Welcome to Echelon 2.0

http://erratasec.blogspot.com/2013/06/welcome-to-echelon-20.html

by bluetooth • 13 years ago

191 52 13 years ago

erratasec.blogspot.com

jaryd• 13 years ago

It's crazy... I remember in high school (I think 2001) I gave a speech to my Social Studies class about Carnivore (previously DCS1000). I was incensed by it, and by what it represented. I now read this stuff, and just kinda quietly think "what next?"

samstave4• 13 years ago

I recall that the only ISP that refused Carnivore being installed in their systems was EarthLink - then there wasa story that EarthLink was founded by Scientology and they already had deep packet inspection and full traffic filtering/monitoring.

When the AT&T closet fiasco was revealed, it was a short-lived outrage.

The fact that the library of congress has signed a deal archiving all tweets is extremely odd.

The amount of ex-intelligence employees at facebook is just astounding.

The fact that .ir and .us cointelpro agents have built duqu and stux is amazing - the capabilities of those sytems is crazy.

We live in a cyber WWIII - and its largely invisible to 99% of the world.

adventured4• 13 years ago

Earthlink wasn't founded by Scientology. The founder of Earthlink - Sky Dayton - who did not have a controlling interest in the company by the point of the IPO in 1997, was/is a Scientologist. Earthlink was backed by a myriad of capital sources, from traditional VC to people like George Soros; Apple even put $200 million into them.

kijin3• 13 years ago

What next? This [1], of course.

Of all the electronic device you own that are capable of being exploited for automated surveillance, your PC or Mac is probably the only thing that is not actually being used for automated surveillance (not counting your web browsing habits, and provided you don't have any spyware on your computer). How dare you use a computing device that (hopefully) does not have any backdoors built into it, is not locked into any vendor's monthly payment plan, is not locked into any vendor's proprietary OS, and even supports "terrorist" techniques such as full-disk encryption?

Fortunately for Big Brother, key hardware components of general-purpose computers are only produced by a handful of corporations such as Intel and AMD. Don't be surprised if they agree to build all sorts of defects-by-design into their processors, graphics cards, HDDs/SSDs, etc. There are already plenty of excuses: I have popcorn ready for the day when graphics cards finally implement security systems to prevent them from being used for bitcoin mining or password brute-forcing.

The FSF should change their name to FCF, Free Computing Foundation. We need them badly, more than ever before.

[1] Cory Doctorow, "The Coming War on General Computation", https://www.youtube.com/watch?v=HUEvRyemKSg

endgame• 13 years ago

> not counting your web browsing habits, and provided you don't have any spyware on your computer

You don't need spyware to do that: http://www.experian.com/hitwise/hitwise-methodology.html

k3n• 13 years ago

> Echelon (probably) existed

Probably?

http://en.wikipedia.org/wiki/ECHELON

adventured4• 13 years ago

This is a pretty bad article. The NSA wouldn't violate the constitution? Give me a break. They violate it every minute of every day. They're using it as toilet paper, as they attempt to store every piece of digital information on every American they can, in their mega data center in Utah.

You'd be better off starting from a list of big Federal agencies that aren't violating the Constitution every day of the week.

It's not speculation that Echelon existed, it's an openly admitted fact that the program was not only developed but live. It was used to help catch, as two examples: Pablo Escobar and Carlos the Jackal.

gohrt3• 13 years ago

Do you know someone who works at NSA? I knew someone (a rank-and-file SIGINT engineer), and he swore that people in his office are trained to discard any domestic data they encounter. Was he lying? Maybe. Did the policies change? Maybe.

xntrk• 13 years ago

Yeah the discard it right into there domestic database...

ianhawes• 13 years ago

The likely scenario is that information distributed throughout the agency suggests that they do not spy on US citizens. Basic training is done for all employees where they are taught not to spy on US citizens.

However, NSA also conducts clandestine operations. Employees selected for those operations are probably recommended based on their willingness and trustworthiness when it comes to spying on US citizens and effectively breaking the law.

Alternatively, as has been suggested recently in numerous articles, FBI probably works hand-in-hand with NSA to "legally" allocate information required for datamining. To the employees of the clandestine operations, the information obtained is technically "legal", so perhaps that serves to settle the nerves of the employees involved.

betterunix2• 13 years ago

I think the most likely answer is that your friend was not lying, but that the NSA is a massive agency with numerous different divisions and operations that do not all follow the same set of rules or have the same objectives.

Torgo• 13 years ago

Binney has stated that he witnessed a shift in culture at the NSA since 9/11. We either have to take him at his word or not though.

rdtsc• 13 years ago

Just because what they are doing is legal doesn't mean it isn't shady. You can tell they've gone far and wide to push the boundaries slowly as far as they could. It is like they can't slice your throat but they can surely wave the knife a inch away from your head while claiming they are still following the rules.

Then perhaps some will wonder, how come people mistrust the government?

The Constitution was written centuries ago. Before internet, before phones. And I guess for a long time people trusted the government to keep up with the spirit of the Constitution. It seems the opposite is happening. Those who one expects to know, respect and defend it are the ones chipping away at its edges, bit by bit.

This leads to trust issues. It is like entrusting someone with a job, and then they find a way to screw it up then come back and say technically I didn't do anything wrong because "I followed all the rules". Yes they followed all the rules, but they also managed to lose the trust. Now the relationship is adversarial as opposed to one of mutual support.

Now I always wondered about the peons. They ones working in the trenches who have implemented all these technical "features" . One or two have come out and revealed it. What about others? Will there be death bed confessions, 20 years from now? Don't anyone of them care or see what they are doing or what they are enabling? Just wondering what goes on in their heads.

kijin3• 13 years ago

The U.S. Constitution was written, not because people trusted their government to do the right thing back then, but because they did not trust the government. The current political atmosphere, where the government is considered trustworthy until proven otherwise, is a result of Reconstruction and the two world wars that followed. Before that, it was a very real possibility that the newly founded United States might soon devolve into the kind of tyranny that the Founding Fathers perceived British rule to be. The Constitution was an attempt to prevent this from happening. By default, the government could not be trusted; and trust was only granted reluctantly when the government could demonstrate that it was doing the right thing. That's why so many clauses of the Constitution are concerned with what the government can't do. The government was never supposed to enjoy as much blind trust as it does today.

adventured4• 13 years ago

Indeed, the Constitution and Bill of Rights were meant to act as a straight-jacket on the government.

The commerce clause, and numerous laws leading up to it, were the major opening. It made the lobbying boom possible by giving the government direct control over the economy (and therefore lobbyists acquired reason to lobby, and reason to buy politicians).

All powers not expressly granted to the government were to be outside their province. They switched that, such that any powers not expressly denied the government were to be assumed to be in their province.

rayiner8• 13 years ago

None of this is actually true. The state governments didn't trust the national governments, but the Constitution does nothing to limit the power of government in general (the nearly unlimited power of the state governments, inherited from their status as successors to the British Parliament). The structure of the Constitution is much more about the politics between the states than it is about a blanket mistrust of government.

tlrobinson• 13 years ago

"Don't anyone of them care or see what they are doing or what they are enabling?"

Perhaps they're afraid of prosecution (or worse). After all, they would know more than anyone exactly what the government is capable of...

samstave4• 13 years ago

Also, dont forget the HW backdoors provided to the NSA by Cisco for over a decade...

And the NSA chip fab...

http://hardware.slashdot.org/story/10/10/29/1456242/hiding-b...

nnq• 13 years ago

Q for those of you with a legal mind: how could one "extend"/reinterpret the US Forth Amendment to make it apply to things like internet logs or credit card receipts? Why should doing something via a 3rd party business make the information concerning what you do less "intimate"?

...and pondering more on it: why should businesses not benefit from the same rights to privacy as individuals do?

einhverfr• 13 years ago

Read the Alito and Sotomayor concurrences (well, to be specific Sotomayor concurred in full, while Alito concurred only in judgement) in Antoine Jones v. United States (GPS surveilance of a car requires a warrant) and Douglass's dissent in California Business Association v. Shultz (a case that decided there was no 4th Amendment protection for bank records). The encouraging thing is that you can't read both of these and not think that maybe the court is slowly coming around to our side (pesky issues like standing notwithstanding, heh).

I actually don't think the third party doctrine has that much to do with call detail records. The issue is not only that they are held by a third party but that, at least when this was originally litigated, they weren't really that expressive, and there is already a major question as to whether historic cell site location data (also covered by the order btw) is protected, with already circuit splits forming on the issue.

gohrt3• 13 years ago

Orin Kerr explains: http://www.volokh.com/posts/1211991760.shtml

His argument is that: it would be inconvenient to follow the 4th amendment in the 21st century, because computers give people the technical power to have conversations in private that would be otherwise need to be public, so government should ignore the 4th amendment.

In short, there is no such interpretation, but government lackeys and show-off contrarians make up sophistic excuses for the governments illegal actions.

rayiner8• 13 years ago

"Sophistry" does not mean "I don't like the result of this educated and rational analysis."

Gormo3• 13 years ago

The problem is that Kerr's assessment of the impact of technology on searches and seizure is exactly backwards. Modern technology makes it far easier to intercept people's private correspondence, track their movements, and perform undetectable surveillance against them.

It's utterly absurd to suggest that technology gives us more opportunities for private conversations now than it did when audio and video couldn't be recorded and when written correspondence existed in the form of single-instance physical documents that could be sealed and examined for tampering.

So if the fourth amendment is to remain "technology-neutral", we need to be far more aggressive in its application, not less so. Encryption is, at best, a tool that helps people restore the former level of privacy that they would have expected in their correspondence.

rayiner8• 13 years ago

> Q for those of you with a legal mind: how could one "extend"/reinterpret the US Forth Amendment to make it apply to things like internet logs or credit card receipts?

I don't think its worth a strained interpretation of the 4th amendment to achieve this purpose. If it is desired, it would be better to make it a statutory or common law privilege (e.g. like the kind that applies to confidential communications between clients and their lawyers).

> Why should doing something via a 3rd party business make the information concerning what you do less "intimate"?

Because information that is voluntarily exposed to third parties is almost by definition not "intimate"?

Technologists tend to be fundamentally mistaken about the nature of the information at issue in privacy debates like this. AT&T's logs of your calls are not your information. They're AT&T's information. Romantic notions of internet technology aside, this is the physical nature of things: it's AT&T's data collected by AT&T's routers and wireless base stations, sitting on AT&T's servers. It's not your private information, at least not in the technical sense.

To use an analogy: you can object to the government listening in on a private dinner party at your house. You can't object to the government asking one of your guests what was said at the dinner party. You can't assert your privacy right over information that isn't yours.

> ...and pondering more on it: why should businesses not benefit from the same rights to privacy as individuals do?

They do. They just don't care to assert that right to protect the data they have on individuals.

mapt• 13 years ago

The content and addresses of the letters you send cease to be 'your information' the moment they enter the mail system.

Does this mean we expect, Constitutionally, for them to be penetrated by government overseers?

If the Constitutional protection were about one's diary, something one expects never to transmit to another, that would be another matter, but the clause is implicitly understood to apply to information transmission and storage between people.

PavlovsCat• 13 years ago

the NSA cannot intercept signals within the United States

Oh, really?

https://www.youtube.com/watch?v=s976iyaO39A

In the first few minutes of that Bill Binney says this:

"I was focused at foreign threats. The problems I solved, and the way I solved them, were directed at foreign threats, and foreign potential threats. Unfortunately, after 9/11 they took my solutions and directed them at this country, and everybody in it."

bascule• 13 years ago

Thanks for posting this! That part of the article bothered me as well. See also:

http://en.wikipedia.org/wiki/Stellar_Wind_(code_name)

cdooh2• 13 years ago

Ah, when you look at it critically the death of 3000 people, 9/11, has lead to 2 never ending wars, the curtailling of people rights all over the world as states rushed to implement broad anti-terror laws to please the US and funnily enough, from where I seat in Kenya, the complete dismissal of the very thing that makes America America; it's constitution

adventured4• 13 years ago

* made America America

The Constitution is arguably no longer the governing law for the US Federal Government. Their behavior indicates it's optional as to whether they follow it (and there haven't exactly been big consequences to not following it, we keep giving them more money to spend to expand the abuse).

cdooh2• 13 years ago

America is democracy, you can bring about change with your votes. Unless of course you also have the same problem we have in Africa;democracies paralysed by idiots with votes

rayiner8• 13 years ago

> The Constitution is arguably no longer the governing law for the US Federal Government.

I can't think of a federal action, even this one, that is blatantly unconstitutional. The problem is that you don't like what the Constitution says. You want things like the 4th amendment, which protects you against invasive searches of your home and person, to apply to information like that the NSA is collecting that is not private at all (and indeed is not even in your possession, being collected and stored by an independent third party).

You want to act like the government has turned away from the Constitution, but the case is rather that you want to re-litigate the boundaries of Constitutional protections. There has never been the kind of blanket protection of "privacy" that technologists like to claim applies to the internet. "Privacy" in that sense is a concept that largely post-dates the founding (the 4th amendment is better understood not as a privacy protection, but as a protection against the indignity and invasiveness of illegal searches). If the founders had meant to create a blanket protection of "privacy" they would have done so.

ethanazir• 13 years ago

I guess people who use encryption stand out. But how can we avoid Watergate type abuse of this information. Say if I'm a Tea Party candidate, I must compete with a one way mirror?

Kekeli• 13 years ago

Doesnt end-to-end encryption for your calls as offered through open sourced apps like Redphone secure your conversations so that nobody can listen in.

https://whispersystems.org/

gavinlynch2• 13 years ago

There already was an Echelon 2.0 back in the 90's. I suspect we're on Echelon 4 or 5 or 6 or 6, etc. by now.

gavinlynch2• 13 years ago

lol @ the downvotes. Sure, please downvote factual history. Hilarious.

Welcome to Echelon 2.0

Related Stories