Snowden Interview with Jacob Applebaum

http://cryptome.org/2013/07/snowden-spiegel-13-0707-en.htm

by teawithcarl • 13 years ago

219 86 13 years ago

larrywright5• 13 years ago

Some of this seems odd to me. Snowden appears very intelligent and credible, but how would he have been in a position to know who wrote Stuxnet?

lawnchair_larry• 13 years ago

How wouldn't he?

That's like asking how he would be in a position to get Top Secret documents.

larrywright5• 13 years ago

I'll confess that I've followed this subject only partially, so I may be missing facts about what he had access to. Did he have complete access to everything at the NSA?

asveikau5• 13 years ago

How wouldn't he?

Easy. Omniscience is not the default state of a human being. Perhaps he had access to information revealing this, and didn't find or read it. Perhaps he had no access to such a thing. I don't think we can safely assume he knows everything there is to know about anything the government (or even some small sector) is involved in. He's just one guy, after all.

marshray• 13 years ago

Perhaps he read about whatever futile investigation they felt like doing on Obama's staff who leaked it to the New York Times.

jonknee2• 13 years ago

The New York Times put that fact on 1A a year ago. It's not shocking that someone who leaked a Top Secret FISA order (supposedly one only accessible by a handful of people) would also be able to confirm something that is widely known. I mean, there was even a very public book written about it. It would only be newsworthy if he said the NSA did not have a hand in it.

http://www.nytimes.com/2012/06/01/world/middleeast/obama-ord...

larrywright5• 13 years ago

I knew that, but I also know that it's not been officially acknowledged. My reaction was just based on his apparent confirmation that this was true, as it seemed to be from a perspective of first hand knowledge.

davorak• 13 years ago

but how would he have been in a position to know who wrote Stuxnet?

I read that as it is commonly understood among my colleges at the NSA that America and Israel wrote Stuxnet and this understanding seems to be reputable rather then rumor.

pvnick2• 13 years ago

To folks downvoting, stop. This is an interesting, on-topic, technical question. There's a reason we're given the ability to downvote only after reaching a karma threshold, because we're to do so judiciously.

coldtea2• 13 years ago

Isn't the answer to who wrote it kind of a "you don't say" thing in the first place?

drawkbox• 13 years ago

Hacking infrastructure/cyber warfare has been part of the plan for over 30 years or since it was available. Even Reagan allowed it to help bring down the USSR (http://www.wired.com/culture/lifestyle/news/2004/03/62806).

Stuxnet is largely believed to be created by the US and Israel to cause problems to Iran's nuke programs (http://topics.nytimes.com/top/reference/timestopics/subjects...). Part of defense is offense against infrastructure that is a threat and will be as long as there are countries.

larrywright5• 13 years ago

"largely believed" I agree with. That's not what the interview says. It states very matter-of-factly that we DID, which is different. My question is how we would have been in a position to know this for certain.

bpatrianakos• 13 years ago

Agreed. Are we just believing everything Snowden says without proof here and are we believing that any site that posts a Snowden interview is actually posting a legit interview? That's not to say someone really believed they were talking to him but rather to ask how are we to know? Are there documents that prove the mass data collection is real, especially the British and other European programs. So far the only documents I've seen are related to PRISM. I'm hesitant to just take Snowden's word at face value. There are a few things about him and his behavior that make me question his reliability. I'm willing to believe a lot but not all of it yet.

jrochkind15• 13 years ago

I think Snowden et al made a mistake with the PR, with regard to what they released first.

The "PRISM" stuff, the stuff with specific internet app/service providers, is actually the _least_ troublesome. (And the closest to legal/constitutional, with FISA orders involved and all.)

MUCH more troublesome, but receiving MUCH less media attention (such that I don't even know the special program names, they are not 'prism'):

* They are recording everything that goes over the internet, by tapping in at major backbones, undersea cables, etc.

* They deploy RAT malware to take over and observe targetted person's computer. (Have we been given evidence by Snowden that they do this inside the US and/or to US citizens? I am not certain. Do they get FISA orders/warrants first? I am not sure. Have we gotten info released on the RAT stuff yet? This interview is the first I've heard of it, in fact.)

Both of these are WAY more alarming, more significant invasions of privacy, less likely to be legal/constitutional, than PRISM. But PRISM's getting all the attention.

I wonder if this was in fact part of NSA/government counter-PR, to make sure PRISM gets the attention and people get burnt out on the story before they get to the REALLY disturbing stuff.

pvnick2• 13 years ago

I wouldn't worry about it. Greenwald claims that the currently-released information is but a fraction of the total disclosures to come. I'm sure he and his editors meticulously played out every scenario of the different release order options.

djloche2• 13 years ago

We've known about your point A since the 641A information was leaked in 2006. Worse, both major party 2008 presidential candidates (Obama and McCain) voted in 2007 (as then Senators) for effective immunity for the telcoms for their participation in the helping of the government to spy on everyone. Snowden was wise to reveal new information to get people interested again.

jrochkind15• 13 years ago

Did we really know then that they were tapping into backbones and recording all the bits?

It's possible 'we' did, but I just didn't notice it because I wasn't paying attention and the media didn't make too much of it.

I did hear about the immunity thing, but figured that was for individual requests for particular information for particular investigations; it honestly didn't occur to me that they'd record the entire internet, I naively thought that would obviously be unconstitutional and thus not done.

If "we" did know that before, then I guess the Snowden leak has been great PR, because I didn't know about it until now!

hkmurakami• 13 years ago

I think the everyday average person (non engineer, non tech industry) would take interest in the subject much more with PRISM, which names companies and services that they interact with every day and they depend upon.

If you take the body of people who use Google/Yahoo!/Facebook and get the % of people who are aware of the existence and importance of internet infrastructure, you will find that the % is nowhere near 100%.

I think the order is okay, but the issue is that the media is making it a personality focus to make the story more sensationalist (do we sense a pattern here!?) and said average Joe is surely distracted.

rickhanlonii2• 13 years ago

I make the same observations, but I actually think that it's a brilliant move by Snowden et. al. The way they are releasing the information so far has been from less to more troublesome. It's hard to say yet, but I would imagine that the first leak is on the lower spectrum of importance. But it was a great starter because it appealed to a larger audience given that it had powerpoint with big name companies on it, rather than the technical details that would be required to demonstrate the two points you mention.

As the leaks have moved on, the information has become progressively more concerning. Anyone who has followed this issue should have at least a vague idea of the caliber of information that could be coming (your post as an example). So, rather than releasing the big ticket items first, and having the rest of the issues make no impact in comparison, they're allowing as much information as possible to have it's greatest individual impact before moving on (not to mention the now well-discussed benefit of authorities lying themselves into corners trying to cover up the smaller issues).

In this way, they're priming the public so that we've spent months digesting the impact, and understanding the issue so that when we get (say) screenshots proving everything going over telecommunications is recorded, the public is prepared to understand and digest that fact quickly, and can move to action quicker--or even at all.

The more I think about it, the more I earnestly believe that this technique is the most effective methodology available to them and may be our one and only shot to stop it (keep in mind that once a subgroup of society reaches enough power and intelligence over the rest, there is literally nothing the rest of humanity could do to overthrow them; we can't dump tea in the ocean and fire guns at them anymore if they have drones and know everything about everyone).

He doesn't have to convince HN readers that this is worth stopping our daily lives for to stand against, he has to convince the general public.

With that in mind, the best thing we can do right now, is help them to prime the pump. Bring it up to everyone that will listen. Make the electorate informed. Because when the news comes--the one that we will need to act on--the public needs to be ready to hear it and move on it.

jrochkind15• 13 years ago

good points.

although I'm not sure I'm confident that there is a 'big one' coming 'the one that we will need to act on' (if what we've already gotten isn't it) -- we will see. I am curious to hear more about the RAT stuff.

sneak4• 13 years ago

He doesn't have to convince HN readers that this is worth stopping our daily lives for to stand against, he has to convince the general public.

The opinion of the general public doesn't matter. It's been being effectively managed for years, and that won't change now. The proles will never revolt.

The fact is, these programs existing and being public knowledge to "foreign entities" (Obama's words), pose an existential threat to Google, Apple, Amazon, Microsoft, and any other US-based company that intends to make money handling the private data of those filthy foreigners (whom outnumber US citizens on the internet something like a dozen to one).

Sure, tell everyone who will listen. But you'll find that most people don't give a fuck, and wouldn't know what to do with the information even if they did.

This change, if it comes, will come from industry, as all major internal policy changes in US government have for decades.

antocv3• 13 years ago

Have we been given evidence by Snowden that they do this inside the US and/or to US citizens?

Im amazed why do you US citizens always derail the debate towards this question "us citizens or not"?

Are you guys more important than us? Dont you think US citizens are spied upon by UK, New Zeeland, Canada, Sweden, Germany etc and then exchange of information happens with those countries?

Does it matter that much how many laws NSA broke and how many lies they told you? Would you be fine with all of this if NSA had lobbied for a law, like FRA did in Sweden, to make all their activities, spying on US citizens included, perfectly legal? Just suck it up and accept "democracy" then?

Is this legal, who broke what law. What theyre doing is immoral no matter how they twist the law and how much they talk about what direct means in direct access.

Please, avoid discussing legality of minor details and focus on the implications for democracy, power and inequality. How do we fight back?

aptwebapps• 13 years ago

It is very self-centered, but there's a reason for it. It's easier to make a stink about something immoral if it is also illegal. And some Americans are pretty touchy about the Constitution so the more clearly an action violates the Constitution, the more likely it is to provoke a reaction.

It's certainly not the only debate worth having regarding the whole affair, but as far as things go in the US, it's significant.

lucian1900• 13 years ago

* They are recording everything that goes over the internet, by tapping in at major backbones, undersea cables, etc.

This bit worries me less than PRISM or malware. We've already designed our networks to resist MITM where we believe security matters and there is a general push towards TLS for everything.

meowface2• 13 years ago

I would be very curious to see how they might remotely deploy malware to US residential internet subscribers. It's probably unlikely that they would use client-side zerodays for such a task, since it would only take one of the targets to realize something happened and then analyze a packet capture to bust the whole thing.

If I were to guess, they probably only stick to ISP-level monitoring in most cases, and in other cases maybe they'll physically install malware on a system when they have to.

medde• 13 years ago

He should start signing all his messages

asveikau5• 13 years ago

More of this Hollywood movie plot version of network security:

The analyst can then decide what he wants to do - the computer of the target person does not belong to them anymore, it then more or less belongs to the U.S. government.

This is kind of like when he said:

You are not even aware of what is possible. The extent of their capabilities is horrifying. We can plant bugs in machines. Once you go on the network, I can identify your machine.

Software types reading this stuff know that this is not how computer networks generally work. Maybe it is a dumbed-down reference to some sort of government malware. If so I would like to see more technical precision from Snowden before I can say that he has any chance of knowing what he's talking about.

lukifer2• 13 years ago

I'm guessing it's more along the lines of collaboration with major tech vendors to plant backdoors within commercial hardware and software, probably under the guise of "just once in a while, to catch the really bad guys".

AnthonyMouse• 13 years ago

Maybe it is a dumbed-down reference to some sort of government malware.

That's what I took it as. With government-level resources you can pretty easily throw a team at all the common web browsers and find exploitable 0-days and then MITM the next connection the target makes to any website to exploit it, and then find a local privilege escalation vulnerability if necessary. Once you have root (or equivalent) on any given machine you pretty much own it.

That sort of thing isn't necessarily in reach of your typical J. Random Hacker against a patched machine (may not have access to 0-day, can't easily MITM target's internet connection, etc.) but it's really not a stretch to imagine that the NSA can do it if they have no regard for the law.

asveikau5• 13 years ago

not a stretch to imagine that the NSA can do it

In what kind of numbers, though? I mean, from what I remember reading Stuxnet had this kind of crazy stuff in it (multiple zero-days if I recall), but also a clear target in Iran. Would they have the resources to do this to everybody? Is there any evidence of that? Certainly if there were it would be really fascinating to know more, but all we have is this movie plot scenario.

With what Snowden says it makes it sound like they do it to anyone out of sheer boredom. I think to understand the scope of this claim we need more details.

bangbang• 13 years ago

It's possible and somewhat easy to pwn a system's bios and have it phone home unpon boot. This was demonstrated at Defcon 20.

asveikau5• 13 years ago

Even this vague comment is more specific than what Snowden is offering. I'd imagine it also involves a non-zero amount of hurdles (physical access? kernel mode privileges so you can flash BIOS?) which can be mitigated against.

That's the weird thing about Snowden's claim. It makes them sound all-powerful. If it were really something concrete, there'd be more knowledge of scope, mitigations, etc. It's also hard to believe they are doing this on everyone, by default.

digitalengineer• 13 years ago

I more or less suspect there are backdoors all over our machines these days. The printer or scanner you buy, the OS... "Secret Admin Backdoor Accounts Found in Samsung Printers" http://news.softpedia.com/news/Secret-Admin-Backdoor-Account...

meowface2• 13 years ago

This is a common issue with many hardware peripheral devices, but if your desktop computer contained some sort of hardware-level or OS-level backdoor, there would be a massive uproar.

I think either Snowden is incorrect in what he's talking about, or the NSA is doing something rather devious like hijacking the Windows update process or some other automated task to install malware, which they could only do with heavy cooperation from Microsoft. This would be rather risky though as it could certainly be detected.

tippytop• 13 years ago

He has a nice idea about a prospective path of resistance:

"The [telcom] companies should write enforceable clauses into their terms, guaranteeing their clients that they are not being spied on. And they should include technical guarantees. If you could move even a single company to do such a thing, it would improve the security of global communications. And when this appears to not be feasible, you should consider starting one such company yourself."

Google and Facebook don't seem to care, but the people here can create the kinds of companies that do. Let the PRISM collaborators starve of a talent storage.

antocv3• 13 years ago

Yes, this is what we should talk about.

How do we create, maintain and support companies that guarantee our privacy? What do we do when those companies and its employees receive threats, blackmails and various attacks by the feds? When they become infiltrated? When they buy them up like Skype and close its security down?

Facebook, Oracle, Google all seemed to crap their pants when PRISM came out, can we increase the heat on them to stop what theyre doing?

What methods do we have? What can we, the good hackers non-NSA-employed hackers, do?

We have various encryption technologies, mega made some fine client-side encryption kind of easy to use, what else?

Whatever we build will not be a perfect solution, it will require agreements and legal frameworks and support from a major group of people. Isnt this what GNU is about, the FSF and freedom box project?

EDIT: Its kind of tiresome that HN must always have a critical comment at the top, no matter the issue, someone always tries to tear any story up to pieces. Id like to remind you people of this awesome quote;

""It is not the critic who counts; not the man who points out how the strong man stumbles, or where the doer of deeds could have done them better.

The credit belongs to the man who is actually in the arena, whose face is marred by dust and sweat and blood; who strives valiantly; who errs, who comes short again and again, because there is no effort without error and shortcoming; but who does actually strive to do the deeds; who knows great enthusiasms, the great devotions; who spends himself in a worthy cause; who at the best knows in the end the triumph of high achievement, and who at the worst, if he fails, at least fails while daring greatly, so that his place shall never be with those cold and timid souls who neither know victory nor defeat. ""

D9u• 13 years ago

Question: What happens if the NSA has a user in its sights?

Snowden: The target person is completely monitored. An analyst will get a daily report about what has changed in the computer system of the targeted person. There will also be... packages with certain data which the automatic analysis systems have not understood, and so on. The analyst can then decide what he wants to do - the computer of the target person does not belong to them anymore, it then more or less belongs to the U.S. government.

I wonder if regularly wiping and reinstalling your operating system has any effect on the aforementioned computer compromising by government/criminal elements?

Obviously, an open source OS is a better choice than some closed, proprietary, OS, but I seem to remember some controversy about BSD developers being approached by government agents for the purpose of coding a backdoor into the systems which they were working on.

Just how secure is my unix-like OS?

jallmann5• 13 years ago

This information is illuminating, albeit not too surprising. But with all these releases, Snowden's chance of securing whistleblower protection on constitutional grounds is completely shot. There could be a legitimate discussion about tapping US companies, or constitutionality of the information dragnet on Americans [1]. He could have had a fighting chance if the leak were confined to just those.

That's not going to happen anymore, because now everybody is distracted by sensational asides: we're hacking everybody, we're behind Stuxnet, we're in cahoots with the Europeans, etc etc etc. Snowden is allowing the spotlight to remain fixed on him; this whole thing is perfect fodder for the media -- an individual on the run, Hollywood-style hacking plots, and predictable Internet outrage. All while the constitutionality issue gets swept under the rug (see Congress). What's more, Snowden will probably lose the battle of public (and legal) opinion because these foreign operations are arguably justifiable [2], and the leaks weaken the US bargaining position with other countries.

I'm not sure what the goal of this leak is anymore. Snowden is completely fucking himself over while diverting public attention from issues that have the best odds of an immediate fix -- the surveillance of Americans. This whole thing is a bitter popcorn-fest.

William Binney said this during the USA Today interview [3] a few weeks ago:

I would tell him to steer away from anything that isn't a public service — like talking about the ability of the U.S. government to hack into other countries or other people is not a public service. So that's kind of compromising capabilities and sources and methods, basically. That's getting away from the public service that he did initially. And those would be the acts that people would charge him with as clearly treason.

[1] Sorry, non-Americans: the Constitution doesn't cover you guys. But we need to protect ourselves from our own laws first before we can help the rest of the world.

[2] If you think the US is the only one doing this, or if the world should just hold hands and sing Kumbaya: get a clue.

[3] http://www.usatoday.com/story/news/politics/2013/06/16/snowd...

sneak4• 13 years ago

Snowden is allowing the spotlight to remain fixed on him;

Well, look who the interview is with.

sneak4• 13 years ago

Sorry, non-Americans: the Constitution doesn't cover you guys. But we need to protect ourselves from our own laws first before we can help the rest of the world.

Protecting the US internet industry from these actions means not permanently undermining the credibility of every single US company when they say they're not spying on their international customers to further the government's (secret) national interests.

Americans are outnumbered more than a dozen-to-one on the Internet, you know. (And that ratio stands to get even more lopsided as the next 2 billion people get on the internet, too.)

grey-area2• 13 years ago

I think he simply wants Americans, and the world, to know the truth about what their governments are doing, and doesn't believe that the best chance of that happening is staying within the bounds set by US law. He probably believes the best chances for pushback on privacy lie outside the five-eyes states, because those states have been co-opted so completely by their intelligence services. In the UK for example, every secret communication of every politician, judge and public servant is now available to those services.

Binney in his heart still believes the US government can be reasoned with and negotiated with and it seems you agree with him. It appears Snowden has decisively broken with that point of view and sees it at somewhat naive (probably after seeing what was done to Binney and Manning). As to treason (in a broad sense as betraying his country), I think that depends on whether you believe he's exposing wrongdoing or not. If he's found extensive wrongdoing, it's impossible to make that public without damaging the US in the short-term, but in the long-term, he may believe what he does is in the interests of the US. I certainly agree with him.

Sorry, non-Americans: the Constitution doesn't cover you guys. But we need to protect ourselves from our own laws first before we can help the rest of the world.

Personally I think we should try to move past this sort of parochial patriotism and look at this issue as one which affects the whole world. If you accept the argument that foreigners may be spied upon, and anyone having contact with foreigners, you're accepting that anyone who does business outside the US or has contacts outside the US is a potential surveillance target. That probably covers almost the entire cosmopolitan US population nowadays. So much for American privacy. You also accept that states like the UK and Canada will be allowed to take every bit of information that passes through them and pass it back to the NSA, because that data is now 'foreign'. By the same argument text messages in the UK are all swept up, because they pass over the border for technical reasons apparently.

Of course the only country and legal framework we can currently work within is our own, but it is inconsistent and ultimately futile to view this as a struggle for rights in only one country, because the network which we're objecting to is global in scope and global in ambition.

Perhaps more important than the difficulties of separating foreign from US data is the damage this attitude causes to the standing of the US in the world - if this deepens the perception that there is one law of US citizens and another for everyone else, why should other countries treat American data and persons with respect?

jallmann5• 13 years ago

believes the US government can be reasoned with and negotiated with

Whistle-blowing is an important exercise that keeps the system in check. And I do think this whole thing was an important wake-up call. But it really seems that Snowden has gone beyond any capacity for protection -- the leaks are so far-reaching that it will be easy to steamroll and discredit him. He doesn't deserve treason, but the politicians will be able to make a convincing argument of that (or at least espionage), given the scope of the leaks.

this issue as one which affects the whole world

No doubt.

Of course the only country and legal framework we can currently work within is our own

Exactly. This information is too much, too fast, and is overwhelming reasonable options for what can be done. Fix the first things first (surveillance, tapping US companies), and other things later (vacuuming up data globally).

Of course it's impossible to say how fixing the "other things later" should/would have worked -- it could've required another leak (or at least a less egocentric approach), or the process of fixing things in the US could have strengthened rights elsewhere. The way things are going now, I fear we may not even have chance to fix anything at all.

mongol• 13 years ago

Related to 1): If that's the American attitude, then Snowden is certainly a hero for all of us non-Americans.

guelo2• 13 years ago

I hate the "everyone is doing it" "get a clue" excuses. The U.S. government hacking into Hong Kong computers is wrong and disclosing it is a public service to the people of Hong Kong. If we don't demand moral just governments we will never get them.

jallmann5• 13 years ago

If we don't demand moral just governments we will never get them.

OK, here's a clue: truly moral governance is only sustainable if all governments follow the same moral behaviors. Unfortunately, that's not a stable equilibrium, because the world is not Kantian -- thinking otherwise is naive.

HSO• 13 years ago

[2] If you think the US is the only one doing this, or if the world should just hold hands and sing Kumbaya: get a clue.

1) Governments spying on governments, sure. On foreign businesses even, sure, if they're big or important enough, I've heard that too. But does any other country do indiscriminate mass surveillance on the entire US population? Make no mistake, this is the informational equivalent of carpet bombing other countries. And not just your purported and declared "enemies" but even your friends and allies. You should not wonder if you end up having none.

2) "It's right because other people do it too / did it first." Hm, grow up?

3) "It's ok because it's always been done like that." Don't I love this time-based argument. So it was ok to have concentration camps in 1944 because they've been there in 1943? Or where is the line? And who determines it?

jallmann5• 13 years ago

1

If they don't, it's probably because NSA is actively preventing it (albeit while doing it themselves). Anyway, we're not disagreeing here.

2

Like it or not, it's how the world works.

3

...and Godwinned. One would hope that it's conversations like these that allow us to call out the slippery slope between liberty and (overbearing) security.

PavlovsCat• 13 years ago

[2] If you think the US is the only one doing this, or if the world should just hold hands and sing Kumbaya: get a clue.

If you think that's an argument, you should follow your own advice.

gexla• 13 years ago

If the NSA saves all my stuff, then why do I need my own backups? Forget Dropbox, just give me access to my stuff at NSA. This is a service I'm already paying for.

throwaway345• 13 years ago

I'm still conflicted over these Snowden revelations. On the one hand, it is (of course) an egregious (and probably illegal) breach of privacy.

On the other hand, I think it's incredibly naive to believe that, once a technology exists, it won't be aggressively used to further the interests of nation-states and multinational corporations alike.

What makes you think for a second that China and Russia aren't using (or at least in the process of building) the same sorts of systems?

Snowden Interview with Jacob Applebaum

Related Stories