Snowden Interview with Jacob Applebaum

If you take the body of people who use Google/Yahoo!/Facebook and get the % of people who are aware of the existence and importance of internet infrastructure, you will find that the % is nowhere near 100%.

I think the order is okay, but the issue is that the media is making it a personality focus to make the story more sensationalist (do we sense a pattern here!?) and said average Joe is surely distracted.

As the leaks have moved on, the information has become progressively more concerning. Anyone who has followed this issue should have at least a vague idea of the caliber of information that could be coming (your post as an example). So, rather than releasing the big ticket items first, and having the rest of the issues make no impact in comparison, they're allowing as much information as possible to have it's greatest individual impact before moving on (not to mention the now well-discussed benefit of authorities lying themselves into corners trying to cover up the smaller issues).

In this way, they're priming the public so that we've spent months digesting the impact, and understanding the issue so that when we get (say) screenshots proving everything going over telecommunications is recorded, the public is prepared to understand and digest that fact quickly, and can move to action quicker--or even at all.

The more I think about it, the more I earnestly believe that this technique is the most effective methodology available to them and may be our one and only shot to stop it (keep in mind that once a subgroup of society reaches enough power and intelligence over the rest, there is literally nothing the rest of humanity could do to overthrow them; we can't dump tea in the ocean and fire guns at them anymore if they have drones and know everything about everyone).

He doesn't have to convince HN readers that this is worth stopping our daily lives for to stand against, he has to convince the general public.

With that in mind, the best thing we can do right now, is help them to prime the pump. Bring it up to everyone that will listen. Make the electorate informed. Because when the news comes--the one that we will need to act on--the public needs to be ready to hear it and move on it.

Im amazed why do you US citizens always derail the debate towards this question "us citizens or not"?

Are you guys more important than us? Dont you think US citizens are spied upon by UK, New Zeeland, Canada, Sweden, Germany etc and then exchange of information happens with those countries?

Does it matter that much how many laws NSA broke and how many lies they told you? Would you be fine with all of this if NSA had lobbied for a law, like FRA did in Sweden, to make all their activities, spying on US citizens included, perfectly legal? Just suck it up and accept "democracy" then?

Is this legal, who broke what law. What theyre doing is immoral no matter how they twist the law and how much they talk about what direct means in direct access.

Please, avoid discussing legality of minor details and focus on the implications for democracy, power and inequality. How do we fight back?

This bit worries me less than PRISM or malware. We've already designed our networks to resist MITM where we believe security matters and there is a general push towards TLS for everything.

If I were to guess, they probably only stick to ISP-level monitoring in most cases, and in other cases maybe they'll physically install malware on a system when they have to.

How do we create, maintain and support companies that guarantee our privacy? What do we do when those companies and its employees receive threats, blackmails and various attacks by the feds? When they become infiltrated? When they buy them up like Skype and close its security down?

Facebook, Oracle, Google all seemed to crap their pants when PRISM came out, can we increase the heat on them to stop what theyre doing?

What methods do we have? What can we, the good hackers non-NSA-employed hackers, do?

We have various encryption technologies, mega made some fine client-side encryption kind of easy to use, what else?

Whatever we build will not be a perfect solution, it will require agreements and legal frameworks and support from a major group of people. Isnt this what GNU is about, the FSF and freedom box project?

EDIT: Its kind of tiresome that HN must always have a critical comment at the top, no matter the issue, someone always tries to tear any story up to pieces. Id like to remind you people of this awesome quote;

""It is not the critic who counts; not the man who points out how the strong man stumbles, or where the doer of deeds could have done them better.

The credit belongs to the man who is actually in the arena, whose face is marred by dust and sweat and blood; who strives valiantly; who errs, who comes short again and again, because there is no effort without error and shortcoming; but who does actually strive to do the deeds; who knows great enthusiasms, the great devotions; who spends himself in a worthy cause; who at the best knows in the end the triumph of high achievement, and who at the worst, if he fails, at least fails while daring greatly, so that his place shall never be with those cold and timid souls who neither know victory nor defeat. ""

That's what I took it as. With government-level resources you can pretty easily throw a team at all the common web browsers and find exploitable 0-days and then MITM the next connection the target makes to any website to exploit it, and then find a local privilege escalation vulnerability if necessary. Once you have root (or equivalent) on any given machine you pretty much own it.

That sort of thing isn't necessarily in reach of your typical J. Random Hacker against a patched machine (may not have access to 0-day, can't easily MITM target's internet connection, etc.) but it's really not a stretch to imagine that the NSA can do it if they have no regard for the law.

That's like asking how he would be in a position to get Top Secret documents.

http://www.nytimes.com/2012/06/01/world/middleeast/obama-ord...

I read that as it is commonly understood among my colleges at the NSA that America and Israel wrote Stuxnet and this understanding seems to be reputable rather then rumor.

Stuxnet is largely believed to be created by the US and Israel to cause problems to Iran's nuke programs (http://topics.nytimes.com/top/reference/timestopics/subjects...). Part of defense is offense against infrastructure that is a threat and will be as long as there are countries.

Well, look who the interview is with.

Protecting the US internet industry from these actions means not permanently undermining the credibility of every single US company when they say they're not spying on their international customers to further the government's (secret) national interests.

Americans are outnumbered more than a dozen-to-one on the Internet, you know. (And that ratio stands to get even more lopsided as the next 2 billion people get on the internet, too.)

I think he simply wants Americans, and the world, to know the truth about what their governments are doing, and doesn't believe that the best chance of that happening is staying within the bounds set by US law. He probably believes the best chances for pushback on privacy lie outside the five-eyes states, because those states have been co-opted so completely by their intelligence services. In the UK for example, every secret communication of every politician, judge and public servant is now available to those services.

Binney in his heart still believes the US government can be reasoned with and negotiated with and it seems you agree with him. It appears Snowden has decisively broken with that point of view and sees it at somewhat naive (probably after seeing what was done to Binney and Manning). As to treason (in a broad sense as betraying his country), I think that depends on whether you believe he's exposing wrongdoing or not. If he's found extensive wrongdoing, it's impossible to make that public without damaging the US in the short-term, but in the long-term, he may believe what he does is in the interests of the US. I certainly agree with him.

Sorry, non-Americans: the Constitution doesn't cover you guys. But we need to protect ourselves from our own laws first before we can help the rest of the world.

Personally I think we should try to move past this sort of parochial patriotism and look at this issue as one which affects the whole world. If you accept the argument that foreigners may be spied upon, and anyone having contact with foreigners, you're accepting that anyone who does business outside the US or has contacts outside the US is a potential surveillance target. That probably covers almost the entire cosmopolitan US population nowadays. So much for American privacy. You also accept that states like the UK and Canada will be allowed to take every bit of information that passes through them and pass it back to the NSA, because that data is now 'foreign'. By the same argument text messages in the UK are all swept up, because they pass over the border for technical reasons apparently.

Of course the only country and legal framework we can currently work within is our own, but it is inconsistent and ultimately futile to view this as a struggle for rights in only one country, because the network which we're objecting to is global in scope and global in ambition.

Perhaps more important than the difficulties of separating foreign from US data is the damage this attitude causes to the standing of the US in the world - if this deepens the perception that there is one law of US citizens and another for everyone else, why should other countries treat American data and persons with respect?

1) Governments spying on governments, sure. On foreign businesses even, sure, if they're big or important enough, I've heard that too. But does any other country do indiscriminate mass surveillance on the entire US population? Make no mistake, this is the informational equivalent of carpet bombing other countries. And not just your purported and declared "enemies" but even your friends and allies. You should not wonder if you end up having none.

2) "It's right because other people do it too / did it first." Hm, grow up?

3) "It's ok because it's always been done like that." Don't I love this time-based argument. So it was ok to have concentration camps in 1944 because they've been there in 1943? Or where is the line? And who determines it?

If you think that's an argument, you should follow your own advice.