Encrypted Communication

Credits Indira Cornelio, Alma Uguarte Perez Last Updated 2017-06

This session builds on prior training content related to encryption, conveying to participants the importance and utility of encrypting communications and providing relevant tools.

ADIDS Element

Input

Parent Topic(s)

PGP/GPG Email Encryption

Duration

45-60 minutes

This session was developed for, and should be attributed to, the Institute for War & Peace Reporting resource “Cyberwomen: Holistic Digital Security Training Curriculum for Women Human Rights Defenders” under a Creative Commons Attribution-Share Alike 4.0 International CC BY-SA 4.0 License

Materials to Prepare:

Slides (with key points included below)
Laptop/Computer and Projector setup

Running the Session:

Step 1 | Start the session by sharing relevant examples of situations where encrypted communications could be useful, taking time to explain how encryption works. Demonstrate some example screenshots a GPG-encrypted email to illustrate roughly what messages and emails look like while encrypted, and highlight common implementations of encryption – in particular, HTTPS, end-to-end encryption and GPG/PGP encryption.

Step 2 | Focus the discussion now specifically on tools that permit encrypted communications: Signal for calls and messages, meet.jitsi for video calls and Tutanota or GPG & Thunderbirdfor emails are good examples to share.

Step 3 | Explain the security benefits of these tools to the group, primarily how they enable users to limit others’ access to their communications; then discuss situations where the security of a user’s data could still be compromised, even while using encrypted communication. Ask participants – How could the contents of a GPG encrypted email be compromised by keylogging or screen-capturing malware? What if a user’s private GPG key was accessed by an adversary – how could they use it to gain access to their data?

Step 4 | If time allows, participants should have the opportunity for hands-on practice with at least one of the tools mentioned above in Step 2. Although there may not be enough time to set the group up with GPG/PGP for email, you may choose to demonstrate an HTTPS protected video call using meet.jitsi, or have participants install Signal on their phones to practice sending one another encrypted messages, or to exchange encrypted phone calls.