Comment by jacquesm | Hacker News Reader

Comment by jacquesm | Hacker News Reader

> information terrorist

right

> In the case of the war logs, we got a picture of a military operating in difficult circumstances in the most effective and humane way possible.

I think your bias is showing.

> So let's ponder the implications for the rest of us. When your company's secrets – profit margins, production methods, distribution deals, and marketing plans – are no longer confidential, how will you compete?

You mean like when TC posted the Twitter files ?

> When your personal medical or financial records can be disclosed at any time, will you still enjoy the notion of “free speech”?

Free Speech is not a privacy issue, and medical and financial records being public will not limit your ability to speak out.

> Whether as private individuals or public officials, WikiLeaks will come back to haunt even those who applaud it today.

Time will tell. I think it is much too early to make that call.

> It will plunge us into a new dark age of Shakespearean whispers and plots.

The only thing that would have stopped this stuff from being juicy and interesting would have been impeccable behavior, so there are multiple solutions to this.

It speaks volumes that you would immediately assume that like any organization that can not stand 'the light of day' that diplomacy would move underground. And if it does that will tell us two things and nothing will change so in that case if it does not harm it does not hurt either.

Just to clarify, I am not the author, I just came across the opinion piece and thought it was an interesting perspective. I also don't know if the author has an account on HN, but he probably does not.

>Free Speech is not a privacy issue, and medical and financial records being public will not limit your ability to speak out.

If one cannot communicate private information without worrying about its release to the public, one may be pressured internally NOT to speak as one would wish.

That's reaching, private communications can be protected quite effectively by encryption, and having your private communications released to the public means that at least one person who should not have had access to that data get their hands on it.

So only in the case that all those conditions are met and the person we're talking about is embarrassed to the point where they'd rather shut up than speak out (in which case I'd call them a coward) does that come true.

Because clearly, if you encrypted your communications, Assange would never dream of publishing it once it was broken.

He'd have to break it first. From what I get all this stuff was in plaintext, not even the most basic precautions were taken to limit access.

The communication may have been encrypted, but the storage at the end points may not have.

Somehow I find it hard to blame wikileaks for that.

That was not my point. My understanding of the discussion: someone pointed out a potential result of the leaks is that government employees may not communication frankly because of the leaks. You brought up encryption as a means to counter that. I pointed out that encryption of the communication itself does not necessarily mean it is stored encrypted. I brought that up because I feel it takes encryption out of the discussion; I don't think it's relevant to the original point made.

Sorry, it is my understanding that if you value your data enough to protect it in transit that you should protect it equally strong at the endpoints.

Okay, granted. But my point was that has no relevance to the lhnn's point: http://news.ycombinator.com/item?id=1950776

That's not true either.

The end points can be encrypted by every techonology imaginable, that only prevents people who shouldn't be able to access the data from accessing it.

The guy who leaked this stuff was granted access to it. He had the passwords to open everything he leaked, so the problem is not (a possible) lack of encryption but the fact that he was able to access so much without anyone noticing. He seemingly downloaded more files than one person could read in a year, how was this not noticed?

What's not true? I pointed out something that may be the case because I thought it was relevant to the discussion.

The weird thing is that wikileaks were said to be breaking encryption on the Apache video. And that was supposed to be also from Manning

This is a "might makes right" argument and it's garbage.

I'm not close to the scariest person breaking systems. And I'm appalled on a biweekly basis by what I can manage to get software to cough up. One person's "basic precaution" is another's "failure so spectacular it demands an example be made of its author".

You aren't OK with a world governed by the ethic you just alluded to. You're only OK with invoking it to make a haphazard argument.

I absolutely do place blame on the people charged with protecting the information that got leaked. But that has nothing whatsoever to do with WL's culpability.

> One person's "basic precaution" is another's "failure so spectacular it demands an example be made of its author".

The American Government and it's diplomatic services are currently being made an example of.

> You aren't OK with a world governed by the ethic you just alluded to.

That's an assumption.

> You're only OK with invoking it to make a haphazard argument.

I think it's pretty solid. If you are in charge of material that you deem important enough to stamp it 'secret' then you should take basic precautions, if you do not then you only have yourself to blame. Not locking your house is stupid, even if burglary is wrong.

> I absolutely do place blame on the people charged with protecting the information that got leaked.

Good.

> But that has nothing whatsoever to do with WL's culpability.

Indeed, it doesn't because as far as I know they're not culpable. The investigation in to the leak has so far been limited to those in the employ of the US government, and again, as far as I know wikileaks and its associates have not been charged with any crimes or even misdemeanors related to these leaks.

The 'if you've got nothing to hide you've got nothing to fear' mantra cuts both ways. I don't agree with it when applied to the general public, and I just as much don't agree with it when applying it to the government. The difference is that I would expect the government to at least be somewhat capable when it comes to dealing with data that is deemed sensitive.

So maybe your point is that crypto is pointless because no matter what information will be leaked and therefore the recipients of the leaked data should have culpability but that is a world governed by an ethic that I'm not ok with.

Your argument is incoherent. It will be modded up because it supports Wikileaks, but understand between the two of us that it is a stupid argument, and I think less of you for making it. People who leave their front doors unlocked are not themselves responsible for burglary. Burglars are responsible for buglary.

Information security people in the US government were apparently negligent with information they were charged with protecting. But those people weren't information owners or stakeholders.

You fail to provide any reason why it is incoherent.

Not everybody that disagrees with you is incoherent.

> People who leave their front doors unlocked are not themselves responsible for burglary.

I agree with that and I would like to live in a society where that was true. However, the insurance company and the police in the region where I live consider living in an unlocked house reason enough to lay at least part of the blame with the owner of the premises, insurance companies respond to this by refusing to pay out, the police responds to this by saying they will not spend time investigating the case.

> Burglars are responsible for buglary.

Yes, they are, they are the perpetrators. But locking your door makes it harder for burglars to do their deeds. We also have a proverb here that illustrates some of the culpability of the keeper of the resource, 'the opportunity creates the thief'. Not giving people opportunities significantly cuts down on the risk.

> Information security people in the US government were apparently negligent with information they were charged with protecting.

And not for the first time. They also support leaking information when it suits their purposes, such as the Valerie Plame scandal.

> But those people weren't information owners or stakeholders.

I have no knowledge of that.

In the US, people who break into houses with unlocked doors are felons, and are routinely prosecuted as such. My block in Chicago is across a street from one of the worst neighborhoods in the city --- if ever there was a place where the police would be too busy to prosecute crimes like this, it's the Austin neighborhood of Chicago --- and my neighbors have had breakins through unlocked doors. Lo and behold, the police tracked down the people doing it. And (I checked), our homeowners insurance doesn't give a shit if you accidentally left your door open. A B&E is a B&E.

Of course, in the real world, "unlocked door" is as moot a point as "properly encrypted data". The people you really worry in the city about just take a cinderblock to your doors and windows (our car and garage doors are never locked for exactly that reason), and the people you really worry about online don't care what you did to encrypt your data, because they already own your kernel.

I've always found your attitude strange for someone working in security. Especially in military intelligence the name of the game is protect yourself or you only have yourself to blame. The main reason we are seeing this leak is because too many and/or the wrong people had access to the data, which is also why it's mostly "raw data".

What's your point? Try to hold these two thoughts together in your head: whoever was charged with protecting this information was negligent, and whoever actually leaked it is responsible for their own actions.

> Try to hold these two thoughts together in your head

That's skirting the edge of an ad-hominem attack, maybe even crossing the line. For someone of your stature that is a pretty bad example to set.

> whoever was charged with protecting this information was negligent, and whoever actually leaked it is responsible for their own actions.

Neither of those are Assange.

So, the new world we live in: if information is leaked it will instantly reach an audience of millions. Plan accordingly.

And - in a large organization, where you need to communicate patient information to a potentially significant number of doctors, for example - what prevents one unscrupulous doctor from posting the information in plain text when it gets decrypted?

Encryption works fine for trusted communication, but it's not a solution when the people posting the information are also potential valid recipients.

This is absolutely true, which is why I'm categorically against long lived record keeping in centralized databases when it comes to stuff like this.

Eventually it will hit the street and eventually it will be abused, you can pretty much count on it.

That's also the reason why I have yet to get a new passport because I don't think the government should have my fingerprints on file, given their history with respect to data loss and internal abuse cases.

Then it is whoever is causing the internal pressure that is harming freedom of speech.

Sometimes it's self-censorship. If people don't trust that their own communication will remain confidential, they may censor themselves.

Yes and no. If you know that stuff you say confidentially could be leaked at any time, you would be pressuring yourself to keep your lips sealed - at least, if you're ethical and care about privacy.

Reply on news.ycombinator.com