Umbrella User Manual

About

Umbrella is an all-in-one app developed by Security First for digital and physical security. It provides information on what to do in any given security situation and the tools to do it. Umbrella is designed for and used by journalists, aid workers, human rights activists, and people travelling in high-risk areas.

Umbrella allows the user to choose what they want to do, such as: protect data; securely make a call/email; securely access the internet; plan secure travel; protect their office/home; conduct counter-surveillance; or deal with kidnapping, arrest or evacuation. Once a situation is chosen, the app outlines what to do and what tools to use given your circumstances. This is followed by a simple checklist of recommended actions that can be customised, saved and shared securely. Umbrella’s Feed also provides users with an up-to-the-minute account of potential risks in their chosen location.

Installation

Umbrella is available on Android, iOS, and the web.

App Store

Umbrella is available on the App Store for devices running iOS.

Google Play

Umbrella is available on Google Play for devices running Android. Open this link on your mobile device. This link should open in the Google Play app. Tap the Install button to install Umbrella.

If you have an Android device but you prefer not to use Google Play, you can install the Umbrella app via F-Droid, Amazon, or direct download.

Amazon Appstore

Umbrella for Android can be installed from the Amazon Appstore.

F-droid

Umbrella for Android is available on F-droid. Follow these steps to install:

1. Install the F-Droid app.

2. Open this link on your mobile device. The link should open in the F-Droid app.

3. When the Add new repository screen appears, click Add.

   

4. F-Droid will update the list of available apps. When it finishes, tap the search icon at the bottom right of the home screen and search for Umbrella.

5. Click on the Umbrella card, then on the Install button.

   

Umbrella Web

The web version of Umbrella is available at umbrella.secfirst.org.

Running Umbrella for the first time

The first time you run the Umbrella app, you will see a set of screens showcasing some of Umbrella’s features. The final screen shows you a summarized version of Umbrella’s Terms and Conditions. Read through the Terms and Conditions and accept them to proceed.

A popup appears asking you to download more content. Umbrella has lots of lessons and contents, some of which need to be downloaded so that they work offline. Tap OK to download more content.

After the content is done downloading, choose what security guide you need most, or explore on your own if you prefer.

After making any selection, you should now have access to Umbrella’s content. At this point, Umbrella will prompt you to set up a password. Your password must be at least 8 characters long and must contain at least one digit and one capital letter. After entering and confirming your password, tap OK to proceed. Once you have set a password, you will be prompted to enter it every time you open the Umbrella app.

Alternatively, you may decide to skip the password setting step. Note that doing this significantly diminishes your safety in regards with any identifiable data you input into Umbrella.

When you set a password, you will be prompted to enter it every time you launch the Umbrella app.

Feeds

The feeds dashboard contains security feeds from places like the UN Relief Web and the US Centers for Disease Control. You enter your location (and how often you want to be updated) and whenever a new update is released (e.g a disease outbreak in your location), the information comes up on the dashboard.

Feed

The Feed keeps you up to date with the current risks in your area, helping you monitor local threats with live security alerts from trusted sources. The content you see on your feed depends on the country and sources you set.

To begin setting your feed, click on the Set Now button, under the Set your feed card.

A popup appears, requesting for an interval. The interval determines how often your feed will be updated with new content from the source(s). Enter your preferred interval in minutes and tap OK to continue.

Next, enter a location and tap OK. You will only get alerts related to the location (country) you pick. There is no geolocation or tracking of your input location. We can’t see it, and neither can anyone else.

Finally, select your preferred feed sources and tap OK. The sources you select will determine the nature of the content in your feed.

Below are the sources that Umbrella currently includes for real-time updated security feeds. For privacy reasons, users never connect directly to these services. More useful sources that will help users keep updated on the move will be added with time.

• ReliefWeb / UN: excellent physical security updates that amalgamate information from the UN and various NGOs - though not available in every country
• Foreign and Commonwealth Office: foreign travel advice, consular help, and services abroad and document legislation
• Centers for Disease Control: updates on disease and health warnings
• Global Disaster Alert and Coordination System: updates on natural disaster issues such as floods, earthquakes, and tsunamis
• US State Department Country Warnings: updates mainly focused on the security situation for travellers and internationals - available for every country

That’s it. Your feed should now be populated with content, ordered by the newest content first.

Tapping on the feed card will open a page with more information about the event, directly in the Umbrella app.

You may change your feed location, interval, and feed sources at any time, using the Set buttons under their respective sections.

RSS

RSS feeds show you recently-posted content from blogs and websites you choose to follow. While a Feed is dependent on location and specific sources, an RSS feed shows all new content from any website. You are encouraged to add your own RSS feeds for customised updates.

Navigate to the RSS tab of the feed page. By default, Umbrella provides RSS feeds from popular news websites like BBC and Threadpost.

Click on a source to see the RSS feed from that website.

To add more RSS feeds, tap the plus icon (+) at the bottom right of the RSS screen.

Then, enter a link to the RSS feed into the Feed Source field, then tap OK.

For each post on the RSS feed, you can share using the Share button or view more information using the Learn More button. You may read the full post without even leaving the Umbrella app.

Forms

Forms enable you to compile secure itineraries and protocols, which can be shared with your team.

Forms allow a user to quickly fill out and share important information about issues such as their travel plan in a high-risk location or report on a digital/physical security incident.

Filling a form

Tap on the Forms tab from the bottom navigation menu to visit the forms page. Umbrella provides four default forms, and they can be filled as many times as you want.

Any information you input into a form in Umbrella is encrypted. That means we can’t see it, and it will stay private if you use a strong password. (Go to Set Password under Account option in the navigation menu. To learn about strong passwords, read the Information –> Passwords lesson in Umbrella). Forms are not encrypted when you share it by email, but should be reasonably secure if the person you’re sharing it with has a strong password and uses two-factor authentication (the Passwords lesson has more information about two-factor authentication). However, if you want to input really sensitive information, like credit card details, read the Information –> Protecting Files, and Information –> Safely Deleting lessons and think carefully about the risks of unauthorized access before exporting the form.

Physical Security Incident

The Physical Security Incident prompts you to report a physical security event, such as a robbery or kidnapping.

1. Contact Information: Note your name, title, phone number, email address, and a secure communication method, if you have any.
2. Incident Description: What happened during the incident? Provide a brief description.
3. Type of Incident: Pick an incident from the list or enter a custom incident.
4. Impact/Potential Impact: What assets were damaged during the incident? How many people were impacted? What threats were made? Was anyone injured? If yes, what type of injuries?
5. Response: Write down any steps you have taken in response to the incident.
6. Motive: What do you think is the motive of the perpetrators? Did they want money or something else?
7. Reporting the Incident: If you have reported the incident to someone, mention this. Did you call the police or anyone else?
8. Security Guidelines: Note if any security guidelines were followed during the incident.
9. Guidelines Revision: Do the security guidelines or any other aspect of security management need to be revised to prevent similar incidents in the future? If yes, what sort of revisions do you think should be made?
10. Lessons Learned: Suggest specific measures that may help avoid this type of incident in the future. Enhanced security guidelines? Personel security training?
11. Action Request: Note any specific action requested during the event.
12. Supporting Information: Challenge yourself to put something you haven’t thought of here.

Proof of Life Form

This form is meant to indicate that an individual was alive at the time the form was completed.

1. Questions 1, 2, 3, and 4: Write down 4 questions known only to you or someone close to you.
2. Personal Duress Word: Do you have a word that you can use to warn others that you are being forced to do something against your will?

Travel Security Memo

Umbrella’s Travel Security Memo prompts you to capture your itinerary, emergency contacts, and procedures for staying in touch with your home base, all in one secure location. You can carry this information with you in the app, or export it to share with others. 1. Name/Travel Date. If you want the option to export and share your form with a partner, parent, or childminder, enter your name. If “travel dates” isn’t relevant, you could always enter the date as a reminder of when you last updated the form. 2. Destination/Purpose. If you don’t have an immediate destination in mind, adapt this section. What’s a destination it would be useful to note in case of emergency? You could enter the evacuation/meeting point for a disaster plan here. 3. Itinerary/Travel. Enter your travel plans and flight information 4. Immigration/Phone Numbers. What important phone numbers could be useful here? Consider your doctor, insurance, driver breakdown, bank, or a local police station. 5. Organisational/Procedures. Note professional or institutional contacts (boss, secretary, colleague, teacher) for you and your family here. 6. Personal/Medical. Note personal contacts (parents, close friend, housemate) here. Do you or a family member have a medical condition that needs specific medication or treatment? 7. Physical/Digital. Write about your physical and digital security situation. What security measures have you taken? 8. Key Contacts/Other. Challenge yourself to put something you haven’t thought of here. What information could really help in an emergency? Here are some examples to get you thinking: - UK: https://www.redcross.org.uk/~/media/BritishRedCross/Documents/What%20we%20do/Preparing%20for%20emergencies/Home-emergency-contacts.pdf - US: https://www.redcross.org/images/MEDIA_CustomProductCatalog/m12140360_ARC_Family_Disaster_Plan_Template_r083012.pdf

Digital Security Incident

You can use Umbrella’s Physical Security Incident form to report a digital security incident, such as an incident where an organization’s systems or data have been compromised. 1. Your Contact Information: Enter your name, phone number, email address, and security information (such as a PGP Key ID), if you have any. 2. Details: What happened during the incident? Select all that apply or write a custom description. 3. Time: At what day and time did you discover the incident? Be as specific as possible. 4. Impact: Note if any assets, information, or people were impacted by the event. 5. Impact details: What devices, accounts, or services may have been compromised? Select from the list or write a custom entry. 6. Scale: Think about the severity of the incident and note how many people could be affected. 7. Status: Are you using the incident form to document what happened or to seek support? Record it here. 8. Guidelines: Are you are following any guidelines to resolve the incident? 9. Response: If you are following any guidelines or performing any actions to handle the incident, check all the options that apply or describe a custom action. 10. Notification: Note persons who have been notified or are still to be notified. 11. Responsibility: If you have any information about the perpetrators of the incident, write down the details. 12. Motive: What do you think is the motive of the perpetrators of the incident? Do you think they were after money, company assets, or something else? 13. Evidence: Have you saved any evidence (screenshots, error messages, emails, files) that show that the incident occurred? 14. Reflection: Think back on how the incident happened. Is there anything you can change to prevent a similar incident from happening in the future? 15. Next steps: Note actions that you need someone else to take to resolve the incident. 16. Anything else Get creative. Challenge yourself to write something you haven’t already mentioned here.

Tap on any of the available forms to begin filling it. The information you’re required to fill in depends on the type of form.

Enter information into the fields and tap on Next to proceed to the next section of the form. You can also go back to edit your previous answers with the Back button. As you complete a form, a percentage indicates how far you have gone.

You can exit a form anytime by tapping on the back arrow icon at the top left of the screen. Umbrella automatically saves how far you’ve gone. Once you have started filling a form, it is shown on the Forms page, under the Filled our forms section. You may edit it, share it, or delete it by tapping on the appropriate icon.

The same form can be filled multiple times.

Note: Since forms ask for personally-identifiable information, it is advisable to set up a password for Umbrella app, to prevent unauthorized people who may have your device from accessing your data.

Lessons

Umbrella has many lessons, giving you simple step-by-step actions of what to do in any given security situation and showing you the best tools to do it with.

The general flow of lessons is presented in order to replicate the typical way that a user works. Protecting their own information –> Communicating with other people –> Arranging and travelling to a location –> Doing their operations and work –> Dealing with personal issues that may arise –> Seeking support if something goes wrong.

Below is a rundown of all Umbrella lessons:

Access your risk

• Security Planning

Information

These lessons mostly cover the security of information that is stored on your computers.

• Managing information
• Malware
• Password
• Protecting Files
• Safety Deleting
• Backing Up
• Protect your workplace
• Workplace raids

Communications

These lessons mostly cover the security of information when it is sent or received.

• Mobile Phones
• Making a call
• Sending a message
• Email
• Censorship
• Online Privacy
• Phishing
• Radios and satellite phones
• Online abuse

Travel

These lessons cover the security of travelling in high-risk areas.

• Preparation
• Borders
• Vehicles
• Checkpoints
• Protective Equipment

Work

These lessons include topics that may affect you in your work.

• Meetings
• Being followed
• Protests
• Dangerous Assignments
• Public Assignments
• Public Communications
• Whistleblowers

Incident Response

These lessons cover how to respond to events.

• Arrests
• Evacuation
• Kidnapping
• Sexual Assault
• Terrorism

Stress

• Stress

Emergency Support

Explains places to get extra help if you have a problem.

• Physical
• Digital

Tools

These are detailed guides about how to use software and apps mentioned in the lessons. The tools currently covered in Umbrella’s tool guides are:

• Messaging
  • Mailvelope
  • ObscuraCam
  • Pidgin
  • Psiphon
  • Signal for Android
  • Signal for iOS
• Encryption
  • Encrypt your iPhone
  • k9 & Open Keychain
  • KeePasXC
• PGP
  • PGP for Linux
  • PGP for MacOS
  • PGP for Windows
• Tor
  • Orbot & Orfox
  • Tor for MacOS
  • Tor for Linux
  • Tor for Windows
• Files
  • Cobian Backup
  • Recuva
  • VeraCrypt
• Other
  • Android
  • Facebook

Glossary

The glossary contains explanations of the various technical terms used in the app.

About

The About page provides more information about Umbrella, its licences, and appreciation for the people involved in its development.

Bookmarks

If you would like to quickly come back to a lesson later, you can save it to your bookmarks. Each lesson has a bookmark icon. Tap on it to save the lesson to your bookmarks.

Now, when you click on Bookmarked in the Lessons menu, you’ll see your bookmarked lessons.

Checklists

Every Umbrella lesson ends with an easy-to-use checklist that can help you track your progress. You can also create custom checklists. Checklists are quick and easy references to help users implement the advice in the lessons. You can tick them off as you complete each item. Checklists can also be shared through other apps such as your email.

Existing checklists

At the final tab of every lesson, you will find the checklist. Tap on a checkbox to mark it as completed. A percentage at the top indicates your progress so far. You can long-press on a checklist item to edit the item.

Once you begin marking a checklist, your progress is saved and you can come back to complete it at any time by navigating to Checklists, from the bottom navigation menu. The Overview tab shows you all the checklist in progress and how far you are to completing them.

The Total Done card shows what percentage of existing checklists you’ve completed so far.

You can share a checklist using the share icon.

Under the Top Tips section, tap See all to select a guide to start your security journey or bookmark any guide for later.

Custom checklists

To create a custom checklist, navigate to the Custom tab of the Checklist page and tap the plus icon (+) icon at the bottom right of the page.

On the popup that appears, write down the name of your checklist and tap OK.

Next, you have to add checklist items. Write an item name into the field, then tap the small green plus icon to add more items.

When you’re done adding Checklist items, you will be able to find your newly-created custom checklist under the Custom tab of the Checklists page.

Just like with the default checklists, you can tap on a custom checklist’s items to mark them as completed. At the top of the page, a percentage indicates your progress.

To add more items to a custom checklist, press the “+” icon at the bottom right of the screen, write down a new checklist item, then tap Ok to finish.

You can create as many custom checklists as you want.

Account

Tap on Account from the bottom navigation menu. This is where you can control your Umbrella account.

Settings

From the Account page, tap on Settings to view and configure Umbrella’s settings.

Skip Password

If you enable this option, you won’t receive any other popups asking you set up a password for Umbrella

Refresh from the server

This will fetch data from the server and refresh the Umbrella app with any new content. The process takes a few minutes.

Change repository

You can load data from a new repository, which will be loaded over your current data. Since loading a new repository will reset all the progress you made, you should back up your data before you do it.

Next, enter a link to the git server you want to switch to and tap OK.

Select language

Tap on the Select language button to change the language of the Umbrella app.

Umbrella is currently available in 7 languages: English, Spanish, Chinese, Arabic, Farsi, Russian and French. Select your prefered language and tap OK to set it.

Import your data

If you had an Umbrella account before and had exported data, you can import that data into a new Umbrella app. Tap on Import your data and navigate to the directory of the file to import the data.

Export your data

Select this option to backup your database file. On the popup that appears, enter a name for the export file. Under Wipe data, check the checkbox to delete all reset all current Umbrella content after export.

Finally, select a backup type, which may either be Share (lets you share your Umbrella backup) or Export (saves the Umbrella backup as a file on your device).

Refresh interval for custom feeds

You can decide how often you want custom Umbrella feeds to be updated with new content. The default value is 5 minutes.

Your location

Tap this setting to specify a default location for your feeds.

Security feeds sources

Here, specify sources for your feeds. Select your prefered sources and tap OK.

Show updates as notification

When this option is enabled, Umbrella will show updates (such as feed changes) as notifications in your device’s notification panel.

Enable Mask

The Mask feature is particularly useful when in high-risk settings (or do emergency sums). To enable the Mask, select Enable Mask from the Account page.

Tap OK to confirm.

When enabled, Umbrella will be disguised as a calculator app (called SimpleCalc).

To unmask the app, simply shake your device when in the SimpleCalc app.

Set password

From here, you can set up a password for Umbrella. Your password must be at least 8 characters long and must contain at least one digit and one capital letter. After entering and confirming your password, click on OK.

It is recommended to set up a password for Umbrella, especially if you’re entering personal identifiable information into the app (via forms).

If you set a password, you will be prompted to enter it every time you open the Umbrella app.

Logout

If you have a password set, tap on Logout to log you out of the app and trigger the prompt to enter a password. If no password is set, the Logout button has no effect.

Make Umbrella work for you

Imagine we have a security manager called K. K is running a team spread across three countries. Staff have various levels of training — in some cases, none at all. Risk levels vary, from sources who require total anonymity, to an office administrator with no field experience and limited digital expertise beyond Microsoft Office. Here are some different ways for K to make use of Umbrella:

Option	Description	Cost
Adapt	Download Umbrella	Free
Customize	Build your own security app	Developer skills required
White Label	Secure app for your brand/content	Request a quote

Adapt Umbrella

Umbrella was designed to meet the needs of people from different sectors operating at various levels of risk.

To adapt Umbrella for the needs of the team, K should:

• Point team members towards the most appropriate lessons and tool guides.
• Warn of any deviation from existing policies to avoid confusion.
• Take mitigating action if having Umbrella on a particular device could increase risk.
• Review legal and insurance requirements for security or duty of care to incorporate Umbrella.
• Umbrella should complement and streamline K’s security strategy. It can’t replace a proactive security manager.

Customise Umbrella with Tent

K wants to put existing policies in a secure app. K has a technical background and a colleague in IT who’s up for a challenge. They build their own version of Umbrella at minimal cost using open-source tools, including Security First’s mobile CMS, Tent.

Tent contains all the tools you need to create, edit, and publish securely-under one roof.

White label Umbrella with Tent

K’s boss can contract Security First to white label Umbrella with the organisation’s own brand and content — no technical background required.

Request more details or a quote at info@secfirst.org.

Updating

Umbrella should be kept updated at all times. If you continue to use an outdated version of the app, you may be vulnerable to security flaws or outdated content that will compromise your security.

Google Play

Tap on the hamburger menu next to the search bar and navigate to My apps & games –> Updates. If you find Umbrella on the list of apps that need updating, select it and tap the Update button.

F-droid

Tap on Settings, then go to Manage installed apps. Select Umbrella and tap on the Update button.

iOS

See the Apple Support page for instructions on how to update apps on iOS devices.

Uninstallation

Warning: If you uninstall Umbrella without exporting your data, there’s no way to recover your account. To save your progress and information, export a backup of your data first.

You may uninstall Umbrella via Google Play, F-droid, or your device’s settings.

Google Play

Tap on the hamburger menu next to the search bar and navigate to My apps & games –> Installed. Select Umbrella from the list of installed apps, then press the Uninstall button.

F-droid

From the F-droid app, Tap on Settings, then go to Manage installed apps. On the next screen, select Umbrella and finally tap on the Uninstall button.

iOS

See the Apple Support page for instructions on how to uninstall apps on iOS devices.

Device app settings

Depending on your mobile device’s brand, navigate to Settings –> Apps. Select Umbrella from the list of apps, then tap on the Uninstall button.