Australia’s national mission to become one of the world’s most cybersecure nations hinges on building public awareness and opening up the profession, the government’s cyber coordinator said on Wednesday. While cyber technologies will be an important defence, their place in the hands of adversaries makes people and process all the more critical, according to Australia’s…
Mozilla is highlighting each year the work of 25 digital leaders using technology to amplify voices, effect change, and build new technologies globally through its Rise 25 Awards. On 13 May 2024 was the turn of Raphael Mimoun, a builder dedicated to making tools that empower journalists and human rights defenders. Aron Yohannes talked with Raphael about the launch of his app, Tella, combatting misinformation online, the future of social media platforms and more.
Raphael Mimoun: So I never worked in tech per se and only developed a passion for technology as I was working in human rights. It was really a time when, basically, the power of technology to support movements and to head movements around the world was kind of getting fully understood. You had the Arab Spring, you had Occupy Wall Street, you had all of these movements for social justice, for democracy, for human rights, that were very much kind of spread through technology, right? Technology played a very, very important role. But just after that, it was kind of like a hangover where we all realized, “OK, it’s not just all good and fine.” You also have the flip side, which is government spying on the citizens, identifying citizens through social media, through hacking, and so on and so forth — harassing them, repressing them online, but translating into offline violence, repression, and so on. And so I think that was the moment where I was like, “OK, there is something that needs to be done around technology,” specifically for those people who are on the front lines because if we just treat it as a tool — one of those neutral tools — we end up getting very vulnerable to violence, and it can be from the state, it can also be from online mobs, armed groups, all sort of things.
There’s so much misinformation out there now that it’s so much harder to tell the difference between what’s real and fake news. Twitter was such a reliable tool of information before, but that’s changed. Do you think that any of these other platforms can be able to help make up for so much of the misinformation that is out there?
I think we all feel the weight of that loss of losing Twitter. Twitter was always a large corporation, partially owned by a billionaire. It was never kind of a community tool, but there was still an ethos, right? Like a philosophy, or the values of the platform were still very much like community-oriented, right? It was that place for activists and human rights defenders and journalists and communities in general to voice their opinions. So I think that loss was very hard on all of us.
I see a lot of misinformation on Instagram as well. There is very little moderation there. It’s also all visual, so if you want traction, you’re going to try to put something that is very spectacular that is very eye catchy, and so I think that leads to even more misinformation.
I am pretty optimistic about some of the alternatives that have popped up since Twitter’s downfall. Mastodon actually blew up after Twitter, but it’s much older — I think it’s 10 years old by now. And there’s Bluesky. So I think those two are building up, and they offer spaces that are much more decentralized with much more autonomy and agency to users. You are more likely to be able to customize your feeds. You are more likely to have tools for your own safety online, right? All of those different things that I feel like you could never get on Threads, on Instagram or on Twitter, or anything like that. I’m hoping it’s actually going to be able to recreate the community that is very much what Twitter was. It’s never going to be exactly the same thing, but I’m hoping we will get there. And I think the fact that it is decentralized, open source and with very much a philosophy of agency and autonomy is going to lead us to a place where these social networks can’t actually be taken over by a power hungry billionaire.
What do you think is the biggest challenge that we face in the world this year on and offline, and then how do you think we can combat it?
I don’t know if that’s the biggest challenge, but one of the really big challenges that we’re seeing is how the digital is meeting real life and how people who are active online or on the phone on the computer are getting repressed for that work in real life. So we developed an app called Tella, which encrypts and hides files on your phone, right? So you take a photo or a video of a demonstration or police violence, or whatever it is, and then if the police tries to catch you and grab your phone to delete it, they won’t be able to find it, or at least it will be much more difficult to find it. Or it would be uploaded already. And things like that, I think is one of the big things that we’re seeing again. I don’t know if that the biggest challenge online at the moment, but one of the big things we’re seeing is just that it’s becoming completely normalized to grab someone’s phone or check someone’s computer at the airport, or at the border, in the street and go through it without any form of accountability. People have no idea what the regulations are, what the rules are, what’s allowed, what’s not allowed. And when they abuse those powers, is there any recourse? Most places in the world, at least, where we are working, there is definitely no recourse. And so I think that connection between thinking you’re just taking a photo for social media but actually the repercussion is so real because you’re going to have someone take your phone, and maybe they’re going to delete the photo, or maybe they’re going to detain you. Or maybe they’re going to beat you up — like all of those different things. I think this is one of the big challenges that we’re seeing at the moment, and something that isn’t traditionally thought of as an internet issue or an online digital rights issue because it’s someone taking a physical device and looking through it. It often gets overlooked, and then we don’t have much kind of advocacy around it, or anything like that.
What do you think is one action everybody can take to make the world and our lives online a little bit better?
I think social media has a lot of negative consequences for everyone’s mental health and many other things, but for people who are active and who want to be active, consider social networks that are open source, privacy-friendly and decentralized. Bluesky, the Fediverse —including Mastodon — are examples because I think it’s our responsibility to kind of build up a community there, so we can move away from those social media platforms that are owned by either billionaires or massive corporations, who only want to extract value from us and who spy on us and who censor us. And I feel like if everyone committed to being active on those social media platforms — one way of doing that is just having an account, and whatever you post on one, you just post on the other — I feel like that’s one thing that can make a big difference in the long run.
We started Rise25 to celebrate Mozilla’s 25th anniversary. What do you hope that people are celebrating in the next 25 years?
I was talking a little bit earlier about how we are building a culture that is more privacy-centric, like people are becoming aware, becoming wary about all these things happening to the data, the identity, and so on. And I do think we are at a turning point in terms of the technology that’s available to us, the practices and what we need as users to maintain our privacy and our security. I feel like in honestly not even 25, I think in 10 years, if things go well — which it’s hard to know in this field — and if we keep on building what we already are building, I can see how we will have an internet that is a lot more privacy-centric where communications are by default are private. Where end-to-end encryption is ubiquitous in our communication, in our emailing. Where social media isn’t extractive and people have actual ownership and agency in the social network networks they use. Where data mining is no longer a thing. I feel like overall, I can see how the infrastructure is now getting built, and that in 10,15 or 25 years, we will be in a place where we can use the internet without having to constantly watch over our shoulder to see if someone is spying on us or seeing who has access and all of those things.
Lastly, what gives you hope about the future of our world?
That people are not getting complacent and that it is always people who are standing up to fight back. We’re seeing it at. We saw it at Google with people standing up as part of No Tech for Apartheid coalition and people losing the jobs. We’re seeing it on university campuses around the country. We’re seeing it on the streets. People fight back. That’s where any change has ever come from: the bottom up. I think now, more than ever, people are willing to put something on the line to make sure that they defend their rights. So I think that really gives me hope.
Nikole Yanez is a computer scientist by training, and a human rights defender from Honduras. She is passionate about feminism, the impact of the internet and protecting activists. She was first drawn to human rights through her work as a reporter with a local community radio station. After surviving the coup d’état in Honduras in 2009, Nikole broadened her approach to focus her activism on technology. When she applied for the Digital Forensics Fellowship with the Amnesty Tech Security Lab in 2022, she was looking to learn more about cybersecurity and apply what she learnt with the organizations and collectives she works with regularly.
She highlighted her commitment to fostering a network of tech-savvy communities across Latin America in an interview with Elina Castillo, Amnesty Tech’s Advocacy and Policy Advisor:
I grew up in Honduras, where I lived through the coup d’état, which took place in 2009. It was a difficult time where rights were non-existent, and people were constantly afraid. I thought it was something you only read about in history books, but it was happening in front of my eyes. I felt myself just trying to survive, but as time went by it made me stronger and want to fight for justice. Despite the difficulties, people in my community remained hopeful and we created a community radio station, which broadcast stories about everyday people and their lives with the aim of informing people about their human rights. I was a reporter, developing stories about individual people and their fight for their rights. From there, I found a passion for working with technology and it inspired me to train to become a computer scientist.
I am always looking for ways to connect technology with activism, and specifically to support women and Indigenous people in their struggles. As much as technology presents risks for human rights defenders, it also offers opportunities for us to better protect ourselves and strengthen our movements. Technology can bring more visibility to our movements, and it can empower our work by allowing us to connect with other people and learn new strategies.
Is there one moment where you realized how to connect what you’ve been doing with feminism with technology?
In my work, my perspective as a feminist helps me centre the experiences and needs of marginalised people for trainings and outreach. It is important for me to publicly identify as an Afrofeminist in a society where there is impunity for gendered and racist violence that occurs every day. In Honduras we need to put our energy into supporting these communities whose rights are most violated, and whose stories are invisible.
For example, in 2006, I was working with a Union to install the Ubuntu operating system (an open-source operating system) on their computers. We realized that the unionists didn’t know how to use a computer, so we created a space for digital literacy and learning about how to use a computer at the same time. This became not just a teaching exercise, but an exercise for me to figure out how to connect these tools to what people are interested in. Something clicked for me in this moment, and this experience helped solidify my approach to working on technology and human rights.
There are not many women working in technology and human rights. I don’t want to be one of the only women, so my goal is to see more women colleagues working on technical issues. I want to make it possible for women to work in this field. I also want to motivate more women to create change within the intersection of technology and human rights. Using a feminist perspective and approach, we ask big questions about how we are doing the work, what our approach needs to be, and who we need to work with. Nikole Yanez Honduras Human Rights Defender
For me, building a feminist internet means building an internet for everyone. This means creating a space where we do not reproduce sexist violence, where we find a community that responds to the people, to the groups, and to the organizations that fight for human rights. This includes involving women and marginalised people in building the infrastructure, in the configuration of servers, and in the development of protocols for how we use all these tools.
In Honduras, there aren’t many people trained in digital forensics analysis, yet there are organizations that are always seeking me out to help check their phones. The fellowship helped me learn about forensic analysis on phones and computers and tied the learning to what I’m actually doing in my area with different organizations and women’s rights defenders. The fellowship was practical and rooted in the experience of civil society organizations.
How do you explain the importance of digital forensics? Well first, it’s incredibly relevant for women rights defenders. Everyone wants to know if their phone has been hacked. That’s the first thing they ask:, “Can you actually know whether your phone has been hacked?” and “How do I know? Can you do it for me? How?” Those are the things that come up in my trainings and conversations.
I like to help people to think about protection as a process, something ongoing, because we use technology all day long. There are organizations and people that take years to understand that. So, it’s not something that can be achieved in a single conversation. Sometimes a lot of things need to happen, including bad things, before people really take this topic seriously…
I try to use very basic tools when I’m doing digital security support, to say you can do this on whatever device you’re on, this is a prevention tool. It’s not just applying technical knowledge, it’s also a process of explaining, training, showing how this work is not just for hackers or people who know a lot about computers.
One of the challenges is to spread awareness about cybersecurity among Indigenous and grassroots organizations, which aren’t hyper-connected and don’t think that digital forensics work is relevant to them. Sometimes what we do is completely disconnected from their lives, and they ask us: “But what are you doing?” So, our job is to understand their questions and where they are coming from and ground our knowledge-sharing in what people are actually doing.
To someone reading this piece and saying, oh, this kind of resonates with me, where do I start, what would your recommendation be?
If you are a human rights defender, I would recommend that you share your knowledge with your collective. You can teach them the importance of knowing about them, practicing them, as well as encouraging training to prevent digital attacks, because, in the end, forensic analysis is a reaction to something that has happened.
We can take a lot of preventive measures to ensure the smallest possible impact. That’s the best way to start. And it’s crucial to stay informed, to keep reading, to stay up to date with the news and build community.
If there are girls or gender non-conforming people reading this who are interested in technical issues, it doesn’t matter if you don’t have a degree or a formal education, as long as you like it. Most hackers I’ve met become hackers because they dive into a subject, they like it and they’re passionate about it.Nikole Yanez Honduras Human Rights Defender
A $206.4 million budget commitment to improved data capability and cybersecurity has been given to Australia’s two financial regulators, among a series of smaller cyber upgrades. The funding, included in the 2024-25 federal budget, will also go towards stabilising the regulators’ business registers and modernisation of legacy systems following the cancellation of the multibillion-dollar Modernising…
The Albanese government has deployed its autonomous cyber sanction powers for the second time, joining the United States and United Kingdom in imposing restrictions on another alleged Russian hacker. Senior leader of ransomware group LockBit, Dmitry Yuryevich Khoroshev, is now subject to financial sanctions and a travel ban. The restrictions, announced on Wednesday, mean it…
Last year, the Helpline received a total of 3,709 requests for digital security assistance.
To put this in perspective, the Helpline received 10,000 requests in total between 2014 and 2021, but more than double that number in the three years that followed.
Most (82%) of the cases we dealt with in 2023 were reactive in nature, meaning they related to unfolding incidents or emergencies that required beneficiaries to take rapid measures to strengthen their digital security. The remaining 18% were preventative, whereby beneficiaries preemptively sought out digital security advice, tools, and solutions.
In recent years, the Helpline has been investing in our ability to operate 24/7, 365 days a year, and to deliver more substantial and engaged forms of support. For instance, we’ve been conducting analysis of advanced threats and producing collaborative research in places such as Armenia, Serbia, and Jordan.
In 2023, the regional distribution of cases was as follows:
Our work supports a wide spectrum of civil society stakeholders; from individual activists, human rights defenders, and members of marginalized communities, to journalists and media workers. For it to be as impactful as possible, we work closely with the wider digital security community, through networks like CiviCERT. This allows us to deliver adequate support to each of our beneficiary groups, which were distributed as follows in 2023:
In 2024, the Helpline will continue improving and increasing how we collaborate with activist groups around the world, as well as working to meet the evolving needs of the global rapid response community. If you are a member of civil society in need of digital security assistance, you can find details about how to get in touch on our website page.
Global cyber threat intel from Microsoft will feed directly into the federal government’s threat intelligence sharing platform at machine speed in a move designed to boost Australia’s cyber defences. The intel, sourced from Microsoft’s Sentinel platform, will surface in the Australian Signals Directorate’s Cyber Threat Intelligence Sharing (CTIS) platform, following a “world-first” initiative to connect…
On 12 March 2024 the U.S. and European Union issued new joint guidance on Monday for online platforms to help mitigate virtual attacks targeting human rights defenders, reports Alexandra Kelley, Staff Correspondent, Nextgov/FCW.
Outlined in 10 steps, the guidance was formed following stakeholder consulting from January 2023 to February 2024. Entities including nongovernmental organizations, trade unionists, journalists, lawyers, environmental and land activists advised both governments on how to protect human rights defenders on the internet.
Recommendations within the guidance include: committing to an HRD [human rights defender] protection policy; identifying risks to HRDs; sharing information with peers and select stakeholders; creating policy to monitoring performance metric base marks; resource staff adequately; build a capacity to address local risks; offer safety tools education; create an incident reporting channel; provide access to help for HRDs; and incorporate a strong transparent infrastructure.
Digital threats HRDs face include target Internet shutdowns, censorship, malicious cyber activity, unlawful surveillance, and doxxing. Given the severity and reported increase of digital attacks against HRDs, the guidance calls upon online platforms to take mitigating measures.
“The United States and the European Union encourage online platforms to use these recommendations to determine and implement concrete steps to identify and mitigate risks to HRDs on or through their services or products,” the guidance reads.
The ten guiding points laid out in the document reflect existing transatlantic policy commitments, including the Declaration for the Future of the Internet. Like other digital guidance, however, these actions are voluntary.
“These recommendations may be followed by further actions taken by the United States or the European Union to promote rights-respecting approaches by online platforms to address the needs of HRDs,” the document said
Australian energy ministers will develop nationally consistent standards and a new regulatory framework for household solar and vehicle-to-grid technologies to help manage the risks, including cybersecurity, of a quickly changing energy system. Development of a new National Consumer Energy Resources (CER) Roadmap was announced Friday by Climate Change and Energy minister Chris Bowen after the…
Online safety standards designed to force tech giants to scan cloud storage for illegal and harmful content in Australia set a “dangerous global precedent” that could undermine security protections and lead to mass surveillance, according to Apple. The tech giant made the comments in a submission to the eSafety Commissioner, which is developing binding standards…
New cybersecurity standards for solar inverters, battery storage and electric vehicle chargers are being developed by the federal government to improve the security of Australia’s energy supply, which is increasingly exposed to compromise. Department of Climate Change, Energy, Environment and Water (DCCEEW) officials on Monday confirmed that a departmental team had been stood up to…
Australia has sanctioned a Russian hacker for his involvement in the Medibank cyber-attack, marking the first time the federal government has used Magnitsky-style powers to name and shame a cyber criminal. Foreign minister Penny Wong revealed the sanctions against 34-year-old Alexander Ermakov on Tuesday following almost 18 months of investigation by the Australian Signals Directorate…
Proposed legal protections for businesses that share information with the government cyber responders during an attack should not stand in the way of future enforcement action by regulators, according to Australia’s privacy watchdog. In a submission to a parliamentary inquiry into cybercrime, the Office of the Australian Information Commissioner urged the government to design the…
Australian businesses will continue making ransomware payments while it makes business sense, but the government’s move to force disclosure of the payments will eventually help arrest the current growth in attacks, according to global cyber firm Arctic Wolf. “Unfortunately, there are circumstances especially in the mid-market or the SMB [market], where the viewpoint of those…
The latest review of New South Wales government agencies’ cybersecurity has revealed a lack of progress and cast more doubt on the impact of state’s dedicated cyber agency, which struggled under a lack of funding certainty last year. Agencies continue to grant unwarranted privileged access to bureaucrats, developers and suppliers, and leave a critical system…
The federal government’s cyber hubs program was scrapped after an independent evaluation found the model would not have resulted in a significant cybersecurity uplift or prevented an Optus-style data breach. The report also found that the program, piloted at a cost of $80 million, would have required at least $500 million to formally establish within…
The government would fine businesses that fail to report ransomware attacks, including sensitive information about their systems, to cyber agencies under the initial proposal for its upcoming notification scheme. Companies that are impacted by a ransomware attack, even if no ransom is paid, could be asked to provide the specific vulnerability in their system, what…
The government would fine businesses that fail to report ransomware attacks, including sensitive information about their systems, to cyber agencies under the initial proposal for its upcoming notification scheme. Companies that are impacted by a ransomware attack, even if no ransom is paid, could be asked to provide the specific vulnerability in their system, what…
Queensland has become only the second state to legislate a mandatory data breach notification scheme for public sector entities, as an almost identical scheme comes into effect in New South Wales. The Information Privacy and Other Legislation Amendment Bill 2023 passed through the Queensland state Parliament on Wednesday, less than two months after the bill…
Facing rapidly escalating cyber threats, Australia’s cybersecurity landscape demands a decisive and strong response. The Australian Government’s 2023-2030 Cyber Security Strategy, while a big step forward, grossly underestimates the magnitude of the current situation. With a phased horizon approach geared to solve urgent gaps and improve cybersecurity maturity, the strategy intends to establish Australia as…
Facing rapidly escalating cyber threats, Australia’s cybersecurity landscape demands a decisive and strong response. The Australian Government’s 2023-2030 Cyber Security Strategy, while a big step forward, grossly underestimates the magnitude of the current situation. With a phased horizon approach geared to solve urgent gaps and improve cybersecurity maturity, the strategy intends to establish Australia as…
Local cyber industry stakeholders have welcomed the focus on sovereign capability in the federal government’s 2023-2030 Cybersecurity Strategy, but there are differing views on the how effective the government’s new plan and relatively low funding will be. The government will attempt to build sovereign capability through a Cyber Challenge through the Department of Industry, Science,…
The federal government has adjusted its cyber aspirations from being the world’s best to being among the leaders, a recognition that several factors will be beyond Australia’s control in a “deteriorating” global cyber landscape. Under a new national strategy unveiled by Cybersecurity minister Clare O’Neil on Wednesday, the government will invest an additional $587 million…
Cybersecurity minister Clare O’Neil has released the Australian government’s long-anticipated cybersecurity strategy, a seven-year plan to make Australia “a world leader in cyber security” by 2030. The plan includes $587 million in additional funding over the forward estimates committed to initiatives to boost cyber capability. Among “six cyber ‘shields’” outlined in the 2023-2030 Australian Cyber…
RMIT researchers and Sydney cyber startup Tide are claiming a mathematical breakthrough has allowed them to spread system access authority across a network using decentralised keys, meaning there is no one weak link or human vulnerability. The research has been conducted over several years but has now been translated into a prototype developer tool touted…
Safe harbour laws that temporarily shield companies from liability during a cyber-attack will be pursed by the federal government in a bid to improve information sharing with Australia’s cyber responders. Defence minister Richard Marles foreshadowed legislation on Wednesday, as a new report from Australia’s cyber spy agency revealed a 23 per cent increase in cyber…
Australia’s cyber coordinator has been recalled to Defence to deal with a personal matter, with Home Affairs’ critical infrastructure lead brought in to cover the position while the government continues responding to a major cyber attack. Defence issued a brief statement on Wednesday saying National Cyber Security Coordinator, Air Marshal Darren Goldie had “been recalled…
The Albanese government will introduce a mandatory ransomware reporting scheme for businesses as part of its update to the national cybersecurity strategy, ruling out an outright ban on the payment of ransom demands. Cybersecurity minister Clare O’Neil unveiled the proposed notification scheme on Monday, as one of the country’s biggest port operators continues to battle…
Australia’s privacy watchdog is taking Australian Clinical Labs to court over a data breach that exposed the personal information of 223,000 Australians, a week after its regulatory actions were criticised in Senate Estimates. The ASX-listed company, which owns Medlab Pathology, is alleged to have “seriously interfered with the privacy of millions of Australians by failing to take reasonable…
Home Affairs and Cybersecurity minister Clare O’Neil met with representatives from her former employer McKinsey & Co 22 times this year as it helped developed Australia’s upcoming cyber strategy. McKinsey’s contract for work on the strategy was doubled to $2.4 million without competitive tender, and the controversial consultancy now appears to be the dominant outside…
Australia is not prepared for the next wave of cyber-crime. Government has yet to implement regulations that would reduce the impact of what is coming. And Australian businesses and industry continue to lag international best practice. Imagine what would happen when artificial intelligence and automated lifelike voice generators become weaponised by cyber-criminals and rogue nations….