Tools For Treason

http://techcrunch.com/2013/07/06/tools-for-treason/

by llambda • 13 years ago

132 55 13 years ago

techcrunch.com

noonespecial2• 13 years ago

Just like in medicine, if its not strong enough to kill, its not strong enough to cure either.

mistercow• 13 years ago

Of course, in medicine that's not actually true. Where do people come up with these silly sayings?

noonespecial2• 13 years ago

I think it was supposed to be a "rule of thumb" not a law of nature. I heard it used in response to "snake oil" cures that were supposed to be completely harmless but cure everything from cancer to pancreatitis.

If you carry it out to the point of absurdity, even water can kill people if too much is ingested too fast.

dllthomas2• 13 years ago

Yup, if you're starting to suffer from the onset of scurvy, don't bother with vitamin C - no way it's strong enough to cure.

cjp• 13 years ago

http://en.wikipedia.org/wiki/Vitamin_C#Overdose

venomsnake• 13 years ago

I am a bit disturbed of him calling virtualized hardware safe. It by definition is not.

I think that every person should have personal encryption router from whih to access the cloud services

saraid216• 13 years ago

whih

I thought this was some technology I wasn't aware of until I realized it was just missing a 'c'. :P

grugq• 13 years ago

You got that so close, but wrong. Cloud services are inherently insecure because you don't have physical control over the devices containing your data. You have to trust that the remote end is secure, and exploiting trust is what intelligence agencies do best.

For an encrypted router, here is my script for making a RaspberryPi into a PORTAL: https://github.com/grugq/PORTALofPi

And an older blog post on why encryption and tradecraft only get you so far: http://grugq.github.io/blog/2013/03/12/anonymity-is-hard/

Here is the Ruckus Society's manual on "security culture" which has some brief info on why you need physical control over your data storage devices. Includes also some pointers on how to establish strong(er) physical security for your data. http://ruckus.org/article.php?id=789

devindotcom6• 13 years ago

I don't think that just any virtualized hardware is safe fundamentally or anything, I just meant it as a practical option instead of multiplying machines. Obviously trust, as I wrote, can't enter the equation. But if you are sure (in the mathematical sense) that the virtualized machine cannot be doing anything but running tangential software and relaying your info without the possibility of decrypting, it seems safe to me.

Obviously if I'm wrong let me know, but I just meant it as a general alternative to people having their own entirely isolated physical server, local or remote.

smoyer• 13 years ago

Excellent article ... The comments on the article's page are interesting. He's obviously not advocating treason, but one of the comments goes to great lengths explaining that those controlling the data collection are duly elected.

I was tempted to compare this type of end-to-end security to the second amendment (the right to bear arms), which was a right given to the people (in part) to ensure they could overthrow a corrupt government should one form - I don't think we're to that point and overreaching by the government has contracted back to reasonable levels before.

But thinking about this issue from a constitutional level, we have indeed (as the article states) given away our fourth amendment rights, and I don't see how developing the systems described in the article could be construed as treason - I'm simply making myself personally responsible for enforcing my fourth amendment rights.

My steps:

- Replace Google Apps for domains with my own servers.

- Stop using drop-box

- Establish private communications channels for IM (and perhaps something like Twitter.

Then I'll only use public infrastructure for data/messages I want to be public. Unfortunately, the list above represents a lot of work and is exactly the reason we seeded control of our data to outside corporations. We gave them our data as a means to simplify our lives or to gain greater "connectivity". It won't be so easy to go back.

temphn• 13 years ago

  one of the comments goes to great lengths explaining that 
  those controlling the data collection are duly elected.

And how powerless are they? The unelected Clapper did anything, while the elected Wyden could do nothing. The technologist Snowden did everything. Democracy didn't bell the cat of the government bureaucracy. Technology did. Technology is more powerful than both democracy and bureaucracy, as it is not subject to dilution and co-optation.

steveklabnik• 13 years ago

Technology is more powerful than both democracy and bureaucracy, as it is not subject to dilution and co-optation.

How many web sites do you visit with ads compared to the ones you don't, again? I mean, the whole "eternal September" concept is predicated on certain technologies being diluted/coopted.

raintrees2• 13 years ago

Aren't you comparing/confusing the tool with behavior? It seems to me I could restate that as "The pencil is more powerful than the mathematical equation E=MC^2 it writes"...

rayiner3• 13 years ago

Technology is more powerful than both democracy and bureaucracy

That's an interesting statement, and I think one I represents a a troubling undercurrent of thought in the tech community. "We refuse to submit to the democratic process and will override the democratic consensus through technology."

rainsford3• 13 years ago

The interesting thing to consider is that, from a 4th amendment perspective, the technology the author is discussing in theory goes way, way beyond protecting any rights found in the 4th amendment.

I think this may have been the point of the article's title (aside from being attention grabbing). The 4th amendment gives Americans the right against unreasonable searches without a warrant, and some similar legal protections exist in many other countries. But the technology the author is discussing generally has a design goal of preventing all searches, under any circumstances. In other words, to technologically ensure a right you never possessed in the legal sense. It provides protection for people and in situations not even the most rights respecting government would be likely to legally protect.

This doesn't make the technology bad, but it's a very interesting thing to think about, which is what I suspect was one of the points of the article. For better or worse, technological protection has the potential to go well beyond legal protections.

PeterisP2• 13 years ago

The whole point is that in technology, there is no such thing as privacy/secrecy that's conditional on having a legally proper warrant.

Either the data or system is secure, or it isn't. Technologically, if there is a way for a judge to authorize reading a single X; then it is a hole that eventually will allow to read all X without the warrant by others as well.

As an example, if a cellphone network software allows for FBI wiretaps, then that can be used also by illegal wiretapping (http://en.wikipedia.org/wiki/Greek_wiretapping_case_2004%E2%... - the criminals weren't even identified). And if a system is secure (for any reasonable definition of the word secure), then noone can break that security, no matter what warrants they have.

There is no middle way. If I'm allowed to protect my communications from random illegal snoopers (say, corporate espionage); then that protection will be just as effective against legal snoopers.

nateabele• 13 years ago

But the technology the author is discussing generally has a design goal of preventing all searches, under any circumstances.

Well, the alternative is that the government has access to everything, all the time, and we just have to trust that they're not going to misuse it.

Also, your wording implies that if a government agency does have a valid warrant, that this means they're somehow entitled to whatever information they seek (within the parameters of said warrant). This is patently absurd to me. If the government seizes an encrypted document with a valid warrant, more power to 'em. Have fun brute-forcing it. Doesn't mean I owe them the passphrase.

rmc2• 13 years ago

Sure, the us constitution is written that way, but other one that explicitly mention privacy (eg article 8 of the European convention on human rights

unclebucknasty2• 13 years ago

but one of the comments goes to great lengths explaining that those controlling the data collection are duly elected.

I saw this too and thought how insanely naive it was. Also how nonsensical a response it is. The very point is that people feel betrayed by their government. By definition, then, those "duly elected people" are not representing the will of the people. That is, there is something broken about the system that must be fixed, but cannot be fixed by merely participating more in that broken system.

This dysfunction is also evidenced by the fact that much of this was done in secret by these elected officials and there is much effort to maintain that secrecy. A democracy cannot flourish in secret, as it relies upon an informed populace. But, if not for someone breaking laws created by "duly elected officials", we would not even know of these programs and hence the need to consider holding these officials accountable democratically.

In fact, that was the very point of the article: we have lost the reins and must now protect ourselves. And, the article itself was very thought provoking. Not so much for the technological solutions it suggested, but for the justification and context for their neccessity.

lurchpop• 13 years ago

It's very much a "blame the victim" argument government apologists & partisans always run to. It's the same as the redneck's "love it or leave it" choice. If the government is violating my rights I can either elect a different Democrat or I can live as an illegal alien in another country.

rayiner3• 13 years ago

The very point is that people feel betrayed by their government.

Here is the problem: the people don't feel betrayed. Just look at the turnout of the recent "Restore the 4th" in San Francisco--a pathetic ~400 people turned out. You claim that our elected representatives are not representing the "will of the people," but what you mean is that they are not representing the viewpoints of you and your friends. It's disingenuous.

And it's not because people are entirely apathetic. Just look at how many people Tea Party rallies attract. Tea Party rallies regularly get tens of thousands of people to turn out at events all over the country.

Maybe, just maybe, the people know and just don't think the slope is so slippery as you and your friends think it is?

panarky• 13 years ago

To be truly secure from government intrusion, we must accept the inevitable and horrific consequences.

The freedom to own lethal weapons leads directly and inevitably to the massacre of innocent first graders.

Likewise, the freedom to be truly "secure in their persons, houses, papers, and effects" leads directly and inevitably to monstrous and evil acts.

Freedom is dangerous. Both the second amendment and the fourth cause us to "arm our enemies".

Freedom is also analog, not digital. We can accept some limits on our freedom to reduce the risk.

rmc2• 13 years ago

Yes freedom is analog and has rewards and consequences. There are countries which have decided that giving the common person guns is not worth it.

GigabyteCoin• 13 years ago

We can accept some limits on our freedom to reduce the risk.

Speak for yourself. I don't wish to limit my freedom for any reason.

devindotcom6• 13 years ago

"Freedom is dangerous" is certainly one of the major themes in play here, and I actually cut a bit relating this (the knife and hammer thing is the remainder) because it was getting a bit too philosophical. I'm glad you (and certainly others) heard the echo and followed it back to the sound.

troels• 13 years ago

He's obviously not advocating treason, but one of the comments goes to great lengths explaining that those controlling the data collection are duly elected.

I certainly didn't elect them.

rainsford3• 13 years ago

I found the almost throw away shot the article took at Spideroak to be kind of odd. While I'm sure they comply with the law, their service would not seem to allow them to very easily "decrypt on command".

In fact services like Spideroak would seem to be a reasonable tradeoff between convenience and security. A service you run on your own server from open source code reviewed by experts could be more secure, but it's a lot more of a hassle to set up.

devindotcom6• 13 years ago

I don't think that Spideroak would just decrypt your data if someone said pretty please, but the fact is that they retain the ability to do so if they are legally obligated to. It follows that they may do so if they are not legally obligated to, though I don't mean to imply that they would (and I don't think I do in the article, sorry if it comes across that way). It does mean that they can decrypt on command, though. If they have access theoretically, they have it practically, in this case. There's a difference between them and other cloud services but it's more like the difference between varieties of apple than between apples and oranges, I think.

Zigurd• 13 years ago

Hopefully this article describes the outcome: That spying eventually makes us more free by making people truly secure their documents and communications against all intrusion short of the government running a black bag job on them. That provides a natural restraint on government intrusion.

rch• 13 years ago

Freenet has been around for a long time. I wonder about it having been compromised though.

Tools For Treason

Related Stories