Metadata, internet and mobile privacy: from secure apps to VPN

The metadata attached to your phone calls and online activity is making you vulnerable. Here’s how to leave less of a trail.

Being a tech writer, I repeatedly get asked how to stop mobile phone records and web browsing activity from being collected as metadata.

For anyone not familiar with this, metadata is the information appended to content. When you snap photos, the content is the photo itself; the metadata is the caption, list of people in the photo, location, type of camera and so on.

For phone calls, the metadata the government wants to collect is not call content but the phone account holder, the call out number, receiving number, time of call and location, gleaned from a mobile, so authorities will know who called whom, when and where, and, significantly for mobile phone users, who was at the same place at the same time.

Similarly, the government wants internet service providers to store your IP address (internet protocol address, a number assigned to each online device) when you access a website, for a minimum of two years.

I don’t believe people want to undermine measures to help law enforcement but journalists and others have genuine concerns about how metadata could be misused, and about the prospect of “jurisdiction leak” — an increase in the number of agencies that could access this metadata.

And what about private investigators? Many already seem skilled at using electronic means to pinpoint anyone, anywhere. Could they access our metadata?

It’s in this spirit of circumventing potential abuse that I offer these tips. There’s nothing illegal about implementing measures to protect your privacy, such as a VPN, or virtual private network. Communications Minister Malcolm Turnbull has made that clear in an interpretation of online copyright infringements posted on his website. However, if you use the anonymity of a VPN to conduct illegal activities or breach copyright, that’s a different matter.

I can’t guarantee everything here is secure, so keep your wits about you.

Mobile phones

Instead of making regular cellular calls, use a secure phone app for confidential calls and messages. They won’t generate regular cellular call metadata records.

Regulars such as Skype, Viber, Facebook and Twitter aren’t designed for super-secure communications. You need apps that offer end-to-end encryption of calls and texts, so conversations can’t be intercepted; and you want them not to store call logs, so there are no records to be retrieved.

Wickr, available for Windows, OS X, iOS, Android and Linux, purports to do that and offers self-destructing messages. Open Whisper Systems apps such as Signal (iOS and soon Android), RedPhone and TextSecure (Android) also offer end-to-end encryption. Signal offers secure messaging, calls and video calls, but you will need to delete messages and logs.

If you’re meeting someone confidentially, don’t take your mobile. Metadata from a mobile phone can reveal your location. Be aware that some anti-spying phones such as Blackphone and Boeing Black may be fantastic for securing phone contents but don’t necessarily stop you being tracked when connected to a network.

Computers

A VPN is one defence on a computer. Think of it as a long data tunnel that extends from your computer to the far reaches of the internet, from where it emerges without identifying characteristics — a wormhole for data.

Many companies offer VPN services online. You join up, download software to your computer, install it and activate it to create that magic tunnel. Some let you switch the VPN on and off, and let you choose the countries where you want the data tunnel to emerge.

I have been trialling VPN provider Private Internet Access . It ticks a few important boxes. It claims not to keep usage logs. That’s mandatory for any VPN you choose, otherwise your activity can be traced later. It has tunnel exits in Australia, the US and several other countries, so I can choose where to be on the ­internet.

I like to be connected locally but anonymously to retain download-upload speeds. Using Speedtest.net, I found my download speed was virtually unchanged at about 22 megabits per second when connected through PIA to Australia, but exiting in California reduced download speeds to less than 10Mbps. It’s your choice.

Be careful. Your real IP address can leak, even with a VPN. Use the site IPleak.net to check this. I couldn’t stop these leaks (known as WebRTC leaks) when browsing in Chrome on Windows, so I’d recommend not using Chrome for VPN browsing.

Internet Explorer is OK as WebRTC is disabled by default, as is Firefox if you search for an online guide and disable WebRTC before browsing. I didn’t have an issue using Safari in OS X.

Another option is to configure your router to connect directly to a VPN. Everything in your home will then connect to the internet securely without any further modification.

Many domestic routers won’t let you do this; their VPN feature is restricted to logging in locally from, say, work to home securely. To connect to a VPN, you need to flash your router with new firmware, something really for the geeks among us.

Fortunately there are firms that will do this for you professionally. For $US50 ($63), US firm FlashRouters will remotely install firmware on your router so that all devices at home connect to a VPN directly. It will even set up a VPN.

Alternatively, it sells many of the newer popular routers with this special firmware installed, and offers discounted delivery — an Australian data retention laws special.

If you don’t like the VPN concept, you could download the Tor browser suite . Tor works differently from a VPN by sending your internet traffic by a long and circuitous route via several servers across the net.

It’s secure but slow. And you can’t install plugins such as Flash as they can compromise your privacy. So you get a more vanilla browsing experience.

Email

For email, you could use special secure web-based mail. Swiss-based ProtonMail, for example, offers secure end-to-end encrypted email protected under Swiss law.

But remember — today’s answer for protecting your privacy may be useless tomorrow if legislation catches up with it.