Trying to answer the original question - should “they might be reading your messages and arrest us all if you don’t switch messengers” not be enough?
What I can help more with maybe is a comparison of messengers for your use case. Much of it might be shaped by my personal opinion, of course(!). You may also want to ask other people. I think that the most important thing is to switch away from SMS. If you have more questions, just ask.
My advice:
- use DeltaChat with an email provider (that’s what comes after the ‘@’) that’s not from Myanmar;
- in case you face internet outages try the WiFi and Bluetooth features of Briar (it’s a bit less usable in general though, and both involved phones need to be online at the same time to send messages);
- if it’s crucial that the messages do notify you, use Threema (DeltaChat and Briar may fail to send a notification or notify you with a delay, just try out notifications before you rely on them);
- if the options are Facebook messenger and SMS, go with Facebook messenger.
- if you want a “poll” feature, use Telegram
- Don’t use SMS.
More detailed comparison:
- Delta Chat: You don’t need any phone number, just create a new anonymous email account. Together with Facebook messenger / WhatsApp, it’s therefore the only option where the ISP can’t see that you are using the service. Make sure though not to use a provider that the military could control. More info about some known providers. Pro: if the ISP looks at your network, it looks unsuspicious as you seem to just use email. NOTE: If you use an email provider from Myanmar, the military probably can see which email addresses communicate with which other email addresses (the email provider is the thing behind the ‘@’, i.e. if your email address is alice@gmail.com, then your provider is gmail.com).
- Briar: Even more decentralized and private, uses the Tor network by standard. It has some ways of communicating even if there is no internet at all (over bluetooth/wifi, if you are nearby), which might be interesting for you. I don’t know if just using Tor will make you suspicious though. Works without a phone number. It’s a bit less usable in general, and both phones need to be online at the same time to send messages.
- WhatsApp (I think that it’s similar to Facebook messenger): It belongs to Facebook, which is a monopolist, data-hungry mega company, but to the military, your messages will most likely not be accessible, just as with the other messengers. Everyone who has your phone number can see that you use WhatsApp and when you’re online (it might make you suspicious that you are always online at the same time as some other suspicious person; OTOH it’s rather unlikely that the military does the effort of matching online times, so you should be fine actually).
- SMS: Probably by far the worst option as it’s inherently insecure and unencrypted, probably the only option listed here where the military can actually read your messages. Rather use Facebook messenger if those are the options.
- Signal: everyone who has your phone number can see that you are using Signal, which might be a problem if only protesters use Signal, so that using Signal makes you suspcious; also, if they seize a phone, they can see with which numbers you communicated and then also arrest everyone else; apart from that it’s secure
- Telegram: Not encrypted, but as all messengers here, they won’t give your data to the Myanmar military. (same point as WhatsApp/Facebook messenger). Has polls if you need them, and probably the best user experience of all messengers here. Again, not actually privacy friendly, but if your worries are the military, you’ll be fine. You need a phone number, but you can write people without revealing your phone number (by setting a username, I think).
- Threema: Similar to Signal but big advantage: you don’t need a phone number. Downside is, it costs 3$ per account.
Some more notes on security with DC:
- You can set messages to be deleted after a certain time (go to “Disappearing messages” in the three-dot-menu in a chat)
- There is a feature that you can get a temporary account by scanning a qr-code; not sure how production-ready this is. @hpk can give you a QR code, when you scan it with DeltaChat you get a temporary email account. Downside is, if all activists use this and they catch some activists, they may be able to get the ip addresses of the others (because they control the ISP)
See Security goals of Delta Chat for some more explanation.