Hong Kong's 612strike uprising is alive to surveillance threats, but its countermeasures are woefully inadequate

The millions of Hong Kong people participating in the #612strike uprising are justifiably worried about state retaliation, given the violent crackdowns on earlier uprisings like the Umbrella Revolution and Occupy Central; they're also justifiably worried that they will be punished after the fact.

After all, the #612strike was triggered by a proposed legal change that would allow people in Hong Kong to be extradited to the Chinese mainland for political crimes -- and Hong Kong people already witnessed the horrific spectacle of dissident booksellers being kidnapped to China and then tortured into giving coerced, televised "confessions."

The movement is taking countermeasures to avoid identification, using masks to beat facial recognition systems, organizing in encrypted Telegram chats (Telegram blamed the Chinese state for a wave of DDOS attacks that could disrupt these chatrooms), and using cash money to pay for subway fares to and from the protests, avoiding leaving identifiable e-payment trails.

But all of that will be of limited use if the protesters are identified by other means. The most significant risk is from cell-site simulators -- briefcase-sized fake cellular towers that trick your phone into contacting them and coughing up its unique identifier, which can be used to conduct mass re-identifications of every person with a switched-on mobile phone at the protests. These devices are small, cheap, powerful, and can even mounted beneath aircraft, including drones.

Unless the protesters are using burner phones -- not just burner SIMs, but burner handsets, too -- they face a significant de-anonymization risk.After all, they're using mobile phones to coordinate the protests themselves, and that means that they're effectively carrying always-on wireless nametags that the state can silently enumerate and store indefinitely. Read the rest