If recent reports are to be believed, the National Security Agency has broad powers to capture private information about Americans. They know who we're calling, they have access to our Gmail messages and AOL Instant Messenger chats, and it's a safe bet that they have other interception capabilities that haven't been publicly disclosed. Indeed, most mainstream communications technologies are vulnerable to government eavesdropping. 
 
 But all is not lost! The NSA's spying powers are vast, but there are still ways to thwart the agency's snooping. Here are five of them. 
 
 1. Browse anonymously with Tor 
 
 NSA whistleblower Edward Snowden has been photographed with a Tor sticker on his laptop. Tor lets you use the Internet without revealing your IP address or other identifying information. The distributed network works by bouncing your traffic among several randomly selected proxy computers before sending it on to its real destination. Web sites will think you're coming from whichever node your traffic happens to bounce off of last, which might be on the other side of the world. 
 
 Tor is easy to use. You can download the Tor Browser Bundle, a version of the Firefox browser that automatically connects to the Tor network for anonymous web browsing. 
 
 2. Keep your chats private with OTR 
 
 If you use a conventional instant messaging service like those offered by Google, AOL, Yahoo or Microsoft, logs of your chats may be accessible to the NSA through the PRISM program. But a chat extension called OTR (for "off the record") offers "end-to-end" encryption. The server only sees the encrypted version of your conversations, thwarting eavesdropping. 
 
 To use OTR, both you and the person you're chatting with need to use instant messaging software that supports it. I use a Mac OS X client called Adium, which works with Google, AOL, Microsoft and Yahoo's chat networks, among others. Windows and Linux users can use Pidgin. OTR works as an extension to conventional instant messaging networks, seamlessly adding privacy to the IM networks you already use. You can configure Adium or Pidgin so that if a person you're chatting with is also running an OTR-capable client, it will automatically encrypt the conversation. 
 
 3. Make secure calls with Silent Circle 
 
 The conventional telephone network is vulnerable to government wiretapping. And many Internet-based telephony applications, including Skype, are thought to be vulnerable to interception as well. 
 
 But an Internet telephony application called Silent Circle is believed to be impervious to wiretapping, even by the NSA. Like OTR, it offers "end-to-end" encryption, meaning that the company running the service never has access to your unencrypted calls and can't turn them over to the feds. The client software is open source, and Chris Soghoian, the chief technologist of the American Civil Liberties Union, says it has been independently audited to ensure that it doesn't contain any "back doors." 
 
 4. Make secure calls with Redphone 
 
 Redphone is another application that makes phone calls with end-to-end encryption. Interestingly, it was developed with financial support from U.S. taxpayers courtesy of the Open Technology Fund. 
 
 The government hopes to support dissidents in repressive regimes overseas. But the only way to build a communications application that people will trust is to make it impervious to snooping by any government, including ours. So like Silent Circle, the Redphone client software is open source and has been independently audited to make sure there are no back doors. 
 
 5. Remove your cellphone battery to thwart tracking 
 
 The NSA phone records program revealed by the Guardian last week not only collects information about what phone numbers we call, it also collects data about the location of the nearest cellphone tower when we make calls. That gives the NSA the ability to determine your location every time you make a phone call — and maybe in between calls too. 
 
 Unfortunately, Soghoian says there's no technical fix for this kind of surveillance. "The laws of physics will not let you hide your location from the phone company," he says. The phone company needs to know where you are in order to reach you when you receive a phone call. 
 
 So if you don't want the NSA to know where you've been, you only have one option: You need to turn off your cell phone. Or if you're feeling extra paranoid, take out the battery or leave your phone at home. 
 
 You probably can't hide metadata 
 
 Soghoian says that a similar point applies to your phone calling records. Encryption technology can prevent the government from intercepting the contents of voice communications. But it's much harder to hide information about your calling patterns. And information about who you've called can be as revealing as the contents of the calls themselves. 
 
 "If you're calling an abortion clinic or a phone sex hotline or a suicide counselor, what you say is basically the same as who you're saying it to," Soghoian argues. 
 
 Unfortunately, there's no easy technological fix for this problem. Even obtaining a phone not specifically tied to your identity may not help, as it may be possible to identify you from your calling patterns. 
 
 This problem tripped up Paula Broadwell, who was outed last year as having an extra-marital relationship with Gen. David Petraeus. She had been sending e-mails from an anonymous Gmail account, and she had even been smart enough to avoid logging in from home. 
 
 But the FBI identified her anyway. Broadwell logged into the account from several different hotels. The FBI obtained lists of who had checked into those hotels on the relevant dates and looked for common names. Broadwell was the only one who had checked into all of the hotels. 
 
 So it's fairly easy to protect the contents of your communications from government spying. But there's no easy technological fix to prevent the government from finding out who you're communicating with. ||||| Now that we have enough details about how the NSA eavesdrops on the internet, including today's disclosures of the NSA's deliberate weakening of cryptographic systems, we can finally start to figure out how to protect ourselves. 
 
 For the past two weeks, I have been working with the Guardian on NSA stories, and have read hundreds of top-secret NSA documents provided by whistleblower Edward Snowden. I wasn't part of today's story – it was in process well before I showed up – but everything I read confirms what the Guardian is reporting. 
 
 At this point, I feel I can provide some advice for keeping secure against such an adversary. 
 
 The primary way the NSA eavesdrops on internet communications is in the network. That's where their capabilities best scale. They have invested in enormous programs to automatically collect and analyze network traffic. Anything that requires them to attack individual endpoint computers is significantly more costly and risky for them, and they will do those things carefully and sparingly. 
 
 Leveraging its secret agreements with telecommunications companies – all the US and UK ones, and many other "partners" around the world – the NSA gets access to the communications trunks that move internet traffic. In cases where it doesn't have that sort of friendly access, it does its best to surreptitiously monitor communications channels: tapping undersea cables, intercepting satellite communications, and so on. 
 
 That's an enormous amount of data, and the NSA has equivalently enormous capabilities to quickly sift through it all, looking for interesting traffic. "Interesting" can be defined in many ways: by the source, the destination, the content, the individuals involved, and so on. This data is funneled into the vast NSA system for future analysis. 
 
 The NSA collects much more metadata about internet traffic: who is talking to whom, when, how much, and by what mode of communication. Metadata is a lot easier to store and analyze than content. It can be extremely personal to the individual, and is enormously valuable intelligence. 
 
 The Systems Intelligence Directorate is in charge of data collection, and the resources it devotes to this is staggering. I read status report after status report about these programs, discussing capabilities, operational details, planned upgrades, and so on. Each individual problem – recovering electronic signals from fiber, keeping up with the terabyte streams as they go by, filtering out the interesting stuff – has its own group dedicated to solving it. Its reach is global. 
 
 The NSA also attacks network devices directly: routers, switches, firewalls, etc. Most of these devices have surveillance capabilities already built in; the trick is to surreptitiously turn them on. This is an especially fruitful avenue of attack; routers are updated less frequently, tend not to have security software installed on them, and are generally ignored as a vulnerability. 
 
 The NSA also devotes considerable resources to attacking endpoint computers. This kind of thing is done by its TAO – Tailored Access Operations – group. TAO has a menu of exploits it can serve up against your computer – whether you're running Windows, Mac OS, Linux, iOS, or something else – and a variety of tricks to get them on to your computer. Your anti-virus software won't detect them, and you'd have trouble finding them even if you knew where to look. These are hacker tools designed by hackers with an essentially unlimited budget. What I took away from reading the Snowden documents was that if the NSA wants in to your computer, it's in. Period. 
 
 The NSA deals with any encrypted data it encounters more by subverting the underlying cryptography than by leveraging any secret mathematical breakthroughs. First, there's a lot of bad cryptography out there. If it finds an internet connection protected by MS-CHAP, for example, that's easy to break and recover the key. It exploits poorly chosen user passwords, using the same dictionary attacks hackers use in the unclassified world. 
 
 As was revealed today, the NSA also works with security product vendors to ensure that commercial encryption products are broken in secret ways that only it knows about. We know this has happened historically: CryptoAG and Lotus Notes are the most public examples, and there is evidence of a back door in Windows. A few people have told me some recent stories about their experiences, and I plan to write about them soon. Basically, the NSA asks companies to subtly change their products in undetectable ways: making the random number generator less random, leaking the key somehow, adding a common exponent to a public-key exchange protocol, and so on. If the back door is discovered, it's explained away as a mistake. And as we now know, the NSA has enjoyed enormous success from this program. 
 
 TAO also hacks into computers to recover long-term keys. So if you're running a VPN that uses a complex shared secret to protect your data and the NSA decides it cares, it might try to steal that secret. This kind of thing is only done against high-value targets. 
 
 How do you communicate securely against such an adversary? Snowden said it in an online Q&A soon after he made his first document public: "Encryption works. Properly implemented strong crypto systems are one of the few things that you can rely on." 
 
 I believe this is true, despite today's revelations and tantalizing hints of "groundbreaking cryptanalytic capabilities" made by James Clapper, the director of national intelligence in another top-secret document. Those capabilities involve deliberately weakening the cryptography. 
 
 Snowden's follow-on sentence is equally important: "Unfortunately, endpoint security is so terrifically weak that NSA can frequently find ways around it." 
 
 Endpoint means the software you're using, the computer you're using it on, and the local network you're using it in. If the NSA can modify the encryption algorithm or drop a Trojan on your computer, all the cryptography in the world doesn't matter at all. If you want to remain secure against the NSA, you need to do your best to ensure that the encryption can operate unimpeded. 
 
 With all this in mind, I have five pieces of advice: 
 
 1) Hide in the network. Implement hidden services. Use Tor to anonymize yourself. Yes, the NSA targets Tor users, but it's work for them. The less obvious you are, the safer you are. 
 
 2) Encrypt your communications. Use TLS. Use IPsec. Again, while it's true that the NSA targets encrypted connections – and it may have explicit exploits against these protocols – you're much better protected than if you communicate in the clear. 
 
 3) Assume that while your computer can be compromised, it would take work and risk on the part of the NSA – so it probably isn't. If you have something really important, use an air gap. Since I started working with the Snowden documents, I bought a new computer that has never been connected to the internet. If I want to transfer a file, I encrypt the file on the secure computer and walk it over to my internet computer, using a USB stick. To decrypt something, I reverse the process. This might not be bulletproof, but it's pretty good. 
 
 4) Be suspicious of commercial encryption software, especially from large vendors. My guess is that most encryption products from large US companies have NSA-friendly back doors, and many foreign ones probably do as well. It's prudent to assume that foreign products also have foreign-installed backdoors. Closed-source software is easier for the NSA to backdoor than open-source software. Systems relying on master secrets are vulnerable to the NSA, through either legal or more clandestine means. 
 
 5) Try to use public-domain encryption that has to be compatible with other implementations. For example, it's harder for the NSA to backdoor TLS than BitLocker, because any vendor's TLS has to be compatible with every other vendor's TLS, while BitLocker only has to be compatible with itself, giving the NSA a lot more freedom to make changes. And because BitLocker is proprietary, it's far less likely those changes will be discovered. Prefer symmetric cryptography over public-key cryptography. Prefer conventional discrete-log-based systems over elliptic-curve systems; the latter have constants that the NSA influences when they can. 
 
 Since I started working with Snowden's documents, I have been using GPG, Silent Circle, Tails, OTR, TrueCrypt, BleachBit, and a few other things I'm not going to write about. There's an undocumented encryption feature in my Password Safe program from the command line); I've been using that as well. 
 
 I understand that most of this is impossible for the typical internet user. Even I don't use all these tools for most everything I am working on. And I'm still primarily on Windows, unfortunately. Linux would be safer. 
 
 The NSA has turned the fabric of the internet into a vast surveillance platform, but they are not magical. They're limited by the same economic realities as the rest of us, and our best defense is to make surveillance of us as expensive as possible. 
 
 Trust the math. Encryption is your friend. Use it well, and do your best to ensure that nothing can compromise it. That's how you can remain secure even in the face of the NSA. ||||| Zoom in on this story . Explore all there is to know. 
 
 Edward Snowden appears by robot at a TED conference in Vancouver. Photo: AFP 
 
 Former intelligence contractor Edward Snowden has emerged from his Russian exile in the form of a remotely-controlled robot to promise more sensational revelations about US spying programs. 
 
 The fugitive's face appeared on a screen as he manoeuvred the wheeled android around a stage at the TED gathering, addressing an audience in Vancouver without ever leaving his secret hideaway. 
 
 "There are absolutely more revelations to come," he said. "Some of the most important reporting to be done is yet to come." 
 
 Advertisement 
 
 Snowden, a former National Security Agency (NSA) contractor who has been charged in the United States with espionage, dismissed the public debate about whether he is a heroic whistleblower or traitor. 
 
 Instead, he used the conference organised by educational non-profit organisation TED, or Technology Entertainment Design, to call for people worldwide to fight for privacy and internet freedom. 
 
 Internet creator Tim Berners-Lee briefly joined Snowden's interview with TED curator Chris Anderson, and came down in the hero camp. 
 
 When Anderson posed the question to the TED audience – known for famous, innovative, and influential attendees – the idea that Snowden was a force for good met with applause. 
 
 Hero or traitor? 
 
 "Hero patriot or traitor; I would say I am an American citizen just like anyone else," Snowden said. 
 
 "What really matters here is the kind of government we want; the kind of internet we want." 
 
 He sais he was inspired to pass a huge trove of NSA files to reporters when he saw US spying tactics going too far and intruding into the private data of millions of internet and telephone customers. 
 
 Snowden argued that if he had gone to the US Congress with his concerns he would have risked being "buried along with the information". 
 
 Snowden instead urged the "adversarial press" to challenge government and ignite public debate "without putting national security at risk". 
 
 He argued the dangers critics have played up regarding disclosure of information have not materialised, and insisted he remains comfortable with his decisions. 
 
 He depicted the NSA's PRISM program for getting user information from internet firms as a way for the US government to "deputise corporate America to do its dirty work". 
 
 And he blasted a US secret court for seldom rejecting NSA requests to compel internet companies to turn over user data and US legislators for showing little oversight. 
 
 Snowden urged internet companies to stand against online snooping by encrypting online activity by default so spies could easily note anything from book browsing at Amazon.com to visiting websites. 
 
 People should be able to book air travel, order books, make phone calls and send text messages without worrying about how it will look to an agent of the government, Snowden declared. 
 
 "More communications are being intercepted in America about Americans that there are in Russia about Russians," Snowden said. 
 
 Terrorism mantra 
 
 Snowden argued the NSA is making the US, and the world, less safe by lobbying for weak standards that could open back doors into online venues or services such as online commerce or banking. 
 
 "Our basic freedoms are not a partisan issue," he said. 'It is up to us to protect them; it is up to us to preserve the open internet." 
 
 Snowden endorsed the campaign by Berners-Lee for a global Magna Carta laying out values and rights on the internet. 
 
 "A Magna Carta for the internet is exactly what we need," Snowden said. 
 
 Anderson said the NSA had been invited to take part in the TED chat with Snowden, but it did not work out "for logistical reasons". 
 
 AFP 
 
 Follow IT Pro on Twitter
– Don't like the idea of the NSA spying on your phone calls and emails? In the Washington Post, Timothy B. Lee offers five ways for you to protect yourself: Tor: This Internet browser lets you remain anonymous, and does not reveal your IP address or other identifiers. One fan: NSA whistleblower himself, Edward Snowden. Silent Circle: This Internet phone app is thought to be "impervious to wiretapping, even by the NSA," Lee writes. OTR: Even your chat logs may be available to the NSA via PRISM, but if you use this chat extension (its name is short for "off the record"), the server will only see an encrypted version of your chat. One caveat: Both chatters need to be using software that supports OTR. Click for Lee's complete list. (Or, if you want to anonymously leak to the media, check out a how-to guide.)