Hacker News Reader

Comment by jimlongton | Hacker News Reader

Yes, look up the Bhima Koregaon case in India. Indian police used Israeli spyware to hack the phones of lawyers, human rights activists and critics of Modi. They also used phishing and other malware to plant terrorist material and then imprisoned them.

> In Wilson’s case, a piece of malware known as NetWire had added 32 files to a folder of the computer’s hard drive, including a letter in which Wilson appeared to be conspiring with a banned Maoist group to assassinate Indian prime minister Narendra Modi.

[1] https://www.washingtonpost.com/world/2021/07/20/indian-activ...

[2] https://www.wired.com/story/modified-elephant-planted-eviden...

View on HN

Just last year an NSA ... contractor? ... was convicted for mishandling classified materials, and, curiously, not for possessing the child pornography they also accused him of having on his computer. There was a wholly credulous New Yorker article about it, linked on HN.

Supposedly he had foolishly exposed all the passwords of his phone and online accounts so they could freely find anything they liked, or that had been planted. And the unit he worked in was, IIRC, coincidentally exactly involved in cracking security on accounts, and somebody else he had worked with, there, had developed an antipathy toward him, to the point that he had filed an HR case expressing fear for his own safety.

That a top-level security expert would have left all his own passwords exposed was transparently ludicrous, and the author and jury should both have been deeply suspicious of any evidence claimed to come from it, but seemed entirely oblivious.

It is just possible the jury saw evidence not derived from online records. But I doubt it.

> That a top-level security expert would have left all his own passwords exposed was transparently ludicrous

Not quite. Some experts apply all their own expertise to themselves, others are more lackluster about their own opsec because they 'know what they are doing' or 'this isn't anything important'. Never underestimate human laziness.

I work in IT security and I see the full range of total disinterest to full tinfoil hat mode in this environment when it comes to people's own resources.

Also, it depends on people's area of expertise. Most of our networking security specialists are running segmented VLANs and IDS at home, and WPA3 with all the trimmings. The Windows AD security guys would just have whatever router the provider provides and sometimes don't even change the provided wifi password (which in many cases is algorithm-generated based on the MAC address or something!), but their windows workstations would be top-notch secured.

It is transparently ludicrous to assume as a matter of evidence. Yes, many people are stupidly incautious, particularly when they "have nothing to hide". But having nothing to hide and therefore being incautious make planting anything easy.

Back in the office days I'd see senior-tier engineers without uBlock, loading blatantly malicious ads and being redirected to fake flash player download pages while giving a presentation, Firefox message saying that their SSO password (saved in browser of course) is reused in other places and shows up in compromises, browser addons on work PCs that exfiltrate every URL visited and inject rubbish onto every page like Honey or Rakuten, signed into personal accounts on a work device...

It's kind of bizarre.

You're confusing a few details, he was a CIA employee and he was almost certainly guilty. You should read through the court transcripts, they basically recovered logs showing him doing it on his workstation and managed to narrow it down to the leak on the basis of a typo in a command that existed in the logs and in the copy of the dump sent to wikileaks.

He spread a lot of FUD in his defence though, so if you don't pay attention and bother to read the court transcripts you'll walk away with the opinion you have.

For the record, he was barely computer literate-- they made their living writing programs that basically just inject DLLs and copy files. I'm probably being a little untruthful calling him border-line computer illiterate, he has a bachelors in CS or similar, but he was just a basic programmer and not some sort of super hacker or exquisite computer all-star.

Logs are as easy to fabricate as anything else. Especially for people in that line of work. Which could easily be what they actually did on a day to day basis.

While in jail he had his passwords for his contraband phone written down in his notebook. How was that fabricated?

https://www.newyorker.com/magazine/2022/06/13/the-surreal-ca...

Anybody could write a password into his notebook, at any time it was in their possession.

Do I have proof the evidence was all fabricated? No. But there is no denying the case stinks.

That's ridiculous to claim without evidence. How would they know the password to plant in his notebook? How did they get into the phone? Why wouldn't he bring that up in court?

Reply on news.ycombinator.com