What exactly can the Ministry of Interior spy on and how to protect ourselves

In recent days, the Internet has been abuzz with the news of the new software with which the Ministry of Interior and in particular the Directorate of the Interior will have the ability to read mobile and desktop computer devices. Of course, our society, like any other, is sensitive to such issues and the news caused a wave of concerns, dissatisfaction, uncertainty. Very quickly, opinions appeared that try to bring clarity and some peace on the topic like this or this or that television appearance. Here we will share the information that we consider important on the topic.

What is the GDBOP software and what can it spy on?

It is about forensic/investigative (Forensic) software that collects data and clues from your phone automatically. No investigator is required, and most are not technically literate enough, to extract data from various mobile devices, so it is much easier for them to rely on software that will compile and extract the information they need in a form that is ready directly for the courtroom. This is exactly what the Bulgarian Anti-Money Laundering and Counterfeiting Service is doing, they are buying software to extract data from already captured and detained computer devices. From the tender and supply contracts we understand the names of the software. We are talking about EnCase Forensic, MOBILedit Forensic and File Scavenger.

EnCase Forensic– the main program in the suite. With it, you can log into computers, mobile phones, and GPS devices, from which you can automatically extract documents, emails, chat archives, photos, audio, information about visited places, your browsing history, etc. The software also offers limited ability to crack passwords and decrypt encrypted databases.

MOBILedit Forensic is specialized for Android, iOS and Blackberry mobile devices and claims to be able to bypass PINs and passwords to unlock your phone, as well as passwords to log in to certain applications. In this way, it can extract all your chats, phone numbers from the directory, information about calls made, emails and documentation from your smartphone and if you are on iOS, even decrypt your data and access it despite the encryption.

File Scavenger is a program dedicated to recovering deleted files. With it, the GDBOP will be able to retrieve information that you have already deleted "permanently" with Shift+Delete in case you have tried to hide evidence and clues in this way

Many of these functions are also available through free open source software such as PhotoRec. Some of the software listed above also has pirated cracks, and chat archives are simple text files that anyone can access through their file system. In general, the GDBOP have taken software to make their work easier, not to gain any new spying capabilities. Their idea is that within the 24 to 72 hours that you are detained, they can get everything from your computer devices in a format that they can directly work with. Let's clarify again: We are only talking about devices that are physically in the hands of the GDBOP, not about remote spying. We write about it below.

How can we protect ourselves?

Encrypt your devices! Encrypting your information gives you much, much, much more security than similar forensic software.
If you are on a Windows operating system, you have the option to use the built-in BitLocker feature, which is completely sufficient and quite easy to use. Set a different and unusual access password and if the GDBOP doesn't learn it from you, there's no way they can decrypt your data.

If you have iOS, you have FileVault encryption on your Mac and built-in encryption on your iPhone. Keep in mind that if you have Apple devices, the software that the Ministry of Internal Affairs has purchased is sold as capable of breaking encrypted Apple products and your security is in question.
If you have Android, you have had built-in encryption since version 2.3, but with serious improvements since version 5.x. It can be done literally in a few simple steps. Keep in mind that encryption is a one-way process and the only way to get rid of it on Android is to delete all your information and start over (this does not prevent you from downloading the information to your computer first, of course).

The encryption option in Linux systems is called LUKS and, again, it is extremely easy to use.

Keep in mind that no matter which device and operating system you choose to encrypt, it will cause a slight slowdown in its performance. It is normal that when you have to constantly decrypt and encrypt files, the system performance increases. For convenience, on systems like Windows and Linux, you can encrypt only the User folder, which hides information like emails, chat logs, etc., while leaving the rest like games, movies, etc. unprotected and easier to use.

Delete your chat history! Simply delete all your chats periodically or set your apps not to archive chats but to delete them after you leave the app.

Are the police spying on us after all?

What is said here are just rumors that we have heard and we do not commit to their veracity, but we have heard from several independent sources about the possibility of DANS remotely accessing (without having your device) everything you do on Facebook. We assume that this is only done in times of serious risk to national security, and not for chicken performances, BUT there is no way to know anything for sure.

After a TV appearance by a Viber representative today, it became clear that if there is a prosecutor's order, their company provides information to the Ministry of Interior about who wrote and spoke to whom in the application. This is possible because although the chats are encrypted at both ends and even Viber (in theory) cannot read them, your registration there is not anonymous, but is done with a phone number (which, according to Bulgarian law, always has a name and ID card of the owner). This way they know that phone number X spoke to phone number Y, and for the police from there it is a matter of minutes to establish who exactly is behind number X and number Y.
The exact same thing applies to centralized encrypted chat apps like Signal, Telegram, and Whatsapp.

The solution to this problem is the use of OTR encryption, and chats using the TOR network. This will soon work for participants in the Liberty 420 cause and all members and sympathizers of the Bulgarian Libertarian Society completely free of charge.
In addition, we will try to add a detailed Wiki with instructions and information on how to stay safe on the internet.

Authors: Dimitar Karagegov and Plamen P. Batalski

Did you like it? Take a minute to support the EKIP on Patreon!