ACLU senior staff attorney Nathan Freed Wessler was concerned not just that Microsoft wanted to sell a “dangerous” tech to an agency involved in a “racist drug war,” but that it came just as the US Attorney General had reportedly expanded the DEA’s surveillance powers. The DEA could misuse the tech to spy on people protesting police brutality, Wessler speculated.

We’ve asked Microsoft for comment. The company has defended federal contracts in the past, but not universally so. While it argued that a military HoloLens contract was important to support people who “protect the freedoms” of Americans, it justified an Immigrations and Customs Enforcement deal by noting that it didn’t cover the agency’s most controversial practices. The DEA case is another matter — there’s little doubt that facial recognition would be used for contentious purposes.

While there isn’t a whole lot you can do against a cop with a can of mace and an itchy trigger finger, there are plenty of ways to protect your safety, identity and personal data when you’re out exercising your First Amendment rights.

You’ll have to do more than follow the Wu-Tang’s advice to protect ya neck if you want to avoid the wrath of the police, you’ll need to protect your whole damn head. The cops have recently taken a page out of Chile’s playbook and started aiming rubber bullets at protesters’ (and especially journalists’) faces and eyes. As such, you’ll want to carry a set of ANSI Z87+ certified ballistic eye protection with you while protesting. They might just save your vision. And for gods’ sake, bring an umbrella to ward off the pepper ball volleys.

“Targeted attacks on journalists, media crews and news organizations covering the demonstrations show a complete disregard for their critical role in documenting issues of public interest and are an unacceptable attempt to intimidate them,” Carlos MartÍnez de la Serna, program director of the Committee to Protect Journalists, told the Columbus Dispatch. “Authorities in cities across the U.S. need to instruct police not to target journalists and ensure they can report safely on the protests without fear of injury or retaliation.” 

Protecting your identity, unfortunately, isn’t as simple as sliding on a pair of specs. Numerous police forces throughout the US have partnered with facial recognition firms like Clearview AI to identify protesters and potentially intimidate them into silence. To keep your identity under wraps, you’ll want to keep your head under wraps as well. Unfortunately, using makeup and hair styling such as CVDazzle to ward off computer vision systems will not do you any good. 

Besides being designed to thwart technology that is now close to a decade old, CVDazzle is only capable of confounding the facial recognition algorithm itself — it doesn’t prevent tracking based on your build, clothing or walking gait. Plus, should a human review the video, they’ll easily be able to spot the one member of the crowd running around looking like A Flock of Seagulls on acid. What’s more, once the tear gas starts flowing, wearing contact lenses and eye makeup — really any oil-based product, including sunscreen — can exacerbate the gas’ irritating effects. Jip van Leeuwenstein’s “surveillance exclusion” mask or Jing-cai Liu’s wearable face projector both run into the same issue. They may be able to fool an algorithm but they’re easy to spot with the human eye. 

No mask? Tension nahin Leneka! Simple hai! pic.twitter.com/NSNPMikDZ3

— Ronit Bose Roy (@RonitBoseRoy) April 20, 2020

Instead, you’ll want to wear a mask that covers as much of your face and head as possible and keep it on. Assuming you don’t have access to one of URME Surveillance’s photo-realistic 3D-printed masks that fool AIs into thinking you’re the company’s president, you can easily make a balaclava out of any old t-shirt you have lying around. If possible, wear your existing N-95 or cloth mask underneath it. We’re still in the midst of a global pandemic here people and the corrupt power structures of this nation will not tear themselves down if you’re laid up in the ICU. 

The Los Angeles chapter of the Democratic Socialists of America recommends that protesters practice the same counter-COVID procedures we’ve spent the last three months perfecting. That includes staying six feet apart and avoiding physical contact whenever possible, though the police may have a different opinion on that latter point.

Since you’ll be spending a lot of time on your feet and likely running from the police at some point during the demonstration, it’s important to pack light. At the bare minimum, bring along a personal first aid kit, snacks, any medications you need, as well as a couple bottles of water, not only for hydration but to help rinse out your eyes in the event of a tear gas attack. Liquid Maalox works too as does a mix of 3 teaspoons of baking soda to 8.5 ounces of water, which is the mix that the Hong Kong protesters swore by. Most importantly, make sure your friends and loved ones know where you are going, when you plan to return and then check in regularly.

Take extra sharpie pens. Take a notebook. Write a bail fund or your lawyer’s number on your arm in permanent marker. Take water. Take more water. Take liquid antacid. Take a friend, or make one when you get there.

— Linda Tirado (@KillerMartinis) June 2, 2020

The most important thing you can bring with you is a phone, however, it can become a liability if you fail to properly secure it against unauthorized snooping. Luckily, that’s easy to fix. First and foremost, turn off your FaceID and fingerprint readers — the police can force you to unlock your phone using these methods if you’ve been detained but they’ll have a much harder time trying to crack through a 9-digit pin that you’ve conveniently forgotten due to the stress of your arrest. 

Second, encrypt your phone. It’s easy to do for both Android and iOS. If you’d prefer not to risk your primary phone being damaged or confiscated during the protests, pack along an older model that you’ve wiped of all personal data or splurge on a burner phone that you can simply ditch after the demonstrations have ended. Do not, under any circumstances however, reuse that phone for any reason other than protecting your identity while protesting. I mean, that’s literally the point of having a burner in the first place.

Third, do not — and I cannot stress this enough — communicate using the phone’s standard voice and text features. Download and use Signal instead so that your conversations can’t be easily intercepted. Be sure to turn on the Disappearing Messages function to delete conversations after they’ve been read. Heck, it’s even got a handy automatic facial blurring tool to help protect the identities of your fellow protesters. 

Speaking of which, if you plan to document your experience at the protest, follow the basic rules of photography etiquette. Specifically, avoid filming the faces, scars, tattoos and other identifying features of your fellow protesters before posting them. While you’re at it, turn off the geotagging and location tracking features for every app on your phone to help obfuscate where and when the image was captured. And in the event that you’ll catch the cops being bastards, take a read through Teen Vogue’s most excellent guide to safely and ethically filming the police.

Perhaps the most insidious threat you’ll face while protesting isn’t the tear gas, attack dogs or billy clubs, it’s having location data siphoned from your phone and used against you. International Mobile Subscriber Identity catchers — more commonly known as the Stingray, though that’s only one of the broader class of cell-site spoofing (CSS) systems — are employed by law enforcement organizations across the country. They act as mobile cell towers, offering unwitting smartphones the strongest available signal strength in the area to induce the phone to connect, upon which the CSS will record the phone’s IMSI and then release the phone back to the regular network. Since the ISMI is generated by your carrier and stored on the phone’s SIM card, it can be linked back to the account holder allowing the police to track your whereabouts. For more information on the nuts and bolts of Stingray technology, the EFF has put together an authoritative guide to their operation. 

Their full range of capabilities remains a mystery, however it appears that keeping your phone in airplane mode unless you’re actively using it to make calls can help mitigate some of the risk, though carrying a burner phone can mitigate that to a much higher degree. The Apple and Google stores are both stocked with counter-IMSI apps such as Android IMSI-Catcher Detector (AIMSICD), SnoopSnitch, Sitch, GSM Spy Finder, and Cell Spy Catcher though none have proven particularly effective against the catchers.

The FBI has engaged in “political policing,” the ACLU said, including spying on peaceful activists. That raised the potential for abuse against innocent targets. The agency also claimed that it didn’t need to demonstrate probable cause to use facial recognition, and couldn’t confirm if it honored “constitutional obligations” to inform defendants in criminal cases when the tech was involved. And these concerns assume the systems are accurate, which they sometimes aren’t — the ACLU referred to studies showing racial and gender biases in facial recognition.

This isn’t the first time the ACLU has pressed for disclosure. It filed Freedom of Information Act requests with the FBI and DEA in January. Both agencies recognized the requests, but didn’t provide any “responsive documents,” the ACLU said.

However the agencies respond to the lawsuit, they’ll be swept up in a mounting opposition to unfettered use of facial recognition. California and the city of San Francisco recently passed measures banning key government uses of facial recognition, and companies like Facebook have shied away from past uses. There’s an increasing sense that the privacy risks are too great to ignore, and that there should be at least some baseline restrictions on when facial recognition comes into play.

There was good reason to put those efforts under tight scrutiny, the Inspector General’s office said.

Under one program, nicknamed Program A, the DEA relied on “non-target specific” subpoenas to make telecoms supply metadata for calls made between the US and countries it deemed a “nexus to drugs,” even when there was no apparent link to a specific case. Program B, meanwhile, used equally vague subpoenas to scoop up data for anyone buying certain products through key vendors, and had no plans to get rid of that data once it was no longer useful. Program C saw the DEA buy metadata on targets through a contractor for another agency, but it wasn’t clear if the DEA’s authority covered that data.

On top of this, the DEA took numerous steps that “hindered” the Inspector General’s access to info.

The potential for abuse isn’t as high as it was years ago. The DEA shut down Program B in 2013, and scaled back Program A to focus on specific investigations in the wake of Edward Snowden’s leaks. The DEA also told Nextgov in a statement that it agreed to abide by 16 recommendations from the report that would keep bulk data collection legal and respectful of civil rights. Still, the findings aren’t comforting — they indicate that the DEA spent years (dating as far back as 1992) gathering data without checking that was honoring the law, compromising privacy safeguards in the process.