Dutch secret service tries to recruit Tor-admin

It's nothing new. It has gone on amongst the NGO and activist community for many years. Especially the aid worker (in places like Pakistan) and environmental defender community (all over the world). We have investigated a number of instances of pitches by both government and corporate intelligence human penetration over the years in many different countries. In fact we cover it quite extensively in our security training programs that we teach. I think people are often surprised to know that we've seen nearly as many human penetration attempts as digital. The activist space is full of (mostly) good hearted humans who are as vulnerable as any normal person to flattery, money, ego etc (the common and preferred pitching point of a service) and weaknesses like crime, blackmail, revenge etc (the lesser preferred pitching point).

On a side note, it's always worth pointing out, especially in Europe, that direct attitribution to a service making a pitch is never so sure. Many countries make pitches pretending to be other (usually local) services. For example the US and Israelis are often aware that Europeans often take personal political stances against their government policies so they will impersonate a local service like AVID. People have spent years not realising what service or country they are really working for.

I am a dutch citizen as well, and thought we were doing quite well. Do you have sources for the TomTom, bluetooth scanners and most importantly phone/internet data being saved?

If this stuff is true, I need to start weighing digital rights a lot more in my politics.

So on a scale of 0 - United Kingdom, where would you say the Dutch are?

I'm a little surprised by this, and skeptical of your claims. The Dutch have one of the strongest advocacies in the world for privacy. This is evidenced by many policies, some seemingly trivial, others not, such as:

1) All ISPs are supposed to delete all logs of customers within 6 months.

2) All websites that deposit a cookie on your machine are required by law to require user consent before doing so (which is why so many American websites become a bit different when browsing them from the Netherlands -- all those popups requesting consent).

While I know the Dutch basically invented the wire tap decades ago, and I have no reason to believe they don't have an advanced spy mechanism in their government, your claims seem to go much further than reason, and feel a bit tabloid to me. You need to provide some concrete evidence about this.

Yeah but that sort of thing is also a hook...once you do it once they begin to own and have greater control over you. Similar to how even when the individual might not want to take anything in return for information, they will want to get the individual to take money or something else in return (free trips to stuff, ego stroking, sex, drugs etc). Especially on a regular basis.

This means the individual has a) compromised themselves and now cannot feel "clean" in this previous environment and b) are starting to get used to/spend the new perk/cash so pretty soon they can't live without it. The power relationship then swings more towards a needs based one. Suddenly the handler(s) are the only people who really know the truth about how the informant truly is. Also the handler(s) are the only people how can meet the new need that the person has got hooked on.

Will you do me a favor and send me €2000 or so first, so I can put a lawyer on retainer and run this by him? :)

My basic understanding of this matter is this: never co-operate with the intelligence community.

Shit on these people and burn their identities whenever you can because they're not your friends. You might even be able to limit the future career opportunities of a younger intelligence officer who's approached you by not only telling your friends, but informing the entire internet.

These people may be a necessary extension of diplomacy, but history shows that it's likely toxic for any individual to be ensnared as an asset in any kind work for this sector of the government, foreign or domestic.

There are enough 'useful idiots' who will fall for this, you don't need to be one of them. Unless you're an actual employee of an intelligence agency or a contractor, these people will fuck you over in a heartbeat.

Anyone unfamiliar with this line of business could do worse than to read any old basic textbook on intelligence and counter-intelligence work (such as 'Thwarting Enemies at Home and Abroad', linked below. There's a good audiobook version on Audible).

Training in this business is based on cultivating anti-social behavior in susceptible individuals. Just as you don't want any garden variety sociopaths in your life, you don't want to deal with people who've been trained to fuck with you.

http://press.georgetown.edu/book/georgetown/thwarting-enemie...

Been working on security for NGOs and activist groups all over the world and in every part of the space for a long time. I think your figure is on the high side and overly alarmist. Perhaps with Pirateparty-style groups it is higher than most but not across the whole sector. It's certainly not the case that two-thirds of all groups and activists have been compromised. People forgot that human intelligence operations are actually pretty cost intensive and fairly difficult to pull off well. Some parts of the community make the problem worse once a genuine compromise is found by then creating biases and accusations where none can be confirmed.

It really depends on many factors - location, group activities, training, personal, the threats they pose to the actors with the will/desire etc to target them, also how you define compromised (a cleaner keeping tabs? a phishing email opened? a disgruntled volunteer? a paid staff member who walks out the door with data? a leader who has been turned?)

It is dishonest and dangerous to claim that NGOs are compromised without providing any proof. I've worked in that space, and it is critically important that aid workers are seen as politically neutral and with pure intentions.

As an example the Taliban was targeting NGOs in the Afghanistan/Pakistan region because they believed efforts to vaccinate against polio were in fact an attempt to poison Muslims. Dozens of doctors, nurses, and volunteers were killed because someone like you decided to start a baseless rumor.

Most first world intelligence agencies have policies against embedding spies in aid operations. When it became common knowledge we used a vaccination campaign to collect on UBL, many people resigned from the Agency.

Running a Tor node doesn't make you an accomplice of a crime. That's like saying a taxi driver is an accomplice because he (unwittingly) drove a terrorist around.

Opening borders then putting everyone including your own citizens who pay you on surveillance isn't patriotic.

There's nothing particularly wrong with them trying to recruit him (though opinions regarding covert internal observation services differ), but they're not just interested in him for his technical prowess. They're asking him to report on people in hacker spaces, hacker conventions, etc; ie. to spy on many of the people that participate in this forum.

There's always been running gags about spooks at hacker conventions, but it's "nice" to have a confirmation (even if it's hard to verify).

> this is about 'protecting' your country, right?

Theoretically, yes. But when you have agents allegedly asking civilians to "crash a system in a public place" while promising they won't "get arrested and nobody will know about it, not even the police," other possibilities emerge.

You may be deployed for political or commercial purposes, domestically or abroad. If you push back, your prior assignments, done while you were a civilian, could be used against you. Consider, too, how easy it is for foreign governments or criminal syndicates to pose as the AIVD and recruit patriotic civilians thusly.

> WWIII will be mostly 'cyber'

We are not at war and he was not being recruited to be a soldier. He was allegedly being asked, as a civilian, to commit crimes, domestically and abroad, under the alleged cover of an intelligence agency.

---

Buro Jansen & Janssen only verified "the existence of this person and confirmed their existence." We should consider this account plausible but unconfirmed.

If it was reported correctly, to me the conversation sounded more like an attempt to subvert Tor nodes and perhaps get access to the Tails developers and repositories or similar projects in the long run. Not that I know anything about this, but it may be better to counter such attempts not in an adversarial manner, but by playing such a dumb idiot and making so stupid jokes that they lose interest in you. Talk them down with irrelevant bullshit. After all, these kind of conversations really are sort of job interviews or attempts to intimidate to coerce cooperation, so any behavior is fine that would definitely spoil a job interview and make you unhirable. (Unless you want to work for them, of course...)

Regarding the threat: well duh, you are doing something that might make you an accomplice of a crime (with whatever law they make) so yeah, they could arrest you then. How is that even surprising?

Running a Tor exit node is probably not a crime in the Netherlands - I haven't checked on this. In any case, if it's a crime, it should maybe worry you that they also promised to protect the guy against police if he works for them. That's at least dubious. If on the other hand running an exit node is not a crime, which seems more likely to me, then the guy was really just threatening and harassing him.

> Isn't this how any country would recruit new people?

> this is about 'protecting' your country, right?

Something like: "If you do illegal things for us we'll protect you from the police. If you don't... be a shame if you get raided for your exit nodes."

This sounds like setting up a criminal organization. Not sure you want that "protection"

seems a bit amateur if you read the official histories of TLA's doing a crash approach like this is not the norm.

Nor is blackmail very good way to recruit

Instead of talking about the hacker community, lets talk about HN community which we are all part of.

How would we all feel if secret service people were recruiting moderators/ycombinator people that wrote paid comments and informed on the content of private conversation between founders and investors?

Personally I would trust the community less. I would expect contributions to have lower quality, be less insightful and more hostile, resulting in a general distrust that in the long runs kills the community from within.

When they threatened the person after he/she said "no", they crossed the line.

Naive or pushing a narrative to people who are naive themselves.

You'd be surpised: https://www.techdirt.com/articles/20151118/08474732854/after...

Maybe, but remember that people used to laugh about the capacities of the FBI (and to some extent the NSA) before the Snowden leaks...

Besides, high level statements like that (that make the main stream media) aren't meant to be factually correct or framed considering all nuances. It's political maneuvering. People don't always mean literally what they say; part of social intelligence is understanding this, and being able to read between the lines. I wish I had learned about this 2 decades ago. I guess us computer types aren't predisposed to have this come natural to us.

Re: brave publishing it like this

I wonder if he could (potentially) be prosecuted for it; the exchange includes "information reasonably assumed confidential."

Artikel 85 Wet op de inlichtingen- en veiligheidsdiensten 2002 http://wetten.overheid.nl/BWBR0013409/2017-01-01#Hoofdstuk7

Having more encrypted traffic definitely makes spying harder.

It's a lot easier to track, store, and attempt to crack one single terrorist's encrypted traffic in a sea of non-encrypted traffic, than try to pick out the terrorist's encrypted traffic in a sea of other encrypted traffic.

If terrorists are the only ones using encryption, then their traffic will stick out like a sore thumb. While if everyone uses encryption, their traffic will simply blend in.

>He's taking a huge risk

I understand how it can be viewed that way and it's certainly a bit of a risk but realistically it's not a huge risk.

If this is AVID, at the end of the day, despite what many may think due to outlying examples, they are an intelligence organisation working in a democracy and their agents aren't normally going to be in the business of retribution for someone turning down a pitch. Plus, if they became known for unnecessary retribution for minor things like someone saying no to a pitch, it would damage their long-term efforts in other areas.

They will expect that probably the majority of the pitches they make will be rejected. It's not something new to them. Similarly they will have risk assessed and planned for the eventuality of it being made public. Yes, it will annoy them but they will still just keep on moving through the social network analysis diagrams until they find and pitch the right people they are looking for.

Plus, while it will make some people more weary in future, occasionally exposure of efforts like this often leads to a softening up of others who might be interested in doing this sort of thing for them in future. Maybe a few months down the line someone in the community gets pissed off with others and remembers this article and drops AVID a mail........

I can imagine the red tape for training, then buying and running a node would be a bigger hassle than the usual MO of bribery.

If your goal is to collect everything like the western intelligence services, infiltrating hackerspaces and the CCC seems like a very efficient use of resources. Especially if they're focusing on Tor and related projects, which they seem to be.

I assume they're interested in acquiring information and techniques from these hacker gatherings, rather than hoping to find a terrorist there. The attendees are probably/hopefully not the target.

I would be more worried if secret services were not trying to acquire assets and keep tabs on potential threats.

If others do it, you have to do it too.

> That they will say that if you hack a system under their responsibility they will shield you

Promises are cheaper than deeds. You don't need to actually protect anyone. It's actually better, from the agency's perspective, if they can convert an asset from an honest law-abiding man to someone who has "crash[ed] a system in a public place". They have leverage over the latter.

This is how criminals work. Given the secrecy involved, you could never be sure you weren't working for one.

Note this interview: http://www.trouw.nl/tr/nl/4324/Nieuws/article/detail/4452683...

Note they did offer him a position to manage young hackers.

I guess the sad part is the threat. Hackers have to decide for themselves if they want to work for the government or not. But is bad if part of recruitment is making threats (and demanding that those threats kept secret).

The duplicate detector is weak to allow good stories get a second chance.

https://news.ycombinator.com/item?id=11273241#11273580

Don't worry, the points don't get you anything.

Many in the Dutch hacker scene would never work for the Dutch government (at least, the more sensitive parts such as intelligence agencies, police, etc.).

So mostly likely he didn't want to work for them anyway and was very unhappy about the implicit threats related to his tor exit-nodes.