Going Nuclear: Programmatic Protections against Extreme Vetting, Social Pressures, and Coercion

It's become more common for individuals to be forced to grant access to their "personal" online accounts/devices. There has been recent media focus on border crossings where individuals are required to temporarily turn over laptops/devices, often being coerced into giving decryption secrets or biometrics. Similar demands are made when individuals are arrested. It's also been reported that some employers request employees' credentials for social media accounts—there has even been consideration of adding similar requirements to the U.S. visa application process.

These are all obvious invasions of privacy with at-best questionable legality, and yet not complying has dire consequences—prolonged detainment, missed work, or barred entry to the country. As these measures are put in place domestically, it's only reasonable to expect similar policies in other nations, particularly those with less individual freedoms.

What options are left for an individual? This talk explores three programmatic options to help activists, dissidents, travelers, foreign nationals, and everyday citizens better protect their sensitive data. These proof of concepts (released post-talk) focus on what should be done to implement a "nuclear" option: revoking access to everything—possibly while under threat—wiping data when necessary. These solutions are not intended to be answers to the issues at large, but proof of concepts that we hope will start a greater conversation in regards to acceptable (and legal) privacy investigations.

You can view an animated version of the slides that were used for this presentation here.