Hacker News Reader

Comment by nickelcitymario | Hacker News Reader

Nothing in this article is surprising. I mean, honestly, if you don't think the CIA is actively trying to gain access to your devices, WTF do you think they do all day?

I'd be more concerned if the intelligence agencies of the world WEREN'T doing this. It's their purpose. It's what we pay them for with our taxes.

Of course we should also always root for tech companies to stay one step ahead. But infosec is an arms race, and I sure hope my own country's intelligence agencies (CSIS and the CSE in Canada) are doing their best to stay ahead of, say, North Korea or Russia.

(Please note: I'm not saying violating our privacy is OK, any more than I'm saying it's cool to launch nuclear weapons. But if anyone's going to have the ability to hack my phone or launch a nuke, I want it to be the people on my own team. This seems like basic self-interest and survival strategy.)

View on HN

>WTF do you think they do all day?

One would hope that they were trying to gain access to someone else's devices, as opposed to turning the guns towards their own citizens and economy. If a soldier showed up at my door and pointed their gun at me, my reaction wouldn't be "of course you're doing that, your job is to point guns."

Somethings like spying on American phone calls (or just their "metadata") I agree with.

But somethings like breaking encryption, exploiting iPhones, etc. while they may be used against Americans can also be used against others.

Essentially there's an arms race, and we use our tax money to sponsor our government in this race, with the hopes that they'll side with us. There really isn't another option unless you want to give a private entity this power, or not participate in the race (which I don't advise).

> Somethings like spying on American phone calls (or just their "metadata") I agree with.

> But somethings like breaking encryption, exploiting iPhones, etc. while they may be used against Americans can also be used against others.

Both of these can have a chilling effect on free speech, therefore I'm against the CIA doing this to citizens. The potential threat against citizens nowhere near outweighs the need to uphold our constitution.

I think we all agree that they shouldn't do this to American citizens. The problem is we can't isolate their capabilities to just foreign persons.

We could make doing this illegal and enforce it…

Unfortunately, other nation states might not care about US laws. Which returns to the above statement that it’s better for the CIA and Apple to be in a security arms war than it is for Apple and the FSB, at least from the perspective of an American.

As a "foreign person", I'd rather like for no organization to come and record everything I do just because I wasn't born in a specific place.

Ironically though, the average American citizen is probably under more CIA surveillance than the average foreign person such as myself.

I'd rather we didn't either. If we trust you enough to let you visit, work, whatever, then we should treat you respectfully.

> Somethings like spying on American phone calls (or just their "metadata") I agree with.

Why keep pretending the CIA is a foreign intelligence service?

For some of us, it is.

> One would hope that they were trying to gain access to someone else's devices, as opposed to turning the guns towards their own citizens and economy.

Apple devices are sold all over the world, so there's no way of gaining access to the enemy's devices without that method also being applicable to everyone else. Actually using them on everyone else is a different matter.

"the enemy's devices"

Which enemy?

Strategic rivals: Russia and China

Regional rivals: North Korea and Iran

Authoritarian partners/allies: Turkey, Saudi Arabia, a bunch of other Middle Eastern countries

A bunch of countries flirting with authoritarianism: Brazil, Hungary, Poland, Israel

Seriously? This kind of stuff is exactly why countries are opposed to free trade and globalism. You listed two countries in the EU there, for example.

Yeah if Poland and Hungary are 'flirting with authoritarianism' then the US with it's current leader is too.

If that sounds dumb to you, you should rethink the statement about Poland and Hungary.

I don't think it's objectionable that any countries Intelligence Service tries to identify threats before it's too late.

U.S. Congress

[0] https://www.theguardian.com/world/2014/jul/31/cia-admits-spy...

[1] https://www.theguardian.com/us-news/2016/sep/10/cia-senate-i...

"...no way of gaining access to the enemy's devices without that method also being applicable to everyone else."

That's only true of some methods like using exploits and other vulnerabilities, or mass-surveillance style methods. It's not true of other types like confidence tricks and social engineering, eavesdropping and potentially watching passwords being entered or getting them on camera, phishing, fake wifi points, tailored viruses, or cookie hacking. Those methods can be designed for a specific target. Of course, there's also the good old-fashioned method of getting a warrant for data.

The entire concept that the government has "a right" to this data - an argument I've seen judges actually make to justify these activities - is ludicrous. They don't have a right to it by default. They have a compelling interest in the data/information if and only if there is enough reason to believe someone is up to criminal activity. In which case they should have no problem at all getting a warrant.

No one outside of America has ever bought an Apple device, obviously.

People outside of America also have human rights.

I never said it was moral or ok, just that it doesn't suggest that the purpose is spy on Americans.

oh trust me... everything is tested at home first...

Or on Canadians. Our government has historically been very willing to let the USA experiment on unwitting civilians.

Human rights have never excluded foreign intelligence services from engaging in espionage.

I'm yet to see a clear explanation for citizens not being as much of a risk as, say, a random foreigner located far away from your country.

If anything, a citizen is more capable of carrying out a terrorist attack, or just doing any action some foreign power wants to perform in that country.

The exception for domestic citizens seems to be just a concession for the masses and their representatives, not a pragmatic choice.

Edit: a pragmatic reasoning could be compartmentalization — keeping citizens under the watch of a separate entity (e.g. FBI) but it doesn't explain why domestic mass surveillance should be ruled out.

Domestic threats are outside of the CIA's scope.

The constitution and amendments to it give us certain rights. It really doesn't matter if citizens are a much larger risk or not.

> "...it doesn't explain why domestic mass surveillance should be ruled out."

It's a matter of who we have a responsibility towards.

The government we elect in our own country is responsible to us, and as a people we widely do not want our government spying on us. (This is true in most if not all countries.)

But that same government is NOT responsible to the citizens of other nations. The CIA has no responsibility towards Canadians (like myself) or anyone else who isn't American.

I'm not arguing that this is ethically right. I'm just saying it's pragmatic.

If you're not a citizen of my country, my country has no legal obligations to you outside of international law. And no country, to my knowledge, has ever tried to introduce the right to privacy into international law. Every country hates spies within its own borders, but seeks to have them inside of everyone else's.

The American revolution was started because citizens did not want the government in their homes.

I don't think that's historically accurate. Please correct me if I'm wrong, but wasn't the battle cry of the revolution "no taxation without representation"? It wasn't about privacy, it was about wanting to be more than just a backwater colony.

> wasn't the battle cry of the revolution "no taxation without representation"?

That was a slogan of the revolution, but there were more than one; it wasn't the unique complaint. There was also a fairly specific list of grievances in the Declaration of Independence.

"No Soldier shall, in time of peace be quartered in any house, without the consent of the Owner, nor in time of war, but in a manner to be prescribed by law." -- The 3rd Amendment

The early revolutionary war history overly simplified is something like this. Britain increases taxes on America. America stops paying taxes. Britain increases military presence to force America to pay taxes. America fought against the British military.

During the increased British military presence in America the British goverment did terrible things, including living in civilians homes and eating their food. This is what the parent comment meant when he said "The American revolution was started because citizens did not want the government in their homes." Ultimately, the British goverment was in American homes to help the tax collection effort, so your idea of early Americans caring a lot about taxation is also true.

Ah, gotcha. I took it as suggesting the revolution was about privacy, but I see where I was mistaken.

Thanks!

Also, bootleggers who made money by smuggling stuff for cheap and selling it right below the full tariff price and weren't happy about the British ending their tariffs and making them lose money.

Also, the whole trial by jury of peers was really great for those like John Hancock (the guy who signed his name really big on the Constitution) who got in trouble with the British for smuggling and then would be invariably found not guilty by his employees. When military trials came into place, Hancock and his distributor buddies started getting jail time.

Also, by the way, Hancock shipping basically had a mob, who were responsible for a bunch of the rioting in Boston and likely the related Tea Party.

Just wanted to point out that America wasn't exactly formed out of ideology.

By the way- that big signature? Essentially the largest political middle finger ever.

I did say my history lesson was oversimplified. The question of _how_ Americans avoided paying taxes is always interesting, not just during this time period.

There is an unbelievably good show about this called Turn, Washington's Spies:

https://en.wikipedia.org/wiki/Turn:_Washington%27s_Spies

There was this document called the "Declaration of Independence" that I believe you might find useful in clarifying the answer(s) to your question.

if it was exclusively no taxation without representation, we would be witnessing the H1-B armed revolt by now

That's the fairy tale version.

I think it's pretty fair (although naive, obviously) to expect soldiers and intelligence agencies alike to, you know, actually just keep us safe.

Let's be real. It wouldn't be that surprising given how the world actually works. Assuming you aren't an oligarch.

Well, by law, the CIA aren't allowed to spy on US citizens, that's the FBI's job.

However, there's nothing stopping them sharing capabilities with the Five Eyes and asking one of them to spy on a US citizen...

I think you all must have a different relationship with your government in Canada than US citizens do.

None of these agencies are "on my own team". They are all adversaries. I feel far more threatened by US government hacking precisely because I live inside US jurisdiction. If we were to have a difference of opinions, and they were to snoop around in my data and decide they didn't like what they found, well, I'm sitting right here; they could easily ruin my life.

What are the Koreans or the Russians or anyone else going to do to me? They're an ocean away and I pose no conceivable threat to them. Harassing me would be expensive and pointless; they're not going to bother.

Poison you?

How much does a clandestine international assassination cost? Why would anyone bother?

I suspect you're being downvoted because of the below. Spoiler alert: dictators don't follow the same value calculus as normal people for when they should "bother".

https://en.m.wikipedia.org/wiki/Poisoning_of_Alexander_Litvi... https://en.m.wikipedia.org/wiki/Sergei_Skripal

Sure, I'm aware of those cases - but I am not a former Russian military intelligence officer, and I'll wager that nobody else participating in this thread is, either. There is no conceivable reason that any dictator, anywhere in the world, should care enough about any of us to bother spending the enormous amount of money and presumably political capital that would be involved in executing such an attack, so why should we worry about it?

That's obviously true (most people will not be targeted). But there's plenty more cases than the last few prominent ones. There are also low level cases that are not reported globally, only in local news.

It's ranging from secret services trying to use people to bomb planes and public places, to dissidents active abroad being threatened, beaten up or assassinated by suspected secret services of their origin countries. On source of such activity is Assad's regime in Syria.

https://www.middleeastmonitor.com/20190119-is-assad-trying-t...

It's uncommon, unlikely, but not that unique.

+1 for the idea that I (an American citizen) would much rather have Putin or the Chinese compromising my security than most American intelligence.

I suspect we have a similar % of Canadians who distrust the government as Americans do. I'd count myself among them.

However:

1) I maintain that the only reason to fund an intelligence agency is to expect them to perform intelligence activities, and today that requires being the best in the world at black hat infosec.

2) I mistrust my government less than I mistrust yours or Russsia's, because at least my government depends on me for votes and taxes and general compliance with laws.

>2) I mistrust my government less than I mistrust yours or Russsia's, because at least my government depends on me for votes and taxes and general compliance with laws.

But this also means that they have way more reason to lie to you and to mislead you.

Well, their incentives are different, this is true. I don't know that it's MORE reason.

I mean, if they successfully lie to me, they get my taxes.

If they successfully lie to you, maybe you don't invade our country.

Considering that Apple is a US company, and that millions of US citizens use Apple products, US intelligence agencies should be securing these devices. Not compromising them.

The US has such an overwhelming military advantage over North Korea or Russia that it doesn't have to gain a leg up in infosec. All it has to do is level the playing field by making sure that everyone's running as securely as possible.

I'll rely on the one dozen Naval Carrier Strike Groups to keep me safe. Really doubt that reading Kim Jong Un's email is going to make a difference.

> Considering that Apple is a US company, and that millions of US citizens use Apple products, US intelligence agencies should be securing these devices. Not compromising them.

You're absolutely right! It's unquestionably the job of the US intelligence apparatus to help secure American interests.

With that said, Apple is a multi-national company, with millions of units used by people of all nationalities. And a vast amount of American military superiority is based on superior technical intelligence.

A carrier group can solve, at great expense in blood and treasure, a problem that intelligence can often solve more quickly and at an earlier point in time. With that in mind, it seems reckless to not take seriously the value of intelligence.

Again, you're completely correct in every way. Apple is an American company! It's just perhaps possible that there could be a bit of subtlety to this.

So for the sake of possibly needing to break into a non-US citizen's iPhone, they do research to create exploits that put EVERY US citizen who uses an iPhone at risk? And they really don't have a great track record of keeping these exploits safe [1]

1: https://www.vadesecure.com/en/nsa-malware-malware-protection...

If there was a way to have exploits that only affected non-citizens, I would expect them to explore that enthusiastically. I suspect there is no such thing, but I would absolutely love to be enlightened as to how completely wrong I am!

With that in mind, do you think it would be wise for an intelligence agency to refuse to consider searching for exploitable holes in a platform that is known for a fact to occasionally used by adversaries? Bear in mind that, of course, there are plenty of other groups and agencies doing the same thing.

Do you think this choice would better serve to advance American interests? If so, why? Would the weaknesses the CIA could find cease to be if the CIA was not looking for them? Perhaps you imagine a scenario in which the CIA finds every exploit first, and in doing so causes them to get fixed rapidly. Would you be comfortable with an intelligence agency working hand-in-glove with a major American company selling supposedly-secure consumer goods? Would you trust such an arrangement to protect you?

You're right, there's no existing solution to exempt US citizens from these exploits. However, with the massive resources available to them, if they focused on enhancing our security rather than fouling it, I very much believe we would be better off. Think about how much crime occurs in the modern era through electronic hacks and exploits. Would it be better to have these intel back channels, or to stop these crimes? Their priorities are in the wrong place, through tradition more than anything else.

There are many, many platforms that are "occasionally used by adversaries". The Intelligence Community has put exceptional resources towards one that has a very significant market share among it's citizens. And given the wholesale surveillance we are already under, I can't accept that this was an innocuous decision.

Trust is built through positive actions over time. I have zero trust for our Intelligence Community as is; and I've actually worked with US intelligence. If they devoted a majority of their efforts to finding and patching security risks through public and open source means, I would slowly start to trust them again.

You're so completely right that the NSA, CIA, and more already agree with you!

The IC invests massive resources into enhancing security. I've seen it firsthand - software projects like SELinux and a whole slew of research projects come to mind in addition to stuff I worked on. Though if you've only ever been exposed to the other side of the house, it's easy to be ignorant that the defensive missions exist at all. Certainly it tends to not make any news, ever.

It's true, I've only been on the military side of the IC, so everything I've been exposed to has been offensive in nature. That being said, the attitude of everyone I've met in the IC has been "we need to be able to access everything, at any cost". This attitude comes from the top (how else would it be so pervasive), and it is completely at odds with any sense of security for the average citizen. I think that this overall attitude is what really skews me. I'm familiar with SELinux, and why it was made open source; but I'm also familiar with Dual_EC_DRBG. Seems SELinux release may have been more a red herring or PR stunt than an actual attempt to protect security of the average person, given how much effort they put into defeating the security of the average person.

>doesn't have to gain a leg up in infosec

>I'll rely on the one dozen Naval Carrier Strike Groups to keep me safe. Really doubt that reading Kim Jong Un's email is going to make a difference.

That's a weak strawman argument.

The fact that spying on foreign enemies now requires the capability to spy domestically is definitely a red flag. But saying we don't need infosec when that Naval Carrier Strike Group can be owned, rendered useless by a cyber attack is naive.

Moreover, rogue hacker groups from all across the world posess the power to covertly & remotely target critical infrastructure of virtually any nation. What good is a Naval Carrier Strike Group going to do against that?

The CIA is spying on your phone so that the Russians and Chinese don't have to?? Really, you think CIA OpSec is that good... as in so hard to crack that it's worth spending $100 billions (in Rubles and Yuan) to do it some other way? Maybe some political doofus thinks that, but technically savvy folks should know better.

Nope, if you create a weapon you better be prepared for your enemy to use it against you.

Really you need to think about world governments less like permanent adversaries and more like parents that get annoyed with each other from time to time.

Not that I think anything I say will convince you to my thinking, but I didn't say "the CIA is spying on your phone so that the Russians and Chinese don't have to". I'm not sure how you got that from what I wrote.

In an ideal world, no one can hack my phone. This is why I support Apple and Google and Microsoft and all the others doing their very best to keep my devices as secure as possible.

In the worst-possible world, enemy nations have hacked my phone. Because if they've hacked my phone, they've also hacked those of my politicians and military.

In the real world, the only way for my country to be able to defend against enemies is to be as-good-as or better than those enemies at hacking my phone.

That's why I support it. Because I have a sneaking suspicion that truly awful people are working hard to hack every device out there, and the best infosec defense is a good infosec offense.

I don't disagree with you that "if you create a weapon you better be prepared for your enemy to use it against you". But a worse scenario than that is for my enemy to beat me to the punch and I'm standing here with sticks and stones.

The thing about an arms race is that once it starts, it's pretty much impossible to get out of. I didn't start the infosec arms race. It would be nice if the race didn't exist at all. But it does.

Only a "political doofus" would prefer to pretend otherwise.

If I thought CIA/NSA hacking was truly white-hat to increase the security of Apple devices, then I would agree. However, 3DES seems to be one of the last times that actual info-sec as opposed to spying (on local citizens) with questionable legal standing (in the US) was the purpose.

Sadly, the omniscient and incorruptable rep of the NSA/CIA and associated TLA have been significantly tarnished by Snowden and the current external political interference. This is a crisis, because there are likely people in powerful positions of those orgamizations who do not have their countries interests at heart. Whatever ideology (white nationalist or communist) or external subversion they are not being adequately policed in the current situation.

I would prefer they spend their efforts spying externally rather than internally and keeping everyone's private information safe. For example focus on vulns in Huawei 5G base stations or foreign anti-virus installations instead. I think that's safer for us tax payers. Heck, use the social credit system for your own ends, as they did with Tindr.

Apple products are used globally, so even if they do restrict their spying efforts externally, the ability to hack Apple products is aligned with those efforts.

They should also absolutely be looking for vulnerabilities in Huawei products. They should be looking for them in any product with significant market share. But there's no reason to think they can't do both.

All that aside: Theres a social credit system with Tinder? Am I reading you correct? Tell me more! That sounds way more interesting...

Apple sales in China are ~10% of the market and falling. In the US (especially high value targets) are ~50% or higher. That's not a good ratio for the US. I suspect the numbers for Russia are more similar to China. Targeting your own people (and not trying to secure the system) isn't a good strategic plan.

Ok, so it's 10%.

Thought experiment: You're a chinese spy. Your enemy is pouring tonnes of effort into hacking the phones made by your own country, but have chosen to put zero effort into hacking those made by theirs.

Which phone do you use?

Meanwhile, your own people are good at hacking both American and Chinese phones.

So in this scenario, the USA's decision to not try to hack products made by American companies leaves them at a decided disadvantage to China's decision to hack all of them.

Hack the NSO group (or any of your adversaries/allies) and use their zero days... likely a lot cheaper than developing your own or creating new ones for other people to hack and use against you. If nobody else has any, you're not behind :^)

I am generally positive on the side of TLA efforts to compromise existing software, more so if they share the vulnerabilities with those companies (basically, security testing is hard, having a government agency that tries to break software could be seen as a very useful public service)... when they hoard those exploits to use themselves I'm a bit less sympathetic and grow less and less the longer they hold off on disclosing them.

The thing I'm 100% not okay with is when TLAs use social pressure, legal pressure or traditional espionage to insure there are exploits they can exploit - this has never ended well and is always a concession in security that increases our vulnerability to bad actors. I have a modicum of trust for TLAs in the traditional espionage realms, but they have entirely burned my opinion of them when it comes to tech at this point... The NSA compromising ECC `Dual_EC_DRBG` is just a level of stupidity that demonstrates a clear lack of responsibility to civilians.

Aren't domestic investigations the FBI's job, though? Why does the CIA have jurisdiction to steal the intellectual property of an American company?

Why do they hack computers of congressional staffers?

Why do they explicitly violate the law (re: Iran/Contras)?

Why...

For operations, you're completely correct!

Research, which is what this article appears to be primarily about, the CIA is permitted to conduct domestically.

> WTF do you think they do all day?

Look for WMD's in middle eastern countries to justify policy?

Well, all middle eastern countries bar one.

The last US president to take that matter seriously was JFK.

https://en.wikipedia.org/wiki/Nuclear_weapons_and_Israel#US_...

Most people don't pay taxes so the CIA can spy on them. They pay taxes so they don't end up in prison. If they're going to take our money I'd actually prefer they just used it to buy themselves luxuries over spying on us.

Which is exactly why there are so few countries that you can trust. Here is a good article about it: https://protonvpn.com/blog/best-vpn-country-comparison/

Well yes, and I also hope we don't know what they do all day.

Another point worth making is that the government can't really be on your team, as they tend to hog the ball/puck.

> "the government can't really be on your team"

That's kind of the root problem of democracy, isn't it? If a government truly is "of the people, by the people, for the people", then they are by definition on their people's team, and their people should trust them.

But, if they can't in fact be on your team, and if you can't trust them, then you can't really have a democracy, can you? You end up with something else, something that looks like democracy but really isn't.

Reply on news.ycombinator.com