“100 spies” will monitor all SMS and email that goes in and out of Norway

Guess again.

https://www.ft.com/content/eef717f2-bb6e-11e8-8274-55b729265... https://www.army.mod.uk/who-we-are/corps-regiments-and-units...

etc.

There is so much information available in democracies if you have the time to work through it, that they are effectively protected just by the sheer amount of documentation an interested observer has to plough through.

Start with the annual budgets - they´re extremely informative as to what the real issues are.

Meh, we have had the same thing as you guys for a long time. FRA (the signal intelligence in sweden) has been recording our border-passing communications for many years. This is maybe not new knowledge, but definitely not that widespread.

The information gathered (oh, they have access to XKeyscore) is then shared within X eyes (nine? fourteen?) program. The extent of FRA's intelligence operations was not known before snowden.

Some of it became more public knowledge in 2008 when there was a new law that gave them permission to do cable interception. It was later confirmed that they had been doing cable interception before the law was enacted, in conflict with the law, but "with acceptance" of the administration.

Sweden is really not much better than other countries. Norway is following suit, but with a slightly "better" law that at least requires secret court orders to store other things than metadata of things passing the border.

Edit: oh, and they are allowed (or at least not strictly disallowed) to do targeted hacking, which they have done in cooperation with other (NSA) intelligence agencies.

But, at least we do not have a secret bugdet like other democracies :) . They got about 1 billion SEK last year, or about 0.1% of the national budget.

Imagine if the "100 spies" were representatives you could vote for.

In the majority of cases, TLS for SMTP (delivery between MTAs) is still trivially downgradeable. So they could presumably downgrade and read SMTP traffic that's going between MTAs in Norway and MTAs outside Norway.

Even the data is encrypted is worth to save for the future. They will be able to access when they have the key or when some quantum computing breaks it.

My personal belief is that they dont. Best they could achieve is trapping the ISP's sending mail server in Norway before the mail is encrypted but there is no capability to decrypt SSL without obtaining the keys.

They could still store metadata like sending IP address, timestamp etc.

Using foreign webmail via HTTPS would not be intercepted in any possible way. Unless they get support from the service provider in question. I think the service providers you mention will comply with law enforcement and give out your data. But those are isolated cases and mass data required by intelligence services is a different thing. National security letters are only for US Govt use and other governments have no access.

I also think legislation like this is years late now that about every protocol has encrypted variants and they don't get any meaningful results compared to the money spent.

They get the keys from the NSA.

(Sarcasm, but a non-zero fear that it's true.)

Like most gov, they probably have access to a root CA and they MITM.

I'd watch that movie though.

You are mistaken about WhatsApp. It does end to end encryption by default. What needs to be explicitly enabled is that theoretically WhatsApp/some bad guy could steal an WhatsApp account, and it would create a new public key, and if you didn't turn on security notifications, you might not be aware that the person you think you are talking to changed. You also should verify that the end to end encryption keys match, but most users are not paranoid to that level.

Quite many crimes are such that if you were a smart person, you would not be committing them in the first place.

I think this is why even simple things such as wiretapping and checking which cell phones registered near the crime scene still work.

the tag name of the docker container that runs on the same Linode VPS as the rest of Norway's Internet infra. /s

edit: just some friendly (immature) banter from another European

You decrypt the traffic. Or you monitor on a point in the chain where the traffic has already been decrypted. I think what you meant to ask was how do they obtain the decryption keys or establish a point of presence post-decryption?

When TLS is used there is no metadata either... server x talked to server y for a while, but what, if anything, happened we know not.