Taking Steps to Maximize Privacy While Covering the Lack of It

https://www.nytimes.com/2019/05/22/technology/personaltech/maximize-online-privacy.html

Version 0 of 1.

How do New York Times journalists use technology in their jobs and in their personal lives? Jennifer Valentino-DeVries, an investigative reporter, discussed the tech she’s using.

What are your most important tech tools for doing investigations, and how do they fit into your reporting process?

People seem to think that investigative reporting involves secret techniques. But it is actually not that mysterious. The big “secret” is that I get time to do these stories — so I can sift through thousands of records, or contact dozens of people before finding one who will talk with me.

One of my favorite tools for investigations is an updated version of an old-school newsroom feature: the New York Times tip line. (Please take this as a hint to send me your tips.)

People who want to share evidence of wrongdoing can always mail us an actual letter, but now they also have the option of contacting us through SecureDrop, which is an encrypted submission system that uses anonymity software. After almost every article I have written, I have received useful tips about ways to extend that reporting.

I write a lot about technology companies. To investigate them, I rely not only on help from sources but also on tests of the technology itself.

Tech executives tend to stay on message and provide canned responses about how their company is committed to protecting user privacy. But if I can see, for example, that their website’s code directs user location data to dozens of advertising firms’ servers, I can raise deeper questions about what is really happening. I often use products like Google Chrome’s Developer Tools to learn more about what is going on under the hood.

I am fortunate to work with journalists who are adept with more complex code as well. For example, we recently analyzed data sent by mobile apps. Those apps sometimes make it hard to see the information they’re sending, so my colleagues Michael Keller and Aaron Krolik used tools more commonly employed by computer security researchers to help reveal it.

You’ve specifically written a great deal about privacy. How has your reporting on privacy issues changed the way you use technology for work and for play?

I don’t think it is realistic to expect people to abandon technology over privacy concerns. I’m on Facebook and Twitter. I use Google and Slack. Technology is an inextricable part of our society and the business world.

That said, there are two products I would use if not for the nagging questions I have about data collection: DNA testing and in-home voice assistants. I would love to get pretty charts about my ancestry. I would love to ask Alexa or Google to tell me the weather forecast so I don’t have to look at a screen in the morning. But I just can’t bring myself to do it, because the data involved — my genetic information and recordings of what I say at home — is just too sensitive.

I take more steps to protect my privacy than the average person probably does. I regularly check my phone’s location settings, and I use services that help stop online trackers. I have removed myself from a variety of data broker lists, which make your personal information widely available. But after covering this field for a while, I am under no illusions that I am able to fully protect my privacy, even with these procedures.

You have written about how dozens of smartphone apps have recorded people’s location data. How have you seen that data being used?

Advertising is the biggest business for such data by far. Companies can use your location data to profile you and show you the ads most likely to influence you. For example, if you go to an elementary school and back home every morning, you might be a stay-at-home parent.

But the most interesting use I have seen has been by hedge funds. They look at this data to get ahead of the stock market, for example, by seeing which stores are having an uptick in customers before those stores report earnings.

What steps do you take to protect confidential sources?

When I began covering technology in 2010, my computer-security sources introduced me to encrypted communications. We would use special chat programs and send our messages over the Tor anonymity network. It was a complicated setup, and not something I would be able to persuade most sources to undertake.

Now, so many people know of encryption apps like Signal, which is as easy to use as any other texting app. It’s so much simpler to get a source to take at least some steps to protect themselves.

That said, it’s important to keep in mind that these apps aren’t foolproof. Many journalists have made mistakes in attempting to use secure communications. If you back up all your encrypted messages to your iCloud account, your use of encryption is pointless. The possible mistakes terrify me, and sometimes it’s better to simply meet someone face to face and leave your phone at home.

Outside of work, what tech product are you currently obsessed with?

I have young children, and I think they are pretty much the cutest people ever. I’m a huge fan of limited photo-sharing apps that allow a small set of people to see what they’re doing in preschool and other daily activities. I literally just watched a video of my 2-year-old dancing awkwardly.

If people could do one thing today to protect their digital privacy, what would you tell them to do?

It depends what you mean by “digital privacy.” If your top worry is hackers, the best thing you can do is get a password manager instead of reusing the same passwords everywhere.

If you are concerned about companies controlling your data, you face more challenges. It seems likely that a large part of the remedy in this area will involve changes to consumer protection laws, which have passed or are being considered in multiple states.