Chromebook for Activists (Tor & anti-forensics)

[James]

Hey guys,

I emailed this mailing list in June of last year as I was in the process of trying to develop a secure, purpose build bare-bones chromium based device for use by activists. I have given up on my aspirations to develop a custom device and am now more interested in the suitability of Chrome OS devices for this purpose. I was therefore wondering if you guys would be able to answer some further questions for me, so that I can better understand how close this is to becoming a viable option. 

Just as an aside before I continue, if any of you are interested in learning about the nature and extent of surveillance and interference of peaceful protesters by western states, here is a really comprehensive two part talk given by the security researcher Jacob Appelbaum to a group of Occupy Wall Street activists. The talk is three hours long in total and is well worth a watch for anybody concerned with freedom and liberty. 

The two biggest areas of concern for activists is anonymity on the internet and integrity/security of a system. 

In the email I sent last year I asked about whether there were any plans to incorporate Tor into chromium. As I am primarily interested in the suitability of off-the-shelf chromebooks for non tech-savy activists, I guess this is really directed specifically at the Google engineers in this list, but I was wondering if any more progress had been made in this direction? Having spoken to quite a prominent security researcher, it was implied to me that Tor was already being bundled in Chrome OS devices in an inactive state, but I have since found no information to substantiate this claim. I also notice that @JackalAnon on twitter reports to have been able to get tor working on his cr-48, but I suspect with all the security previsions, that his efforts would have only been temporary given the secure boot capabilities of chromebooks. I personally believe that anonymity online, or the right to privacy without routine surveillance (whether real-time or retroactive) of personal data should be the rule and not the exception. I would therefore implore you guys to consider moving in this direction if it is something to which you have previously given little thought. 

The second area I am interested in learning about is integrity / security of chromebook devices against forensic examination. For the sake of being thorough I am interested in understanding how susceptible a chromebook is to both logical and physical forensic data extraction. I understand the documented security features, but am curious to know if these security features would stand up scrutiny by states who have an extensive range of forensic equipment. 

Following on from the forensic examination of devices, I am also interested in understanding the extent with which Google works with law enforcement agencies and governments to aid with the legitimate investigation of chromebooks. I understand that this is probably not a question I should be asking of engineers on this list, but I will ask it anyway in case any of you could shed some light on this. Given that Microsoft have publicly talked about their COFEE suite of forensic tools, which they have made available to law enforcement agencies, it is not unreasonable to expect that Google might also be providing similar tools to law enforcement. Given the cloud-orientated nature of these devices, it would also be interested to learn if Google have developed any live-monitoring back doors for law enforcement, similar to the one found by security researchers in iTunes. I don't seriously expect any Google engineer to disclose this sort of thing here if it was going on, but for the sake of being able to make recommendations to activists, it would be good to know where the goal posts stand.

One of the replies to my previous email suggested that Google's Project Glass might be useful to activists, presumably in being able to provide point-of-view recording of actions and police brutality. As some time has passed since my last chain I would love to use this as an opportunity to ask any Google engineers on this list if you would be willing to do me the favour of communicating with the Project Glass team and ask if an early device could be made available to me for the purposes of testing for activism? I am incredibly excited about the technology and would absolutely love to get my hands on an early device!

Thanks to those who have read this and I look forward to reading your responses.

[Steve Pirk]

Hi James,

There was another thread on this topic recently, and I got lucky and found some information about Tor and Chromium OS. This issue was put on hold last summer, but it clearly shows that the Chromium team are working on it.

https://code.google.com/p/chromium-os/issues/detail?id=17514

It all comes down to user experience, and how the user is notified that they are using untrustworthy networks. If you star the issue, you will be notified when it is updated. Feel free to add a comment in support, and toss out some ideas. The priority has been lowered, but maybe we can get it back on the radar.

-steve

-- steve

--
Chromium OS discuss mailing list: chromium-...@chromium.org
View archives, change email options, or unsubscribe:
http://groups.google.com/a/chromium.org/group/chromium-os-discuss?hl=en

[James Varnham]

Hey Steve, 

Thanks for getting back to me. I've left a comment on the issue tracker and hope that the developers can look into it again!

Regards,

James

James