“100 spies” will monitor all SMS and email that goes in and out of Norway

https://translate.google.com/translate?sl=auto&tl=en&u=https%3A%2F%2Fwww.nettavisen.no%2Fnyheter%2F100-spioner-skal-overvake-alle-sms-er-og-e-poster-som-gar-inn-og-ut-av-norge%2F3423589246.html

by DyslexicAtheist • 7 years ago

108 44 7 years ago

translate.google.com

dajohnson89• 7 years ago

Clickbait title. It's a proposed bill.

andai• 7 years ago

I'd watch that movie though.

DyslexicAtheist2• 7 years ago

100 people in suits and tie intercepting "Norsemen" memes and analyzing fake-book reviews such as "The Dragon with the Girl Tattoo"

edit: apologies just realized the latter was Swedish not Norwegian

rocqua• 7 years ago

Sounds like it's only meta-data of emails, not actual content when TLS is used.

chrismeller• 7 years ago

When TLS is used there is no metadata either... server x talked to server y for a while, but what, if anything, happened we know not.

zaroth• 7 years ago

In this case running your own server works against you.

CWSZ• 7 years ago

When TLS is used there is no metadata either... server x talked to server y for a while, but what, if anything, happened we know not.

Quite a bit of metadata really...

Client X: IP address

Server Y: IP address

Client X request: TLS parameters that can be analyzed through TLS fingerprinting

Server Y response: Hostnames supported by SNI

Server Y response: TLS parameters that can be analyzed thorough TLS fingerprinting

ourmandave• 7 years ago

I assume "100 spies" is the name of the server running all the traffic is funneled through.

DyslexicAtheist2• 7 years ago

the tag name of the docker container that runs on the same Linode VPS as the rest of Norway's Internet infra. /s

edit: just some friendly (immature) banter from another European

kwhitefoot• 7 years ago

How does that work with encrypted transport? Yahoo, Microsoft, Google and of course many others, all provide IMAP over TLS so sending email to them and receiving from them doesn't go in the clear.

sydli2• 7 years ago

In the majority of cases, TLS for SMTP (delivery between MTAs) is still trivially downgradeable. So they could presumably downgrade and read SMTP traffic that's going between MTAs in Norway and MTAs outside Norway.

upofadown• 7 years ago

Wouldn't that also be trivially detectable?

fefb• 7 years ago

Even the data is encrypted is worth to save for the future. They will be able to access when they have the key or when some quantum computing breaks it.

anemic• 7 years ago

My personal belief is that they dont. Best they could achieve is trapping the ISP's sending mail server in Norway before the mail is encrypted but there is no capability to decrypt SSL without obtaining the keys.

They could still store metadata like sending IP address, timestamp etc.

Using foreign webmail via HTTPS would not be intercepted in any possible way. Unless they get support from the service provider in question. I think the service providers you mention will comply with law enforcement and give out your data. But those are isolated cases and mass data required by intelligence services is a different thing. National security letters are only for US Govt use and other governments have no access.

I also think legislation like this is years late now that about every protocol has encrypted variants and they don't get any meaningful results compared to the money spent.

ams6110• 7 years ago

They get the keys from the NSA.

(Sarcasm, but a non-zero fear that it's true.)

trumped2• 7 years ago

I thought that the NSA used backdoors and didn't need keys... (ie: direct access to large corporation's servers, where the data is not encrypted)

sametmax• 7 years ago

Like most gov, they probably have access to a root CA and they MITM.

ahje• 7 years ago

Didn't a new Norwegian CA offer free https certs a while back? </tinfoil>

Ajedi322• 7 years ago

There are currently no publicly trusted CAs participating in such a scheme. If there were, it'd be trivially detectable due to the millions of fraudulent certificates showing up in Certificate Transparency logs.

danielskogly• 7 years ago

This article references another news article as their source.

Link to original: https://translate.google.com/translate?sl=no&tl=en&u=https%3...

olivermarks• 7 years ago

At least the Norwegians (and other Scandinavian countries) are publicly open about what they are doing. You'd probably never see this 'news story' in the UK or US except as the solution to some event that supposedly justified it

neffy• 7 years ago

Guess again.

https://www.ft.com/content/eef717f2-bb6e-11e8-8274-55b729265... https://www.army.mod.uk/who-we-are/corps-regiments-and-units...

etc.

There is so much information available in democracies if you have the time to work through it, that they are effectively protected just by the sheer amount of documentation an interested observer has to plough through.

Start with the annual budgets - they´re extremely informative as to what the real issues are.

bjoli• 7 years ago

Meh, we have had the same thing as you guys for a long time. FRA (the signal intelligence in sweden) has been recording our border-passing communications for many years. This is maybe not new knowledge, but definitely not that widespread.

The information gathered (oh, they have access to XKeyscore) is then shared within X eyes (nine? fourteen?) program. The extent of FRA's intelligence operations was not known before snowden.

Some of it became more public knowledge in 2008 when there was a new law that gave them permission to do cable interception. It was later confirmed that they had been doing cable interception before the law was enacted, in conflict with the law, but "with acceptance" of the administration.

Sweden is really not much better than other countries. Norway is following suit, but with a slightly "better" law that at least requires secret court orders to store other things than metadata of things passing the border.

Edit: oh, and they are allowed (or at least not strictly disallowed) to do targeted hacking, which they have done in cooperation with other (NSA) intelligence agencies.

But, at least we do not have a secret bugdet like other democracies :) . They got about 1 billion SEK last year, or about 0.1% of the national budget.

equalunique• 7 years ago

Imagine if the "100 spies" were representatives you could vote for.

x15• 7 years ago

I doubt most tech literate criminals won't use something like Telegram or Matrix over a tor relay.

Whenever I and my girlfriend talk about anything too personal, I always joke about the government's ability to hear our conversation.

WhatsApp and Viber provide cryptographic communication but, if I'm not mistaken, it needs to be explicitly enabled and I've also read there's a bunch of metadata exposed.

greiskul• 7 years ago

You are mistaken about WhatsApp. It does end to end encryption by default. What needs to be explicitly enabled is that theoretically WhatsApp/some bad guy could steal an WhatsApp account, and it would create a new public key, and if you didn't turn on security notifications, you might not be aware that the person you think you are talking to changed. You also should verify that the end to end encryption keys match, but most users are not paranoid to that level.

_trampeltier• 7 years ago

I heard a couple of times, after people get a new phone number, after installing WhatsApp, they see the conversation from the old owner of this phone number. How can this happen then?

jpalomaki• 7 years ago

Quite many crimes are such that if you were a smart person, you would not be committing them in the first place.

I think this is why even simple things such as wiretapping and checking which cell phones registered near the crime scene still work.

lostgame• 7 years ago

How exactly does this work with encryption, which is becoming more and more prevalent? E.G., Tor...

auiya2• 7 years ago

You decrypt the traffic. Or you monitor on a point in the chain where the traffic has already been decrypted. I think what you meant to ask was how do they obtain the decryption keys or establish a point of presence post-decryption?

mlindner• 7 years ago

You can't decrypt the traffic. You can however monitor it at a point that traffic has already been decrypted. SMS messages are not encrypted and email is only encrypted between you and your email provider whether that email goes on to its final email recipient server encrypted or not is entirely up to the email provider.

messo• 7 years ago

This is a proposed bill and is far from being implemented yet. It is currently being evaluated by all involved departments, institutions and companies and has predictably received sharp critique from many angles. It will be interesting to see if it survives the process at all.

ElijahLynn• 7 years ago

100 New/More/Added Spies. Not "100 spies".

“100 spies” will monitor all SMS and email that goes in and out of Norway

Related Stories