Tor users and Linux Journal readers are classified as extremists by NSA | Hacker News Reader

Tor users and Linux Journal readers are classified as extremists by NSA

in.techspot.com

38 pointsRatherFunky12 comments

While we are already witnessing the effects of unrestrained government interference and surveillance in our lives I shudder to consider the world the next generation will inherit from us and grow up in.

That said, F..k the NSA. I just opened all the listed links in the article.I am on at least eight more lists now.

>Countries like Canada, the UK, New Zealand, Australia, and the US, also known as the "Five Eyes", are exempt from surveillance, however.

If you're in one of those countries, you should be in the clear?

> Countries like Canada, the UK, New Zealand, Australia... are exempt from surveillance

Anyone with a rudimentary knowledge of spy-craft knows that's not how it works. Everyone will spy on everyone else when they can get away with it.

Given the FBI's interest in Tor, pretty obvious Tor users are targets.

From the rules file:

> fingerprint('anonymizer/tor/torpoject_visit')=http_host('www.torproject.org') and not(xff_cc('US' OR 'GB' OR 'CA' OR 'AU' OR 'NZ'));

So yes, it would appear that you would be in the clear. At least for looking at the TOR project website.

Not this again, I expect better from HN readers. Please do not treat the claims in this poorly researched article as correct information.

NO, Tor and Linux users are NOT classified as extremists by the Intelligence Community.

Yes, there are mentions of 'Linux Journal', 'TAILs' and 'Tor' in a file with filter definitions. But why? If we look at the actual rules in the file (http://daserste.ndr.de/panorama/xkeyscorerules100.txt) we see it contains the following definition:

    // START_DEFINITION
    /*
    These variables define terms and websites relating to the TAILs (The Amnesic
    Incognito Live System) software program, a comsec mechanism advocated by
    extremists on extremist forums.
    */
    $TAILS_terms=word('tails' or 'Amnesiac Incognito Live System') and word('linux'
    or ' USB ' or ' CD ' or 'secure desktop' or ' IRC ' or 'truecrypt' or ' tor ');
    $TAILS_websites=('tails.boum.org/') or ('linuxjournal.com/content/linux*');
    // END_DEFINITION

This does NOT say that anyone using TAILs or reading the Linux Journal is classed as an extremist.

Notice that they describe TAILs is a 'comsec mechanism advocated by extremists' and then go on to define a filter that selects users searching for it. However it would be used in conjunction with filters that also select traffic from browsing those extremist forums. This usefully gives a list of addresses that frequent extremist forums and then seek out and implement the communications security advice given in those forums, thereby indicating they are more than just casual browsers, they have something they wish to hide or secure in their communications.

So, once again, the XKeyScore definitions do NOT automatically classify Linux, Tor and TAILs users as 'extremists', they merely give examples of filters that can be used to select traffic mentioning these keywords or connecting to related sites, in order to further filter traffic from known extremist or terrorist groups that also advocate using these tools for communications security. This allows analysts to determine whether an address belongs to a casual browser of these forums, or someone who wishes to keep their extremist or terrorist related browsing secret, and is therefore worthy of further surveillance of their internet traffic.

(2014) publication date.

And from the last time around:

https://news.ycombinator.com/item?id=7991696

Is "fingerprint" here referring to the Javascript fingerprint ? (https://panopticlick.eff.org/)

This is much more potent than IP address, but there don't seem to be much defense against this.

There is. You can either randomize the fingerprint (per-session fresh vm configured from a pool of possibilities) or unify it (tor/tails), provided that enough people do the same.

Is there a (recommended) add-on that does this ?

It does seem to make sense logistically in terms of why they'd do it. Linux Journal isn't a large website, so it's not hard to just bulk add everyone to a list or whatever.

It seems they're just trying to bulk sweep up anyone that might be using TAILS.

Reply on news.ycombinator.com