I'm afraid there is no real protection possible, for multiple reasons:
- as you stated, all apps can read everywhere on the SDCard. This does not require any special permission
- apps with the
INTERNET permission are not restricted in using the network in any way -- they even can create their own sockets and implement their own ways of communication
- while using an encrypted container would look promising on a first look, the camera app could not access this container either when it's not opened -- and if the container is opened, other apps could access it as well. So even using such a container and have it replacing
/sdcard/DCIM does not work for your purpose
Summed up: if you want that level of protection, you either...
- cannot use any app requiring the
INTERNET permission (no way for that, as several of them already come pre-installed with your device)
- need to root your device and set up a firewall forbidding all apps to access the internet (which, outside the EU, would void your warranty)
- need to have mobile-data as well as WiFi disabled all the time, and never connect your device to any network
As none of the above is really practicable, you need to compromise: When selecting the apps you want to install/use, check beforehand how trustworthy they are -- and keep your fingers away from "suspicious apps" as well as "suspicious sources".
As long as you're only concerned about the photos you take: If you find a camera app which can use an encrypted container solely by itself, this might be a way to go (I never heard of such, but it would be possible to create it, so it might exist). Another possible thing would be a "container app" that lets you specify which apps are permitted to access it. But keep in mind that your gallery app (which you use to view the photos) most likely will have the INTERNET permission as well...
EDIT: As Compro01 pointed out in his comment below, with Android 4.1 and up you can add some protection by enabling the "protect SD Card" item in the developer options. If that is activated, apps (including your camera app) need to have the READ_EXTERNAL_STORAGE respective WRITE_EXTERNAL_STORAGE permission to access the SDCard.
Moreover, PerennialPinömpel found an app named
InformaCam:
InformaCam, part of the SecureSmartCam suite of mobile apps, is a tool that allows users to embed expansive metadata into video or still images; encrypt media to trusted destinations using PGP; and securely upload media to trusted destinations who are capable of accepting InformaCam media.
Unfortunately, neither that app nor the full suite is available on Google Play currently. I also could not find an .apk on the mentioned site, so one would have to clone its Git repository, and compile the app.
