Every week, sometimes more than once, we are taking calls or messages about the same single situation facing an activist(s) post arrest. It is this:
They have taken their phone to a protest, were arrested, cops took their phone (often a lot more interested in phone than owner), phone was on at the time.
Here's what we tell them: It does not matter if you use the best E2EE app (Signal is common) and have a 9x9 18 line pattern unlock, it's time to act like it's game over.
Here's why.
1/n
If your phone is on & you have passcoded or patterned in after boot, forensics can likely access the contents of your device. Doesn't matter that you have the best of breed disk or file-based (FBE) encryption. When on, it is in an *unlocked* state. Screen blanked does not mean "off".
Unless your Signal is also behind auth, forensics, investigators, can likely access your Signal chats, & all of your messages prior to your team doing their due diligence & removing you from the group.
2/n
It gets worse. Even if your phone is powered off before arrest (generally wise), a well resourced forensics team could have access anyway, using tooling like Cellebrite. At the current time only GrapheneOS & recent iOS versions _seem_ Cellebrite-resistant. That could soon change.
Regardless, not handing over access can have you legally pivoted as obstructing the course of justice. This is increasingly the case, & the penalties can be too cruel for many to bear, caving under pressure.
3/n
So it follows, the only good smartphone to take to a protest is:
1) the one you didn't bring
2) the one that can be safely handed over _unlocked_, with none of you, your fellow activist mates, family or friends on it (our devices are rarely only about us). It's a burner, with a burner SIM, burner accounts for streaming video, uploading photos to an anonymous share (ideally self-hosted, jurisdictionally gapped over the border), & with SOS contacts none more.
4/n
I realise this can all sound unrealistic, excessive. After all, so often we don't wake up planning to join a march, but there we are by mid-afternoon.
Reality is tricky however, & so if you are time & means privileged enough to get & setup a protest burner, do it. If not, just leave the smartphone at home (& have a fallback meeting point & time arranged). You'll be living the old French proverb "It's better to prevent than heal", keeping those you care about, the cause, & yourself, safe.
5/5
Oh yes, and if phone stays at home, write your emergency contact numbers on your arm, with a permanent marker.
If you are caught out with your personal phone, never say "I will not give you the password to this device", as you risk being legally pivoted for obstructing an investigation. Request a lawyer, or call your own if you or your group has one. Hopefully you are privileged enough to be in a jurisdiction where that matters.
6/5+1
Julian Oliver
themadhatter
Tommaso Gagliardoni