NSA targets the privacy-conscious

http://daserste.ndr.de/panorama/aktuell/NSA-targets-the-privacy-conscious,nsa230.html

by freejack • 12 years ago

434 176 12 years ago

daserste.ndr.de

caster_cp• 12 years ago

The only way out of this, as I see it, is making privacy the default. But this require some cooperation and motivation from the big guys at silicon valley.

Imagine if Chrome, Firefox, Safari, all of them had, just like the incognito mode, the private mode. Of course, as anonymity also depends on the behavior of the user online, other actions are needed to really ensure security and privacy. But making it the default will educate more people about the importance of privacy and, more importantly, make the point that privacy isn't only for criminals, terrorists and wrong-doers, but that "normal", law abiding citizens also should have the right to be private. And that is paramount for a democracy to work.

Zigurd• 12 years ago

But this require some cooperation and motivation from the big guys at silicon valley

Unfortunately, this is key to making strong encryption commonplace. A social graph and real-time communication could be used to make key exchange easy and secure. Open client software is needed to make security verifiable. And the storage and email infrastructure and clients need to make using encryption the default.

All the pieces of a "trust nobody" environment are there, and so are the pieces for making it an easy to use default.

Hopefully, doing this will be required for American service and technology companies to regain trust.

schoen3• 12 years ago

One of the biggest difficulties for "easy and secure" key exchange is that so many people want to be able to access private communications on many different devices.

How do you authorize a new device in an "easy and secure" way without simply outsourcing the problem to an intermediary who is then in a position to attack you by authorizing its own devices?

This issue has quite concrete implications for the security and convenience of lots of existing security tools, from GPG to iMessage to Skype to Firefox. They've chosen different approaches but the underlying problem and associated tradeoffs apply to all of them.

On the bright side, there are now a lot of people exploring the space of possibilities for dealing with these tradeoffs.

higherpurpose2• 12 years ago

Funny enough, Chrome used to say that incognito mode doesn't protect you against spies. It still says it doesn't protect your data from governments.

yry43454• 12 years ago

I think the cooperation necessary would be for the "big guys" to not have a vested interest in selling out privacy, which has been the prevailing business model for a long time. And, since the big guys only listen to their bottom line, that means not using them until they support privacy. It may mean not using the Internet substantially at all. (It's more than a little ironic to be saying this on the preeminent "business hacker" (or "startup") community, which has a visible subset who sympathize with some of the NSA's programs, or at least have been able to rationalize them...)

As you say, the tools have always been there, but no one uses them. That might be because it's a chicken-or-egg problem. At the same time, it might be because the people in the positions to develop and promote the tools, even if only for their own use, are being prevented by a one-track culture that encourages them to sell out their client's privacy in addition to discouraging them from working on projects like Tor. (Again, the HN forum is an example of that conflict - being a largely business-oriented forum; surveillance technology sells... Even DuckDuckGo, a favorite startup in this community, has filters to protect us.) Rather than peer-to-peer solutions like Gnutella, Gnunet, Tor, and even open wireless, people continue to make websites with JavaScript encryption, despite the proven MITM threat.

I don't think JavaScript and CSS will get us out of this, but if this latest revelation doesn't wake people up in the tech community specifically, nothing will, since BoingBoing readership is a large number of them - which to me means that the tech and programmer categories are themselves a primary focus of the surveillance that some highly-respected tech pundits (and HN forum members) have defended and rationalized as only being used for terrorists and perverts. That definition now includes anyone with enough knowledge to build or use strong privacy tools. The definition now includes everyone on this forum.

aluhut• 12 years ago

"No one" uses it because it is too complicated for "every one".

Sprint2• 12 years ago

They can start with using HTTPS for everything and hosting things like analytics (Piwik rocks!), javascript libraries etc. themselves.

terranstyler2• 12 years ago

Warning:

The first sentence goes "If you read Boing Boing, the NSA considers you a target for deep surveillance".

So, if you find this interesting, maybe you shouldn't read it.

sroerick2• 12 years ago

Or maybe you should read what you want, and fight for your right to do so.

notastartup• 12 years ago

"I'm not a terrorist or a criminal so I am fine with forfeiting my rights to privacy and freedom so they can keep me safe from the imminent danger of terrorists"

Heard that one before.

krapp• 12 years ago

You're warning people about the possible consequences of reading BoingBoing on a site called Hacker News, Where actual hackers and technorati hang out and complain about the American government all the time.

Sprint2• 12 years ago

https://en.wikipedia.org/wiki/First_they_came_...

First they came for the Socialists, and I did not speak out— Because I was not a Socialist.

Then they came for the Trade Unionists, and I did not speak out— Because I was not a Trade Unionist.

Then they came for the Jews, and I did not speak out— Because I was not a Jew.

Then they came for me—and there was no one left to speak for me.

terranstyler2• 12 years ago

OK, just to clarify - I wanted to point out that the site basically says "once you're reading this, you're getting tracked" paradox warning in a (IMO) funny way.

I don't agree at all with these practices.

cLeEOGPw• 12 years ago

If you are here, you can be damn sure you were already on their list long time ago.

afarrell3• 12 years ago

When the NSA collects evidence on someone and uses that evidence to prosecute a criminal case, they can and should file a motion to suppress that evidence.

The NSA data is collected under search issued by a FISA court. So, during a suppression hearing, defense counsel can challenge the validity of the warrant. If their challenge is denied, they can appeal. If their appeal fails, they can petition the Supreme Court. In all these courts, the proceedings are public record and the standard for a warrant can be debated by lawyers and the public alike. We have an open process for checking the work of the humans issuing FISA court warrants; Use it.

Even if the warrant was valid, the NSA might have overstepped its bounds. This can also be challenged when the NSA defends the admissibility of its criminal evidence in a suppression hearing. An independent judiciary can decide if the executive branch has acted outside its bounds. No, an investigator isn't punished for the overbroad evidence collection, but they are embarrassed by having a criminal get off due to their sloppiness. We have an open process for checking the work of human investigators in this country; Use it.

It isn't as if the government just takes that evidence and unilaterally decides to blow people up. We have due process in this country; Use it.

mckoss• 12 years ago

I believe it has been reported that the FBI lies about the sources used in investigations so that defendants never find out about the true sources that led to their prosecution. Your legal right to challenge sources of evidence is useless in the face of a corrupt government whose primary goal is to hide those sources from the public.

avmich• 12 years ago

But you can always ask FBI to prove that their sources are legitimate. They say the sources are legitimate, but you say no, and it's their word versus your word, right?

On an unrelated news, http://mayday.us campaign still has two days left.

bgentry• 12 years ago

And meanwhile, years of your life will be wasted sitting in prison awaiting challenges, all while you're threatened with decades in prison for evidence that the government should never have had access to. Not to mention the legal fees if you can't get pro-bono coverage on your case.

It's no wonder so many plea out to a lesser (but certain) sentence when given the choice.

joe_the_user• 12 years ago

It isn't as if the government just takes that evidence and unilaterally decides to blow people up.

Well, except when they do, in Afghanistan or Yemen, say.

afarrell3• 12 years ago

Yes, I am aware of that. I am also aware that the NSA does not being criminal cases even if it does give data to the FBI.

YokoZar• 12 years ago

This would be a reasonable view if there weren't a systematic campaign by the NSA, FBI, and DEA to lie to judges and prosecutors about the actual source of underlying evidence.

https://www.eff.org/deeplinks/2013/08/dea-and-nsa-team-intel...

The EFF calls it Intelligence Laundering. The DEA calls it parallel construction. Either way it is sinister and immoral and a court hasn't had a chance to rule on it precisely because it is very difficult for defendants to prove that both the prosecutor and judge were lied to.

afarrell3• 12 years ago

I don't actually hold the view expressed. I've just been trying (and failing) to find a compelling way to articulate the following point: "The FISA court's warrant system is flawed because the validity of its warrants or their execution are never checked because the warrants aren't actually used to bring criminal cases."

So, I thought I'd try sarcasm. But I couldn't come up with a concise way to address the fact that parallel construction means that their info actually is used in criminal cases. Oh well, back to the drafting board...

jewhaseloff• 12 years ago

Raw milk distributors.

sroerick2• 12 years ago

Wait, what? Are you being facetious? This is so oddly specific.

yry43454• 12 years ago

http://boingboing.net/2009/12/08/farm-family-put-unde.html

Edit: The title and link of this HN article have changed. The link changed from a BoingBoing article to the original German article, and the headline used to be a question ("Who is the NSA spying on..." or similar) that gave the GP comment more context.

pekk• 12 years ago

It's a conservative meme that raw milk producers are being unfairly persecuted, in those circles it's supposed to be a paradigm case of the overly intrusive nanny state.

In reality, there is hard epidemiological data showing that selling raw milk (edit: e.g. through the normal store channels) can lead to serious harm including deaths. So FDA bans it for interstate sales, but it's up to the state to decide how to regulate in-state sales. Just like any other food safety issue.

NSA is extremely unlikely to be involved in enforcing regulations against raw milk in reality, but in the mind of the conservative conspiracy theorist it's all of one totalitarian piece.

dang• 12 years ago

Changed the url from http://boingboing.net/2014/07/03/if-you-read-boing-boing-the..., which points to this.

There were two versions of this story on the front page. This thread has the fuller discussion, the other the original source. In such cases we usually merge them by reassigning the url and burying the other thread.

jobu2• 12 years ago

Because anyone trying to keep anything private or secure must be hiding something bad... That's just wonderful.

After 10 years of pervasive surveillance and not being able to catch a single terrorist I can't believe the NSA is trying to rationalize it as being a good thing. It's too bad the bill to defund the NSA didn't pass: http://defundthensa.com/

duaneb• 12 years ago

I can't believe the NSA is trying to rationalize it as being a good thing

Is it really a surprise people in power wish to remain in power?

Zelphyr• 12 years ago

I wonder if the sentiment here is that the NSA used to be known for being a highly intelligent group of people trying to solve hard problems but now they seem like a bunch of D-level bureaucrats snooping through everything hoping they'll get lucky.

bsder2• 12 years ago

I would amend that to: "Is it any surprise the bureaucracy wishes to protect the bureaucracy?"

ForrestN• 12 years ago

http://people.bethel.edu/~steken/death%20and%20despair/holze...

Zak• 12 years ago

Because anyone trying to keep anything private or secure must be hiding something bad

The NSA does an awful lot of hiding things. It might therefore be reasonable to conclude that it is bad and should, at the very least have its funding cut.

tking8924• 12 years ago

Got to stop people from doing things that they themselves are doing...

Anecdotally reminds of this guy that was key in setting up the British porn filter being arrested for child pornography: http://www.telegraph.co.uk/news/politics/david-cameron/10675...

deciplex• 12 years ago

A person is not a government agency ostensibly accountable to a democratic government and, therefore, public oversight. The NSA is. To the extent a democracy keeps secrets from voters, it is not a democracy. The US government keeps a lot of secrets.

josefresco• 12 years ago

If we are to accept that some who seek privacy and security are good and innocent, we also need to accept that some who seek those same things can also be bad.

bilalq• 12 years ago

You can literally replace "seek privacy and security" with almost anything in that statement. I mean, out of all the people that prefer Coke over Pepsi, there are definitely some bad guys.

While your statement is true, it doesn't really give any justification on targeted spying. That is, unless of course, we consider the desire to hide things to be a signal of being a bad actor. Thinking along those lines is a very slippery slope though. The erosion of freedoms is just another side-effect of policies and actions shaped by such thinking.

josu• 12 years ago

Because anyone trying to keep anything private or secure must be hiding something bad...

No, that's not the reasoning. People that do bad things try to hide them. Therefore, a good first filter to catch bad people is to target those who hide things. They can narrow the search field afterwards.

SeanDav2• 12 years ago

Not sure why you were marked down for that comment. Logically it is an obvious low hanging fruit to target the people looking for privacy. It is cynical but certainly logical, like it or not.

pyre5• 12 years ago

This is true, but saying "treat all people trying to hide things as potential terrorists" is a very wide net to cast (to the point of useless).

mihok• 12 years ago

Literally everyone hides something, its all relative. Not to mention the people that do bad things in plain sight.

stinos• 12 years ago

Because anyone trying to keep anything private or secure must be hiding something bad...

Well that idea isn't exactly new, unfortunately, remember Eric Scmidt.. "If you have something that you don't want anyone to know, maybe you shouldn't be doing it in the first place."

Zarel• 12 years ago

Well, in context, I believe that quote was intended to mean "as a US company, we can't stop the government from intruding upon your privacy", not "we don't value your privacy".

dan_bk• 12 years ago

Like we shouldn't get our privacy.

Whereas he bought himself a specially isolated penthouse in order to live his open marriage in perfect privacy.

jacinda• 12 years ago

not being able to catch a single terrorist

Except, you know, this guy named Osama Bin Laden. http://www.ibtimes.com/nsa-snowden-leaks-satellites-drones-c...

bitchypat• 12 years ago

I think he meant before they wreak havoc.

gdewilde• 12 years ago

No, he had already died in 2001, people only get to die one time.

anigbrowl2• 12 years ago

On the other hand, anyone who is up to something bad is going to try to keep it as secret as possible, no?

After 10 years of pervasive surveillance and not being able to catch a single terrorist

Questionable. I wouldn't expect the NSA to put out a press release every time someone is nabbed on the back of their information-gathering, that wouldn't be very smart.

cbsmith2• 12 years ago

No, because anyone trying to hide something is highly likely to be trying to keep things private and secure. Ignoring the moral, ethical, and legal concerns, it is a perfectly reasonable course of action. The moral, ethical & legal concerns are of course terrible.

pessimizer13• 12 years ago

Of course this happens, and it's an obvious technique. I'm sure that not having a facebook account adds to your score, using AdBlock adds to your score, mentioning the NSA online adds to your score, refusing cookies adds to your score, using Linux adds to your score, etc.

That's how a police state works. (XKeyScore += 5)

My mother was involved in civil rights, so she has a file. It's fine that I have a file too. Hopefully I'll be gone before they start going door to door.

edit: http://www.linuxjournal.com/content/nsa-linux-journal-extrem...

Holbein6• 12 years ago

Yeah, and if you don't even have an internet connection, NSA is putting you on their most wanted list. Give me a break. Not doing something can't make you more suspicious.

pessimizer13• 12 years ago

Not doing something can't make you more suspicious.

That's just stupid.

psykovsky• 12 years ago

Hopefully I'll be gone before they start going door to door.

Why care about the rest of your family that will still be here to endure the rest... or the rest of us. You have no kids, right?

pessimizer13• 12 years ago

I don't. If you want to fight, I'll support you. I donate money to causes that I know raise my XKeyscore, and I subscribe to magazines that I know raise my XKeyscore. My long term plan is to find somewhere where this is not happening, and move there, though.

If I were planning to stay here for the rest of my life, I wouldn't risk political posting on the internet, donating, or subscribing. You'll get more help for me as long as I can rationalize it as only worsening a temporary situation.

higherpurpose2• 12 years ago

Amplify this by 100, and welcome to Minority Report, where you get a arrested for having a "very high score".

This is where the "mass surveillance" and "let's monitor everyone just in case they might do something bad" thinking inevitably ends up.

acqq• 12 years ago

Amplify this by 100, and welcome to Minority Report, where you get a arrested for having a "very high score".

Or maybe welcome to Oceania of 1984, having to deal with Thinkpol:

http://en.wikipedia.org/wiki/Thoughtcrime

"The Thought Police (thinkpol in Newspeak) are the secret police of the novel Nineteen Eighty-Four. It is their job to uncover and punish thoughtcrime."

sliverstorm8• 12 years ago

... you get a arrested for having a "very high score".

Considering this is PRECISELY how spam filtering works, it doesn't seem entirely irrational.

Much like spam filtering, it would all come down to dialing in your filters and picking a good threshold.

Hell, if the system was good enough, it could actually improve freedoms. We currently arrest many innocent people as part of the legal process (who are later exonerated). What if our "arrest filter" outperformed the current system, in terms of percentage of innocent people arrested? It doesn't have to be perfect to be better.

lucb1e3• 12 years ago

you get a arrested for having a "very high score".

I was thinking more in terms of automated drone strikes, but yeah for the facade of democracy arrests may be the way to go for now.

tomphoolery• 12 years ago

I wish I could find out my XKeyScore. I'm genuinely interested in how threatening the NSA believes average people are.

pessimizer13• 12 years ago

XKeyScore is the new credit report:)

digitalengineer• 12 years ago

Someone should be a Check-My-XKeyScore site. Answer several questions (do you have a VPN? Use Linux, etc) and show the submitter how high he ranks in the NSA's eyes. 'share via Twitter etc' Could be fun and easy way to show people just how crazy this is...

anigbrowl2• 12 years ago

That's how any sort of metric works - your credit score, your Acxiom consumer category score, whatever metrics Facebook and Google use to score user engagement.

This is just how life is when databases are ubiquitous. After I bought a house and my name began appearing in property tax databases I started getting lots of (paper-based) commercial spam for things homeowners are more likely to buy, like different sorts of insurance, refinancing, satellite TV service yadda yadda.

When it emerged after 9-11 that various government agencies had failed to 'join the dots' by not sharing intelligence information effectively, there was a lot of public support for better-coordinated and more proactive intelligence gather, notwithstanding warnings about the risk to civil liberties. So collectively we got what we asked for. The lack of public outrage or mass demonstrations against the NSA strongly suggests that a large majority are OK with this state of affairs, especially since they're used to data collection in a commercial context.

pessimizer13• 12 years ago

I think people are too busy, too desperate, and too badly educated to do anything about it. Most people were only being kept solvent by credit cards, borrowing against the equity in their houses, and taking massive loans for major purchases - and when credit got tight, people started setting up tents on Wall Street. The next crash is going to be a terrifying experience.

A little bit of war, however, will probably dull any of that.

fulafel2• 12 years ago

The credit and consumer category scores are legal in the us because of non existing privacy legislation. No such things eg in the EU. Ubiquitous invasive databases aren't fate.

andy_ppp• 12 years ago

Not doing any of those things will massively bump up your score; you must be trying to avoid detection.

blauwbilgorgel• 12 years ago

I'd like to focus on:

Merely searching the web for the privacy-enhancing software tools outlined in the XKeyscore rules causes the NSA to mark and track the IP address of the person doing the search.

Again the media makes it sound like there exists a dragnet on (Google) searches. But this time one of the authors is J. Appelbaum.

So which is it? Terrorist Scores based on search engine searches sounds fantastically insane to me. But unencrypted it is possible to intercept. So perhaps it is something in between: All accessible searches are monitored, and search engines do not cooperate with this directly, unless they have to legally comply with the request?

nostrademons• 12 years ago

One of the earlier Snowden disclosures was that the NSA had tapped private internal Google fiber lines carrying traffic between data centers. Same with Yahoo, Microsoft, other major Internet destinations. Google has since started encrypting all internal traffic, but for awhile pretty much anything was available to the NSA dragnet.

alex_duf• 12 years ago

I'm sure it still is. We just don't know how yet, but a giant corporation like google has probably other ways to be attacked.

And if it is not possible on the technical level, the NSA will find the people to access the data they want.

jqm2• 12 years ago

"It also records details about visits to a popular internet journal for Linux operating system users called "the Linux Journal - the Original Magazine of the Linux Community", and calls it an "extremist forum"."

WTF? I guess I am on a list. Who knew being an extremist was so easy?

reuven2• 12 years ago

I write for Linux Journal. Imagine how I feel! I had no idea that I was participating in subversive activities.

cottonseed• 12 years ago

Proud?

kps2• 12 years ago

No, it doesn't say that Linux Journal itself is an ‘extremist forum’. It says that TAILs is “advocated by extremists on extremist forums”, and includes Linux Journal as a source of information about TAILs, neither of which seem surprising.

jqm2• 12 years ago

Yes it says exactly that. Thus the quotes "" in my post.

4'th bullet point from the top in case you wish to check again.

schoen3• 12 years ago

I think an even more significant thing in the XKeyScore code (in terms of the idea that "NSA targets the privacy-conscious") is the existence of a "documents/comsec/" hierarchy of fingerprints. I may have written some of the documentation that's targeted elsewhere within that hierarchy.

Istof• 12 years ago

and the top key-word on their watch list is de-fund

toddnessa• 12 years ago

What I gleaned most from the article(s) is that it's becoming increasingly important for all of us in the tech community to take a stand ourselves along with TOR to promote online anonymity in our companies (& possibly even think about supporting the TOR Project itself in some way).

antocv• 12 years ago

Did you seriously think news.ycombinator.com doesnt increase your score and suspectibility of having your computing devices hacked into? And puts you on a very interesting NSA/CIA/Letter-Combo/For-Your-Safety list?

Look at Ukraine. War just pops up. I wonder which list they will go by first.

zby2• 12 years ago

That is why you should join the Pirate Party! We are a targeted group - we must organize.

junto2• 12 years ago

Unfortunately in Germany the Piratenpartei have a few too many undesirable links the NPD [1] (i.e. Neo-Nazis) for my liking.

Until they clean house and stamp out the far right, they'll have a problem attracting new voters.

http://www.sueddeutsche.de/bayern/piratenpartei-und-rechte-u...

zby2• 12 years ago

This is two years old article - as far as I know the German pirates now are rather leftist (actually too leftist for my liking - but as a whole the pirate movement is rather balanced between the two poles).

Pirate Party as a new and mostly undefined movement attracted all kinds of freaks - but it can only work as a movement of those that understand how the Internet can be used in politics, both the dangers and the potential for good, and who value the freedom and openness that was associated with the early net.

Create• 12 years ago

We begin therefore where they are determined not to end, with the question whether any form of democratic self-government, anywhere, is consistent with the kind of massive, pervasive, surveillance into which the Unites States government has led not only us but the world.

This should not actually be a complicated inquiry.

http://www.theguardian.com/technology/2014/may/27/-sp-privac...

noobhacker• 12 years ago

I feel quite ambiguous about these discriminating techniques. For example, it is okay for us to give females / older people lower insurance rate because that's what the statistics says. Likewise, it's likely that people who search for privacy-enhancing software are more likely to engage in "subversive" activity. So it's hard for me to determine which kind of discrimination is justified and which not.

TazeTSchnitzel• 12 years ago

Did you mean ambivalent, not ambiguous?

NSA targets the privacy-conscious

Related Stories