Responsible data considerations Before adopting new software, ask yourself... 1. What does “secure” really mean? Who owns the data–and for how long? Saying software is “secure” could mean a When you use an online service variety of things. Read the fine print of any to communicate, create or archive software description. Many tools that claim information, you should question who to be “secure”, including Dropbox, Google, “owns” the data, especially if it is stored and Skype, encrypt your data as it travels on the servers of a service provider between your computers and their servers like Facebook, Twitter or Dropbox. The – but the data is not protected from being answers are typically buried in a company’s accessed by the companies themselves. Terms of Service. Whatever service you Always ask how a service protects your use to archive or share sensitive data, data. Some tools and services use you should research their policies on encryption in ways that protect the sharing data with other companies or data even from the service providers governments, and what you can expect themselves. It is important to understand to happen to the data if you delete your this distinction, and to consider whether it account or the company gets sold or is important to your project to keep data closes down. hidden from service providers. 2. 3. 4. Does the software offer protection from Has the software the particular threats you face? been independently audited? Understanding your own threats is Don’t just trust software developers when important in assessing whether an they promise to offer security, especially application or service will adequately when software is brand new. Even with the protect you. Rather than adopting a best intentions, implementing encryption tool because you heard you should, try correctly is hard. Only use software that building a “threat model” to establish has been independently audited by who may try to access your data, and someone you trust. Preferably the code how (see The Surveillance Self Defense of the software should be “open source” Guide’s Introduction to Threat Modeling). and available for public scrutiny. And The answers to these questions will help even then, you can’t be sure whether you establish which tools are the most clean audits have missed vulnerabilities. appropriate. To learn more about carrying Maintain healthy skepticism always. out a context analysis, see the Explore section of the Holistic Security Manual. 66