Hacker News Reader

Comment by rahkiin | Hacker News Reader

I am really not sure how I feel about this, being dutch myself. Isn't this how any country would recruit new people? I don't see what is so wrong about it. Isn't it logical for secret agencies to monitor possible recruits? Isn't that what other companies do as well, to an extent? (Using linkedIn, buying data from Facebook/Twitter/whoever sells).

I am not really patriotic, but this is about 'protecting' your country, right? And if we will have some WWIII I think it will be mostly 'cyber'.

Regarding the threat: well duh, you are doing something that might make you an accomplice of a crime (with whatever law they make) so yeah, they could arrest you then. How is that even surprising?

But eh, I am not an (ethical) hacker, I just build software...

View on HN

> this is about 'protecting' your country, right?

Theoretically, yes. But when you have agents allegedly asking civilians to "crash a system in a public place" while promising they won't "get arrested and nobody will know about it, not even the police," other possibilities emerge.

You may be deployed for political or commercial purposes, domestically or abroad. If you push back, your prior assignments, done while you were a civilian, could be used against you. Consider, too, how easy it is for foreign governments or criminal syndicates to pose as the AIVD and recruit patriotic civilians thusly.

> WWIII will be mostly 'cyber'

We are not at war and he was not being recruited to be a soldier. He was allegedly being asked, as a civilian, to commit crimes, domestically and abroad, under the alleged cover of an intelligence agency.

---

Buro Jansen & Janssen only verified "the existence of this person and confirmed their existence." We should consider this account plausible but unconfirmed.

There's nothing particularly wrong with them trying to recruit him (though opinions regarding covert internal observation services differ), but they're not just interested in him for his technical prowess. They're asking him to report on people in hacker spaces, hacker conventions, etc; ie. to spy on many of the people that participate in this forum.

There's always been running gags about spooks at hacker conventions, but it's "nice" to have a confirmation (even if it's hard to verify).

>There's always been running gags about spooks at hacker conventions, but it's "nice" to have a confirmation (even if it's hard to verify).

Was the 'meet the feds' panel at DEFCON not enough of a confirmation? I've seen people at academic security conferences wearing name-tags with "National Security Agency" right in the employer field.

Okay. Covert spooks.

Like, admitting to a small lie to get away with a big one?

This reminds me of G. K. Chesterton's The Man Who Was Thursday[1] where a government spy infiltrates an anarchist organization only to find out that the other members are also government spies.

[1] - https://en.wikipedia.org/wiki/The_Man_Who_Was_Thursday

What 'running gags'? I've been to cons in Europe in the late 1990's where people would openly say they were from special departments of the police or intelligence services, and that they were there to recruit, learn about what's going on in the scene and to keep tabs on groups and 'scene' dynamics. This has been common practice and knowledge for 15+ years. I don't even see what's surprising about it.

Who said anything about being surprised? And are you saying there were no running gags about it?

FWIW, I'm assuming they would have asked him to report on fellow hackers without openly saying so. I got that implication from the article, but it doesn't say so and presumably they wouldn't have made that explicit when they approached him.

> Isn't this how any country would recruit new people?

> this is about 'protecting' your country, right?

Something like: "If you do illegal things for us we'll protect you from the police. If you don't... be a shame if you get raided for your exit nodes."

This sounds like setting up a criminal organization. Not sure you want that "protection"

Instead of talking about the hacker community, lets talk about HN community which we are all part of.

How would we all feel if secret service people were recruiting moderators/ycombinator people that wrote paid comments and informed on the content of private conversation between founders and investors?

Personally I would trust the community less. I would expect contributions to have lower quality, be less insightful and more hostile, resulting in a general distrust that in the long runs kills the community from within.

How would you even find out?

The article here is a good example. I would hope some of ycombinator staff would write a similar anonymous article if they were approached.

Anyone can sign up and comment here, and it's a public forum with no private messaging capability, so I don't really see what would be changed by your scenario.

Its about trust. Even on a site where anyone can contribute (like Wikipedia), the community still operate on assumptions of good faith. Wikipedia is also a interesting example in how aggressively the community feel about paid, puppet or other from of dishonest contributions. Without trust the community fall apart.

The only effect it might have to slightly alter the overall bias of the site. Which is not necessarily a bad thing.

HN already has something of a negative bias towards the work of the various security services (that is, the mood is largely pro-Snowden and anti-NSA) - having a better balance of views may well be a positive effect.

Similarly for the pro-capitalist bias here, and what almost amounts to a religious veneration for VCs and the very wealthy. Then again, HN is a bit of a chimera in the topics it covers. So we do have some diversity of interests and opinions.

That's exactly what someone who was paid by an agency to shift the bias of HN might say!~

If it was reported correctly, to me the conversation sounded more like an attempt to subvert Tor nodes and perhaps get access to the Tails developers and repositories or similar projects in the long run. Not that I know anything about this, but it may be better to counter such attempts not in an adversarial manner, but by playing such a dumb idiot and making so stupid jokes that they lose interest in you. Talk them down with irrelevant bullshit. After all, these kind of conversations really are sort of job interviews or attempts to intimidate to coerce cooperation, so any behavior is fine that would definitely spoil a job interview and make you unhirable. (Unless you want to work for them, of course...)

Regarding the threat: well duh, you are doing something that might make you an accomplice of a crime (with whatever law they make) so yeah, they could arrest you then. How is that even surprising?

Running a Tor exit node is probably not a crime in the Netherlands - I haven't checked on this. In any case, if it's a crime, it should maybe worry you that they also promised to protect the guy against police if he works for them. That's at least dubious. If on the other hand running an exit node is not a crime, which seems more likely to me, then the guy was really just threatening and harassing him.

Running a Tor node doesn't make you an accomplice of a crime. That's like saying a taxi driver is an accomplice because he (unwittingly) drove a terrorist around.

What % of taxi fares are made by terrorists?

What % of Tor traffic is for illegal/immoral/subversive activities?

Can you describe what you view as "subversive" activities? Subversive to whom?

Subversive against the current order. I'm talking from a secret services perspective, of course.

Define "subversive." Does politically organizing against Putin count as "subversive"? Does not wanting everything you read online to be tracked and recorded by the NSA/Obama/Trump count as "subversive"? Does not wanting a large fraction of your browsing habits to be added to marketing databases count as "subversive"?

Honestly, I would suggest that more people ought to consider encrypting more of their communications just for day to day use.

More people ought to - but the extent to which everyday people attempt this (even if aware that they might want to) is probably no more extensive than searching via duckduckgo and/or browsing with a private window/incognito mode.

It doing so is much more difficult than these options, then it seems unlikely to happen.

Edit: that said, if there are - in fact - simple ways of achieving this goal I'd like to hear so I can share them.

> Edit: that said, if there are - in fact - simple ways of achieving this goal I'd like to hear so I can share them.

Here are some things which aren't too hard, but which provide a reasonable improvement in security:

1. The easiest thing to do is replace your current SMS application with Signal, and to encourage your less technical friends to do likewise. You can still send regular SMS messages, but if both people have Signal, it will switch to encrypted messages. I've talked a fair number of non-technical, non-paranoid users into doing this and they all seem pretty happy.

2. Tor is surprisingly easy to set up and use these days, it works well, and it uses DuckDuckGo search by default. Again, it won't provide flawless protection against a sufficiently powerful adversary, and it's obvious you're using Tor. But still, launching Tor and using it is pretty easy. And it will definitely keep, for example, web advertising companies or ISPs from building detailed dossiers on your behavior.

Again, if you just want something easy to use and you don't pay attention to the fine print, you're not necessarily going to be well-protected against sophisticated adversaries. But you can improve your security a lot for relatively little effort.

What % of $1 bills are used for illegal/immoral/subversive activities?

What % of $100 bills are used for illegal/immoral/subversive activities?

Conclusion: Anyone handling a $100 bill is a criminal.

We do have standards in place for monitoring the movement of large sums of cash through the system, and those are well accepted... So are you OK with something similar for encrypted traffic?

Only one of those things is a valid activity to be concerned about.

Opening borders then putting everyone including your own citizens who pay you on surveillance isn't patriotic.

The article does not mention surveilling all civilians, only that they look for new recruits which is reasonable. The article also talks about going to other countries and looking for advancements among hackers. Sounds reasonable to do as well. You want to know what others know.

> The article does not mention surveilling all civilians

He is not being recruited as a soldier, but as a civilian. This works by drip feed. To simplify, let's assume the agents are actually from the AIVD (versus a foreign government or criminal syndicate) and that the account is 100% true.

First, he might be asked to recruit. A few months in, he may be asked to "to "crash a system in a public place". Then he will be told to dragnet his Tor exit nodes. If he says no the agents may be unable to continue protecting him from prosecution for crashing that system earlier. He did it as a civilian, after all.

These are people used to total impunity from our rules of law. They will be self-serving and deceptive. You make your own bed by heeding the sirens' calls.

When they threatened the person after he/she said "no", they crossed the line.

seems a bit amateur if you read the official histories of TLA's doing a crash approach like this is not the norm.

Nor is blackmail very good way to recruit

Reply on news.ycombinator.com