Hacker News Reader

Comment by carlmcqueen | Hacker News Reader

Anecdotal, and old now: I worked with an ex-NSA agent when I worked at a big bank who worked out of a some of middle east offices in early 2000s. He talked about how new agents often struggle with the size of data (even then) but most good agents work immediately to look at the lack of normal data. Criminals/targets have their own signal of data and by filtering traditional data patterns you're left with a smaller dataset of the targets you're there to find. He used the same patterns to find financial white collar cheaters in bank data.

(example: phones off during day, on from 1am-5am then shut off again, no facebook browsing at all, etc.)

View on HN

Germany has been doing this since 1979, when mainframes were used to "find terrorists" – i.e., grab a bunch of companies' billing data, and filter for people who were "suspicious" by paying their bills in cash and couldn't be cross-referenced with other government databases, to find people who were (allegedly, surely) using fake identities.

Highly illegal, and put about 18,000 innocent people in the crosshairs of police investigations, but it's for The Greater Good, so nobody ever got punished for it, and today it's done by police agencies for such world-shaking crimes as speeding tickets, participation in legal demonstrations, and substance abuse.

Meantime their former Chancellor moved straight to executive role in Gazprom. Germans - "looks legit nothing to see here, ve must catch all copyright violations and public media fee debtors".

Also Wirecard fraud happened underneath the noses of the authorities who were provided proof from journalists and they still couldn't see it.

The wirecard people were Russian intelligence and had access to the highest level of politics. Nothing to see here.

The head of the Constitutional Protection Agency (BfV) turned out to be a right wing radical who is hanging out with Neonazis and "Reichsbuergers". Nothing to see here

His second in command was present at a meeting to plan the deportation of "not pure germans" last year. Nothing to see here.

Keine sorgen, Sie schaffen das. Das alles. Pre-pandemic dispute in Germany was absolutely toxic. Raising concern about any from the above was impossible. Being "concerned" was a straight way to be called "concerned citizen" ie. "Reichsbuerger". That was then, now I don't know either care.

> His second in command was present at a meeting to plan the deportation

I hope the meeting was not held in Wannsee.

That would be far too on the nose, so they decided to do it a few kilometres to the west.

And the BfV was involved in funding and covering up a right extremist murder spree. Nothing to see here.

And they kept shredding files pertaining to this. Nothing to see here.

Phones off during the day and on during evening hours would describe the behaviors of NSA employees who aren't allowed to carrying phones into their office, are less likely to share or participate with their personal details on social media and is a workforce comprised disproportionately of people with unique quirks like odd sleeping habits.

I'm sure that's not lost on them either, but their signals they seek could be finding other intelligence agents and not criminals.

I’m sure that this is merely a first-pass filter and not a case of arrest warrants being automatically issued based on usage (although I’m sure that will come soon enough).

Exactly. The value of simply windowing your search set by a few orders of magnitude, with low false negatives, is underappreciated.

Getting from 100,000,000 to 10,000 (0.01%) makes other subsequent methods viable, including "have a person follow them," that wouldn't be on the full set.

> Phones off during the day and on during evening hours would describe the behaviors of NSA employees

He did say they were looking for criminals, no?

Not true. I know folks who worked at an aircraft manufacturer with similar requirements and classifications. They had a locker they would put it in somewhere. Some people would grab them at lunch, leave, and put them back. They said it was because of the camera on phones.

Err, it isn’t totally obvious which part of their anecdote your anecdote contradicts.

You don’t have to turn off your phone 9-5 if you’re working on in a government facility. You aren’t going to be flagged as a terrorist because you turn your phone off.

It doesn’t have to be off, but you can’t have it in secure areas. I think the dividing line is secret (ok) top secret (no cameras)

Wouldnt NSA/any government employees be exactly the type of person Spies are interested in keeping tabs on?

Intelligence agents/spies from other countries, or opposing countries, are criminals to us.

> finding other intelligence agents and not criminals.

Who I’m pretty sure have somebody who can tell them how to easily spoof this signal.

"example: phones off during day, on from 1am-5am then shut off again, no facebook browsing at all, etc."

So if one uses an old fashioned feature phone without internet then one automatically becomes a target.

Similarly, I have a smartphone but no Facebook account so I must be a target.

Well good luck to them I'm pretty boring.

If you had a cell phone that was only on between 1am and 5am, that would be mighty suspicious.

And believe it or not, not having a Facebook account does cast a shadow which makes you more interesting and mysterious. Why don't you want to telegraph your entire social graph to the world? What are you hiding?!

But in all seriousness, none of these are making you a target of anything by itself. If you are _already_ a target then they make you an interesting outlier that needs deeper investigation.

If you want to be boring in data it has look like other data. Sometimes being absent entirely in data is interesting.

> Why don't you want to telegraph your entire social graph to the world? What are you hiding?!

I remember in the earlier days, 10+ years ago, that was -exactly- how people looked at me whenever I said I don't have a Facebook account. I'm glad most people are out of that mindset, at least, even if it makes me seem like a target.

There is more of a fragmentation of social media networks now than before. More corporations are trying to enter that business I guess. In effect, this makes it less of a chock to say that you don't use Facebook, because you could easily be using another platform. So given that you don't use Facebook there is a lower probablitiy that you are avoiding social media entirely, hence less drama.

"Target" is likely inflaming some people here.

To use the neutral -- it makes you an outlier or ab-normal (different than normal).

Being separated from an average profile doesn't mean you are anything. It's exclusionary, not inclusionary.

Which other groups you fall into (privacy-concerned techies, terrorists, aficionados of pistachio ice cream, etc.) would require inclusionary signals.

And absent living off the grid, you're likely not going to mask exclusionary signals, simply by virtue of most people creating them 24/7. That's a lot of "side work" to artificially keep up with.

"To use the neutral -- it makes you an outlier or ab-normal (different than normal)."

I'd turn this around and question why a large percentage of the world's population is mindlessly following a modern fad as if they were a pack of lemmings.

Something has gone seriously wrong with the social order.

A combination of monetary incentive on the supply side (from big tech and big media, as centralized, larger-scale products are more profitable) and modern technological capability (smartphones providing computing platforms to most of the world, networked via cellular data)?

There's far less profit and incentive in making decentralized, smaller user base products.

Humans evolved to mimic each other. Fads, fashion, culture, dialect, accent, manners, shared knowledge - the same root.

> Humans evolved to mimic each other.

Why didn't you use the word 'monkeys'?

Its untrue and derogatory. While both primates, humans don't have any monkeys as ancestors. The term monkey is applied to humans when someone wants to belittle their behavior, often when we want to point out that one group is lesser than another group who does not behave that way.

It's true and derogatory. But it's just derogatory for humans who have an exaggerated view on themselves. Stanford's Robert Sapolsky had an excellent course on Behavioural Biology. You can watch it for free.

While monkeys and hominids (apes, humans & chimpanzees) are both primates, they are separate groups that have evolved separately. Any inherent behavior we share with monkeys either came from a common ancestor or was co-evolution.

It is derogatory because it is used to belittle and dehumanize. It has and is commonly used by people with an exaggerated view on themselves to slur other groups, most famously against Africans. Monkey behavior is assumed to be lower and less desirable, and something that should be overridden in humans or be corrected for. Correctly defining things as human behavior (even if primitive behavior shared with our ancestors) is neutral, identifying it as natural and default behavior inherent to our species, and not a joke or slur.

Yes, the Sapolsky lectures are excellent and still hold up IMO.

Sorry, I confused monkeys and apes. In german, we have no nice single-term for monkeys, just Affen for Primates and Menschenaffen for Hominidae, and I didn't thought about that before.

But it makes not much difference. A friend of my wife once gifted her a capuchin monkey, so I could observe the astonishing behavioural similarities to humans (human children) first hand. Since then, I see more and more of them, especially in group behaviour.

And, btw, I don't give a damn how other people use the terms.

"Why don't you want to telegraph your entire social graph to the world? What are you hiding?!"

I'm not expecting you or anyone to believe this but I find the whole concept of Facebook boring, in fact mindbogglingly mind-numbing.

What's missing from people's lives that makes them addicted to Facebook? After all, humankind has survived and managed without Facebook for all of human history save the past couple of decades.

Given a normal distribution of interests, statistics would suggest there's likely a few more like me tucked tightly down one end of the distribution curve.

I think lots of us find Facebook boring and aren’t addicted to it, but have an account. It isn’t at all hard to believe that you find it boring and don’t have an account. Most people don’t have Facebook accounts.

It's a combination of factors, not a single one. You can have your phones off all day at work, and one in the middle of night, but be on Facebook and that is only 2 out of three factors that would in the example make your device suspect.

"Must be a target" in the sense that you're included in an early subset of data that is filtered on abnormal behaviors who will get additional filtering applied to them. Pretty sure the next step isn't tapping your phones and assigning you a tail but applying extra filtering. I'm not in intelligence but I've worked with psychiatry data before and it became boring and routine to identify people with previously undiagnosed mental disorders via data analysis with relatively small amounts of data compared to population-level scales. The intelligence agencies of the world surely know about slightly paranoid techies and have a behavior profile that allows false positives to be filtered out in another pass.

"Used a feature phone at odd hours for years but began leaving their phone behind to go pull large quantities of cash from the ATM according to bank records, followed by a new circuitous route around town where they don't live or work or have associated friends or family according to traffic cameras" is much more interesting.

> "Used a feature phone at odd hours for years but began leaving their phone behind to go pull large quantities of cash from the ATM according to bank records, followed by a new circuitous route around town where they don't live or work or have associated friends or family according to traffic cameras" is much more interesting.

Or they're a slightly paranoid techie going to a dispensary

You can easily become a target for surveillance without doing anything illegal - and that's still (potentially) not a good fate! Paranoid technies might not like the idea of langley, and fort meade listening into to all of their communications.

I don't think that they just "filter it out", I think that spying on techies/industrial spying and technical espionage has never been bigger. I also think anyone working in AI right now is for sure at serious risk of being designated for advanced targeted surveillance.

Like all things, I think the signal being described is just one type of indicator/filter. When used alone, it probably narrows down but not to numbers a mere mortal could handle. When combined with additional filtering, it probably helps reduce down to numbers that is much more manageable.

If you only used "owns a copy of To Kill A Mockingbird" to indicate a serial killer, we'd have a lot of false positives of serial killers.

Becomes part of initial data set. I do share your annoyance, but the only way this does not happen is if the data is not collected at all. I am not entirely certain this is even possible without some major upheaval in our societies.

> Similarly, I have a smartphone but no Facebook account so I must be a target.

I'm sure they have a variety of "typicality" profiles for the significant fraction of the non-criminal population that doesn't use social media. In terms of being a target of investigation, all you have to worry about is if you deviate too much from those profiles.

"...they have a variety of "typicality" profiles for the significant fraction of the non-criminal population..."

I'd be curious to know if it's fact or otherwise but I'd assume it's correct. Like the curious person I am, I'll follow a link in a story to a related matter that of itself is innocuous but it contains a link to some 'darker' site, and so on.

Thus, it doesn't take long to end up on sites that are 'questionable' and one realizes it's not a good idea to be seen hanging around them despite the fascinating info that they often contain.

It seems this is an occupational hazard for curious nerds such as me. ;-)

This isn't surprising, I feel like it's been common knowledge. I maintain a token social media presence precisely because I feel it would look weird/suspicious not to.

It's like hiding $500 in a dummy wallet in your underwear drawer, if someone finds it, they think they found your stash and they move on without tearing the rest of the place apart.

Same reason why I let Google hoard many of my photos. It's the low hanging fruit that makes creating a presence easy. Folks aren't going to look beyond the curtain because they expect the curtain to be there and be all that's there. It's only when you leave the curtain wide open being a digital nomad of sorts that anyone looking has to look deep to find anything at all.

In a way, maintaining token controlled usage of these services is more anonymous than avoiding them, which is wild.

> maintaining token controlled usage of these services is more anonymous than avoiding them, which is wild.

Very insightful, thanks. Still, seems a bit overkill, since I believe there are legitimate people out there who are not using any social media, etc.

Yes but I think the point is even in that case anyone snooping would be drawn deeper to find something.

It depends on who you are trying to be anonymous from. I don’t spend much time trying to hide from the NSA. I care more about being targeted for advertisement or having my insurance premiums raised because of some naughty behavior. These are more impactful on my day to day life.

> It's like hiding $500 in a dummy wallet in your underwear drawer, if someone finds it, they think they found your stash and they move on without tearing the rest of the place apart.

This is one of the silliest things I've read in a while. Maybe it will stop your junkie kids from pawning your shit but there are no "rules" to burglary otherwise.

We were burgled just last week. Despite stealing a single large high-ticket item ($2000) it wasn't enough to stop them from stealing random garbage and glass and metal jewelry the kids made at summer camp. They took everything they could carry.

Regardless of the rest of your comment, you brought up a great point about how bait can work really effectively. Instead of stealing real jewelry, they stole obvious fakes. I understand that that might sentimentally be worse to you, but it demonstrates how effectively you can counter burglary through baiting, which of course is the very point you claim isn't true.

I'll consider bait jewelry as well, and try to increase the size and weight of the bait to make it difficult to carry more. That's good advice.

> This is one of the silliest things

It's not silly at all. Taking everything they can carry is not the same as tearing apart every pillow / mattress / picture frame / etc.

I got my house burgled a few years ago: they found my decoy "hidden" stash. I left a 2 gram of gold sheet there (yup, literally 2 grams, worth 80 EUR at the time), with its certificate. That and a two silver coins worth 20 EUR a pop.

They thought they hit the jackpot. They didn't find the real hidden place where shitload of wealth was stored.

I was pissed that I got burgled but at the same time I, literally, laughed all the way to the bank with the actual gold/jewelry. I say literally because I don't keep that at home anymore now (it's in a safe at the bank, which moreover has an insurance).

There was literally 20 000 EUR worth of gold coins and jewelry very close to where they found their "jackpot" (of about 120 EUR).

And it's a trick I learned from my grandpa: he always had two wallets with him. One day he got robbed in a supermarket (well everybody got robbed there that day): he gave his dummy wallet and kept all his money and precious papers.

You are very greatly overestimating the IQ, approximating that of an oyster, of bad guys. Youtube is full of thieves getting caught and you can see the imbecility in their eyes.

Now I'm not saying one or two aren't above the rest but most them are pathetic.

Absolutely the same for me, but for the police or NSA or whatever, it's for the people that don't believe that I have the right skills...

"Oh well you're a computer nerd, nerd don't sport" kind of thing

This is known as the absence of evidence is the evidence. It might work when you aren't subject to any laws but no court in North America should ever allow such a thing to be presented to anyone.

They aren't using the lack of evidence as evidence itself, they're using abnormalities to narrow down where to search for actual evidence.

It's not evidence its intelligence. If you're looking for someone who took possession of a bomb, or who traded on insider information then you would use the list to look a little closer for evidence.

The NSA isn’t the police. Also, the police are t going to charge you with “insufficient social media use”, it is just one of the filters they use to comb through the massive data load.

Not using Facebook is fine. Not using Facebook, using Crypto currency, having multiple phones, unexplained income, lots of calls to foreign numbers, trips to countries not commonly visited by tourists, associations with known criminals/terrorists, and so on raises your profile and makes them take a second look at you. Any one or two hits probably doesn’t get you out of the noise, but a person who hits on more than that starts looking suspicious.

You just reminded me of my interview for my Trusted Traveler in 2020 when I forgot about a trip to Morocco when listing my international travel. The way the interviewer raised it, I thought I was going to be sent to Guantanamo.

> Not using Facebook, using Crypto currency, having multiple phones, unexplained income

Every mobile developer (with test phones) who owns some crypto with a wife who runs an Etsy shop is sweating now.

Minor nitpick but the NSA does not employ agents, but rather analysts and (sometimes) operators. "Agents" in the IC sense are people that do your bidding, i.e. recruiting someone to insert a USB drive into a target device.

You're still incorrect. Those are "assets", the term "agent" isn't formally used anywhere in the IC

The whole "CIA agent" probably comes from "special agent" which is the title for US police investigators, who sometimes do work undercover, mostly on domestic policing matters. The CIA does have special agents, but it's mostly a desk job, and they are definitely not the clandestine operatives of the pop culture idea. (Most US federal agencies have special agents - even NASA has a little Office of the Inspector General.)

The FBI (and even the IRS) uses "agents" so I assume people extrapolated use of the term to all three-letter agencies.

Random aside, but ATF field personnel used to be 'Inspectors' and we had a pretty good working relationship during annual inspections and so on.

Sometime in the Post-9/11 era they transitioned to 'Investigators' and the majority of them got a big stick up their rear ends and it has become a trying, adversarial relationship every time they come out.

A case officer still runs agents.

I thought an NSA agent was anyone that provides the information or resources whilst the analyst (operator) was the one directly employed by the NSA. In other words, an "agent" of the NSA would imply they are not "federal agents", in the way we use that word. But, instead, are those employed like a third-party for information/resources such that all you are providing is access.

this is why I've always rejected the notion that everyone should put all their data out there so as to overwhelm those trying to collect everything.

Your data is forever and banking on there never being an effective solution (effective does not mean perfection here) doesn't seem like a good gamble.

I saw a talk at defcon about tracking Bitcoin wallets. Apparently use of a Bitcoin atm gets you flagged instantly.

>>no facebook browsing at all

So I am now a target of the NSA..... I despise Facebook and all other social media. Though I do have a lurker account on Twitter now that Elon fixed it from the authoritarians that use to run the platform. Never post though

> Though I do have a lurker account on Twitter now that Elon fixed it from the authoritarians that use to run the platform.

He made it more conservative friendly which is why you like it now. "Free speech" was just a cover story.

https://www.vice.com/en/article/5d948x/x-purges-prominent-jo...

lol I wonder if the fact I basically stopped all social media activity last year except some reddit and HN checking in set off alarms lol. It was more about personal life improvement rather than anything nefarious

Why do people get so horny pretending they are targets of state surveillance.

It’s an astonishing mix of ignorance and narcissism all rolled up into one.

Because all first-world citizens are effectively targets of state surveillance?

The narcissistic "but I'M a target" shtick is pretty funny, but I'd wager you're just as foolish if you think those people "pretend" to be compromised.

I accept your anecdote at face value. Therefore this gets an 'ooof' from me.

> Criminals/targets have their own signal of data and by filtering traditional data patterns you're left with a smaller dataset of the targets you're there to find. (example: ... no facebook browsing at all)

It's just one filter. Exlude this, exclude that, exclude all that is normal to find and what is left is some edge cases that might contain something interesting.

That is how I navigate linux logs when I don't know what I am searching for: grep -v x | grep -v y | grep -v z | etc

It does not mean if you don't browse Facebook you are suspect

> It does not mean if you don't browse Facebook you are suspect

That's exactly what it means.

If you meant the suspicion is low, yeah it is, it's suspicion nonetheless.

Reply on news.ycombinator.com