Who Is Being Monitored?

https://tutanota.com/blog/posts/wer-wird-belauscht/

by upofadown • 5 years ago

197 80 5 years ago

flipbrad• 5 years ago

The point of undermining confidentiality of communications (in law and practice), I think, is to herd the outlaws onto things like Encrochat and An0m - meaning fewer, softer targets (with likely much worse developers and lawyers than the mainstream communication services). That, and maybe picking up the occasional idiot outlaw still using a knowingly-backdoored mainstream service to discuss or commit their crimes.

We may see most mainstream services play along - maybe "voluntarily", as good citizens - because they would probably be quite happy to lose the dodgy contingent of their userbase. Let them be herded!

That does leave people who care about privacy, but aren't outlaws, with an awful dilemma - migrate to the few platforms that still offer confidentiality (along with the outlaws), and instantly make yourself a suspect - or give up and stay with the mainstream services, trusting that you'll be OK so long as you've got nothing to hide.

All of these are understandable forces and motivations - it'll be interesting to see how they net out. I do think the powers that be are overlooking what an appalling precedent / justification they offer, both for contemporary authoritarian powers in other countries, and the future authoritarians that from time to time form part of the government in our own countries.

cortic• 5 years ago

trusting that you'll be OK so long as you've got nothing to hide.

I don't think people are that stupid, they know they have everything to hide from someone, and no idea who someone is. People think they can hide in the herd, the zebra defense. So long as my stripes are the same as everyone else's the lions won't get me. And they are not wrong, its a poor substitute for anonymity but it is a substitute. Problem is with our every move cataloged and indexed, and with searching bots and AI becoming more and more complex.. Its becoming not good enough to just look the same, we have to have the same political views, the same opinions, the same interests. There are other countries that have taken this to its natural conclusion and; having grown up in a democracy, its depressing seeing the level of subjugation humans will put up with.

fsflover• 5 years ago

Nice quote in the article:

"Every time you use encryption, you're protecting someone who needs to use it to stay alive." -- Bruce Schneier

legrande• 5 years ago

Recent successes in criminal investigation, such as the breaking of Encrochat, an encrypted chat app widely used by criminals as well as the AN0M crackdown where hundreds of criminals were arrested after having used an encrypted messaging app secretly run by the FBI, show that it is also not necessary to outlaw encryption for all citizens in order to prosecute criminals.

This. Good old fashioned police-work is needed instead of back-doors into our favorite messaging apps.

The Internet and app ecosystems can't work properly if they're weakened by LEAs. People would just not use them if they know they're being watched. I'm not saying the majority would switch to Linux phones either (like Librem 5 & Pinephone), simply that the two dominating app-stores (Play & Apple Store) would be phased out and people would probably fund independent FLOSS app stores to replace them.

In the end, the people will speak out and respond to back-doors. In-fact we need FLOSS app stores right now (Similar to F-Droid[0], but baked in as the default store), and they need to be funded properly & they need sound economic incentives to continue. No more 'free' apps where you pay for them with your data. It's possible to have FLOSS apps that are not gratis where people pay for them with money, not their data.

(The reason I suggest we switch to FLOSS app stores is that the apps can easily be checked for back-doors or malicious code since the code is open source. It makes the apps readily available for audits too)

[0] https://f-droid.org/

raxxorrax5• 5 years ago

That trick won't work too often though.

iliketosleep3• 5 years ago

I am being monitored for using a privacy focused email address when signing up for services operated by a government entity. Yep, it happens. Their AI determined that people using particular email providers need to be watched. Not only that, I have had payments mysteriously fail with big online merchants, and after following it up through multiple layers of support I was told that particular email services are automatically flagged. You can guess which ones.

Now what do I do? Avoid privacy-focused email addresses for anything in daily life. It seems to be a battle that cannot be won.

8jef6• 5 years ago

That make sense. That's why I'm using two regular service addresses redirected to my privacy focused email address, and assign different tasks to each one of them. It even help me filter out more unwanted messages and subscriptions.

Lunrtick• 5 years ago

That sounds extremely frustrating. Maybe a good workaround is a custom domain?

8jef6• 5 years ago

Be aware that custom domains come with their own problems. Not being blacklisted is one of them.

shapefrog5• 5 years ago

Now you know what it is like to be a black person walking down the street. Instead of a chosen email provider it is an inherited skin color.

8jef6• 5 years ago

Very true.

C19is20• 5 years ago

".....in certain countries".

DINKDINK• 5 years ago

Now you know what it is like to be a black person

What makes you think this person isn't black?

Maybe the first step we can take to ensuring all people are treated with dignity and respect is to not assume Group X is that group other there, an other. Maybe we can instead assume Group X is everywhere.

lostlogin• 5 years ago

particular email services are automatically flagged. You can guess which ones.

I can’t - is there a reason you can’t name the service?

8jef6• 5 years ago

How about Tutanota?

shiftpgdn• 5 years ago

It’s protonmail. Using a protonmail address will automatically cause a failure flag in the MaxMind checker which a ton of merchants use for fraud screening.

swiley3• 5 years ago

I would strongly recommend running your own email. I've done it since I was 17 and it's a lot easier than you would think.

vaylian• 5 years ago

Any tutorials/software you can recommend for this?

raxxorrax5• 5 years ago

It got a lot easier, but mail server hosting should be done with care if you don't want it used as a relay and be put on blacklists. Still takes a while to setup.

trutannus3• 5 years ago

I am being monitored for using a privacy focused email address

How exactly did you find this out? I don't think you generally get letter mail saying "Hey, we're monitoring you now". How do you differentiate monitoring behavior from something like an individual service flagging an individual transaction because of your email and killing it?

I'm always deeply skeptical of claims like this since they're almost always unverifiable by any party (including the commenter).

8jef6• 5 years ago

By the way, your email address provider is only one metric by which you are being monitored. Everything happening online is now being monitored, stored and AI analysed, and will be for a long time in the future as technology is evolving and new meaning can emerge from everything that is recorded.

Therefore, encryption is their enemy. For now. Until they break it all. Or until we break away.

wolverine8763• 5 years ago

These sound like common blacklist-style defenses. As examples, mail services use RBLs to prevent spam, Cloudflare services often require captchas from Tor exit node IP addresses, many websites decline signups from throwaway email addresses like Mailinator. Credit card companies use various indicators to prevent fraud.

I'm not saying these measures are perfect or fair, but they are not related to government (though government may also use them); they are just obvious ways to prevent unwanted activity such as spam, fraud, hacking attacks, etc.

Their AI determined that people using particular email providers need to be watched

How do you know that government has concluded 'particular providers need to be watched', and that the decision was performed by an AI?

for using a privacy focused email address when signing up for services operated by a government entity

How do you know the cause?

fnord772• 5 years ago

all this nonsense would go away if we had some sort of universal identification system on the internet.

people act like anonymity is some kind of right, but it really wasn't in the past. You needed to prove who you are to get a loan, drivers license, etc.

iliketosleep3• 5 years ago

The type of monitoring used was disclosed as was the "likely cause" of me being flagged. This wasn't a secretive kind of thing. Of course one can't "know" anything as it's a black-box. But it's not a stretch to see how such systems may conclude, from automated profiling, that users of privacy-centric services are more likely to be associated with fraud and hence flagged. This also represents a more general issue with the application of machine learning.

hncurious• 5 years ago

It's a cruel fate of any privacy-focused service, as they are more likely to be used by criminals. Be it mailinator or TOR or monero.

This is ultimately a question of freedom vs security. Said government entity is prioritizing security over freedom.

handrous2• 5 years ago

Not only that, I have had payments mysteriously fail with big online merchants, and after following it up through multiple layers of support I was told that particular email services are automatically flagged. You can guess which ones.

You don't need nefarious motives to explain that particular behavior. Operate a store or payment system without rejecting easy-to-sign-up-for-anonymously email addresses, especially ones with a free tier, and you'll find out very quickly why they downrank the trustworthiness of, or simply block, such services. Automated credit card fraud is huge and no fun at all to deal with.

swiley3• 5 years ago

And that is why some people really like crypto currency. You get what is essentially ssh for money with all the pro and con implications.

shapefrog5• 5 years ago

47% of orders are for drugs, 0.1% are for child rape, what of the other 53%?

selling some weed == selling photos of a baby being raped? Probably not right? So what is the scalar of impact on society & the victims of these crimes? 10x? 100x? 1,000x? 1,000,000x?

What about terrorism? Is death by terrorism == death by murder? Based on the way the two are treated for 'privacy' reasons it would apper that being shot and killed by a terrorist is about 1,000x more impactful than being shot and killed by a school shooter which in turn is about 100x being shot by the guy who lives down the street.

raxxorrax5• 5 years ago

Probably political prosecutions (hate speech). Germans are currently much afraid again, so diverging opinions have low tolerance. It is getting uncomfortable again. And it isn't even the party on the right side of the spectrum, those are just dumb and won't get anything done. Authoritarianism has a long culture here and people happily prosecute you for the common good just as well as for nationalistic ambitions.

It is a fundamental fear that people believe they can get rid of if they constrain others.

shapefrog5• 5 years ago

Seems a bit of an oversight to ignore the reasoning for 53% of the requests, or perhaps the classification of them was inconvenient for the purpose of their argument.

IfOnlyYouKnew• 5 years ago

I live in Germany and tend to follow politics to a degree that some would consider unhealthy.

While I am sure there are instances of politicians invoking child pornography to argue against encryption, I do not remember any specific instances of it from the recent past.

Claims of "massive propaganda" are stretching the facts beyond what's reasonable. Indeed, it might itself be the only instance of propaganda on the issue.

chopin• 5 years ago

Your view is too optimistic: [1] mentions "Kindesmissbrauch" amongst other reasons to withhold end-to-end-encryption for the masses. It's newer than a year. By the way, bringing uncomfortable things via EU is a common tactic.

[0] https://www.heise.de/news/Crypto-Wars-Deutsche-EU-Ratspraesi...

raxxorrax5• 5 years ago

Germany is a decent offender of executive overreach, you can see that in the numbers. It is not just prominent cases where the governor of Berlin searched a home for a twitter post. Is it called swatting if you just call your police dept to raid someone?

Sebb767• 5 years ago

Slightly off-topic, but IMO this article could use an editor. At the "Drug related crimes at the top"-headline, 4/5 paragraphs state basically the same thing and of those four, three are simply different formulations. This is very irritating, for me personally at least.

shapefrog5• 5 years ago

Now I cant unsee that. tbh I need an editor for most of my comments, so I can hardly talk. They obviously drafted the same statement a few times forgot to delete 3 of the versions of the same thing. Sloppy in the comments section, but really poor on the headline article.

zug_zug• 5 years ago

I think a lot of us grew up being some of the very few people "in the know" surrounded by masses of technologically-oblivious people who couldn't care less about such issues. I think a lot of us have a sense of "learned-helplessness" based on initial attempts to explain to people why such things matter.

However, in the meantime, I think the average citizen has largely caught up. For example, even on reddit, comments are exceedingly pro-privacy. I also remember net neutrality being overwhelmingly important to people, even the ones who had never programmed in their life.

I think it's time to unlearn that helplessness, because I think the average citizen is informed enough to care and finally is starting to care. A lot of the old fox-news-watchers have since passed on, and now nearly every citizen uses the internet daily. Examples of corrupts government are no longer hypothetical sci-fi exercises, they are public knowledge.

raxxorrax5• 5 years ago

Ironically I think the latest decade has brought conservatives up to speed on some topics.

Not from the US, but could you have imagined a US conservative arguing for free speech and against censorship in 2010? They were always big on the constitution, but very selectively for this topic and there was some kind of flip.

zionic• 5 years ago

Decentralization as well. 10 years ago your average conservative didn't even know that word, and now the big tech monoculture has taught huge portions of them why using distributed, decentralized systems is important.

angst_ridden• 5 years ago

There's nothing new here. The "conservatives" in the US are arguing for free speech and against censorship while passing laws banning the mention of concepts in the classroom.

pessimizer3• 5 years ago

I think a lot of us grew up being some of the very few people "in the know" surrounded by masses of technologically-oblivious people who couldn't care less about such issues.

TBH, the claim that normal people don't care about privacy has been almost exclusively used to silence normal people who are concerned about privacy on the basis of zero evidence. I remember being "in the know" about when and how people were being tracked and being paranoid about things most people weren't paranoid about, but when I explained it to people, it also bothered them - they hadn't 1) realized they were that interesting, or 2) realized how granular and concrete the records they leave behind are.

I've virtually never met someone who wasn't concerned about privacy other than David Brin-familiar nerdballs and radical devotees of communal living and/or eastern philosophy. What people don't know is how computers work, and people who build their business models around surveillance and rent-seeking make a huge effort to obscure how computers work.

exolymph• 5 years ago

You misunderstand. People say they care about privacy. And they do, in their day-to-day context. But they don't care enough about mass surveillance to make any tradeoffs to avoid it.

dandanua• 5 years ago

It's the politicians who must be stripped of privacy. They're servants of all of us. They must be controlled the most, because our societies depend on them the most.

It's them who are the most vulnerable to corruption. It's them who are most likely to abuse their power, including child abuse.

It's them who are most likely to think that they're some privileged caste, so they can do "whatever they want" (c) Trump.

LeonB• 5 years ago

One obvious thing: Major US political parties should insist that prospective presidential candidates disclose their tax returns.

hereme8882• 5 years ago

I don't think tax returns are the most important thing to be transparent about. Things like Hillary's mechanical destruction of digital data and other such abuses are a much bigger issue.

pessimizer3• 5 years ago

It's the politicians who must be stripped of privacy.

Don't worry, they have been and will be. Monitoring dragnets filled with normal people are attractive because squeezing a dime out of a few million people is profitable. But the real monitoring will be of wealthy, powerful people, for the purpose of manipulation and blackmail.

AndyMcConachie• 5 years ago

I came here to grump about the fact that if Tutanota cared about privacy they would upgrade from using STARTTLS to using DANE for SMTP.

But lo and behold tutanota.de is using DANE for SMTP. I know the last time I checked they didn't have it, and I think that was a few months ago or maybe a year.

Good job Tutanota!

https://www.huque.com/bin/danecheck-smtp

fartcannon• 5 years ago

I used tutanota not because they encrypted their email, but because they were the cheapest managed option that let me use my own domain. I just didn't want to enrich Google with my data and I wanted to use catch-all. But over time, I really missed using K-9 so I switched to hosting my own.

can16358p• 5 years ago

This became very dangerous. Putting a taboo, sensitive topic on stakes (even though actual impact is almost zero) and many people objecting against would sound like criminals commiting a crime.

I really doubt those governments even care about children or their abuse, all they want is to break encryption for survelliance, and they are using a sensitive topic about children for their own benefit.

Disgusting.

hereme8882• 5 years ago

I've learned that child pornography and other similar arguments have been used by the FBI and CIA since the fight to publish PGP decades ago. It's never been mainly child pornography.

Government always thinks they're the good guys, but we increasingly become aware of abuses by agencies and people working in government, and also companies who increasingly exploit people with tactics that are always ahead of lawmakers.

swader999• 5 years ago

When you realize that surveillance = control then it starts to make sense why governments do this. It is not about prevention of bad things happening.

Who Is Being Monitored?

Related Stories