German politicians targeted in mass data attack | Hacker News Reader

German politicians targeted in mass data attack

bbc.co.uk

161 pointscamtarn106 comments

How interesting!

I wrote an encrypted pastebin that uses IPFS: https://hardbin.com/

I run a public gateway for it on the hardbin.com domain to make it easy for beginners to use without running their own IPFS node.

Earlier today I got my first ever takedown request for a hardbin paste! CERT-Bund ("the national cyber security authority in Germany") gave me a link to a paste with encryption key and asked me to take it down. I have blocked the link in my nginx config, but I don't know whether that was the right thing to do or not. I'm interested in hearing opinions either way. Obviously it can still be accessed through other IPFS nodes.

The paste contained a bunch of German political party names, alongside links to RAR files, which I presume contained this leaked data.

In my humble opinion, you did the right thing. Whether or not providing access to the dump is legal or ethical, you would certainly receive substantial legal attention should you not comply.

It is on the leaker to find methods to share files that can not be easily traced to a public server or a named owner. This is no different than if someone running one of the many reverse tor proxies (public to hidden network) were told to block access to something. They risk losing their server, domain, accounts and much worse. When dealing with embarrassment of government officials, laws get a little muddy and some people will look the other way.

But did that government agency do the right thing?

It seems more like a waste of public resources to take down links to encrypted files on a distributed file system? The nodes dont even know what theyre hosting and the cataloger to the pointers has pure discretion

They have to make a best effort to protect their people, as futile as it may seem. If the archive really contained home addresses, their family members lives may be at risk.

Was this the best effort or simply an effort

Given that this is now a criminal investigation it is likely best to preserve any evidence while limiting public access to it.

The hack is clearly politically motivated, targeting all but the far-right parties (i.e. AfD is conspicuously missing) and left-leaning public figures. The data is often highly personal, including iCloud dumps, private photos, emails, and messages.

You mean such data as is collected by the BND at DE-CIX? I have only little sympathy.

The absence of content on the AfD could also be due to the relatively young age of the party. It has only existed for 5 years which is extremely young for politics. Even if the leak contains recent data, there has been considerably less time to compromise party members. Being a young party could also mean the party's computer infrastructure and practices are more up to date.

Or the AfD is so technically inebt that it only has one party member that even has email...

AfD members are very active on Facebook and various other networks.

Also possible that this is a divide and conquer strategy by an external actor.

Thats not conspicious given how old the info in this leak is

My SO is a journalist in Germany. She's all over this. Not clear if there are any clear "scandals". Would be fantasticly German if absolutely nothing fishy shows up.

Why would it be "fantastically German"?

It'd play to the stereotypes of Germans being boring and efficient?

"Of course we didn't do anything untoward, being corrupt would be a bad use of resources!"

being corrupt would be a bad use of resources

How badly I wish this was true in other parts of the world!

It's not true in Germany either though...

I think it's funny that if you used to go to these countries for your job, and if you used bribery money, you could deduct it as business expenses.

The law was changed in 2002, where it was still legal in non-German context and not concerning foreign public officers. Now that is illegal too.

That doesn't mean there is non though, I wish it was true in Germany as well.

I've learned to see bribery as a relative problem, not absolute. In my view, if country A takes less bribe than country B, then country A is better - though both countries are corrupt :(

I've never been to Germany, but from what I've read/heard, Germany will probably score pretty high by my standard

Probably but it can be a stark contrast when it comes to personal experiences. I remember years ago a backpacker friend from Taiwan sending me a flood of messages about needing to leave Indonesia ASAP because she couldn't personally deal with the number of attempted scams and required briberies she had to suffer through.

There's also things like John Stossel's short documentary on setting up businesses in HK and in India.

You're telling me...

Yes. German politics and bureaucracy specifically.

the stereotype is that Germans are often ridiculously straight-laced. See tropes about German humour for reference.

which is, btw, why many Germans were so absolutely furious about the Volkswagen diesel emissions scandal - not only was it bad for the environment, but also severely damaged said German reputation for integrity and probity. The fury against these cheaters is palpable.

That whole thing was so stupid, though. A tempest in a teapot. US emissions regs are ridiculous and gaming them was the last possible outcome. The US brought this on itself as we always do, but it was more enterprising to blame the people tasked with pleasing both their corporate overlords and the regulators, a Faustian situation.

While I am against cheating, of course, I have to think that having all those cars junked just due to that scandal was a far bigger waste and far worse for the environment.

> While I am against cheating, of course, I have to think that having all those cars junked just due to that scandal was a far bigger waste and far worse for the environment.

It was about sending a message. And probably also about the fact that VW is a foreign car manufacturer. Let's not forget the bailouts that the American car companies got just a few years ago.

No, they're not ridiculous. They're also not impossible to achieve, see all the cars that manage without cheating.

On top of that, they were barely given a slap on the wrist in Germany whereas they had to pay out billions in the US. Even though they probably sold a lot more diesels in Germany than in the US, and Germans are feeling the pinch a lot more due to many cities banning diesels from inner city roads.

I've read through the files, and so far all there is are private phone numbers, addresses, social security numbers (well, the German equivalent, Rentenversicherungsnummern), bank data, etc of these people.

They basically just doxxed them, put up photos, names, account info of famous people, politicians and their families (at one point publishing photos and personal data of the little children of the host of a German late night show), and for a handful of them also published their entire iCloud content as well as all messages they ever sent/received on social media.

There's nothing fishy in there, just a very unethical and bad hack. Especially considering the hack only targeted left-wing people[1] a political motivation isn't be out of the question.

Footnotes:

[1] The hack targeted all parties that were at the time in parliament, but also many private people such as musicians, artists, TV hosts, etc. All of these people were politically left-leaning.

I wouldn't call CDU left wing. They appear to have spared the "most right" party in parliament (AfD), tho.

Data seems to be from before the AFD was member of the parliament. This doesn’t exclude a political motive, but offers a non-political explanation as well.

Data is as fresh as early 2018 - I read in the German press - which means well after AfD became a player.

The political parties are a different question, I was mostly referring to the private people that were hacked.

In addition to hacking the systems of political parties, they also hacked many left-wing musicians, artists, TV hosts of late night shows, etc.

I've clarified my original post with a footnote.

Indeed, the Wikipedia page describes them as center-right.

European center-right, it would be very different on the American spectrum

You can't position parties in a one-dimensional spectrum. At least two dimensions (economic freedom and personal freedom) are necessary. (You know, the age-old https://fee.org/media/9818/20131203_fulmer1a.png)

True "classical liberals" might as well be nonexistent for all the power they have in modern politics. Even pols who identify as "classical liberals" mostly just end up voting with one of their country's (economically + socially) right-wing parties anyway.

I just used that image as an example, I don't agree with the denominations used.

Well, I have to give you that.

But here in Germany, CDU was always considered "right".

For example, CDU/CSU politicians didn't want gay people to call what they have a "marriage". Merkel said so back in 2017, and eventually voted against the law together with more than 2/3rds of her party; the law passed anyway with the votes of the CDU's coalition partner SPD and the opposition parties. So there are some commonalities with the US right wing politicians and their policies, after all.

But keep in mind that CDU is Angela Merkel's party. She is probably the hate figure of the far-right in Germany.

> Especially considering the hack only targeted left-wing people

1) not true, FDP and CDU are certainly not left-wing

2) even if it were true, would it be more ethical to hack right-wingers?

The current speculation indicates no political leaning whatsoever (apart from one password of one leak for one socialist politician was "linkenshit" which could be either neutral, positive or negative).

Considering the age of the leaked data, it is speculated that during the time of gathering data, the AfD was not part of the targeted parliaments.

> 2) even if it were true, would it be more ethical to hack right-wingers?

I guess the thinking is "it's targeted against one side, so probably look at the other to find the perp". Would be just as true with hacked right-wingers.

(and the corollary: "it's a flag-flag operation by the very same side, so look there", which also comes up no matter what side is affected)

> 1) not true, FDP and CDU are certainly not left-wing

As mentioned in the footnote, I was referring to the individuals hacked, not the parties. In addition to the political parties, the hack also targeted youtubers, artists, musicians, etc.

These include Christian Ehring, Jan Böhmermann, Oliver Welke (all hosts of left-leaning late night or satire shows), Marteria, Casper, K.I.Z. (left-leaning rappers/music groups, or in case of K.I.Z. even explicitly anti-capitalist), and several YouTubers.

Additionally, the twitter account doing the hacks has mocked Böhmermann's Reconquista Internet explicitly.

I get the better way to say it, they targetted everyone who wasn't far-right AFD and celebs that are left wing. The base point seems to remain the same.

> 2) even if it were true, would it be more ethical to hack right-wingers?

The problem is that any side was targeted.

Isn’t German politics ridden with scandals at the personal level? I remember several cases of German top politicians faking their academic records.

Yes, there have been a few cases like these, but so far as I know it's not wide-spread, so "ridden with scandals" is inaccurate (so far as we know), unless you count lobbyist payments (which is scandalous in my opinion, but probably the same in most nations).

Oh yeah, let's pretend like this is only the case in Germany.

What about their post makes it seem like they're suggesting "only Germany" to you?

https://en.m.wikipedia.org/wiki/Guttenberg_plagiarism_scanda...

In the US that would probably just lead to a minor apology. I remember a teutophone math professor mentioning that when she was explaining how serious plagiarism was.

Plagiarism was the issue, approached systematically first in 2011, in the wake of the Guttenberg† scandal. (Plagiarism was discovered in defense minister Guttenberg’s dissertation in early 2011. His title was subsequently revoked by his university and he resigned as defense minister.)

After the Guttenberg scandal a wiki sprung up which investigated more past academic works from people, first mostly politicians.

Now, plagiarism is a serious issue, but these politicians were not “faking” their academic records. They actually had those titles, the universities had just failed to identify their plagiarism and given them the titles in spite of it.

As such hacking them won’t likely reveal such scandals, only actually looking at those (already public) academic works and searching for plagiarism will … which is what has already been happening.

—

† Annette Schavan resigned two years earlier because of plagiarism-accusations, so his wasn’t the first case, even when only looking at recent cases.

> Now, plagiarism is a serious issue, but these politicians were not “faking” their academic records.

'Faking' is a word not even strong enough. Those people acquired titles by fraud and deception.

> Annette Schavan resigned two years earlier because of plagiarism-accusations, so his wasn’t the first case, even when only looking at recent cases.

Schavan resigned in 2013, two years after Guttenberg.

Another widespread scandal was when politicians used miles gathered on flights payed by the public for private flights. The biggest scandal in the last two decades though was the CDU-Parteispendenaffäre (Big donations to the CDU from unknown donors). But the former Bundeskanzler Kohl took the secret to his grave and Schäuble who accepted illegal donations from a well known arms dealer is still a well respected politician and serves as president (roughly similar to the speaker role) of the Bundestag.

Looks more like someone gathered sensitive data from several breaches instead of a single "hack".

There is data dumped from social media accounts, data that was clearly dumped from icloud accounts, etc.

While the hackers are clearly malevolent in their intentions I can't help but think of the one only surefire way to prevent this sort of meddling is radical transparency requirements among political canidates. They will wield immense power so asking them to be openly monitored would be justifiable at levels above even the judicial system so long as it was applied uniformly.

It would indeed be awkward and something politicians everywhere would be reluctant to implement but it would work and respect human rights which is more than can be said about many measures in intelligence.

That’s not the answer either. You’ll not get the most able or most willing politicians but only the cleanest or anodyne candidates who may not be the ablest candidates. It’s a terrible filter.

We already don’t get the most able politicians. We get corrupt and self-interested ones en masse.

This argument is strong in theory, but not so much in practice.

But we're making steps towards not doing so. Why give up?

This is like arguing for monarchy because democracy is a huge amount of time/effort and is imperfect anyway so why not save time. I've heard many bad arguments for monarchism as it happens, but none are quite so bad as "Why bother even trying to have good government?"

Accountability is precisely how we are making progress.

In the UK there are people who would seriously argue for just that, because the image of the monarchy is one of prestige, superiority and good public relation. In other words good PR that politicians dream of, having a (apparently) off hands approach to politics also helps.

I believe that shows the popularity and image contest of democratic politics.

It's very difficult to keep your digital record clean your entire life. Anyone who manages it is either very able and motivated or Amish.

These days when someone talks about a "capable" politician, I can (and probably most others with little hope left) only think of how they have perfected the skill and art of lying and deception, rather than the judicial, diplomatic, and relational skills that they are intended to strive for.

I also think that as a person of political interest, you should be as transparent as possible. There are some aspects of the whole story that this approach doesn't answer or fit into this narrative:

1) It seems, that these documents or a majoritiy of them are tied to the personal lifes of these people, not to the political institutions they are affiliated with.

2) There are non-political targets: journalists, show hosts, singer / rapper -- people affiliated with media in general.

3) Some of these published materials were photos and docs of family members, children etc. When they are made targets of this form of intelligence gathering, something seems horribly wrong. They become victims because their spouse / mother / whatever is pursuing a political career -- this is just wrong on so many levels.

A lot of this data seems like it's only interesting as a means of identity theft and not journalistically interesting. I don't think there's a meaningful transparency argument, and I think the downside of filtering for politicians able to deal with identity theft is a problem. (Think US politician Alexandria Ocasio-Cortez, whose immediate prior job was in food service and didn't have enough salary history to rent an apartment in DC. The ability to ruin her personal credit would quite likely ruin her ability to serve her constituents, whereas richer politicians could survive it.)

It also filters against politicians with unrelated personal problems beyond their control. Maybe they have an abusive ex-spouse they divorced years ago. Do the details of the divorce need to be public? Maybe they have a family member in prison that they visit (San Francisco mayor London Breed's brother is in prison for murder, for instance). Given the state of our political discourse it will be very easy to attack politicians on the grounds that they have, or previously had, relationships with imperfect people, and those usually don't mean they'll use their office to help those people, or that their character is actually doubtful. And again it seems like it would unduly hurt those who come from backgrounds that aren't already the powerful class/group/ethnicity/whatever in the country.

If they have nothing to hide then they have nothing to worry about. Right?

Twitter* suggests there are at least evidence of nepotism amongst the leaked documents, so one would assume there will be some kind of fallout because of this. If this is common practice then I'd assume that demands for future transparency will be met with heavy resistance.

* https://mobile.twitter.com/JulianRoepcke/status/108108941972...

Radical transparency of what? Financial transparency is one thing, but rummaging in people's personal lives and consensual relationships is something we need to leave behind.

(On the other hand, exposing nonconsensual or coercive personal relationships is a benefit)

Let me preface this comment that in principle I find outing other people utterly abhorrent behaviour.

There's one exception

When one of those holier-than-though gay bashers (George Alan Rekers[1] being a great example) is caught with a rent-a-boy in an airport bathroom in a compromising situation (why always airport bathrooms?) is outed I think it's great and fitting justice.

For the hipocrisy and the immense damage those people do to society at large and to individuals specifically.

Else than that I totally agree with you. Consensual relationships and sexual orientation is nobody's business.

[1] https://en.wikipedia.org/wiki/George_Alan_Rekers

This would just increase the levels of strawmen in between the politician and its industrial handler.

> Greens leader Robert Habeck, who had private chats with family members and credit card details posted online

Do you really expect that politicians should publish the kind of data that was stolen in this case?

There arent any details yet about how it was done.

Were the computers of the individuals targeted directly via spearphishing, or was it done by compromising iCloud,etc. directly or (id say most likely) password bruteforce account and no 2FA.

If anyone finds an article with more details, please share.

https://www.tagesschau.de/newsticker/liveblog-hack-politiker... explains one case: poor email password plus password recovery across different services.

2FA would likely have protected that person.

What an amazingly annoying hack to browse, you need to spend hours to just compile the whole thing.

It's not really that complicated to just create a magnet of a folder and then spend time spreading the magnet link.

> A cyber analyst told the BBC there was speculation that hackers may have exploited weaknesses in email software to get hold of passwords that those targeted had also used on social media accounts

If so (as probable, according to Occam), just the usual incompetence, irresponsibility, and self-inflicted damage. If you keep confidential data under no better protection than a Mickey Mouse password, ought you not be held accountable when it is - inevitably - leaked?

I don't know if this is the doing of the Russian government, but it certainly sounds like the kind of thing they'd do.

all political parties are affected, except the AfD. some context: the AFD is more anti-immigration, pro-Russia, and anti-EU than any other party in parliament.

so there are two explanations: 1) the AfD is not affected, because they just entered federal parliament a year ago and the hack happened before then. 2) whoever did this has no interest in harming the AfD.

This feels more like the work of a hacker activist group with the intent to show politicians how exposed everybody is. Especially in light of frequent naive statements about the internet and digitalisation (eg. recent interview with Dorothea Bär).

"Contacts, private chats and financial details were put out on Twitter that belong to figures from every political party except the far-right AfD." ... "However, the fact that no right-wing politicians were targeted while prominent figures who had criticised them had been, suggested domestic right-wingers may also have been responsible, he told the BBC."

hmm. editor?

A clue:

>Only AfD appears to have escaped

AfD is a right-wing political party in Germany. Their focus is migration, Islam and strengthening ties to Russia.

Nice. Now, please do the same to the Aussies, Brits, and U.S.-ians.

So far, it seems that the data dumped is purely "personal effects." E.g. pictures of children, phone numbers, private chats with family.

Democracy and public policy do NOT benefit from this kind of "transparency." This is the "ad hominem" of hacks: vacuous, mean-spirited and — hopefully — entirely ineffectual.

It's exactly the kind of data our politicians deemed fair game for mass surveillance (eg. BND at DE-CIX). I have little sympathy.

I also disagree that there is no potential benefit. Maybe it reminds those in power that any data retained may come back to haunt you. And it might dampen attempts to weaken encryption. Even legislation which explicitly exempts politicians from mass surveillance would probably make the public more aware of the problem.

You do have a point that this kind of data is, in fact, collected by mass government surveillance.

I don't think the reverse holds, though. Politicians will not end up understanding private people's concerns over surveillance, because to them it's something else entirely. One is a frivolous attack on the individual, the other is a more abstract policy goal for the Good Cause™. I'm not saying this line of thought is legitimate, but instead that I have the strong suspicion this will not be interpreted as a message for "Datensparsamkeit" by the powers that be.

I'm also wary of the argument that they "deserve" it. A lot of people who have nothing to do with said decisions were targeted, and maybe even some who opposed surveillance. The notion that "politicians" "deserve" to have their private data exposed by virtue of being politicians is Sippenhaft — collective punishment.

Unfortunately no politician in power has voted against surveillance. Even the green party is guilty of this where in power (Polizeiaufgabengesetz in Hessen and Baden-Württemberg, both of which I consider anti-constitutional).

Reply on news.ycombinator.com