This is an old revision of the document!
Table of Contents
Secure audio and video services
Key points:
Technical options
Signal
Signal's mobile app offers end-to-end encrypted voice and video, without you needing to do anything.
It requires the other person to also have Signal.
You need a mobile phone number to set up Signal but, if you do not have a mobile phone, or do not want to give our your actual mobile phone number, you could rent a mobile phone number and use that to set up Signal. You should keep renting that phone number for as long as you use Signal with it.
You can download it here.
If you don't mind giving data to Facebook, WhatsApp offers simple end-to-end encryption.
Like Signal, it offers group messaging.
As well as text-based messaging, you can share files, and make encrypted audio and video calls.
You need a mobile phone number to set up WhatsApp but, if you do not have a mobile phone, or do not want to give our your actual mobile phone number, you could rent a mobile phone number and use that to set up WhatsApp. You should keep renting that phone number for as long as you use WhatsApp with it.
You can download it here.
Jitsi
Jitsi is an online encrypted audio and video conferencing platform, suitable for multiple simultaneous users. Unlike Signal or WhatsApp, which offers a telephony-like experience, Jitsi is more suited to scheduled meetings, where everyone dials-in to a conference bridge.
You can either use Jitsi's own hosted instance, meet.jit.si, or you can download and run it on your own server.
It can be used with Firefox and Chrome browsers without installing any additional software, and there are iOS and Android apps for use on mobile devices.
If you have a SIP phone system, you can integrate it with your Jitsi installation and enable phone dial-ins, to offer a completely self-hosted conferencing system.
For conferences with more than two parties, it offers encryption between each person's browser and your server, meaning that someone spying on your, or their, Internet connection cannot listen in to your call. It is not end-to-end encrypted, and so interception on your server would be possible — because of this, you need to be confident of the security of your installation.
Behavioural issues
Not all cybersecurity advice is technical. There are some behavioural tips and tricks which can help keep you, and your firm, more secure.
Phone calls: do not trust the number on screen
When you receive a phone call, you'll often be shown the number of the person calling you. If that matches a number in your address book, you'll probably be shown the name of the person in your address book, rather than the number.
This is convenient, but the downside is that it is easy for someone to make a phone call display any number they want, thereby pretending to be your friend.
There's nothing you can do about this at the moment (although some work is under way to try to improve the current insecurities), other than to be mindful that a call from your boss, or your client, or your finance team, may not actually be from them.
Be careful where you speak
It should go without being said, but here we go: you can have the most secure, highly encrypted, voice communications system available, but it is of little use if you are going to have a conversation loudly or in a public place.
Trains, coffee shops, the Law Society's Reading Room… no matter how good your cryptography is, if you can be overheard, you're vulnerable.
Be aware of fake technical support calls
A reasonably common scam is someone calling up, pretending to be from a technical support team, claiming that there is a problem on your computer. They want to get access to your computer, and then either install malware, or else find a (non-existent) problem and try to bill you to fix it.
Don't get into a discussion with them, or try to lead them on or waste their time. Just put the phone down.
If it's actually, genuinely your IT support team, they'll appreciate your security-aware stance.
If you think you have been scammed in this way, or are in the process of being scammed, get off the phone, disconnect your computer from the Internet quickly — pull out your Ethernet cable, or turn off the Wi-Fi adapter — and get your machine checked.