Hacker News Reader

Comment by acqq | Hacker News Reader

This is a financial disaster waiting to happen. Microsoft is oblivious if it is not doing something to divorce itself from the NSA.

Apple, on the other hand, could have come out smelling like a rose, but following the death of Steve Jobs, who apparently refused to play ball with the NSA, it stupidly jumped on board to join the PRISM club.

According to the Prism slides, it really looks so:

   "Dates when Prism collection began for each provider

   Microsoft 9/11/07
   Yahoo 3/12/08
   Google 1/14/09
   Facebook 6/3/09
   PalTalk  12/07/09
   YouTube 9/24/10
   Skype 2/6/11
   AOL 3/31/11
   Apple (added Oct 2012)"

Steve Jobs: February 24, 1955 – October 5, 2011.

If it's true, it's one reason more to deeply admire him.

And can you just imagine how much more sales Apple would get now for not being on that list?

View on HN

That reminds me of Putin a little bit. Even if you think some leader is an asshole, sometimes you need an asshole to stand up to an even bigger bully. I just imagine someone like former president Medvedev (and with no Putin in sight) would've offered Snowden to US government on a silver platter, just like France, Spain, Portugal and Italy tried to do (fortunately unsuccessfully). I remember I was very much against Putin when he fought the US' anti-rocket shield, but over the past few years I've started to understand why he would do that. No country should own the whole world.

Don't mistake a former KGB guy's taunting for a principled stance. Here's how Putin deals with whistleblowers: https://en.wikipedia.org/wiki/Alexander_Litvinenko_poisoning

I don't think mtgox was implying principle, just a willingness to resist, even for the wrong reasons. ("You can't imprison dissidents. That's my job.")

You certainly have a court decision or at least an official accusation to support your claim? Just asking.

You might find some of what you're looking for on the wikipedia page I linked to. But courts are only very rarely the place where accusations against heads of states are examined, especially when it comes to superpowers.

I read it carefully. Name "Putin" is not mentioned anywhere in the Investigation section.

Please stick to the facts.

If the accused can prevent a proper investigation I will make my mind up based on the clues that exist.

The more you look, the more you will find. Plato's Cave is amazing eye opener to everything we do daily.

Medvedev was and is Putin's pawn, he acts the way Putin tells him.

I know that, I just meant "someone like him" (weak personality that does what others tell him to do, even if he's head of a state).

You're right, sorry I should have read your comment more carefully.

Not germane to this topic, but I'm sure there are quite a few GLBT people that might have an opinion on just how much of an asshole Putin is.

It's not exactly him. In my experience most Russians are homophobic to the core, unless they know some LBGT personally.

Your second sentence reminded me of the Dicks, Pussies and Assholes speech from Team America...

http://www.youtube.com/watch?v=32iCWzpDpKs

For those who know Formula 1, I think Bernie Ecclestone and Max Mosley are the sort of examples that might work. Of course, some would say they are and were the bullies that needed standing up to. Heh, I suppose that gets us to the terrorist / freedom fighter type debate!!!

Anyone who serves in a role as top leader of a country or large corporation is an asshole -- it's a job requirement.

What you're seeing in Putin is the ability to be independent. He gets to enjoy watching the Americans squirm at low cost. What's the US going to do to Russia? Our diplomats will be rude to each other, maybe we won't attend the Russian summer ball and snub the Russian ambassador, each country will declare some spies persona non grata.

At the end of the day, the areas in which the Russians and Americans cooperate are areas that they have a mutual interest to do so.

Others, like the Germans or Spain are different. They piss off the US, we cut off the faucet of intelligence, money, privileges, etc.

What amazes me is that among those corporations with revenues in the tens of billions of dollars, not one of them challenged the constitutionality of the decision in court. Not one, not once.

Not that it would be necessary in an obvious case like this, but each one of Microsoft/Skype, Google/Youtube, Apple and Facebook could easily have hired the nation's best and brightest one thousand lawyers at $1,000 an hour, full time for 10 years to defend privacy. It would have been well within their means. Yet, each of them chose to back down. Each of them chose to fail their users' trust.

I don't think its due to cowardice. If these organisations cared the slightest bit they would have acted to protect their users. Not in the wildest scenario would the US government have jailed the leaders of Apple, Google or Microsoft. My best guess is they got something in return.

For all we know, some of them may have challenged it but they cannot make those details public because they're not even allowed to admit the NSA requested such information to begin with.

Not in the wildest scenario would the US government have jailed the leaders of Apple, Google or Microsoft.

That may be naive. Most people have skeletons in their closets. The government would use these to pressure those leaders to acquiesce. I suspect the most dangerous skeletons are ones which seem harmless to you, but cast in the proper light they can be used as a justification for punishment. E.g. Something which seems harmless now can retroactively be used to claim you were doing insider trading. Few people would step up to defend you, even if the charges are baseless, because recently it's been fashionable to hate capitalists, and trading stocks is the epitome of capitalism. So it'd be very much "obey us or we will litigate you into bending your knee anyway."

Jobs was immune because he was the CEO equivalent of a rockstar. To try to pull baseless charges against him would outrage the public. Yet I'd imagine the public would get grim satisfaction out of seeing Ballmer punished, even if the charges were baseless, because most people don't like him. It's shallow, but it seems true.

I can see two sides to this.

On one hand, the CEO of Qwest was convicted of insider trading, and he claims it was retaliation by the NSA because Qwest would not participate in warrantless wiretapping.

On the other hand, the federal government had a perfect excuse to prosecute Steve Jobs in 2006 with the options backdating scandal, but chose not to. Those would not have been baseless charges--Apple really did backdate those options. The government just concluded that Jobs was not personally culpable.

Maybe they were using it as leverage.

Well, PRISM seems to have been created in '07. Plus Apple didn't matter very much in '06 -- not in the same way Google mattered. Apple didn't have much user data for the government to be interested in, because iPhone didn't launch till June '07.

That's actually a perfect example of leverage that the government would have used against a technology company to pressure them into doing the government's bidding.

I remain astonished that Martha Stewart was targeted, convicted, and jailed. I don't care either way if she did some thing wrong. I care about the unequal application of justice.

In contrast, I can't imagine anyone targeting Oprah. She'd destroy (PR-wise) anyone challenging her. Recall that beef lobby's attacks.

Jobs is like Silicon Valley's Oprah.

I agree - it's what I mean when I say that I think they got something in return for not fighting the FISA requests. Could be antitrust cases that were dropped, tax hikes that were cancelled or more personal matters.

Correction: Yahoo did fight, and lost. The details aren't all released, but here's a precis of what's public:

http://www.wired.com/threatlevel/2013/06/yahoo-failed-fisa-f...

It's possible that there's as-yet undisclosed legal action with some of the others; the secrecy around just about any proceeding in the FISC makes it very hard to tell.

I wondered the same thing. With secret courts and secret hearings, who knows who is fighting or not for our rights?

Fighting unconstitutional laws in the phony secret "court" set up by the same laws is not really fighting, is it? It's sort of accepting the terms.

Take the battle to the real courts and ask them to decide on the matter.

Unfortunately, those are real courts, their functions and jurisdictions have been established by the Congress.

If congress can redefine courts into what is basically an administrative panel, then the entire separation of powers can be short-circuited.

It's not a court just because congress says so.

That's the crux of the matter. The root cause is that half of Americans are okay with such courts.

> The judicial Power of the United States shall be vested in one supreme Court, and in such inferior Courts as the Congress may from time to time ordain and establish.

Congress certainly does have the 'say so' -- at least with 'inferior Courts'. That still leaves the Supreme Court though as final arbiter.

I'd like to agree with you. I believe there is a category of societal actions that constitutes a court of justice within the framework of a civil society; secrecy doesn't fall into that category.

Exactly how do you get standing to sue the government for something they are not doing with something that does not exist?

It's been my observation that revenue in the tens of billions of dollars doesn't enable a company to make bold, risky moves -- it hinders it. People become very risk-averse when there's a lot to lose. Many of these well established, high revenue companies can't even take the risks that are necessary to continue having revenue in the tens of billions of dollars, much less stand up to nation-states.

Well, how does one fight dictatorship in a court that is owned by dictatorship?

FISA give them the right to install real-time monitoring on premise.

That means if you fight, they put a server in your shop.

It was just not worth it until now. That's going to be the real legacy of the Snowden leaks.

I must admit, I'm no Apple fanboy but in this case, I can easily picture a NSA rep threatening Steve Jobs and Steve Jobs telling him to f* off.

I wonder what would a Tim Cook-made iMessage look like from a security standpoint (probably a lot more like Skype/Hangouts than how it works right now).

I don't know, but I wouldn't be too impressed with the security of the existing iMessage: http://arstechnica.com/security/2013/06/can-apple-read-your-...

iMessage is in no way NSA-proof:

http://blog.cryptographyengineering.com/2013/06/can-apple-re...

tl;dr:

  * Apple distributes the encryption keys
  * Multiple keys can be associated with an account (iPhone, Mac – and the NSA?)
  * Apple can retain metadata
  * Apple doesn't use certificate pinning

My understanding is that this isn't that bad. If you use iCloud, then the NSA can read your old messages. If you don't sync your iMessages with iCloud, under the assumption that not every iMessage gets encrypted to an NSA key in addition to the recipient's keys, your messages are safe until the NSA/other law enforcement explicitly targets you, and even then, they can only read new messages and not previous ones.

Well if we're going to randomly speculate on such things, Scott Forstall resigned on October 29, 2012.

"And can you just imagine how much more sales Apple would get now for not being on that list?"

Barely any change at all, I'd bet. And not worth the legal hassle they could have been up against if it came to a knock-down, drag-out battle with the US Government over <spins the dial>.

I can imagine that U.S. companies wouldn't do anything, but European companies would be much more motivated for transition. As we speak, the top managers in Europe do try to find an alternative and everybody likes the easy way out. At the moment, baring some other potential compromising evidence, Apple would be such a way was it not on the Prism slide. Transitioning to big the powerful non-compromised Apple would be probably valued as less pain than transitioning to your in-company-made Linux distribution.

not worth the legal hassle

That's not the Steve Jobs I read about. Like him or not, he was a man of principle.

He was also pragmatic enough to pick the right battles. That,s a prerequisite for success in any business.

Again, not the Steve Jobs I've read about.

Having your factory retool weeks before you launch an unproven product because you don't like the glass? Not very pragmatic.

I think pushing your suppliers hard to correct a serious flaw in a key product is pragmatic.

"serious flaw" == hyperbole

I think the lesson of Apple's recent success is that such things matter.

Principles must have come to him later in life because I'm sure his first daughter would have something to say about that.

Being principled does not necessarily mean they are principles you agree with!

I suppose that's true.

I'd imagine for Steve Jobs...

everything is worth a fight.

Seems like "Think Different" was more real than "Don't be Evil". Even with all the Apple's closed ecosystem.

This reminds everyone to look at different angles when we criticize people/companies and understand that, even now, an individual makes a lot of difference.

How do you know it was Steve Jobs that prevented Apple from joining earlier? Perhaps Apple just wasn't a priority for the NSA until 2012.

It's conjecture, but it's likely. Apple as a company has put a high value on user privacy, which was heavily influenced by Steve. He was also known for maintaining a high degree of personal privacy for such a public figure (for instance, refusing to put plates on his car).

Apple is a company producing consumer devices, while the others are companies offering Internet services, which is what PRISM targets. Apple has only recently had some success in the Internet services space with iCloud.

One of those most successful devices is a phone. One that has been selling pretty well for 6 years.

That's incitement enough to try to get them on board.

Until iCloud/iMessage, all the actual information was transmitted through third party services (i.e. network providers, email services, etc.)

Why go after the myriad of handset manufacturers when you could just get the network providers on board?

There are things network providers can't do: activate mic remotely, capture local-only data, keylog apps that use encryption, etc.

The list was about joining PRISM, it doesn't say anything about backdoors in mobile phones. They may very well be present in all iPhone generations.

Curious as to why Amazon isn't on that list then? Perhaps it's true that Bezos has more in common with Jobs.

Apple had internet services since around year 2000. Apple had mac.com emails for a very long time, as well as

http://en.wikipedia.org/wiki/MobileMe

.Mac: July 17, 2002 – July 9, 2008

MobileMe: July 9, 2008 – June 30, 2012

iCloud was launched on October 12, 2011, one year before Apple entering Prism.

http://en.wikipedia.org/wiki/ICloud

The main difference before iCloud was that you had to pay for it. I can however remember that I've had free .me account before iCloud, so even .me must have had enough users.

You must not have read the part where he said "recently had some success"

Well, in the NSA's eyes, that main difference is important. Free (and highly pushed by the very popular iPhone and iPad) meant people actually starting using iCloud. The cost-benefit analysis shifted tremendously from .mac/MobileMe.

It is fun to think of Steve Jobs as the lone person saying "fuck you" to the NSA. But it isn't realistic. It isn't like the other companies are run by meek people who love bending over to authorities.

I can remember that I've had a free .me account before iCloud, so I believe even .me must have had enough users: it was freely available to every iDevice user. There were millions of them fast.

How does that follow? It is not just about the cost, but the amount of utility for the NSA. There are plenty of free services that are not on the PRISM list and I am sure even Apple employees would freely admit their pre-iCloud user numbers were disappointing. They would not have bothered to rebrand the service in the first place if they had a significant userbase.

Looking at the PRISM company list, we are talking data service companies with users in the tens of millions (minus the oddball Paltalk). Apple just wasn't in that group until recently.

I thought you were joking about the number plates thing, but it's true (and apparently legal) ...

http://thenextweb.com/apple/2011/10/27/mystery-solved-why-st...

This reminds me of a friend of mine who proxies all his web traffic through something which strips user agents and referrers. It's very easy for me to tell when he visits my website, because the logs show "-" for each of these fields.

That's really interesting. It sounds like an easy way to get targeted by the people who do want to track you, though. Still -- do you have any idea what he uses for that?

How does your friend do that? I'd be really interested in reading on how to setup a proxy like that.

Burp, fiddler maybe, webscarab maybe. Some kind of proxy with any sort of meaningful capabilities.

http://www.privoxy.org/

It is really simple.

> It's very easy for me to tell when he visits my website

Simply drawing attention to the fact that his attempt at anonymity acts a key personal identifier in this instance.

>This reminds me of a friend of mine who proxies all his web traffic through something which strips user agents and referrers. It's very easy for me to tell when he visits my website, because the logs show "-" for each of these fields.

I wonder if the best strategy, then, is to figure out a very common user agent string and use that. The EFF's Panopticlick might be a good start: https://panopticlick.eff.org.

Steve Jobs went through a background check for a top-level security check in the 80s. I wonder if he ever received it?

http://www.wired.com/threatlevel/2012/06/steve-jobs-security...

I find it hard to believe that the NSA didn't see one of the most valuable and popular companies in the world as a priority until 2012. I bet they were salivating as soon as the first iPhone launched.

With a public record as a LSD user, I wonder how they could have justified giving him clearance.

I don't think that would effect his chances. All of our latest presidents have admitted or have been proven to do illegal drugs of some sort. Not to mention that the U.S. government has done some crazy things with drugs, especially LSD.

https://en.wikipedia.org/wiki/Project_MKULTRA

http://www.cracked.com/blog/five-fun-facts-about-the-cia-and...

As I understand it, getting a security clearance doesn't especially care about whether you've done anything illegal, it cares about:

1. Whether you're likely to voluntarily leak any secure information.

2. Whether someone who dug up some dirt on you could blackmail you into leaking secure information.

Or as the saying goes, it's fine to have a mistress, but having a mistress that your wife doesn't know about is a problem...

Having gone thru the sec clearance thing in the 90s, the third thing is if you have financial issues (like an expensive addiction with much income) and some foreign intelligence service can "help". So they're pretty interested in finances. Which wouldn't have been a problem for Jobs...

A friend in college wanted to be an FBI agent, so I got to hear alot about this.

I believed they polygraphed you about drug use, and I recall that they had a threshold number of "experimental" sessions with marijuana that were ok, as long as you disclosed them during the background check and polygraph.

The FBI still uses the polygraph? I would hope the FBI would be looking for the kind of people that know a polygraph is near worthless.

I remember an Australian talking about the various levels of clearance - confidential, secret negative (anything stand out in your history), secret positive (in-depth active examination of your history). He said that the process wasn't about finding dirt on you, it was about finding out if you had any dirt that could be leveraged against you. For example, if you were gay and being outed would be a problem, then that's leverage. If you didn't care and were clearly open about it, that's not leverage.

That harmonizes with my experience. I was interviewing for a "top secret" job with the US and spent some time studying the system and looking over the appeals rulings of the clearance process.

Generally, the key things were, "are you a crook? are you liable to be bribed/coerced?".

E.g. one chap was a transvestite, but the appeals court ruled that since his wife and minister knew, it wasn't something that could be leveraged against him.

If the record is public, then it actually provides a lot less leverage for blackmail than a history of secret use of LSD.

Then again, Apple was (and still is) huge on the mobile sector. As far as surveillance goes, I'd expect mobiles to be of high priority.

Why bother with a phone manufacturer when you can have access to all communications directly at the network provider? Much more convenient.

Possible but unlikely. Steve Jobs was very influencial within Apple. Jobs' opinion was almost certainly a strong factor. Apple had been a leading and popular mobile phone manufacturer for many years before 2012, why wouldn't the NSA be interested in them?

We don't know. We just went with the more plausible explanation, instead of jumping through hoops to avoid it.

Apple not being a priority for NSA until Oct 2012? Pfft.

Is this just a function of the relative popularity of the services?

Or it means even NSA knew that Apple has mostly sucked in data and web services.

Reply on news.ycombinator.com