Hacker News Reader

Comment by arca_vorago | Hacker News Reader

Which is exactly what we crazy cookoo conspiracy theorists have been warning about. It's the same slipperly slope we already went through in the 90's crypto wars, but SV gets amnesia when it gets lots of stupid company valuations and forgets all those lessons apparently.

Bottom line is this. If you put backdoors in, or exploit 0days for your own, they will get out in the wild eventually, and suddenly you have massively weakened infrastructure, corporate, and government security... basically all the things important to national security in general. So while I don't disagree that triple letters need some cool tools to get shit done, I think this function needs some technocratic oversight specifically for this issue.

It's time for a new Church committee.

View on HN

> If you put backdoors in, or exploit 0days for your own

This seems like a disingenuous statement. I believe many reasonable folks would agree that inserting backdoors is an awful idea.

However, there is no evidence at all which indicates the exploits leaked by Shadow Brokers are intentional backdoors. Mentioning backdoors dilutes the discussion as it makes it seem like there is any sort of relationship with 0-day exploits (Which are the issue at hand).

0-days are going to be in code regardless of who finds them. It would be great to get some clarification on this from the government, but I would be pretty OK if the process looked anything like this:

1. Discover 0-day exploit relevant to mission.

2. Build modular tools to utilize the 0-day.

3. Create detection signatures for the exploit to run against Upstream collected internet communications.

4. If another party is seen using the same 0-day (doesn't matter if it was via leak or independent discovery), have a cutout such as FBI or DHS contact vendor with details to get it patched ASAP.

That's the exact process I'd like to see, but what really happens is more like:

1. Discover 0-day exploits relevant to mission

2. Build modular tools to utilize the 0-day

3. Do nothing

4. Lose control of 0days, or allow other actors to discover them.

It seems like the NSA is trying to avoid perceptions that they're scanning domestic internet traffic, but that leaves us in the vulnerable position of hacking everyone while leaving our own doors wide open.

"It seems like the NSA is trying to avoid perceptions that they're scanning domestic internet traffic, but that leaves us in the vulnerable position of hacking everyone while leaving our own doors wide open"

I'm curious as to what your response would be to solve this. If it's to scan domestically, then that's a 180 from every other argument point people make against the NSA and domestic operations. That said, they do spend a regular amount of time working with private companies to remedy and solve breaches by nation- state & similar actors. For an example lookup the aurora investigation.

Many of those exploits will be used to knock through a backdoor. I wonder if they use different keys for each one? Fingers crossed they do.

>3. Create detection signatures for the exploit to run against Upstream collected internet communications.

Yes, it's a good thing that very illegal cyberattacks are never done over encrypted channels. To catch the once-in-a-blue-moon hacker who has their bots log in to the mothership with ssh or something, we could just go ahead and let the government write ring-0 antivirus for us.

I think you understand that my comment was phrased generically so that the logic applies to multiple scenarios (not just this one).

The only signatures that could ever appear in the open would be from, very specifically, attacks on encryption implementations during startup (heartbleed attacked keepalive for example, so no help there). The attack surface of the application itself will always lie entirely behind the no-visiblity line.

> there is no evidence at all which indicates the exploits leaked by Shadow Brokers are intentional backdoors

And this seems a little disingenuous. Perhaps there is no evidence so far regarding these particular leaks from Shadow Brokers, but in general the NSA has a history of creating backdoors.

You and I discussed some of this a bit already in one of the older NSA threads:

https://en.wikipedia.org/wiki/Bullrun_(decryption_program)

https://en.wikipedia.org/wiki/Dual_EC_DRBG

The idea of "key escrow", used by the NSA in the Clipper Chip's Skipjack algorithm, is really a euphemism for a built-in cryptographic backdoor.

https://en.wikipedia.org/wiki/Clipper_chip

https://en.wikipedia.org/wiki/Key_escrow

https://en.wikipedia.org/wiki/Skipjack_(cipher)

I definitely do not deny any previous instances. I am very against backdoors and will never defend them. But it is an extreme accusation to make against Microsoft in this case without evidence, so the fact that there is no evidence should be stated clearly to ensure people do not get confused.

Perhaps there is no evidence so far regarding these particular leaks from Shadow Brokers

And right there, GP is correct. Either there is evidence to suggest that these were planted backdoors (difficulty: patched out long before the leaks), or there is not.

I think a more reasonable approach would be to have a hard time limit on each discovered exploit. Something like 180 days to use it for any missions, after which they must report the exploit and get it patched. This shortens the window for any leaks or independent discovery while still allowing it to be used for important intelligence gathering activities. In turn this will create a pressure to keep finding more exploits as old ones expire, and that in turn will mean more get fixed 180 days later, etc.

I love comments like this, because they acknowledge that there are two valuable things here: (a) collecting sigint via available means & (b) keeping infrastructure secure.

The best solution enables both of these to the maximal extent possible (and has honest discussions about their relative values).

Would it be crazy to say sitting on exploits is effectively "inserting a backdoor"? Maybe it doesn't have a doormat but it certainly still grants you access. To me this would seem against the mission statement of protecting national security when a whole list of them are published, like now...

EDIT: I would agree that without intent to gain access, it's not inserting a backdoor.

>Would it be crazy to say sitting on exploits is effectively "inserting a backdoor"

That seems intentionally dishonest, no? If I disagree with a position I'm not justified in intentionally misrepresenting it because I feel morally correct. Unless you're alleging that these vulnerabilities were intentionally placed there, I don't understand why you'd feel the need to say that. Worrying about the effects of stockpiling vulnerabilities seems like a defensible position in and of itself.

its a 0day. a bug not intentional. the effect is the same but can and ussually does get fixed(whether timely or not is another thing).

Hard to say, that is much more of moral argument rather than one you could argue much based on fact.

Part of the NSA's job is signals intelligence, so they specifically find the vulnerabilities as a means of access. And if that were not the case, they would not have spent the time finding the vulnerabilities, so those 0-days would still exist and be potential attack vectors regardless.

A unreported zero day is a de facto backdoor. The chain you mentioned has similar flaws as the current strategy. Step 3 would be incredibly difficult. It would be similar to detecting a virus signature, which are easily circumvented. The second party can use trivial techniques to change the signature in a way that makes it incredibly difficult to detect.

Many 0-days are built of of multiple bugs. A triple letter may use bug #1 and bug #2 to get a result, but another party will use bug #1 and bug #3 to get a similar result. Back to square one with corporate/government/personal equipment getting hacked reducing overall security.

> A unreported zero day is a de facto backdoor

Traditionally the meaning of “backdoor” has involved intent as well as access. Unlike a basic bug, the system is working as designed but the designer wasn't trustworthy.

> A unreported zero day is a de facto backdoor.

This is not true. A backdoor indicates that Microsoft is aware of it (and/or colluded to put it in), but there is no evidence of that. I respect your disagreement with my thoughts on how they should handle 0-days, but re-defining "backdoor" does not seem helpful.

We can debate the meaning of words, but the goal of a backdoor from the perspective of the government is to gain access to a system. The effect of a backdoor is accomplished through a literal backdoor or a figurative backdoor by hoarding exploits, which both are a detriment of security.

By de facto, I was implying that they both accomplish the same things with almost the same list of pros and cons.

When I worked on jailbreaking tools for iOS devices, we routinely held onto multiple 0-days, waiting for a major iOS release to ensure compatibility.

While I know there may be reasons to disagree with that practice, I think it would be a major stretch to say that it meant iOS suddenly had a backdoor.

I agree that it is not a true backdoor, but I am simply pointing out that the goal is accomplished by hoarding 0-days or creating an actual backdoor.

The 0-day you were not reporting gave you escalated access to iOS devices. If Apple had given you a backdoor, you would have had the exact same access to the device.

Not saying its the same thing, which is why I used "de facto". The government just wants the access. Regardless the hole is intentional or unintentional, if a hole exists, then overall security is weakened

The antidote seems to be for the NSA to maintain a security report for each discovered zero day. If it ever leaks, they can send the target company the report, which explains both what the exploit is and how to fix it.

That seems fair enough. The NSA needs to exploit flaws, but they can be a bit less evil about it by being ready to fix them if necessary.

That doesn't solve the fact that NSA's competitors could find and exploit the same flaws, or that sometimes it's hard to tell whether any leaks have happened, but it's an improvement.

At the end of it, it's hard to seriously argue that the NSA should stop exploiting computers. It's their role. We need them, just like we need a military. But we can think of ways to reduce the impact without getting in the way of their job.

If the 0 day is in an open source project this seems doable but I don't know if the NSA has access to the Microsoft or Cisco source code.

They very likely do have access to the Windows source code. Microsoft does share that with certain governments & educational institutions. I think the Chinese government also has access, FWIW, but it's been a long time since I looked into this.

I got personal access to the Windows source along with many others via the MS MVP program.

And it's unlikely that even if MS was secretive that the USG cannot get multiple people working at MS with access.

True, but blackbox pentesting is pretty common. If a company is informed of a flaw in their XYZ service with details of how the flaw operates, it would probably be enough.

MS has a code sharing program. Large government contracts almost always have a code transfer clause in them if nothing else than if the company goes bust or no longer wants to support the product.

> If it ever leaks

We have evidence that the NSA has no idea from where or through whom it's leaking. My impulse is to say "you get so many years to use an exploit, maybe more with higher-up approval, and then you must disclose it." Unfortunately, with virtually zero independent oversight of these agencies, I have no faith such rules would be followed.

We have evidence that the NSA has no idea from where or through whom it's leaking.

The general consensus seems to be that Russia was the source of the leaks. The US government knows this, and everyone involved knows who is leaking what, and why. If so, then this is a political move. Is there evidence to contradict this?

https://www.nytimes.com/2016/08/17/us/shadow-brokers-leak-ra...

The current enemy is always the source of the leaks. A few months back it was china. The political move is just the finger pointing.

Who cares what nation state actor alledgedly moved the exploits from an NSA employee to WikiLeaks? Why would the medium matter in the least, in the case of hoarding 0days?

I agree with this and want to further add to it.

Firstly by saying: isn't it interesting that, if it is Russia who moved the exploits from the NSA employee / contractor to WikiLeaks then they (the Russians) have acted in the service of the global public.

But let's not get distracted.

The source of all NSA leaks is never some rogue employee, or contractor. It's never "The Russians"™ or "The Chinese"™.

The source of NSA leaks is the goddamn NSA.

We probably need the NSA. It's their job to exploit computers the same way it's the job of the military to apply force. It's difficult to say that we can do without the NSA any more than we can do without a military.

In that light, the context is to reduce the impact of the NSA's necessary goals.

Higher up in the thread, it was claimed that one of the most feared branches of the intelligence arm of the most powerful government in the world was so incompetent that they had no idea who was behind these leaks, and that there was evidence to support this assertion. I have an open mind, so I was hoping to see this evidence.

> It's their job to exploit computers the same way it's the job of the military to apply force.

That's one half of their job, the other half is to secure government infrastructure from exactly the type of attacks they use on other countries.

The problem there is that it sets up an incredible tension since how do you get the message out about a 0-day in windows to protect your 'own' side without your opponents getting the same message.

I've thought for years that the NSA doing both jobs is silly since one side will inevitably win that argument (as seems to be the case).

It needs to be a separate agency concerned purely with securing government and infrastructure from external threats with a decent firewall between the two sides (and possibly an oversight clearing committee to keep an eye on what both sides are up to).

Over here in the UK we have largely the same problem with GCHQ having a dual mandate.

> how do you get the message out about a 0-day in windows

American companies get disclosures, foreign companies do not.

What's an 'American' company these days?

US companies like Oracle, MS, Google, etc. have offices all over the world.

They also tend to use various visas to import 10% of their own US based staff (probably a much higher ratio of engineers) from foreign nations.

The US has gotten very wealthy from offshoring, foreign talent, and technical exports, but it causes a massive problem when keeping secrets locally.

> how do you get the message out about a 0-day in windows

Force-push a Windows 10 update? That seems like one of the few legitimate usecases of Win10 being a corporate botnet.

I think the obvious answer here is to go full open-source on the infrastructure. if they can afford to pay engineers to craft exploits, the can afford to pay engineers to fix them.

Its impossible now. Wikileaks showed the the cia goes into incredible detail to frame other countries.

https://www.wired.com/2017/03/wikileaks-cia-dump-gives-russi... http://thehackernews.com/2017/03/cia-marble-framework.html

I also bet that other countries do the exact same thing, probably even more likely considering the "marble project" source code is leaked.

http://www.dailymail.co.uk/news/article-4427452/CIA-launches... Also it looks like a hunt for the internal leaker has begun.

Whatever the source, We do still have to deal with the content of the leaks.

The content is what we need to take a very close look at begin to increase and harden our security. Especially senior developers and software architects.

>Wikileaks showed the the cia goes into incredible detail to frame other countries.

No.

Wikileaks has not shown this, although it seems to be the narrative which some wanted to push regarding the Marble leak.

> We do still have to deal with the content of the leaks.

Check out the actual content of the Marble leak. You will find that there is no evidence of your claim. It has been mentioned countless times that the foreign languages seen in the code are gibberish when translated, and are evidently there for testing purposes.

Well, that means that if they decided not to leak them they would still be known to others. So that's an excellent argument for disclosing to vendors anything that you do find if you're serious about this whole national security thing.

What it shows instead is that the NSA and other agencies could not care less about national security as long as they get to hack interesting targets elsewhere.

The article you linked only has a single citation for the Russian attribution, which is a Snowden quote: “circumstantial evidence and conventional wisdom indicates Russian responsibility”

Is there any evidence other than Snowden's speculation?

We aren't at war with a country, we don't need spy agencies.

Disband the CIA, NSA and their 3 letter brothers. Fold personal and funding into the FBI. This doesn't make me a fan of the FBI, but at least there is some transparency. IMO

> The NSA needs to exploit flaws

In the current doctrine, it apparently does.

    > If it ever leaks, they can send the target
    > company the report.

Any usage of the exploit by the NSA constitutes leaking it.

You can't treat cyberweapons like normal weapons.

The analogy is not that you come up with a secret bomb design and drop it on the target, but that to use your bomb you must send the full Top Secret designs for the bomb to every target, hoping that they voluntarily use it to blow themselves up instead of writing the design down & using it against you.

Sort of. For example, the NSA developed a way to hotpatch an ethernet adapter's firmware to respond to incoming packets that operate out of band with normal IP packets. Meaning it's a way to communicate with a target computer that's completely undetectable by standard tools. Using such an exploit against a computer isn't typically a risk, because the target you're exploiting isn't sophisticated enough to catch the exploit. And even if they were, and they send their computer to a foreign intelligence agency for extensive analysis, that typically wouldn't confer an advantage to that agency. They were already developing their own exploits to use against us, and there are only so many unique techniques.

The way to protect against this is probably to have constant security audits. But these are expensive, so the situation is that there will always be exploitable computers and software, especially when a nation-state adversary is doing the exploitation.

The solution is what it's always been: Political control. We have terrifying weapons, and what keeps them at bay is aligning the incentives of our politicians so that the calculus of employing them is more costly than keeping them unused. (Unfortunately this may not be possible with cyberweapons, because unlike real weapons, there is no death and destruction as a side effect.)

Would it be possible to scan for infected systems if you know the 0-day?

If I recall correctly from some of the Snowden docs, they do have their passive internet taps watch for exploit signatures of foreign adversaries. I don't see why they would not do the same with their own.

> it's hard to seriously argue that the NSA should stop exploiting computers. It's their role. We need them, just like we need a military.

Would you say the same of Chinese government hackers and Syran military? If yes, OK. I understand you accept the need for competition in arms. If not, can you explain why?

Exactly, if the US army starts raping ISIS females later it can't pretend its barbaric for other armies to do the same, incl. american females in the army.

Doing the least morally right thing always brings more problems than its worth, and that's exactly what NSA does every time it pokes holes into everyone's software.

> Would you say the same of Chinese government hackers and Syran military?

No, for the same reason why I'm okay with the US military having nukes but wouldn't be okay with Syria having them.

Obviously it'd be great if we could get by with no military powers having to possess zero-day exploits (or nukes), but so long as we can't be sure no other nations are benefiting from such exploits, it makes no sense strategically to forbid our own governments from doing the same.

So it equally makes no sense for China to forbid itself from using their own exploits? As long as they can't be sure America isn't benefiting from them, they'd better keep up with the arms race.

Or do you consider America to be special and that it deserves these powers more than other countries? Personally I don't think it's competent to hold them because it has an ongoing history of using its weapons to destroy other countries, property and lives. If I had to choose who wins the arms race, I would prefer a less hostile country like China or Germany to have them instead of America. But really, why not nobody? Exploits are offensive weapons, not defensive ones.

> So it equally makes no sense for China to forbid itself from using their own exploits? As long as they can't be sure America isn't benefiting from them, they'd better keep up with the arms race.

Correct. Same goes for any nation. Since there's no way to be sure that other nations aren't developing zero-day exploits, not developing exploits of your own does nothing more than put you at a disadvantage.

> Or do you consider America to be special and that it deserves these powers more than other countries?

Yes. I know this seems to be a rather unpopular opinion with the HN crowd these days, but the US absolutely deserves to have better military capabilities than nations like Syria or China. (As for Germany, I'd also be mostly okay with them possessing exploits; as they're a democratic nation who I generally trust to act in the best interests of their citizens. I cannot say the same for Syria or China.)

> But really, why not nobody? Exploits are offensive weapons, not defensive ones.

That'd be great, but unfortunately it's not a realistic option. So long as one nation possesses and benefits from zero-day exploits (even secretly) then it makes no strategic sense for any other nation to intentionally put themselves at a disadvantage by not developing exploits of their own.

Yes and no.

I'm not OK with the Chinese having slingshots and spears, never mind ICBMs and nuclear warheads. That doesn't stop them, and I'm not offended or shocked that they would be armed.

Regarding cyberwar, I prefer that the Chinese not know how to program computers or even find the "on" switch. I'm not offended or shocked that they manage this and much more.

The same goes for Syria.

> If it ever leaks

You mean, if they become aware of it leaking. Exploits can leak and be utilized without anyone being aware of it, for years. It's not like you see a mushroom cloud on the horizon and your earthquake detectors wobble.

> The NSA needs to exploit flaws

there are plenty legal wiretapping/surveillance alternatives that don't rely on not fixing a compromised worldwide infrastructure.

>Which is exactly what we crazy cookoo conspiracy theorists have been warning about.

Which is what exactly? That a spy agency is spying?

>If you put backdoors in, or exploit 0days for your own, they will get out in the wild eventually, and suddenly you have massively weakened infrastructure, corporate, and government security

I don't agree with putting in backdoors, but I don't see how exploiting backdoors by your security agency is so nefarious. That is literally why they were created to do, and this is what every other foreign security agency is doing as well.

>So while I don't disagree that triple letters need some cool tools to get shit done

Sounds like you do.

>I think this function needs some technocratic oversight specifically for this issue.

How about congressional, judicial and executive oversight? Because that's what we have now.

The NSA leverages these exploits to spy on foreign nations. That's fine, spies should spy...

But it does beg the question: who's protecting our information from foreign intrusions?

Isn't that partly the mission statement of the NSA and CIA and FBI?

The CIA and NSA are externally oriented.

Defense is arguably part of the FBI mission, however they don't have the NSA's level of skill or resources. The FBI might be able to detect abuse when it gets rampant but I have zero confidence that they would discover any of these exploits themselves. The FBI is mostly cleanup and criminal prosecution.

We need an organization focused on preemptively securing our infrastructure.

The NSA is actually tasked with that mission:

> NSA is concurrently charged with protection of U.S. government communications and information systems against penetration and network warfare.

https://en.wikipedia.org/wiki/National_Security_Agency

Yes, government defense. Who protects the rest?

Private entities protect themselves and their customers, to varying degrees, which is how it has always been.

That actually overlaps with things like the power grid and ATC, for what it's worth. It's a little bigger than just "government computers".

Before this runs the risk of becoming a universally acknowledged truth, is it fine? Actually wasn't "Gentlemen don't open each other mail", also a perfectly reasonable position? In the cyberwar the US already seems to be fighting against its own weapons! Would it actually be much better for a nation like the US to use its knowledge defensively and keep their citizens safe from foreign interference?

I also strongly advocate for information disclosure and collaborating with vendors.

However, I'm not convinced the NSA is the entity for that role. Organizationally, the NSA makes more sense as an R&D entity that discloses to offensive intelligence agencies and defensive security forces.

> Which is what exactly? That a spy agency is spying?

To spell it out: backdoors are of course a helpful tool for a security agency, but once the key for the backdoors falls into the wrong hands the potential for misuse is monstrous because, well, the backdoors are in all kinds of potentially critical systems systems, e.g. even in the cellphones of high ranking officials (or in cellphones of their families) etc.

To get the same intel by different means than a backdoor is of course much more expensive. So one needs to find the sweet spot, where the utility as a function of cost and security is maximized. That sweet spot likely does not involve backdoors.

> literally why they were created to do

The NSA is supposed to do both defense and offense. The defense came up, for example, when they improved DES to resist differential cryptanalysis (which the public crypto world hadn't discovered yet) before DES was standardized.

But that was a long time ago; at least since 9/11 the offense side seems to have pretty much eaten the defense, as far as we can tell. (See: https://en.wikipedia.org/wiki/Dual_EC_DRBG) I believe this newer strategy is badly misplaced from the standpoint of the security of the American people (and good for the power of security-state insiders).

If the IA department in the NSA were smart enough to figure out every vulnerability that the SIGINT department discovered and got everything fixed, SIGINT would be impotent. Clearly, things like SELinux make SIGINT's job harder, but your suggestion that SIGINT should handicap itself is ludicrous on its face.

Consider a few salient states: the U.S., Iran, Russia, ... If computers worldwide are mostly secure, which see the greatest benefit? If they're a festering pile of vulnerabilities, which see the greatest cost? That's the choice, as U.S. policy, of where you can focus your efforts. It's not a choice of secure U.S. computers and insecure Russian ones.

The way you're framing it presumes SIGINT is in charge and positively welcomes insecure U.S. computers. I'm saying that's bad for us. I've seen others saying the same.

Also, secure computers would not make spying go away, and SIGINT would not be impotent. Its powers are still increasing with, e.g., surveillance of whole populations from the air with high-res video cameras. Comms spying would go back to retail instead of wholesale data collection.

> The way you're framing it presumes SIGINT is in charge.

You fundamentally misunderstood my post, whiis causing you to reach strange conclusions. Neither is "in charge." They are two separate entities with separate missions. Some of the systems developed and documented by IA make the job of SIGINT difficult if our adversaries implement them as well.

How would spying from the air have prevented Iran from developing it's nuclear program?

Well, I said the spying mission of NSA should not override the security of the U.S., and pointed to the contrast between the old sometimes-improvement of crypto standards and the new backdooring of them. You answered that my "suggestion that SIGINT should handicap itself is ludicrous on its face." I don't care if the NSA's SIGINT department does not value our information security; we, the citizens, do. Their narrow departmental interest goes against our interest. The NSA as a whole used to better approximate that interest, back sometime in the 20th century, even if very imperfectly (see Bamford's history). This conversation was missing this point about the NSA's broader mission.

Iran with nukes seems to me a lesser threat to us than an uncontrolled U.S. government.

> The NSA as a whole used to better approximate that interest, back sometime in the 20th century, even if very imperfectly (see Bamford's history).

There is no evidence that anything has changed.

> Iran with nukes seems to me a lesser threat to us than an uncontrolled U.S. government.

Who is suggesting that the government should be uncontrolled? Iran with nukes is a far greater threat than the NSA with 0-days, which is what we're discussing.

>Which is what exactly?

The fact that the three letters are continuously failing to understand the long term blowback potential of the programs they start, regardless of initial merit. In this case, instead of spending nearly as much time doing hardening documents, they were busy comprimising everything. The name of almost all of our fuckups in this arena is blowback.

>I don't see how exploiting backdoors by your security agency is so nefarious

When they use them for lawful purposes, such of foreign sigint, ok. With that kind of power though, at a bare minimum I would be concerned about abuses of that power domestically. At a minimum. I could wax on about all the reasons it could be bad for a long time.

>How about congressional, judicial and executive oversight? Because that's what we have now.

That's exactly what I said was needed. A technocratic oversight committe could exist in all branches on this subject. Also, we really don't have good oversight in place. Think about the kind of effects this has on potential oversight bodies...

For example, the chairman on the senate intel committee is about to vote for more oversight of $secretprogram. It's imperative to national security that this program not receive scrutiny, so it's allowed to use these 0days against them, find or plant blackmail material, and exploit that to get the chairman of oversight to not do it.

This is the kind of shit I was talking about having been warning people about. It's not just about the surveillance. Surveillance is always about control, not security, security is just the bullshit they sell the public to not induce outcry.

>For example, the chairman on the senate intel committee is about to vote for more oversight of $secretprogram.

People's memories are way too short with this kind of stuff because something like this already happened: The CIA hacked the computers of the senate oversight committee responsible for investigating the CIAs record of torture.

https://www.theguardian.com/world/2014/jul/31/cia-admits-spy...

That's just the time they got caught. We can be sure they do this constantly.

> I don't see how exploiting backdoors by your security agency is so nefarious.

Did you ever hear the tragedy of Stuxnet the wise?

Stuxnet was a cyberweapon so powerful and so well hidden it could use computers to cause nuclear centrifuges to fail.

Unfortunately, others learned from code the worm left behind, then other actors used the same techniques to infiltrate computers everywhere for a year. Ironic. It could save the world from nuclear weapons, but not computers.

You haven't been a crazy cookoo conspiracy theorists since the Snowden dropped his info. Unless you've got conspiracies on other topics, then maybe.

I think it's fairly common for even someone with a cursory knowledge of security to know that backdoors are a bad idea.

The triple letters don't get their power from poor products. Those are going to be around no matter what. I'd rather this just drive a push toward more open source products throughout the network stack. The triple letters get their power, not from poor products, but because of existing oversight of the agencies has been lax in the name of fightin' terror.

When it is legal for gobs of data to be vacuumed up without any court order then they will have power, no matter how much poor software is in the wild.

It was before Snowden. We have had hard facts since the 90's that mass wiretapping and exploitation has been going on thru vehicles like AT&T and Verizon.

And we knew about PRISM for a good two years before its public disclosure. Sudden black square over a remote area in Utah in satellite imagery. Pictures of a massive contruct. Coupled with the fact that we knew they needed a place to centralize all of this collected information, it was plainly public how the NSA was operating. No one just wanted to frigging listen until they had a celebrity icon like Snowden to interest them, because we operate on a system of identity politics.

> It was before Snowden.

I wasn't saying that's when it started. I was saying that's when people stopped viewing "government is listening to everyone" as conspiracy.

> No one just wanted to frigging listen until they had a celebrity icon like Snowden to interest them...

It didn't have anything to do with Snowden's "celebrity". Do you think he was a celebrity before he produced physical evidence? Turns out, no one wanted to friggin listen, until someone had proof.

"when people stopped viewing "government is listening to everyone" as conspiracy."

The entire point is that the public isn't listening to the dangers presented beforehand. Yes, now people dont think you're crazy for thinking we are surveilled heavily, but now the equivalent is when I tell people why they put the surveillance in place at all. Typical responses include "but they're just doing it for national security".

If 1/3 of the public only knew half the shit the gov was up to there would be a revolt tomorrow morning. It's deeper and darker than just massive surveillance. My only question for years has been if the public will wake up enough to realize it. With the failing education and financial systems and the propaganda levels turned up to 11, I'm beginning to doubt it.

You're missing the point.

Someone already had proof.

Snowden was the one who managed to bring it to a mass audience. And I love him and respect him immensely for that. But I'm sure he also feels the same disdain that it took him completely destroying his life to convince people that something nefarious has been going on when many clues were already public and just routinely dismissed by people like the other guy arguing with me right now.

Yeah, he gave lots of evidence on programs we didn't even know existed. Like, the full extent of this situation. But we already had enough information to know that we should demand legislation and oversight and that 1984 has all but come true.

I don't think anyone worth a damn as far as this subject is concerned would have labeled you a conspiracy theorist. Anyone with an even passing knowledge of security assumed something of this nature was going on. It just logically follows, given the explosion of computers in every aspect of life, that the NSA would be doing this.

Side note, what black image in a remote area of Utah? If you're talking about the Bluffdale data center, it's been visible on Google maps this entire time IIRC. You can even see historical images of it being built in Google Earth:

https://www.google.com/maps/@40.43085,-111.9278303,2900m/dat...

https://en.wikipedia.org/wiki/Utah_Data_Center

I distinctly remember a point when it was not visible. That is how I discovered the plans to build a complex there years ago. This was probably remedied not long after we started catching wind.

I'm sure it would not be difficult for Google, et al. to retroactively "fix" their public imagery data.

I wouldn't rule it out, but I'm left scratching my head as to the motivation why. I remember reading about said data center years ago, before they even broke ground. The location was known at that time, too. If the physical location was of such importance to censor it from satellite images, why then retroactively add those images back in?

Heh, I'm wondering if my memory has muddied a bit and I actually just saw the foundation being laid down, though I'm pretty sure it was black for a while. Either way seeing that sparked my interest and led to me finding out about plans to build a data center, which were largely conjecture and rumor at the time. At that point we really were all a bunch of conspiracy theorists without any hard evidence.

There is no evidence of mass wiretapping from AT&T or Verizon even after Snowden. The rest of your post shows you still don't have any idea what PRISM is even after Snowden and the government disclosed it.

I'm well aware of PRISM :-)

You misunderstand me. PRISM is the program, but it needed an HQ! Here is that HQ:

https://en.wikipedia.org/wiki/Utah_Data_Center

Here is one such example of such a wiretapping program under AT&T:

https://en.wikipedia.org/wiki/Room_641A

And there are many more. It just depends on what you call "evidence". Is it your own definition, or are you relying on others to tell you what is and isn't legitimate?

It's quite ironic that you are telling me I don't know what PRISM is when I knew about it long before it reached public, and presumably your own, attention.

You very clearly don't know what PRISM is. According to Snowden's documents, PRISM is the program that brings the FBI's FISA electronic communication wiretaps into the NSA's databases. It has absolutely nothing to do with Room 641A, which also doesn't do what you think it does.

I didn't say it had to do with Room 641A. That was a separate and distinct reply to your allegations over no proof of wiretapping.

Look at the very first sentence:

https://en.wikipedia.org/wiki/PRISM_(surveillance_program)

> PRISM is a secret code name for a program under which the United States National Security Agency (NSA) collects internet communications from at least nine major US internet companies

And here:

> Documents indicate that PRISM is "the number one source of raw intelligence used for NSA analytic reports", and it accounts for 91% of the NSA's internet traffic acquired under FISA section 702 authority." The leaked information came to light one day after the revelation that the FISA Court had been ordering a subsidiary of telecommunications company Verizon Communications to turn over to the NSA logs tracking all of its customers' telephone calls

You're talking out of your ass. Clearly. You can't even do basic research on the most public open knowledge base on the internet.

Just saying there is no evidence of mass wiretapping of AT&T's infra makes you look ignorant as hell.

Next you're going to tell me this is just a fraternity club:

https://vimeo.com/193562415

https://theintercept.com/2016/11/16/the-nsas-spy-hub-in-new-...

Look at Snowden's actual documents. It shows the data is actually collected by the FBI's Data Intercept Technology Unit (https://i.imgur.com/setOJIm.jpg), which is the organization within the FBI that handles electronic wiretaps . The FBI requests data for specific accounts from these companies using FISA warrants and NSLs, but only the data requested via FISA (i.e., for foreigners) are allowed into the NSA's systems.

Room 641A isn't a mass wiretapping system. Once again, see the documents from Snowden. It looks for communications from specific Internet endpoints that are being wiretapped under court order.

I never denied the FBI's role in this?

I never said Room 641A was a mass wiretapping system? Just that it was one example of many such wiretapping initiatives?

I also provided citations showing that this is more than just targeting specific accounts?

You're starting to sound like a shill, that won't do any good if you're trying to convince people of your narrative.

The point is that neither is an example of mass wiretapping, as Snowden's documents showed. What exactly do you think is targeting more than just specific accounts? Be specific.

If we take the upper bounds from the transparency reports from the Internet companies, we can estimate that the volume of data from PRISM is so small that you could fit it on a single rack, and the Utah datacenter has nothing to do with it.

You'll find that I'm a shill on the JFK assassination, chemtrails, mind control rays, and every other conspiracy theory that lacks evidence and has substantial evidence to the contrary.

>> Documents indicate that PRISM is "the number one source of raw intelligence used for NSA analytic reports"

PRISM isn't just some negligible thing to be brushed off. And of course it isn't the only thing they're doing over in Utah. It's one of many sources that all come together at places like this for data analysis. But it's the "big deal" everyone is talking about so it is very relevant to the discussion.

Remember, if there is one there is more. We don't need a comprehensive list of every data center and chokepoint that is under surveillance to understand how prevalent it is based on known data.

Example of mass surveillance:

https://en.wikipedia.org/wiki/ECHELON#Confirmation_of_ECHELO...

Example of mass surveillance:

https://en.wikipedia.org/wiki/DISHFIRE#Scope_of_surveillance

Example of mass surveillance:

https://en.wikipedia.org/wiki/MYSTIC_(surveillance_program)#...

Do I need to give you more or can you take it from here? Do you need more proof than the wiretapping of half a dozen countries' ENTIRE phone calls?

Please do not chalk this up to "conspiracy theory". That is damaging and misleading. You are attempting to group this together with more fringe theories in order to discredit it. Logical fallacy. If you want to continue this discussion I ask that you play fairly and not revert to rhetoric and distraction.

> Documents indicate that PRISM is "the number one source of raw intelligence used for NSA analytic reports"

That's because it contains wiretapping data of specific highly valuable targets. Nowhere in this sentence does it say that it contains mass surveillance because Snowden's documents and the government have shown it does not.

I never said that the NSA doesn't engage in mass surveillance, only that it doesn't do mass wiretapping through Verizon and AT&T or through the Internet companies, as you wrongly believed PRISM did. The reason that distinction matters is that the NSA absolutely should gobble up all communications in a war zone or other foreign area threatening national security. That's what it's there for. Gobbling up and processing domestic communications as your claimed mass wiretapping on Verizon or Google would do is outside the scope of the intelligence agencies, and there remains no evidence that they do that despite multiple leaks. Any claim otherwise is conspiracy theory by definition.

I never said PRISM was the same program that engaged in mass surveillance.

I also never mentioned Google. Your arguments keep starting off by strawmanning my own.

But sure let's talk about Google. You really think Schmidt and friends are clean on this? He is a globalist authoritarian lap dog.

https://wikileaks.org/google-is-not-what-it-seems/

And you're also fundamentally confused about something. See, the NSA does not need direct access to all of this data. They allow/encourage/force various companies to comply with certain data collection and retention practices, and tap into this data when necessary. Why? So that people like you can claim they are not directly surveying their citizens.

All of the data still exists, and is accessed when needed.

It's like if my friend spied on you and reported back to me whenever I asked, but then I come out and say, "Hey mister, I'm not spying on you. I only ask my friend about things necessary to my investigation. If you're being a good dog then this shouldn't even bother you."

> I never said PRISM was the same program that engaged in mass surveillance.

You started off by saying you knew about PRISM because the NSA is building a large datacenter in Utah just to hold PRISM's data.

> I also never mentioned Google.

I never claimed you did. You claimed that PRISM ingested mass wiretapping data. That data would come from Google and other Internet companies according to the documents. My point was that your belief that it is illegally gobbling up all the communications done on Google's and other Internet companies' communications products is baseless.

I'm going to ignore your warping of my words and focus on the interesting bit here: again, Google.

You don't remember when news broke in 2014 that the NSA was snooping on Google's Gmail traffic that was flying around unencrypted within their own network? Google, rightfully embarrassed, subsequently enabled internal end-to-end encryption after the news broke.

Here it is straight from the horse's mouth: https://gmail.googleblog.com/2014/03/staying-at-forefront-of...

So... yeah. Not baseless at all. Meanwhile you have yet to provide a single citation throughout all of this.

I cited Snowden's own documents.

According to Snowden's documents, the NSA used email envelope metadata where at least one side was a foreigner to build a connection graph, similar to pen register metadata collection. It didn't look at the contents, which it would have to do in order to be wiretapping. That program (STELLARWIND, which operated behind the Internet companies' backs, not PRISM, which operated via court orders on specific accounts) ended before Snowden even leaked it. https://www.theguardian.com/world/interactive/2013/jun/27/ns...

Let's recap. You claimed that PRISM is mass wiretapping. It isn't. You claimed that the NSA is mass wiretapping Verizon and AT&T. It isn't. Let's stick to your original claims and see them through to completion. Do you admit you were wrong about PRISM and the telcos?

Citing Snowden's documents would involve actually giving me a link.

I did not say PRISM was mass wiretapping but it is indeed part of the surveillance suite of NSA programs. I did not adequately explain myself in my original post, but I cleared things up afterwards and you are ignoring that completely. You have consistently been framing my arguments in a specific way so that you can attack them in a specific way.

I also don't understand why you think that the NSA was not mass wiretapping both of those telco's major junctions. It's a known thing. It's not some fringe conspiracy theory. The Fed has been tapping phone lines since the very beginning. Not all of them sure, but certainly in a dragnet fashion. This has continued with the explosive growth of information networks into the 21st century. I provided links. I do not need to provide any more on that topic.

I've honestly never encountered someone before who so earnestly believes as you do that these programs are not widespread or dangerous or grossly overstepping their bounds. It's like denying climate change or something.

> Citing Snowden's documents would involve actually giving me a link.

I gave you a link to a slide diagramming PRISM and a link to the document describing the email envelope program that had shut down.

> I did not say PRISM was mass wiretapping but it is indeed part of the surveillance suite of NSA programs.

I understand you now concede that PRISM isn't the nefarious new-datacenter-requiring mass data collection you originally claimed it was, that the actual surveillance itself is carried out by the FBI, and that PRISM just enables the NSA to search the FBI's data collected on specific foreigners with a court order.

> I also don't understand why you think that the NSA was not mass wiretapping both of those telco's major junctions. It's a known thing.

If it's a "known thing," where is the evidence? None of your links claim that the NSA is mass wiretapping the telcos' major junctions. Mass wiretapping Americans would violate the Fourth Amendment (the ACLU successfully sued over phone metadata collection, and collecting voice content would be a much bigger issue), so if you have any evidence at all, present it or be prepared to be labeled a conspiracy theorist.

Here you are again, twisting my words! Amazing. No, I did not say anything like that about PRISM. I said exactly what I said-- that I was not clear enough in my original post, but I clarified myself immediately after in response to you. I wrote that original post in a hurry and did not take the time to read over it like I usually do. And I've already elaborated on how the NSA uses other agencies and businesses as tools for its surveillance, to avoid direct ownership of the information that they can request at any time. Again, STOP twisting my words to serve your narrative.

I gave you links, but I will humor you with another:

https://www.eff.org/nsa-spying

> . . . recently published FISA court order demanding Verizon turn over all customer phone records including who is talking to whom, when and for how long—to the NSA . . .

Oh look! FISA being used to demand all of verizon's phone records! All of them! And what are one of the programs that FISA feeds into? Oh yeah, that's right. PRISM. If you do not consider this to be a dragnet surveillance order, you are just lying to yourself. So there is yet another verifiable source highlighting the scope of PRISM.

here is the relevant court case:

https://www.eff.org/cases/first-unitarian-church-los-angeles...

Do I need to physically take you to Titanpointe to see it for yourself? Here is a link explaining what that is, I already posted it once but clearly you have not been following through and reading these links.

https://theintercept.com/2016/11/16/the-nsas-spy-hub-in-new-...

> FISA being used to demand all of verizon's phone records! All of them! And what are one of the programs that FISA feeds into? Oh yeah, that's right. PRISM

This explicitly isn't PRISM, and this isn't ongoing. Moreover, Snowden's documents showed that this data wasn't used for surveillance. The data was anonymized and a system (not PRISM) was built on top of it that could only perform a limited set of graph queries to find associates of known threats to national security. To deanonymize a node, the government would have to request another court order.

You have once again demonstrated that you don't know what PRISM is, so is it any wonder that I keep calling you out on it?

What isn't PRISM? FISA? No shit. I said it feeds into PRISM. And I did not say it is ongoing. And I think you have a warped view of what surveillance is because a system used to query networks and other identifying information is a dragnet surveillance tool. You just refuse to be wrong here.

And a lot of the hooplah about these immoral dragnet tools is not only the fact that they partially target American citizens (after NSA executives said under oath, in very particular terms, that they do not collect files on American citizens) is that it was being accessed by employees without court orders.

Pre 9/11, maybe you could have made a case about this "anonymization" being legitimate. There were certainly programs in the work that attempted to incorporate homomorphic encryption into their design. But these have been gutted and reformed into what we have today.

You have to wonder, what are these tools being used for? They certainly haven't been publicly attributed to stopping any terrorist activities. If you don't think these systems, put in place by spy agencies with the legal ability to lie about their internal operations, are being used to spy on their targets (which is the general public) then what the hell do you think they are for?

> I said it feeds into PRISM.

It doesn't. That's my point. How many more times are you going to show that you don't know what PRISM is while claiming that you do?

Also, surveillance is, by definition, close observation. Merely having anonymized phone metadata is not surveillance any more than having access to Google Maps satellite imagery without any other data sources to join to. More specifically, it isn't mass wiretapping, which as you recall was your original claim that you have yet to substantiate, instead pointing to this metadata program that I had earlier used to show you that no evidence exists for mass wiretapping of Americans.

> PRISM is the program that brings the FBI's FISA electronic communication wiretaps into the NSA's databases

> It doesn't.

> Merely having anonymized phone metadata is not surveillance

OK. Not only are you inconsistent but your arguments are based around ill-defined terminology. Goodbye now.

How have I been inconsistent? I've repeatedly stated that collecting phone call metadata isn't wiretapping. Wiretapping is well-defined and requires collecting the content of conversations.

Surveillance != wiretapping. MYSTIC is the wiretapping program I was referring to. Only MYSTIC. It is indeed wiretapping because they recorded calls and SMS.

You are difficult to argue with because you continue to either misinterpret or warp my words. Goodbye now.

You originally claimed that the NSA was performing mass wiretapping on AT&T and Verizon. MYSTIC has nothing to do with those companies or with Americans, as I've already stated.

It appears that you finally agree both that PRISM isn't mass wiretapping and that AT&T and Verizon aren't being mass wiretapped. Good. You appear to have learned something even if you now claim to have known all along.

Listen. I said "mass wiretapping" and "exploitation" thru vehicles like AT&T and Verizon. And then in a separate paragraph I spoke about PRISM. At no point did I call PRISM a wiretapping program. And it is 100% accurate that the NSA and other agencies have wiretapped targets, many targets, through telecoms. I also provided you with various citations showing different government surveillance programs and their various forms of reach. Understand what I am saying here. I have not waivered in my position once.

Stop fucking putting words in my mouth.

You've just got to get your last word in to frame the conversation in a way that doesn't give you cognitive dissonance, don't you? OK. Go ahead and have it. Claim I am saying whatever you want me to say.

This argument has been wholly destructive and not the least bit constructive, because you constantly derail it at every turn and put me in a position of defending the same thing over and over instead of covering new ground. This is a common tactic used by authoritarian and conservative types across the world and I don't have time to play ball.

Have fun, kid.

OK, given what you claim to have known all along, what do you find bad about what they're doing? Everything you now say you've known all along is perfectly legal and what a spy agency is supposed to do.

People did not read the source material of the Snowden leaks, only the editorialized articles which made unsubstantiated interpretations of what the leaked slides mean. That is probably why you are being downvoted, regardless of the fact that you are entirely correct.

> You haven't been a crazy cookoo conspiracy theorists since the Snowden dropped his info.

neh, the world was calling for them to stop trying putting backdoors in security software for a while. To my generation it was the 2007 ecc curve primes. https://www.schneier.com/blog/archives/2007/11/the_strange_s...

to the previous generation it was the clipper.

Snowden really raised awarenes outside the security circles, but this has been an issue long time prior

Why do 3 letter agencies need special tools? Who will they be accountable to that these tools are being used ethically?

We already have a bunch of stories of crooked cops using databases to stalk love interests, etc. Then look at the Michael Hastings incident. Imagine how much abuse goes unreported.

SV doesn't get amnesia, it gets younger people reinventing the wheel to "disrupt".

They don't even need to go out into the wild.

https://en.wikipedia.org/wiki/Aldrich_Ames

https://en.wikipedia.org/wiki/Robert_Hanssen

The US intelligence agencies have a less than stellar history regarding moles.

So the tool is getting used everywhere by "kiddies"?

I don't see any discussion about the fact that, if you were the NSA, you'd absolutely want this to happen to muddy the waters for attribution.

What does this have to do with SV company valuations?

Seems like you're pigeonholing a pet issue into something totally unrelated.

No, the people who know how hard good security is, how easy it is for this material to spread around when a huge chunk of your intelligence services are private for-profit contractors, and had completely sane ideas about how weaponized the government's tools were likely to be - were not crazy or cuckoo or conspiracy oriented.

Conspiracy theorists are where 3 million illegal voters, thousands of Arabs dancing on buildings, and the last president being a Kenyan with a falsified birth certificate, all come from.

Reply on news.ycombinator.com