Hacker News Reader

> Read my previous comments if you want to see my thoughts on how the media has been getting it wrong, and what the deal is from the perspective of someone who worked in this community.

I can't speak for everyone, and I've certainly been doing a lot of Devil's Advocating on behalf of the NSA and the government, but I think people would feel better if there were much more transparency into things like:

* Why a given collection technique is useful.

* Why that technique can't be replaced by other existing techniques.

* Why good policy-based protections cannot be reasonably lifted into the law.

* And especially whether there are good technical protections in place to protect these masses of data being collected to ensure they are used only for valid investigations. I.e. there is undoubtedly a policy saying not to mis-use the data; is there any superior technical controls also in place?

Because while I'm sure that the vast majority of the 4+ million of you all are upstanding people just trying to do the right thing, we've seen in the past month the damage that just 1 "disgruntled worker" can do...

While getting into specifics of collection shouldn't necessarily be public discussion, as it renders those collections effectively useless (think the old school mafia knowing what they can and can not say to be rendered into evidence in court), a framework is definitely a necessity. There is already a framework in place, but it doesn't address what the public concerns are. We should publicly answer questions like:

-Is it okay to collect intelligence on foreign governments? -Is it okay to collect on allies? -What are the boundary markers for the government abusing its power? -Can we amend the constitution to reflect privacy concerns of the 21st century? -How many civilian casualties are the threshold for being a tolerable amount in America?

Just questions to get you thinking about things. I feel like the majority of people's indignant outrage, if not translated into action in fixing a perceived problem, is passively accepting the status quo.

As an insider you have a different view from others. I wonder though if you do not see the forest for the trees. Does knowing more than others about the inner workings of the NSA make the effects of the NSA actions on the country less apparent to you?

But, is it more likely that the 4+ million security clearance holders are in on some large conspiracy to take away our freedoms, or that a disgruntled worker wanted to watch the world burn a little.

Those aren't the only two choices for what is happening here. There is also the idea of a government bureaucracy without a credible internal counter balance to its desire for more and more information. I have to wonder if an analyst there ever got promoted for saying something is wrong. That the something in question goes against the People's right to privacy.

With the CIA, FBI, and other organizations I've worked for, you'd probably be right. The NSA is the only meritocracy that I've encountered in government work, although I only have a total of 10 years of experience so I haven't "seen it all" per se.

When you work for the NSA, you can take a managerial route or a technical route for promotion. This means that you can achieve the highest rank (GS/GG-15) being either a manager or just being good at your job.

I once wrote a report which countered reports that other people had written, resulting in some angry phone calls demanding me to redact my correct report so as to not make them look bad. I responded with a no to all of them, and when circumstances proved the validity of my analysis, I was rewarded for standing my ground and not punished.

All in all, the people working there on the whole cared about doing what is right, is what I found. In that light, NSA stood in stark contrast to the FBI culture of major bureaucracy and lazy/inefficient practices.

As an example of the culture, I learned to program at NSA because when I said I was interested they said, "Here's a book and some servers.".

IMO, that's the tragedy of this whole situation. We're blaming the civil servants for policy decisions.

I think the core problem here is that the scope of what the NSA does was blown out dramatically, because the nature of the threat shifted from the Soviet bloc to various extremist groups that may or may not have state affiliation.

So we went from a world where we were spying on the Russians (which nobody has an issue with) to a world where we're spying on people with extremist beliefs, who could live next door.

We expanded the scope, depth and breadth of the mission, but there isn't a level of oversight present that is trustworthy. When we ask the question "Who watches the watchers?", the answer is both nebulous (in that you never get a straight answer to any question from anyone) and antithetical (secret courts, blurred and cozy executive/judicial lines) to the way that the American system works otherwise.

> So we went from a world where we were spying on the Russians (which nobody has an issue with)

I used to think that was true, but witness the reaction here on HN to the very idea that the NSA might still by spying on China or Medvedev.

Thanks for your perspective. The point I'd like addressed, is that everyone could be working to do what was right, but still build infrastructure that is dangerous to democracy.

If the infrastructure is put in place to monitor everyone's communications and infer all their contacts, it may be used for good at the present time, but it will be the perfect tool to quash dissent in the future.

People die and the world changes with time. Misguided people have taken positions of extreme power in the USA within the memory of current generations. How can you be sure that won't happen again, that another Nixon won't misuse the tools of state authority, this time so vastly powerful that the misuse would be guaranteed to produce some sort of blackmail information on half the population?

Ok you touched my heart, lookup Breno Salgado in your prism(I'm brazilian so no need to hold yourself!) and you can have all my data and conversations, lets get to know each other better! Kisses, <3

Well, he would need to get a National Security Letter or a FISA warrant to do that, so it may take awhile to get back to you. :P

Do you think that it's feasible for terrorists to use couriers/tradecraft to transmit all messages to their group members around the world?

Osama bin laden ran the largest terrorism network in the world that way for years so... Yes.

Also mail can get just about anywhere in the world in a few days so speed is hardly a problem.

I would bet you that NSA has been reading international mail for decades.

> is it more likely that the 4+ million security clearance holders are in on some large conspiracy to take away our freedoms, or that a disgruntled worker wanted to watch the world burn a little.

In this case, I trust the disgruntled worker more than the people still getting a salary.

"It is difficult to get a man to understand something, when his salary depends upon his not understanding it." -Upton Sinclair

The word conspiracy brings a lot along with it. I don't think the government is conspiring to "take away people's freedoms" any more than the terrorists "hate our freedom". They're both straw men.

What I do think is that the government is doing what it always tends to do in these situations: kill flies with bazookas. Why? Because they can. They don't answer to anyone, so they can exert a ridiculous amount of resources and infiltration that no other body could feasibly get away with.

No evil man thinks they're doing evil.

I agree, and I definitely agree with the privacy sentiments and government overreach fears that people have on hacker news.

All I'm saying is that if there was a significantly flawed system, I didn't see it and I was pretty deep. Take that how you want.

I don't think the situations you put forward and the conclusions you are drawing from them necessarily follow.

In the first example, how often is it that you must communicate with someone far away in an hour without any prior coordination? Assuming that is the case, then wouldn't the NSA also have to intercept, decode, translate and mobilise within less than an hour? In that case using those systems may be fine. Or perhaps use those systems to point your cousin to cryptocat or redphone. Anyway I think there is a difference between what might be used for long term planning vs. the immediate communication scenario you outline.

In the second example, another poster on a different thread worded it much better than I will here, but I don't think it has to be 4+ million people working towards a conspiracy. I think intelligence work is hard. I think people with the best of intentions will always look for a way to make their job easier. Each individual incremental step may seem small and inconsequential, but over time it leads to a massive overreach. One person then looked up to see the forest instead of the trees and felt it was wrong and spoke out. In that scenario it isn't 4+ million in on a conspiracy or one person wanting to see the world burn it's what I think is typical human nature in large organizations over time.

This is just patently not true. If you read up how Osama bin Laden practiced tradecraft, you'd know that he did not even so much have a land line at his compound when they offed him, definitely not a cell phone. If you'd like a credible news source for these sorts of things, read Stratfor. They're relatively cheap as far as these things go. Terrorists do not use gmail, skype or cell phones.

You are right that armchair BS isn't going to get us anywhere here. To that end, your comment is ironic because do know that the real terrorists know they're being snooped on.

While I can't comment on the UBL part, I will say that the stratfor part made me pee a little in my pants. I don't mean this to come off as condescending, but stratfor is one of the biggest jokes by people who do real intelligence. It's like saying "if you want to know what's really going on in the world and what's really important, watch Fox News.".

You know... it's a joke, but it's still less of a joke than everything else out there, kind of like Hacker News or /r/programming. ;-) The people who actually do "real" anything tend to think that everything beneath them is a joke.

I'm guessing all Commerical OSINT is. I read http://kgsnightwatch.com nightly and used to read the DHS OSINT open source report daily. (Both are available to the general public.) I want to be informed as a citizen and as a human being living on this planet where the events of the world do effect us. On top of those we have Twitter, which is really kind of one sided when you're limited to English language views of the middle east conflicts and social struggles.

There is possible evidence that a crime may have been committed (by both the US Government and Snowden). It is for the legal system to decide if people are guilty. You are putting this evidence within a narrative which is interesting, but irrelevant in deciding who is guilty and who is innocent (which I hope the courts will be allowed to decide).

You have to admit that legal grey areas have been allowed to emerge in recent years that are dangerous? If you want to be given the benefit of the doubt, the legal basis should be open and clear.

I 100% agree.

One point I have to disagree with is the complexity of transmission. We are not talking about a cousin that is not expecting to hear from me for another decade. Likely, there are in person communications and some pre-agreed upon methods. One immediate "throw-away" method could be just doing a point-to-point WebRTC chat. Google prototyped a super simplistic method using AppEngine and some public STUN servers to get the link going. Security by obscurity, but that's what the article is claiming.

Also, there are a bunch of other services that offer communications. Even something like Twilio/Tropo/Plivo can be leveraged using their WebRTC clients and calling inside their own networks (as opposed to hitting PSTN). A FreeSWITCH server will get you similar capabilities between extensions and you can spin one up in minutes on a VPS and then just as quickly throw it away.

Sure, but look at the complexity of just describing this stuff. But I think the issue even with a good system is that even the pros will screw up all the time. Sending every message via throwaway accounts, from a different location, with a different computer, from a non-fixed radius from your residence is technically possible but humanly unsustainable and logistically expensive. I could only imagine how exhausting it would be. Most humans with this level of competence simply have better things to do than be terrorists. The argument in the article is that you will only catch the stupid ones with this big drag net, it is reasonable to make the reverse argument - it is very important to catch the stupid ones because if stupid people can easily coordinate terrorist activities, anyone can.

"If I told you right now to get a message to your cousin in Connecticut within an hour without using Skype/email/phone or anything of the other means listed, could you do it?"

That doesn't sound like a situation a reasonably intelligent terrorist cell would find itself in. They know they will have to communicate secretly. The need to exchange messages doesn't just pop up like that.

Why would they not just open a new free web hosting account once every few weeks with some obscure web hoster and upload any messages encrypted and disguised as image files?

To notify each other of new messages they could use "hey, what are you up to tonight?" style SMS messages. They could do all of that using anonymous prepaid phones and use a public VPN paid via bitcoin.

What bazillion is trying to get across is that people are people. They tend towards that which is most convenient and least painful. Sure, HN could come up with the worlds most secure, least detectable, most effective means of communicating with anyone, anywhere at anytime. It will also be a PITA for people to use. Hence, when your mind is occupied with blowing people up or kidnapping someone or hijacking a plane or stealing state secrets, you end up not spending a lot of time on the aforementioned Perfect Comms Path.. you use gmail and pgp the contents (maybe)

I don't think what you say is true for serious terrorists. If they were that naive, they would be easy targets.

It seems more likely that the NSA isn't just hunting hardcore terrorist cells. Terrorists don't act in a vacuum. They are the extreme end of political/religious movements, so if they keep tabs on the radical movements from which terrorists eventually emerge, that could help narrow down the circle of those who are then tracked in a much more intensive and expensive way.

I suppose it all comes down to what you term consitutes "easy"

It's easy if you already have access to or can collect on and analyze metadata from as many sources as possible. Then it's easy(ish)

Without it.. where do you start?

> Let's say you answer that you'll just use steganography (http://en.wikipedia.org/wiki/Steganography) to hide the message.

Why would you even bring this up when raw PGP et al. are so much simpler? Just share your public keys and you're good to go. http://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exch... etc.

I think it's about the metadata. Sending PGP encrypted emails still leaves info such as where you were when you sent it.

thank you, this is my point exactly.

The author seems to ignore two things: real anonymity is hard and people (even terrorists) are lazy. So, if the criminal elements slip up once, it might be saved within Prism, Tempora or one of the other programs we need yet to discover. If it is saved there, algorithms or analysts can detect it and work backwards - or just overlook it because of the sheer amount of data.

I do not condone Prism or any other secret surveillance program in any way, please let me make that clear. But to say "haha, the NSA are idiots, terrorists surely are smarter" is an equally moronic (and dangerous) assumption. I think one of the problems is, that those projects have to be secret to work. Nobody outside a small circle knows if and when they helped to disrupt a plan that would have cost lives. On the other hand, the lack of a democratic oversight makes it easy for people involved to misuse their powers.

I think, Snowden and all the other whistleblowers are like the symptoms of a disease. If you see the symptoms, the self-healing of the body doesn't work anymore. and with self -healing i don't mean the cover up of stuff, but the clean up of something that went clearly wrong or too far. I think, every democracy as a whole should embrace whistleblowers and use the information to act on, not fight them.

Just curious: Does communication need to be done instantly? Couldn't people communicate via something like packages sent via mail or persons traveling between countries?

I always assumed that when these groups communicated, the information was not time-sensitive. Plans can take months or years to discuss or finalize.

Also: Wouldn't it be feasible for communication to be done on a private/custom platform connected to the internet, yet located in a country where the US has no control?

That's if you assume terrorism is all about executing a suicide car bomb. There are other aspects like the funding, the discussion about group goals, the acquiring of arms, the distribution of resources, etc.

It could be feasible, but now your custom platform is a lighting rod drawing all of the attention of intelligence resources into cracking it.

While I'm not sure the article is a useful addition to this debate, there are prominent people from the intelligence community who disagree with you about the utility and legality of the surveillance programs now in place:

http://freespeechdebate.com/en/media/a-whistleblowers-argume...

Could you give an opinion as to whether or not the PRISM slides were made by a BAH contractor or by an NSA employee? So far we have seen very little in the way of corroboration from Snowden -- I'm inclined to believe that he may have made off with assets from BAH's internal network instead: four slides which look terrible if that's all you know of them.

That's an interesting thought. BAH employees spend on a lot of time on what they call "the beach" while they're waiting for a switch to a new job. A lot of that time is spent on reading/writing training materials. You wouldn't be working with classified documents though, typically.

It looked to me more like something some Air Force captain who was looking for a promotion put together. There are all sorts of junk slides floating around like that, which don't necessarily reflect active programs...just proposals to show that the people writing them can think outside the box and whatnot.

For obvious reasons, I can't comment on classified things, but I was very knowledgable about things and I had never even heard of PRISM when all this stuff came out. Take that with a grain of salt, though, since there are plenty of compartmented programs.

> "If I told you right now to get a message to your cousin in Connecticut within an hour without using Skype/email/phone or anything of the other means listed, could you do it?"

Where does this arbitrary 1 hour deadline come from?

> "How are you going to communicate to your cousin where to look for the message and how to break it down?"

In person, long before it's needed. Even better, if cousin A isn't reachable for some reason, cousins B, C, D, E and F are perfectly fine substitutes.

> "is it more likely that the 4+ million security clearance holders are in on some large conspiracy to take away our freedoms"

No conspiracy needed, just everybody looking out for themselves within the framework of rationalizations they bought into. And when it comes to that, 4 million are nothing. Even 4 billion are nothing.

"The ordinary man with extraordinary power is the chief danger for mankind - not the fiend or the sadist." -- Erich Fromm

Were tens of millions of Germans really involved in a conspiracy to industrially murder millions? Of course. They just weren't aware of it. All their individual little steps and reactions were somewhat rational, the bigger picture decidedly wasn't. Do you really honestly believe worse things than this haven't happened to more and better people than 4 million NSA peeps? Such hybris in itself is a ticking bomb.

> "Having worked in every facet of the NSA as a linguist/intelligence analyst/programmer/many other things, and CIA contractor for a year, I tend to think the latter, and I'm very vocal about my thoughts on the intelligence community."

How can working with people who aren't Snowden tell you that he wants to see the world burn? Or do you think that follows from your proposed dichotomy between "it's either all a deliberate conspiracy by everyone involved in it, even as janitor or secretary - or Snowden is a disgruntled worker"?

> "Read my previous comments if you want to see my thoughts on how the media has been getting it wrong, and what the deal is from the perspective of someone who worked in this community."

I did, but I just saw you criticizing specific claims of Snowden, probably correctly so -- that doesn't mean "the media get it wrong" wholesale, it just refutes those claims. The only other thing that seemed relevant was this: Working with the FBI folks at the TSC (Terrorist Screening Center), being dumb and incompetent doesn't even begin to describe what I saw. That can't be what you meant, so did I miss it, do I have to go further back, or was that bit about Snowden actually all?

To whomever it concerns: Pressing a downward arrow is easy, if you can, also put your words where your clicky clicky is. Lest you want me to think you're pouting or something.

It's not much of a rebuttal -- the OP has facts and experience, you offer aphorisms and come close to invoking Godwin's Law.

What happened during WWII is a blue-print for what society should not be (like an anti-pattern). Lets not restrain ourselves from talking about it based on some stupid Internet meme, especially when talking about relevant topics, such as identification, surveillance, discrimination, privacy and all kinds of human rights that should be fundamental for everybody, alien or domestic.

Personally I think @PavlovsCat raised some interesting points. I also hate arguments by authority; if anything @bazillion's experience as an NSA employee and a CIA contractor raises red flags when thinking about his agenda or bias (although kudos for his transparency on the issue - isn't transparency great btw? ;))

What really bothers me about @bazillion's opinion is the logical fallacies he conjures:

1) establishing a protocol for communication is done by meeting with your peers well in advance, which does happen; trying to make this problem harder by restricting what you can do is setting up a straw-man

2) you can still use phone lines, you just need to buy a bunch of prepaid cards, tossing them away after usage, preferably with short messages without going into specifics, accompanied by small chat on weather and baseball games - you can make it so that conversations are indistinguishable from normal conversations or from noise, without using stenography and while still bearing important information. You can also receive incoming calls this way. You buy them in bulk, you communicate the numbers to your peers and you toss them away after each incoming call, with your peers being left to try out the next number in sequence.

3) on the Internet you can use strong encryption, in combination with whatever email accounts you want, including Gmail accounts, you just can't use the web interface. Route that access through easily changeable anonymous proxies placed in countries were the U.S. doesn't have much influence and voilà - you can be immune of NSA's spying and surveillance on the Internet, as they'll have nothing - no words, no name, no IP address. They can't even prevent the message going through, as you can ask for confirmation in your encrypted message and have that confirmation delivered encrypted as well.

Surveillance on the Internet only affects the uneducated, which happen to be normal people living normal lives.

4) the world is not divided between evil men that conspire and maniacs that want to watch the world burn - Snowden's intentions and motives are actually irrelevant. And what NSA apologists don't seem to get is that NSA's intentions or motives are also irrelevant. What really matters is the final result ... people are not safer due to NSA's actions, while these actions are a disaster for privacy and for human rights in general. In fact terrorism prevention only fixes a symptom of the larger problem and one has to wonder why the threat of international terrorism is much smaller in Europe.

> Were tens of millions of Germans really involved in a conspiracy to industrially murder millions? Of course. They just weren't aware of it.

This isn't true. There has been quite a bit of research and when Germans say they didn't know anything they were just making excuses after they lost the war.

I picked this out because it seemed to be quite central to your argument.

It wasn't really, it was just one example of a lot I could have given.

This isn't true. There has been quite a bit of research and when Germans say they didn't know anything they were just making excuses after they lost the war.

"not knowing anything" and "not being aware of mactual details of the industrialized killing they were part of" are worlds part.

I have recently listened to an interview with Hannah Arendt, who was against the Nazis from the get go, and frustrated with her friends of whom many just went along to get along. I don't remember the exact year right now, but between 1940 and 1942 she and her partner first heard of the death camps.

Yes, the concentration camps were known, the persecution of Jews was obviously known, and when it wasn't, it was willfully ignored because the antisemitism got lapped right up. The industrialized killing and the scale of it, that was not known, and certainly not to everybody. At least not to Hannah Arendt, and she did pay attention.

[see caveat at end of paragraph] Then there is the fact that the murdering of mentally disabled children 1942 was an internal secret even to the Nazis, not to mention the public. They only dared to do it under the cover of war. [I'll try to find a source for this -- but I remember it from school ages ago, so if I don't find one, you can ignore this paragraph, it's not like my post rests on it. Edit: maybe I misremembered it: http://www.ushmm.org/wlc/en/article.php?ModuleId=10005200 though maybe not completely -- "Conservative estimates suggest that at least 5,000 physically and mentally disabled German children perished as a result of the child "euthanasia" program during the war years." (note "during the war years", it's not like they wouldn't have loved to kill them on day one)]

But hey, I'm all ears. If you can point me to research refuting that I would be very keen to hear it, being German and not into Nazis and all that.

Given that the death camps didn't start in earnest until the very end of 1941 I would hope Hannah Arendt hadn't heard of it until then.

I coincidentally just finished a WWII history the other day, Max Hastings's "Inferno - The World at War - 1939-1945" and though he only briefed discussed the Holocaust in general, it was fairly clear that there was at least some level of awareness that something very sinister was going on.

http://en.wikipedia.org/wiki/Responsibility_for_the_Holocaus... also has a bit to say, and a link to some books about the very topic.

What you can say is that Germany was not alone in its treatment of the Jews. The Nazis provided the impetus for the Final Solution but found many willing co-conspirators, not just the Germans.

My understanding of the events was that Germans were aware of the Jews being discriminated and forced out of their society, but weren't aware of these death traps until it was too late.

In fact, many Jews unknowingly got into trains having an Auschwitz concentration camp as destination, thinking that they'll be deported to other countries or that they'll get sent to work camps. A significant proportion of them came forth by themselves, wilful to leave Germany. Many of them also assumed that the destination is some kind of horrible, but survivable re-education/work camp. The propaganda at that time included commercials picturing these camps to the German public as being camps were Jews are used for the betterment of German society, while living in humane conditions, unworthy of the rodents they were considered to be.

This whole thing started and evolved in small steps. Auschwitz happened after they realised that deporting them is not feasible, due to the process taking too long due to other countries being reluctant to open their borders to such a big minority and killing them in bulk by gas was cheaper than using bullets.

If anything the German public probably viewed murders and awkward things happening in plain sight as being acts taken for security reasons against disobeying Jews or against Jews that refuse to leave their society.

Eventually the German public must have been aware of the genocide, but you also have to consider that (1) they could have been too frightened of the monster they created, with problematic individuals being in jeopardy of being classified as Jews or Jew-lovers and (2) as a species, we tend to not recognize our mistakes after enough sacrifices have been made, so it's easier to think that you are part of a revolution for the good of human kind, then it is to think of yourself as a freaking murderer that believed the words of maniacs.

Well, I don't think there was anything special with the Germans in this regard. E.g. if you were somehow able to reproduce the same conditions starting from hundreds of years beforehand, ravenous propaganda the decades leading up to it, start off the genocide in the U.S. at the same timeframe, I'm not sure Americans would have fared any better. We weren't exactly nice to the Native Americans, for example.

But that wasn't really the question either. Of course the people should have known what was going on, especially by 1943. Even the example of "working the Jews to death" is horrific enough, and what did they really think was happening over on the Eastern Front?

"especially by 1943"

Which was roughly 10 years too late. By 1934, Hitler had all the laws he needed to do whatever. Also consider that the Nazis are a example of hybris and self-destruction, I wouldn't expect anything to follow that pattern again, other than in the third world. Steady does it.

On the other hand, Dr. Bronner, the magic soap guy, emigrated 1929 to the US, changed his name from Heilbronner to Bronner, and urged his parents to follow him (you can find that on his wikipedia page). So at least when it came to Antisemitism, it was possible to sense it. But on the other hand, there were even Jews who fell for Hitler at first, and were sorely disappointed when their home country turned against them.

So while Hitler never fooled some, he did fool many enough for long enough. And compared today, those times were utterly low tech. Even the propaganda was just brutish. Which is why I like to use them as an example, they were still clearly recognizable for what they were; it got so much murkier after that. You could say it metastasized and got debugged.

Hold on - are you saying Islamic Terrorism is right-wing now? Jeez....

Its right wing in the context of the Muslim world.