Spy agency ducks questions about 'back doors' in tech products
reuters.com
reuters.com
So this is what Snowden has done: he "drew widespread attention to these tactics". Before Snowden they would call you "paranoid" if you would allow yourself to mention it. Today they can not call you paranoid anymore.
And yes, it has hurt US industry reputation. Many don't trust Intel processors and Cisco routers anymore (among other products). They actually destroyed computers and internet as we knew them in the 1990'ies. It is not fun anymore to own a computer or a phone if you know that NSA can get access to it anytime they want... and you will never know if they accessed it...
(I’m presuming here that the laptop is openable, and that you will do so and physically remove any wi-fi M.2 card from it — and associated antennae — since you won’t be using it. There might be some sort of extra surface-mount snooper chip left onboard that could replicate the same function — but without big antennas, how’s it going to report?)
https://www.schneier.com/blog/archives/2014/03/ragemaster_ns...
Or this?
https://www.schneier.com/blog/archives/2014/03/cottonmouth-i...
If you have actually attracted the attention of the NSA, pulling your NIC is playground stuff.
If the NSA has enough of an interest to be intercepting your packages, they're not going to shy away at adding in a transmitter or two of their own preference.
I guess if I was the NSA I'd bring my own Stingray, but then you have to amortize in the cost of the van.
That is patently false.
Oh boy. That's some serious delusion in 2020. Wireless cards and higher end network interface cards are independent computers. Your processor has another processor (Intel ME and others) in it. Baseband Management Controllers are also independent computers on their own right.
With closed firmware and wireless capabilities, you can never know what they're doing at a given time.
Stuxnet reached systems which were seriously air gapped. Consider a what a laptop with a witty wireless card firmware can do.
I'm not getting into TEMPEST attacks and their newer versions, passive surveillance, etc.
I've listened tales about Cisco devices which were configured to isolate and prevent internet traffic but, they mistakenly forgot to drop some magic packets. Uh.
---
Random facts about this stuff:
- Your Intel system runs a special version of Minix on its Management Engine. A version of Minix customized for Intel by its original developer.
- There are photos of Cisco devices which were delightfully enchanced by NSA before shipping to its customer via special firmware and/or hardware. NSA still retains this capability.
The NSA apparently perfectly aligned 4 zeros days in Siemens and Microsoft products to spread the malware from USB into the Iranian LAN (shared printers, industrial PICs etc).
The fact that they could choose and align 4 zero days indicates that the NSA probably has a large list of zeros days.
- They got exact hardware details and topology of the centrifuges somehow.
- They've stolen Realtek's driver signing keys.
- The virus looks like a simple worm which can infect other USB devices and doesn't unpack beyond a certain point if it can't find the SCADA equipment and the correct device ID & topology (It's like a homing cruise missile which looks like an RC plane from distance until it finds its target).
It's possibly the most sophisticated hacking campaign when social and technical aspects combined.
It’s the most sophisticated one _we know of_
I have been to Realtek's offices in Hsinchu many times. While the other efforts may have taken major resources I don't think getting their private keys would have been hard at all. Especially back then. IMHO the building and some people could be easily compromised and I suspect they didn't really care much about security.
Some ideas about the reason they had this particular hardware and software combination:
- The SCADA hardware they got was not compatible with newer software which runs on more modern OSes.
- The SCADA software didn't have any newer version which runs on newer OSes (Windows 7 and further versions are more restrictive in terms of direct HW access).
- Since there are sanctions it was the only hardware and software combo they were able to legally obtain.
Industrial control is like automotive industry. Everything is improved in minuscule steps and by encapsulating everything in more modern carriers. A good example is MODBUS. They still carry the same data, the old way. Only thing is it's either encapsulated in USB or TCP/IP. Why? Because it works and allows perfect backward compatibility.
Since neither the hardware and the software has to run latest version of Doom (metaphorically), if the application is reliable, it's left as is. Even if it runs on DOS 6.22.
Fun fact: There's an auto repair shop in Poland which runs its main application on a C64 [0].
[0]: https://www.popularmechanics.com/technology/gadgets/a23139/c...
[0]: https://www.goodreads.com/book/show/18465875-countdown-to-ze...
"USB drives in the parking lot" could be the tech industry's Korean fan death.
They are used to great effect in pentesting. I think it's natural to see a drive and think "Oh no, I need to get this back to a coworker."
Not on all systems. It's neutralized and disabled on my Librem 15: https://puri.sm/learn/intel-me/.
https://www.ebay.com/itm/191879410081
I hear a lot about Intel's ME, but not much about AMD's PSP. I assume it's just as bad. At least we know how to hobble the ME.
No, we just think we know how to hobble the ME.
A common counterargument comes up when discussing devices like smart speakers. Defenders say that the devices are too low-power and that we would be able to notice power usage changes and sniff network data being sent if spying were happening. IMO, this is true to an extent, but also any onboard preconfigured recognition of certain products could easily send info back to, say, Amazon servers and you wouldn't be able to distinguish it from a "false positive" question to "Alexa". Knowing the extent to which these capabilities are plausible and/or would have been caught by now if they existed is, to me, murky.
This also applies to on-board chips and wireless data. Would we not notice from power usage and sniffing?
Wait until they put 5g chips in every single product to make them "smart". Few people talk about that but I believe it's the main use case for 5g. Everything will be connected and you'll have no way to opt out
> 4G can support about 4,000 devices per square kilometre, whereas 5G will support around one million
I assume for the radio to stay on, it's either subsidized by the parent company (Amazon pays for Alexa's 5G) or I'm paying for a subscription (Xbox subscription pays for 5G on some future mobile XBox)
Maybe you could get the cost down to $1 / month. If you invest $400 in the market it should pay out about that much, so you could make it a one-time payment of $400 for a 5G chip.
Consumer network connections, of any kind I'm aware of, don't go down to $1 per month. Maybe with a big volume order and a low bandwidth cap the cell companies would do it, or maybe 5G itself is just cheaper, but where does that monthly cost come from?
Ah, the "just move to the wilderness and grow your own food if you don't like the government infringing your constitutional rights" argument. I want to be able to meaningfully engage in normal society by buying consumer goods and connecting them to communications platforms and I want my 4th amendment rights protected. I really don't think that is too much to ask.
It is ridiculous that he had to go through this just for people to shake their shoulders and keep on, except for the few that already were inclined to care.
I highly doubt this. In 2015, only 60% of Americans had some idea of who Snowden was, and only half of those had a positive opinion of him. I doubt this has improved over the past five years either.
His comment says an idea of "who [Snowden] was", not of what he was trying to say.
https://web.archive.org/web/20200618030047/https://www.balti...
https://www.latimes.com/archives/la-xpm-2009-jan-16-na-wiret...
And we know that they have such servers from the events surrounding Room 641A. Snowden also released documents from that incident, such as the NSA attempt to stop publication.
And in my article, the NSA claims they can not legally search such data without a warrant. It doesn't say they are unable to access the data illegally though
No, that is not what xkeyscore is. Xkeyscore is a database for metadata.
> And we know that they have such servers from the events surrounding Room 641A.
And thanks to Snowden's leaks, we now know that these are for tapping communications between foreigners where both foreigners are outside the US.
> It doesn't say they are unable to access the data illegally though
Within the US, they can only do so by asking the phone company to set up a tap, just like the FBI. Your article does not dispute this.
For a state-level actor (or the mobile provider itself or those other corporations to which it sells data for advertising purposes) to identify by name the human being who is the source of phone calls, is trivial in most countries today.
https://www.theguardian.com/world/2014/feb/27/gchq-nsa-webca...
I totally agree that it's sad that we're in this place of apathy. But it's hard to get folks all excited when they don't believe it'll really affect them personally.
It's things like this and people who believe the moon landing was faked that convinced me universal suffrage isn't a good thing, and we need some sort of poll test to make sure people are educated on issues before voting. I realize the US has a bad history with "literacy" tests, but it's clear that most people have no business voting.
"The issues" vary between people. How many do you include? Are they just the basic stuff the news covers? Do you need to know federal, state, and local issues? If you vote in a federal election, do you need to know issues in different parts of the country? Wouldn't the test show the biases of the test makers?
Knowing more than someone else does not make you morally superior or give you more of a right to have a say in your own fate.
We only allow those of a certain age to vote because they are able to understand and weigh the issues fairly.
We only allow those of a certain age to be juriors for that reason.
Yes, but we draw a simple, arbitrary rule at a fixed age because everyone grows older, so it isn't manipulable by anyone who is motivated to do so.
If the vote permission line is drawn by more complex means that gives a different answer for different people, it becomes a primary target for manipulation, abuse, and group selectivity.
For example if it was based on IQ tests or even general knowledge tests, it is already well understood that these are heavily biased tests which test for social background, culture and upbringing, rather than general intelligence.
If there's going to be a voter test, it needs to be extremely robust, something just about everyone has confidence in to be fair and appropriate.
1. Future tense because right now the US doesn't have 1 person 1 vote equivalence for most elections.
How does that work once the idiots are in charge of the budget?
> 1. Future tense because right now the US doesn't have 1 person 1 vote equivalence for most elections.
Well it does. The confusion is about what you’re voting for.
Society collapses and we become a failed state - but states fail all the time, universal suffrage appears to minimize the number of states that need to fail.
> Well it does. The confusion is about what you’re voting for.
When it comes to voting for president, my vote as a Vermonter is objectively worth 2.63 times as much as my friend from Washington - additionally the FPTP voting approach and winner take-all electoral college causes a lot of other oddities that make my VT vote essentially worthless when compared with a resident of PA.
There are a few ways we break 1 person 1 vote equivalence and while we can argue whether that's a good or bad thing you can't argue against it being the case.
Curious claim. Has there been any research that shows states are less likely to fail with universal suffrage?
> When it comes to voting for president, my vote as a Vermonter is objectively worth 2.63 times as much as my friend from Washington
See, that’s the confusion. You’re not voting for president directly. You’re voting for who you want your electoral college to vote for. In most states if you’re on the losing side of the vote in your state, your presidential vote literally means nothing.
Your individual vote in Vermont is not “worth more” than your friend’s vote in Washington because your both just voting in state level decisions about who the college should vote for.
The legitimate claim is about the number of delegates and (arguably much more important) the number of house representatives each state is getting.
Reiterated, there isn’t a lack of 1 person 1 vote equivalence in any elections I know of in the US (e.g. landowners don’t get extra votes). There are just elections people think are direct democracy when they are far from it.
I don't disagree on the point of voting - it's not technically a direct election of the president. But we're still voting to impact the presidential election and my vote counts more toward that decision than my friend in WA.
The only society's that i can think of that lasted a long time were society's that didn't have universal suffrage. The idea of a republic is pretty stupid to be honest. What you end up with is a bunch of people with completely different agendas to ensure that every issue gets hotly debated and when a decision is 'made', barely enforced or executed on. Additionally, it seems to give rise to massive paternalism and loss of freedom which is suppose to be the opposite of what it was meant to do.
That's why they're a bad idea and should not return.
Probably better off spending resources on improving education and political awareness.
I personally think that if we aren’t going to let someone vote then we shouldn’t ask them to pay tax either.
Agreed.
Conversely I believe that people who haven't paid tax in a reasonable amount of years, through either not generating it in the first place, avoision or being a net beneficiary of state aid shouldn't be offered a vote.
This is the same as saying "I don't believe disabled/poor people should be able to vote"
If you're mentally unfit to contribute to society then I believe you to be unfit to weigh in on our governance.
>unemployment
I previously mentioned within x amount of years (where x is deemed reasonable) to account for short stints of unemployment. I do not want the long term unemployed weighing in on our governance.
>pregnancy that year
Already covered
>international travel but still a citizen
If you're not present and contributing to a society, in my view, you should absolutely not have a say in the governance of that society. In fact, I find the idea abhorrent.
>As soon as you start pointing to reasons that a government can/ can't take away your power to vote you are screwed as a populace.
Not really. Our species has survived and thrived for tens of thousands of years before widespread "voting" became available. The free-for-all in terms of access to voting is very modern, and very Western.
The modern West is, coincidentally enough, now in a freefall downward spiral from which it likely won't recover. We've went from high trust, well functioning societies where one person could go out to work in a blue collar job and support a family, to a very low trust society now hanging on to false premises like a house of cards, where even two people working full time can struggle to put food on the table.
Screwed as a populace? We're already frogs in the pot and that is with this fancy "everyone gets a say" notion in place.
>Not that i have much faith in the voting system anyways cause' who knows how they count the votes anyways.
My lack of faith in the voting system is that some entity, barely through puberty, highly influence-able, no skin in the game and therefore nothing to lose, can be told by some troglodyte celebrity to go vote for their (the celebrity's) candidate of choice and that vote is exactly equal to that of someone who contributes to society and invests their time in keeping on top of the issues that society faces.
Sorry, but when it comes to governing a society in the name of preserving and advancing its wellbeing, the above is nothing more than a joke and a cruel one at that.
Then perhaps folks living internationally shouldn't be taxed. the truth of the matter is that living elsewhere doesn't release you from being taxed or filing tax returns: Folks in high-tax countries won't get additional tax, but folks in cheap places do.
I'll add that there are myriads of reasons folks won't pay taxes: Staying home to take care of children or parents is one of them.
I 100% agree. This is unique to the USA, as far as I understand it, and only applicable to those earning over $100K, but in my opinion no non-resident should be taxed.
Your state’s Secretary of State should be able to describe the vote counting process and how it is monitored by third parties. Confidence in the voting system is crucial in a democracy. Having questions is good but the answers do exist.
Let's come out and say it: this is a policy designed to consolidate power in the hands of the rich.
Universal suffrage is important.
Low information voting isn’t new either.
If it helps, I’d also stop the elderly from getting a vote once they’re within x years of the average life expectancy for their gender. If you’re not going to have to live with the consequences, you really shouldn’t be getting a say in things.
But don't use that as an excuse to disenfranchise the poor. Poor people are often better informed the richer people.
I wouldn't be surprised, but I'm still going to ask for some proof to the above?
Or people who might be expected to get sent away to inflict violence and suffer the consequent dangers of doing so.
Heinlein was all sorts of fucked up, but his repeated idea of ex serving military being more equipped to vote for the people who get to choose to deploy the military certainly has some merit.
We've decided to go the opposite direction. The US media, celebrities, big companies, etc. have all decided that a huge low-information voter turnout > smaller but better informed voter turnout.
Indeed, apparently democracy is better when everyone participates, regardless of whether a vast amount of those people have the slightest iota of what they're participating about.
In principle, that's a great idea. I mean, we do have to take driving tests before we are allowed to operate dangerous machinery. We should be required to take tests before we are allowed to affect the lives of millions of people.
You can have a similar argument for parenthood. Require classes before people are allowed to bring another human into their care. Nurses have to, why not parents?
The problem with that is that these tests/lectures are defined by other humans. This shifts an enormous amount of power into the hands of a few. Next thing you know, you now have a handpicked elite eligible to vote. The US has historically used this mechanism for segregation.
Having universal suffrage (which is not yet very universal in a few countries, US included) at least allows the average to smooth out outliers. It does create perverse incentives towards not allowing the population to get TOO literate, otherwise they will be educated enough to see through all the BS.
Collectively, we need to focus on improving education for everyone and fighting disinformation. World War 3 has already begun - except it's using words, not weapons.
Are driving tests not designed by other humans? Drivers test writer could already design the tests in such a way that would have them favour certain groups. They ensure a minimum level of competency, which seems reasonable to expect from those who are voting or raising children.
> Next thing you know, you now have a handpicked elite eligible to vote
This seems like the slippery slope fallacy.
> not yet very universal in a few countries, US included
Who isn't allowed to vote?
Okay, now start thinking about what happens when the political party you like least takes power and starts rewriting the poll test questions to advantage themselves. Then perhaps you'll see why this would be a catastrophically bad policy.
A not-so-subtly hidden and totally racist/anglophile question, designed to weed out people/cultures who don't historically follow England vs Australia cricket and know it's "legends". Upper middle class middle aged Englishman? Welcome in sir! Your skin isn't pure white except for the 4 days of summer it turns lobster colour? Well you're not "a good cultural fit" here, sorry.
On the grander scheme, any avenue for political groups to obtain or retain power will be abused. This is why we don't require licenses for people to have children, because the system will be abused in order to ensure a politically desirable future generation.
I absolutely agree that most people are stupid and should not vote (to put it bluntly), but the alternative is much worse.
If the next thing you are going to say is not "The current President of the United States", then sadly you are extremely mistaken because that's the only political fact you can confidently say that all Americans know (and even then, it's not 100%).
Source: A political science degree that I don't use, but this sad fact is well known.
People really don't. You can search comments here or elsewhere, you really won't find anyone calling anyone else paranoid for suggesting the government is watching everyone, intercepting communications, listening in on conversations, whatever. Find me a single example of anyone doing so in the past 2 years without an immediate reply from someone else (i.e. somene other than the OP) saying "No. Sorry. Since snowden you don't get to call anyone paranoid for thinking the government is listening."
In fact, quite the opposite I bet if you asked anyone with an Amazon Echo, "Do you think the government can listen to private conversations using an Amazon Echo" my guess is most people would say, "I don't know. If they really needed to, I guess?"
Nobody would say, "Of course not. Don't be paranoid."
Snowden didn't fail to change things because people didn't believe him. He failed to change things because he didn't articulate a compelling enough reason for people to be fearful of what he revealed.
If people reading this want to see this changed, we need to do a better job of showing the real world consequences of this lost privacy. Talking about theoretical concepts like lost freedom and privacy isn't enough. You need tangible examples of how people's lives are made worse by this spying.
This is not a valid judgement on any way. I just think some people may not realize the way others may perceive and think about this privacy dilemma.
Imagine going to the city and there is this trenchcoat and hat wearing private agent following you all day and you go into a store and see him handing the salesman a note and pointing at you, and then the sales guy comes over to you and says "good day - do you want to buy red things? and you are like "actually i am looking ..." and the agent is now uncomfortably leaning into you conversation, "... for green things". Sales says "sure this way, please" and the agent is writing "green!" in his notebook, circling it three times. That is what the internet is like today. And you look around and everyone has these agents following them, keeping notes. You ask someone about it they say "well most people don't even notice them" or "that is how things are" or "people shouldn't expect not to be spied on by private corporations". So you hurry home while from every side street more agents come and try to follow you until you have this horde on your track and you hasten into your door with a crowd outside holding up signs like "buy red things!" and "green thing is green!" - but you are now at home so you relax and walk through your hallway to your room and say "computer: play some licensed music" and guitar music starts playing and -shocker- there are agents in your living room, one sitting on your couch playing the guitar, one is standing in front of your bookshelf taking notes of its content and another one is looking through your fridge, then stares directly at you and holds a sign up: "buy food"
The internet is nothing like outside.
The notion that my papers inside of my rented apartment have dramatically more protection than my data inside of a rented server is absurd.
Edit: or more precise the "Stored Communications Act" - Cloud Act seems to deal with offshore servers in particular.
Basically you have “no reasonable expectation of privacy” with respect to any information that you provide to a third party who is not an attorney providing counsel or a doctor. Your bank records for example, do not require a warrant to access under this principle.
All of this put in place by the courts. Stranger still, this sort of thing has become something that “conservative” judges are champions of.
Currently most of us are used to the pseudo-anonymity of big cities, where people technically can know a lot stuff about us (because it happens in 'public' space, as you describe) but they overwhelmingly don't, because the vast majority of them are strangers who don't care. The new digital environment, on the other hand, is quite a lot like a small village.
The grocer can make effective suggestions for your food because they remember every purchase you ever made, they will know your consumption habits better than Amazon or anyone else in the modern world. They will know if you're expecting guests tonight just because of your purchases (and might gossip about that), and in that case they'll point you towards their cousin who's selling wine across the street. They will know if you're eating something that their other cousin, the local doctor, has said that you should avoid, and might refuse to sell you that.
The local lender (whether a banker or just a wealthy farmer who's a loan shark) does not need to 'profile' you - they know your dealings and your character, they'll know even if you've been stingy in giving back borrowed things as a teenager. If you buy condoms, the pharmacist will likely know with whom you're planning to use them. The contents of your bookshelf, as in your example? The village knows about that, people have been to your house, if there's anything unusual, word will get around - and if people have not been to your house, you've kept your privacy and the village does not know you, then you'll be treated as an untrustworthy weirdo with maximum prejudice; because keeping private is just not How Things Are Done Around Here. If your political opinions or religious views or sexual preferences don't fit what the village expects, good luck mentioning about it - their condemnation will be much more fierce than any Twitter mob.
So in that aspect, it's not something new, the level of privacy is slowly becoming as low as it was historically when we lived in much smaller communities. We have had some centuries of urban pseudo-anonymity, but it's fading now. It has been just a temporary reprieve, when you could move from a literal village to a big city, get lost in the crowd and be free and anonymous. It was difficult to do in ancient times, and it might be difficult to do again in the future.
But to answer your question: I believe that the constitution must limit the data, which government agencies and private corporations can legally aggregate and process. Our european constitution says that personal data belongs to the person, and refers to the concept of consent for limitation of processing. So to answer your question: no, if people are well informed and freely share their data with a corporation, i would not restrict their freedom to do that.
I do however disagree that this is what is happening right now. Corporations behave like its a gold rush and the one whi mines the data owns it. In my honest opinion the relationship between the data aggregating corporations an the data subjects is highly abusive. Many people have little to no understanding who collects their data for what and many of those who understand say they have no real choice but to let it happen.
This is where the "like outside" argumentation happens: well you can't prevent your neighbor seeing you leaving the house. Sure that might be true in some way, but this neighbor installed a surveillance camera and makes photos every time i leave the house, then follows me to the store, takes notes what i buy and tries to hold a microphone into my conversation with the clerc. That is why i split between the spy and the clerc in my analogy, the agents work for a "Lead Intelligence Service" or similar adtech entity.
Lets look at facebookistan with its population larger then the USA. In the anthropomorphic village metaphor, who is this "Facebook person"? For many it is an every day companion that is present in most of their interactions with other people or companies. The person they go shopping with. Facebook is not a clerc or a neighbor, but a clingy spouse that is also trying to sell you stuff and is gossiping about you behind your back. And that is too positive, as it lacks the asymmetry: FB throws your stuff away if it doesn't like it, rats you out to the government and hands you a divorce without ever having any feelings for you at all. Also almost everyone in the village is married to this one person, who can be in all living rooms at the same time. And not being married to FB has serious downsides, like being the only one who does not go to church. FB is not like the village clerc, at all.
The Anthropomorphism is an illusion.
The truth is, despite all of the analogies you've presented about neighbors with security cameras and clingy spouses, most people do understand that and they simply don't care. What realistic future so you see where that comes back to bite them, beyond feeling like it's creepy?
> most people do understand that and they simply don't care
That's the thing: if they are well informed, of the appropriate age, and give consent, that is fine by me. But in my opinion the relationship between the mega-corporations and the people is one sided and abusive, so such careless consent isn't worth much. Imagine a village and i say to you "hey that farmer is beating his wife", would you say "well that is how they do things here, most farmers are beating their spouses, and they don't seem to care"? There is something wrong with that village. But i think the corporations as people analogy is overused. For most data farmers the users are more like cattle, not spouses or neighbors. This asymmetry can be seen with other freedoms as well: many people don't read contracts anymore, leave alone know about the freedom of contract. They simply have accepted that the corporations give them one and they sign that unread. After all, what alternatives exist to <monopolised proprietary technology everyone uses>?
> What realistic future do you see where that [unregulated data farming] comes back to bite them
A change of society away from "Liberal Democratic Capitalism" to "Totalitarian Surveillance Capitalism" enabled by mega-corporations abusing their position as gatekeepers for social communication, capitalist markets and even government services.
(To be pedantic, it doesn't matter if it's a simulation or not. The important part is that we are not what we think we are.)
Of course this is way off topic, so I'll try to steer us back.
The NSA has a choice between improving domestic security by helping to improve standards and protocols, or choosing to deliberately weaken them so they can collect more. (As an aside, it is nonsensical to collect any more since they cannot even process what they are collecting now.) NSA has chosen to support and encourage the weakening of information security, and that has had serious consequences for both national and global security. One good example of the consequences is the Shadow Brokers dump. https://en.wikipedia.org/wiki/The_Shadow_Brokers
> It is that people don't really care that they are being
> spied on.
Well, my experience is that people care but don't have an idea on how they could change that. They feel powerless, have no idea what to do, and they are apathic. They accept their shackles like they deserve it. They know they are abused but since they are human, they use coping mechanisms to continue using apps they believe are actually not so nice for them.
Of course they have thoughts like "actually, my picture is not private anymore", but for their sanity of mind they carry on because of network effects/ease of use/etc. They choose to push those thoughts off, as they are outside of their control. To us, it might sound like they just don't care. That's wrong!
At least, that is what I conclude after talking with non-techies about this stuff.
I am sure you can sell privacy as a big plus, but you need to deal with above aspects as well.
People feel that they are powerless to change this state of affairs and they are correct. Snowden told people it was happening, most people felt it was bad, but what they going to do? Stop using the internet? Elect someone that will shut down domestic surveillance? Throw away your phone? You might as well tell people to go live in a cave, eat lichen for food and lick the walls for water. People given no other option will accept what options remain. This even includes the option of facing certain death.
Id' say it's weirder still. A lot of people are well aware, and some even spout the wildest speculations about data usage, but if you actually go beyond shallow comments and suggest action (preemptive, legislative, etc) you are often met with a general "well, you care too much" attitude.
I get it, there's a lot of effort to be put in just to understand these matters, let alone remedy them.
That's Cisco's own fault given that there are rarely more than 6 months between critical firmware releases that either have some way of hardcoded backdoor account, remote code execution or other similar bugs.
Now, you should resist, yes, but most people don’t. It takes a very brave soul to resist and hope the Supreme Court will side with you. Civil disobedience generally also requires vast public support who would rally behind you. Practically everyone knows Rosa Parks, but polls have shown only about 60% of Americans have even heard of Snowden. Public support is a fraction of that.
Cisco’s executives would also end up being involved in some massive lawsuits if they shut down the company to take a stand. Lavabit, OTOH, was multiple orders of magnitude smaller than Cisco is, and they could afford the backlash. It also didn’t help that Lavabit catered to tech people who would understand why they shut down. Cisco, OTOH, is used by virtually every large business; many of the employees of which would not understand why they shut down.
The NSA isn’t really in charge of the killing part anyway, that’s the CIA/FBI’s job
So basically the CIA and by extension the US government has compromised their allies' communications. I hope there are massive consequences, but probably not.
No. They'd call you a "conspiracy theorist". By "they", I mean the news/media would call you a "conspiracy theorist".
In fairness, my lack of trust for Cisco products pre-dated the Snowden revelations, and were based on the products themselves.
Nothing I've seen since has caused me to change my opinion.
https://hub.packtpub.com/cisco-merely-blacklisted-a-curl-ins...
Meaning that before, they were free to plant as many back doors as they pleased without any concern for the consequences. And even now, they just need to think about it a bit and warn somebody, no idea who they tell, if they notice it being used.
>NSA now asserts that it cannot locate this document
This is fairly clear proof of either corruption or complete incompetence.
Kinda. There apparently is some approval process and such but I'm not sure everyone at he agency was able to make such requests in the first place...
I'm with your gist, I'm just not sure we know how widespread it really was. I'm not inclined to agree that it must have been ultra widespread.
We don't know the full extent of their activities, but it clearly far surpassed what should be tolerable.
The NSA needs to be disbanded.
However many people somehow simultaneously hold the belief that these agencies should continue to exist, are deserving of our taxpayer dollars, and are generally Good Guys who happen to do bad things sometimes. Perhaps it's just too exhausting to consider the extent of corruption in the USA.
My guess is that most Americans would expect that they sometimes do things that aren't legal, but that generally they are at least intending to do it with the best interest of our country in mind. That second part is the primary reason why they aren't being wholesale shut down, and why they're able to get away with things like lying to congress.
Two thoughts:
1) Even if most Americans decided they needed to be shut down, how would we enact that? It seems to me there are very few people who have that power, and even if a great majority of us wanted it, we have no way to enact it (and no way of knowing if it was actually enacted; we could be told it had been done, but that could easily be an inscrutable lie)
2) If they were actually shut down, what would the people who worked there do? Highly intelligent, skilled, with low morals, used to performing nefarious activities; they would go on to be in shadow NGOs, organized crime, reform under other names, etc.
Prison time, like any other criminal enterprise.
If you took the NSA's "incidentals records" database and said you were purposely tracking Americans, it would obviously be unconstitutional. So they created a loophole to claim the obviously illegal act is allowed.
I disagree. I think they absolutely believe they are doing what is best for the country, but without actual accountability and meaningful outside oversight and input, I would say it is far more likely they have become myopically focused. That they are unable to accurately judge or weigh the effects of persistent surveillance against one’s own citizens and how that negatively impacts a free and open democracy and a government that feels accountable to its citizens, vs their own very skewed perspective of looking at nothing but “threats” and thinking about nothing but threats, and planning for nothing but threats. The “everything is a nail to a hammer” saying comes to mind.
Abolish the (secret) police?
It's basically the same debate; people need to feel that the threat from the "protectors" is greater than the threat they are allegedly protecting against before something gets done. And, realistically, being spied on by the CIA is fairly low down the average person's list of problems. Even the citizens who are most directly threatened by American policing would prefer dealing with the immediate threat of street violence and gunshot murders by the police than the distant, nebulous threat of the CIA plane over the protests.
Having your candidate spied on by the CIA, FSB, Met police, or Jim-Bob's Laptop Repair Shop is more of a problem.
Objectively, even in 2001 terrorism was a negligible risk compared to everyday risks, and subjectively, there hasn't been a major terrorist attack for years. The only reason mass surveillance exists is a rationale by the US state that "more power is good". This may apply to the US army, but not to the spies.
Also, like you say, once the american spies start to (pun intended) "Interfere in american elections", then the problem affects everybody with P=1. Personally I could live with it trump were the only candidate they work against, but if they do it to trump, they likely do it to others. (I see no evidence of interference or other abuse of collected data currently, but I think it's dangerous to give them the power to collect all this info that can in principle be abused for selective prosecution and/or blackmail).
Also, it affects not just politicians, but also corporate execs, who can be further pressured using the other means of the state, and who themselves have power the state can deputize.
A democracy should have the surveillance powers that are proportionate to the benefit from these powers and no more. There is a positive value in minimizing state surveillance power; this concept seems lost on america. (In fairness, it seems lost on conservative parties worldwide.)
Their mindset: we own the United States of America, and the rest of you are just sheep. We are doing shepherd's job and you don't need to understand it. We are doing wolf's job because there are wolves at the gate so we better fight back with bigger teeth. We the people do not include your ordinary sheep, and only the privileged ones are "people".
The big issue with backdoors, is that it's only a matter of time, before they become "front doors."
Presented for your approval. Imagine, if you will, a software engineer; probably based in the US, that writes a backdoor into equipment used to manage a banking transaction network. This is a fairly natural place to have it, as "follow the money" is a classic forensic technique.
Of course, access to this network could net nefarious (probably non-state) actors a lot of money.
Said software engineer suddenly quits and buys a Bugatti.
The back door is now a front door, and it's baked into some hardware that can't easily be changed, as no one trusts the patches, now.
is that it's only a matter of time, before they become "front doors."
There will always be a BBEG, no matter what part of the world you are in or what sort of government you live under.
You are the only one who acts in your best interest.
No, you aren't. And it's impossible to do everything alone.
I'll admit I was being a bit dramatic, and as you have pointed out it's certainly more complex than a single sentence. I was trying to highlight that blindly trusting another human or organization can leave you vulnerable.
Although for some devices if you can root it, you probably also know methods of securing it.
The default root methods just enable apps to request root, after which the user gets a prompt. It's like the camera, microphone, or any other special permission.
https://www.zdnet.com/article/minix-intels-hidden-in-chip-op...
It seems like a massive waste of chip transistors and R&D with limited gain. The hidden minix OS runs at a higher privilege than your host OS. Even if your data is encrypted, any time you decrypt locally, they can see it. I get it, they are looking for bad guys, what if the bad guys take over? There will be nowhere to hide. Yes, I am wearing a tinfoil hat.
The intelligence community didn't open up like this because they wanted to be nice. They did it because there was a very real concern that US industry would be damaged in the eyes of global consumers -- primarily as a result of our intelligence agencies being being too aggressive and, frankly, being sloppy. (It's bad enough to pay for and hoard backdoors, it's another thing entirely when those backdoors are repeatedly stolen and leaked for bad actors to use.)
I guess the news here is that the NSA didn't learn very much from these episodes, or at least, it no longer feels like it needs to repair the damage.
[1] https://en.wikipedia.org/wiki/Vulnerabilities_Equities_Proce... [2] https://www.nist.gov/system/files/documents/2017/05/09/VCAT-... [3] https://www.thesslstore.com/blog/nsa-microsoft-releases-patc...
No, because once their backdoors are (inevitably) going to be found/leaked, they'll come off as liars. Plus, if they would have said no, nobody would buy that or would think they're asleep at the wheel.
This seems to be a common thread in American political corruption. After a certain point, the public just doesn't remember or can't be bothered to care or feels powerless to do anything. Then you can basically do whatever you want as long as you stay quiet enough to avoid another wave of media outrage.
To me a 'back door' could range from 'don't fix that bug for a week' to 'push this update to this user' to some absurd 'hey can you add this remote desktop client to your code, the password has to be 1234'.
By no means is it a light thing to do but I do believe there is a range of actions that would constitute a 'back door' to me.
Granted I'm all for more congressional oversight and I'd like to see MUCH more aggressive congressional action.
The problem with your second example, targeting a specific user, is that they're doing this without any kind of warrant.
That is what parallel construction exists for. Also known as fruit of the poisoned tree.
>Secret encryption back doors are a threat to national security and the safety of our families – it’s only a matter of time before foreign hackers or criminals exploit them in ways that undermine American national security
Software / hardware industry is PLENTY good at paving the way all on its own.
As you say, the hardware/software industries have enough difficulties with security acting on their own. They don't need the NSA purposely making more holes.
EDIT: Another reply has provided a quote that shows Wyden's views on backdoors. He appears pretty strongly against them.
"Hello Support? My computer just popped up a message to say that a bad actor has taken over my computer; should I reboot it?"
Hypothetically.
For example, the US DoD now classifies JetBrains products as prohibited, which trickles down from the 2020 National Defense Authorization Act. I'm guessing this is because they are foreign-controlled, and refuse to comply with National Security Letters requesting backdoor insertions.
Why does the press never mention this?
It's in part why there was an email server in the basement, most people should have theirs there but gmail mostly won that battle due to spam management.
Only example perhaps.
What other back doors have they done?
Literal secret rooms where they tap data, these are not conventionally called backdoors. Nor are unpatched zero days the supplier originally didn't know about.
I don't think any country can install literal backdoors on products without getting caught. Backdoors seem like a Hollywood thing straight out of WarGames.
Why attack the Chinese or visa versa when you'd be basically working for them by damaging your own companies when you get caught.
Not to mention the wholesale hacking of their products bound for export:
https://www.infoworld.com/article/2608141/snowden--the-nsa-p...
Neither of these anecdotes proves anything.
We had one anecdote saying a thing is happening, the second from someone who says it isn't. Your post seemed to indicate that the second post isn't true because maybe that person just doesn't know about it.
That seems to refute the second and assume the first is true.
I say this because NSA seems more clever than that, and because any scheme to explicitly add back doors is bound to be eventually exposed.
Instead they do things like have their former employees and contractors hired into tech companies, and those folks add innocuous bugs that can plausibly be denied as back doors. Also I bet they look for bugs that can be used as back doors, given access to source code and chip design data, then fail to fix them.
Most if not all ICs above a certain intelligence level have JTAG, which effectively is a backdoor. All you now need is (for those chips that support it, in the first place...) a way to bypass the OTP fuses "preventing" JTAG access - this kind of vulnerability turns out often enough to be saying it's commonplace.