facial recognition
technology, further enhancing the
police’s ability to identify people
at protests.
FREE TO PROTEST: THE PROTESTOR’S GUIDE TO POLICE SURVEILLANCE AND HOW TO AVOID IT (UK Edition) (Last updated June 2021) PRIVACYINTERNATIONAL.ORGHOW PREDICTIVE POLICING
CAN BE USED AT PROTESTS What to think about
when going to a
protest
What is predictive • Any photos, videos or messages
that you share about a protest
policing? on any online platform may be
• Predictive policing programs are analysed by the police to identify
used by the police to estimate protesters. Once identified, they
where and when crimes are can then be added to watchlists
likely to be committed – or who or used to create profiles that
is likely to commit them. These then can feed into predictive
programs work by feeding historic policing tools.
policing data through computer
• If police have already classified
algorithms. How is predictive you as someone that is likely to
commit a crime, this may further
• For example, a program might policing likely to be be used to detain, arrest, or stop
evaluate data about past crimes
to predict where future crimes will used in protests? and search you during a protest.
happen – identifying ‘hot spots’ • The police may use facial
or ‘boxes’ on a map. But the recognition technology, IMSI
data these programs use can be catchers or geo-location
incomplete or biased, leading to a technology to identify protesters
‘feedback loop’ – sending officers and add them to databases or
to communities that are already watchlists.
unfairly over-policed.
• Individuals are also often unaware
• Other predictive policing if they have been included on a
programs may suggest how Police database or a watchlists
people will behave. These and as a result, their removal from
programs are fed information it is very difficult, if not impossible.
about a person, and then they
decide whether that person is
likely to commit an offence.
FREE TO PROTEST: THE PROTESTOR’S GUIDE TO POLICE SURVEILLANCE AND HOW TO AVOID IT (UK Edition) (Last updated June 2021) PRIVACYINTERNATIONAL.ORGA GUIDE TO PROTECT YOUR DEVICES AGAINST SURVEILLANCE FREE TO PROTEST: THE PROTESTOR’S GUIDE TO POLICE SURVEILLANCE AND HOW TO AVOID IT (UK Edition) (Last updated June 2021) PRIVACYINTERNATIONAL.ORG
HOW THE POLICE CAN
DETERMINE YOUR LOCATION,
AND HOW YOU CAN BETTER
CONTROL ACCESS TO YOUR
LOCATION DATA
Where is my phone’s location data stored? How can my location data be accessed?
Your phone can be located in two main ways, using GPS or mobile There are a number of methods the police can use to can gain access to your
network location: (phone) location:
1. GPS 2. Mobile network location 1. GPS 2. Mobile network location
• GPS (that stands for Global • Mobile network location (or Global • Accessing GPS location data • Your approximate location data can
Positioning System) uses satellite System for Mobile Communications depends on where the data is be accessed by the police through
navigation to locate your phone (GSM) localisation) relies on your stored. It can be done using a your service provider.
fairly precisely (within a few metres), cellular network, and can be ‘mobile phone extraction’ device,
and relies on a GPS chip inside your determined as soon as you are which plugs into your phone and • This means that the police don’t
handset. connected to the network (i.e. your downloads all the data stored on need access to your phone handset
phone is switched on and not in it, including details of locations you to determine that you were within a
• Depending on the phone you use, airplane mode) but is far less precise have visited. certain proximity of a protest.
your GPS location data might be than GPS. Your approximate location
stored locally and/or on a cloud can be determined with an accuracy • Access to your GPS data may • Another means of accessing this
service like Google Cloud or iCloud. It range of a few dozen metres in a city, also be possible through device same information is to use an ‘IMSI
might also be collected by any app or hundreds of metres in rural areas. hacking, an advanced technique catcher’ (also known as a ‘Stingray’),
that you use that has access to your which might not necessarily require a device deployed to intercept and
GPS location. • This location data is stored by your physical access to your phone and track all mobile phones switched on
network provider. could be done remotely. and connected to a mobile network
in a specific area.
• If your GPS data is also stored
on an online account (e.g. iCloud
Other methods can also be used to determine your location indirectly, such
or Google Maps), it can be
as open wifi access points and Bluetooth beacons your phones connects
accessed through cloud extraction
to or location metadata embedded in your photos.
technologies or legal requests to
the companies that store that data.
FREE TO PROTEST: THE PROTESTOR’S GUIDE TO POLICE SURVEILLANCE AND HOW TO AVOID IT (UK Edition) (Last updated June 2021) PRIVACYINTERNATIONAL.ORGHow to better control your location data
1. GPS • Removing permissions to access your • If you’ve taken pictures with your 2. Mobile network location
location for all apps can prevent location services switched on, the
• The best way to prevent your this data being stored on an online location where the picture was taken • When it comes to mobile network
location being accessed is to limit the account. might be included in the metadata location, the only way to have control
generation of the location data in the (known as EXIF data) of the image. You over it is to prevent connection to the
first place. • If you absolutely need an app to have might want to disable location services network at all.
access to your GPS data, inspect the while taking pictures, or you can use
• In the case of GPS, it can be as simple settings of that app to ensure that you software or an app to erase this EXIF • Having your phone switched off, in
as switching off your GPS (often referred understand if your location is being data afterwards (for example, the airplane mode, or in a faraday cage
to as ‘location services’). But bear in stored online or just locally on your app. Signal messaging app erases EXIF data will prevent connection to your mobile
mind that the location data of any For example, if you use Google Maps when you send images). network, and therefore make GSM
previous occasions where you did have while logged into a Google account, geolocation impossible. A faraday cage
it switched on might still be accessible. you might want to disable location • Similarly, turning off your wifi or or switching off your phone prevents
history in the settings so that your Bluetooth can prevent your phone any and all types of connection to any
• If you still need to use GPS on your location history won’t be stored in your from connecting to unwanted access phone network. Whereas just using
phone, check individual apps’ Google account. points and providing indirect location airplane mode means that some types
permissions to access your location to information. of connections can still be made (e.g.
minimise the spread of this information. Bluetooth or GPS).
FREE TO PROTEST: THE PROTESTOR’S GUIDE TO POLICE SURVEILLANCE AND HOW TO AVOID IT (UK Edition) (Last updated June 2021) PRIVACYINTERNATIONAL.ORGHOW THE POLICE CAN GAIN How can my
images, contacts
How to limit the risk of
your images, contact
ACCESS TO YOUR PHONE’S and documents be and documents being
accessed by the accessed
IMAGES, CONTACTS AND police? • To prevent being targeted by
DOCUMENTS, AND HOW YOU
cloud extraction techniques, you
There are a few ways the police would need to refrain from using
can gain access to this data, Cloud services altogether.
CAN BETTER CONTROL ACCESS
depending on how it is stored:
• If giving up Cloud services entirely
• If you store all your data locally is going to create too much
on your phone, then it can be inconvenience for you, consider not
accessed using a ‘mobile phone uploading sensitive content to the
extraction’ device, which connects Cloud. Reviewing apps’ settings
Where are my images, contacts and to your phone and downloads all and features is also a good way
documents stored? the data stored in it. This method to ensure you know what data on
cannot be used remotely - the your phone is being backed-up
• You generate data every time you of the time you will also generate police would need physical access online (for example, WhatsApp
use your phone e.g. you generate ‘metadata’ that is coupled to it (e.g. to your phone. backups can be stored on Google
data when you take photographs or a photo will have metadata such as Drive, so even though your
record videos, when you create or the time and location it was shot). • Device hacking is an advanced WhatsApp messages are end-
edit notes and documents on the go, This metadata can be as revealing, technique that gives access to to-end encrypted, using cloud
and when you add new names and if not more revealing, than the photo a certain amount of data in your extraction tools these messages
numbers to your contacts directory. itself. phone, but not necessarily all of could still be accessed from your
it. Unlike mobile phone extraction, Google Drive backup).
• All this data is created through • All this data will be stored on your hacking doesn’t necessarily
dedicated apps - your camera and phone’s internal memory (including • However, as the device user, you
require physical access to your have some control over the data
photo apps, social media apps, any external memory attached, such device. This means that this
notes apps, and your contacts app as a MicroSD card), or on the Cloud, you generate in the first place, and
method can be used any time where it is stored. Having a good
are just some examples. or both if you are using any cloud before or after a protest.
services as a backup. understanding of what information
• It is important to note that when you your phone holds about you
• If you are syncing your images, means that if such tools were to be
create any file on your phone, most documents and contacts using used on your phone, you are more
any cloud services (iCloud, likely to be aware of what data is
Dropbox or Google Drive for being accessed.
example), the police can use
‘cloud extraction’ tools remotely • Ensuring the content of your
to access this information without phone is encrypted and that your
your authorisation or knowledge, operating system and apps are
or they can make a legal request up to date will mitigate against
to the cloud service provider. some methods of mobile phone
extraction and device hacking.
FREE TO PROTEST: THE PROTESTOR’S GUIDE TO POLICE SURVEILLANCE AND HOW TO AVOID IT (UK Edition) (Last updated June 2021) PRIVACYINTERNATIONAL.ORGHow can my communications be accessed
HOW THE POLICE CAN by the police?
ACCESS YOUR DIGITAL There are a few ways the police can
gain access to this data, depending
on where you have it stored:
(e.g. WhatsApp backups on Google
Drive/iCloud).
COMMUNICATIONS, AND
• If some of your communications
• Accessing the communications on social networks are public (e.g.
stored on your phone (such as your shared on an open Facebook group),
HOW YOU CAN BETTER conversations in a text messaging
app) can be done through a ‘mobile
the police can also use Social Media
Intelligence (SOCMINT) tools to
access them.
phone extraction’ device, which
CONTROL ACCESS can be connected to your phone to
download all the data stored on it.
• Your text messages and phone calls
can be intercepted, recorded and
• Such access may also be possible interfered with by the police using an
with device hacking, a technique ‘IMSI catcher’, a device deployed to
which may not require physical track all mobile phones switched on
Where are my communications stored? access to your phone. and connected to the network in a
specific area.
• Text messages/phone online or locally. Different messaging • If your communications rely on a
service provider or a social network • Your text messages can also be
calls: Traditional cellphone apps also rely on different protocols, accessed through a legal process
(such as Messenger, Telegram,
communications happen over the which means that some messaging targeting your service provider.
Instagram, TikTok), the police
cellular network. You usually access apps are more at risk of interception can gain access through ‘cloud Similar legal processes can be used
those with the text message and than others. extraction’ technologies, without your to request data from companies that
phone call apps that are provided consent or knowledge. The same might host your communications
as standard on your phone. While • Social networks: Except in rare technique can be used to access (e.g. Facebook).
phone calls aren’t stored anywhere, cases of decentralised/self-hosted backups of your communication
text messages are stored locally on systems, your communications on
your and the recipient’s devices. They social networking apps will be stored
by the service providers.
might also be temporarily stored by
the network provider.
How to limit the risk of your communications
being accessed
• Messaging apps: Messaging encrypted messaging apps to share
platforms enable fairly secure • Limiting the risks starts with controlling
the amount and type of information sensitive information.
communication over the internet.
you share, with whom and through
Depending on the app you use, your • But do bear in mind that if you use
which medium.
messages might be stored locally cloud backup for any of your messaging
on your and the recipient’s phone, • When sharing very sensitive apps, the content could still be
on the service provider’s systems, information, consider meeting in accessed using cloud extraction tools.
and potentially online too. Some person.
• Verify the identity of protestors you
messaging apps also offer backup • If meeting in person is not an option, are communicating with through a
solutions which will be stored either given the low security of cellular different communications channel (e.g.
networks, consider the use of secure messaging them on another platform,
channels such as end-to-end or over encrypted email, or over a voice
or video call).
FREE TO PROTEST: THE PROTESTOR’S GUIDE TO POLICE SURVEILLANCE AND HOW TO AVOID IT (UK Edition) (Last updated June 2021) PRIVACYINTERNATIONAL.ORGHOW THE POLICE CAN How can my unique identifiers be accessed by
the police?
ACCESS YOUR PHONE’S • Your IMSI and IMEI can be obtained and address), it can be associated
‘UNIQUE IDENTIFIERS’,
by the police with an ‘IMSI catcher’, with other data such as your
a device deployed to track all mobile location. Some data brokers obtain
phones switched on and connected massive amounts of data from
AND HOW YOU CAN TRY TO to the network in its vicinity. Once this
identifier is intercepted, it might be
phones and sell it to the police,
including the Ad ID.
MAINTAIN YOUR ANONYMITY
used to retrieve personal information
about you. • Other unique identifiers such as your
MAC address can be collected by
• Your Ad ID can be accessed by apps wifi hotspots but it is far more difficult
and websites on your phone. While to associate this with personal
What are my ‘unique identifiers’ and where are it is not directly associated with your information that can be used to
personal information (e.g. your name identify you.
they stored?
• Your phone and your SIM card address) or your device (e.g. brand,
contain unique identifiers about you, model).
which can be accessed by the police
to identify you.
• Ad ID: Ad Identifiers are different How to limit the risk of being identified through
from IMSI and IMEI in that they can
• The IMSI (International Mobile change over time. Ad IDs are used by your ‘unique identifiers’
Subscriber Identity) is a unique advertisers in apps and websites to • If you are in a situation, such as a these different SIM cards, it will be
number associated with your SIM uniquely identify you online and offer protest, where you may want to ward possible to tie the pre-paid SIM
card. It doesn’t change, even if you services such as targeted advertising. off the risk of an IMSI catcher tracking to the identity registered under your
put the SIM card into a different Ad IDs are not directly linked to your phone, the most effective option original SIM card. This is because of
phone. your personal information (e.g. your would be to refrain from connecting the IMEI, the unique identifier of your
name) but can be associated with to the cellular network. Having your phone.
• If you have a mobile phone other revealing data about you (e.g. phone in airplane mode or in a
subscription, the IMSI will be geolocation, apps used, websites faraday cage will make you invisible • Renewing your Ad ID on a regular
associated with personal information visited etc). The Ad ID is generated by to cellular towers, and therefore to basis is a good way to avoid all your
such as your name and address. your phone’s operating system, and IMSI catchers as well. phone activities being gathered
is usually visible in the settings of your under the same ID. You might
• The IMEI (International Mobile phone. It can be manually renewed. • If it’s important that you are also want to disable personalised
Equipment Identity) is a unique connected to the cellular network, advertising if your mobile offers this
number identifying your phone (the • Other identifiers: There are a few consider getting a separate prepaid option as it will prevent apps and
device). So if you change your phone, other components in your phone with SIM card, (because you provide very websites from obtaining this identifier.
you will have a new IMEI. unique identifiers, such as the MAC little information when you buy a pre-
address for your wifi antenna, or the paid SIM card). If you do so, note that • Using an Ad Blocker is also a good
• IMSI and IMEI cannot be altered BD_ADDR for your Bluetooth module. if your phone connects to a police way to prevent companies from
otherwise, and they can be linked to IMSI catcher at different times with tracking you online and collecting
information about you (e.g. name, your personal information.
FREE TO PROTEST: THE PROTESTOR’S GUIDE TO POLICE SURVEILLANCE AND HOW TO AVOID IT (UK Edition) (Last updated June 2021) PRIVACYINTERNATIONAL.ORGFACT SHEET ON YOUR DATA RIGHTS IN RELATION TO POLICE SURVEILLANCE AT PROTESTS FREE TO PROTEST: THE PROTESTOR’S GUIDE TO POLICE SURVEILLANCE AND HOW TO AVOID IT (UK Edition) (Last updated June 2021) PRIVACYINTERNATIONAL.ORG
FACT SHEET ON YOUR
DATA RIGHTS IN RELATION Are there limits on what the police can do when it
TO POLICE SURVEILLANCE AT comes to my data?
PROTESTS • The police can process personal
data at protests, but there are limits.
interference it must be proportionate
to the objectives of maintaining
They have to be exercising law public order and preventing or
enforcement functions and it has to detecting crime.4 The use of facial
This is based on UK data be necessary for the administration recognition technology is one
protection legislation. The UK’s of justice (or any other function of a example of data processing which
General Data Protection Regulation public nature).1 might violate human rights if the
(UK GDPR) does not apply to proportionality criteria have not been
processing of personal data for law • When it comes to sensitive data, like met.5
enforcement purposes by relevant facial images which could be used to
authorities. identify an individual, the data can • The police must conduct a Data
only be processed where it is strictly Protection Impact Assessment
necessary for the administration of before processing data in a way
justice.2 which presents a high risk of violating
individual rights.6 Although there is
What can happen to my personal data • There are also some forms of data no legal obligation to publish the
processing that can amount to an assessment, many police forces do so
at a peaceful protest? interference with the human rights on their websites.
• The most common personal data • There is no requirement that the of individuals attending the protest,
protest be violent or at risk of specifically the right to private life.3 • Police may only hold data for as long
processed at a protest are notes as it is necessary to do so.
and photographs taken by police becoming violent before data In order for the police to justify the
officers, along with voice and video processing can begin. Moreover, the
recordings taken from body-worn police are not limited to processing
cameras or drones. data in relation to preventing
offences at the protest. For example,
• Data processing can also happen they may process data for the
with sophisticated surveillance tools purpose of identifying individuals
and techniques that you might who are subject to an arrest warrant
not be aware of, including facial unrelated to the protest.
1.
Data Protection Act 1998, Schedule 2(5)
recognition technology, mobile 2.
Data Protection Act 2018, Section 35
phone extraction, IMSI catchers • The police do not have to obtain your 3.
Human Rights Act 1998, Schedule 1, Article 8 ECHR
and hacking. consent before processing your data. 4.
R (Catt) v Commissioner of Police of the Metropolis [2015]
1 AC 1065; [2015] UKSC 9 at [17]
5.
R (Bridges) v Chief Constable of South Wales Police [2020]
1 WLR 672; [2019] EWHC 2341 (Admin)
6.
Data Protection Act 2018, Section 64
FREE TO PROTEST: THE PROTESTOR’S GUIDE TO POLICE SURVEILLANCE AND HOW TO AVOID IT (UK Edition) (Last updated June 2021) PRIVACYINTERNATIONAL.ORGDo the police have to
What happens if the
inform me that they
personal data held by
are processing my
the police is inaccurate
personal data?
• Police must make information • Individuals have a right to have
about their data processing their personal data rectified if it is
inaccurate or incomplete.12 If the
activities generally available
to the public.7 This includes
Can I see the individuals make a request to have
general information necessary for personal data that data about them corrected, then
the police must fix the inaccuracy
accessing your data and making
a complaint about how the police was collected on me without undue delay although there
is no fixed deadline.
have processed your data. But by the police?
they don’t need to tell you more
than that. • Individuals can request access to What happens if the I’m worried that the
the data about them held by the
police. The police must respond
police refuse to tell me police unlawfully
• The police are not required to
provide notification to you each by providing access to the data what data they have processed my data/
without undue delay and at
time they process your data.
the latest within one month of
collected about me? unfairly restricted my
receiving the request.8 • The police may refuse to disclose
data they have retained about
rights. What can I do?
• In addition to receiving the actual you where it is necessary • You can make a complaint to
data, individuals are entitled to protect investigations or the police force which processed
to information about the data, prosecutions, protect national your data or to the Information
including the purposes for which or public security and to protect Commissioner’s Office.13 In every
it is held and who it has been the rights and freedoms of other decision made about your data
disclosed to. people.10 and communicated to you by the
police, you should be provided the
• Individuals have the right to • Ordinarily the police must provide contact details of the ICO.
access data about them held reasons for refusing to disclose
by the police, including the right the information, unless providing
to information about whether reasons would undermine the
the police have processed data purpose of refusing to provide the
about the individual.9 information. 7.
Data Protection Act 2018, Section 44
8.
Data Protection Act 2018, Section 45(3), Section 54
• The police may also refuse to 9.
Data Protection Act 2018, Section 45
disclose data which has been 10.
Data Protection Act 2018, Section 45(5)
deleted in accordance with the law.11 Data Protection Act 2018, Section 39(1)
11.
12.
Data Protection Act 2018, Section 46
13.
Data Protection Act 2018, Section 165
FREE TO PROTEST: THE PROTESTOR’S GUIDE TO POLICE SURVEILLANCE AND HOW TO AVOID IT (UK Edition) (Last updated June 2021) PRIVACYINTERNATIONAL.ORGFACT SHEET ON PHOTOGRAPHING POLICE OFFICERS AT A PROTEST FREE TO PROTEST: THE PROTESTOR’S GUIDE TO POLICE SURVEILLANCE AND HOW TO AVOID IT (UK Edition) (Last updated June 2021) PRIVACYINTERNATIONAL.ORG
FACT SHEET ON
PHOTOGRAPHING POLICE
OFFICERS AT A PROTEST
Photographing or filming incidents Are there limits to
involving police and protestors is Can the police stop and search me for filming or
an important way of holding the how images can be
police to account for their actions. taking photographs?
Members of the public and the
used?
media do not need a permit to film • It is an offence to publish or
• The police have the discretion to ask camera, to ascertain whether your
or photograph in public places and distribute a photograph of a
you to move back if they think you images or videos constitute evidence
police have no power to stop them police officer, member of the
are interfering with their operations. If that you are involved in terrorism.4
filming or photographing incidents armed forces or security services,
or police personnel.1 you refuse, you can be charged with if it is likely to be useful to a person
an offence if your actions amount to • Police officers have the power to seize
items found during a search under preparing any act of terrorism.6
obstructing an officer in the execution
of their duty.2 the Terrorism Act, including a phone
• If you are publishing your photos
or camera, if they reasonably suspect
from a protest online, including
• A police officer can stop and search you that it constitutes evidence that an
on social media, bear in mind
if they have reasonable suspicion that individual is involved in terrorism. But
that the police may be able
you are carrying illegal drugs, stolen they have no right to delete any images
to use those photos to identify
property, a weapon, or a tool that could or videos.
individuals present at a protest.
enable you to commit a crime.3 In the
absence of this reasonable suspicion, • Police officers can also question an
an individual can refuse the search. individual who appears to be taking
photographs of someone who is or has
• But police officers also have the power been a member of Her Majesty’s Forces
to stop and search anyone who they or Intelligence Services as long as this is
reasonably suspect to be a terrorist. being done for a lawful purpose and is
This includes the power to view digital not being done in a way that prevents,
images or videos on your phone or dissuades or inhibits the individual from 1.
https://www.met.police.uk/advice/advice-and-
doing something which is not unlawful.5 information/ph/photography-advice
2.
Section 89(2) of the Police Act 1996
3.
Section 1 of the Police and Criminal Evidence Act 1984
4.
Section 43 of the Terrorism Act 2000
5.
Section 58A of the Terrorism Act 200017. Section 89(2) of
the Police Act 1996
6.
Section 76 of the Counter-Terrorism Act 2008
FREE TO PROTEST: THE PROTESTOR’S GUIDE TO POLICE SURVEILLANCE AND HOW TO AVOID IT (UK Edition) (Last updated June 2021) PRIVACYINTERNATIONAL.ORGPrivacy International 62 Britton Street London EC1M 5UY United Kingdom +44 (0)20 3422 4321 privacyinternational.org Privacy International is a registered charity (1147471), and a company limited by guarantee registered in England and Wales (04354366).
You can also read
