Hacker News Reader

Comment by tptacek | Hacker News Reader

We don't need the Snowden disclosures to know this; it has for 15 years been the worst kept secret in computer security. People from the various groups in NSA that do this work talk about having done it on Twitter. Some of the smartest people in vulnerability research came from stints in NSA.

Be outraged that we're spying on your country if that makes you feel better, I guess. I'd rather nobody spied on each other either. But it is intellectually dishonest to pretend that people are just now discovering that NSA was breaking into computers around the world. That is literally the charter of the NSA. It's why they exist at all. There isn't even a pretense of a different purpose for the organization.

View on HN

>But it is intellectually dishonest to pretend that people are just now discovering that NSA was breaking into computers around the world. That is literally the charter of the NSA. It's why they exist at all.

You're presenting a red herring here, tptacek. Any third grader who played played Splinter Cell would say, "No duh!" But the news isn't that the NSA is breaking into computers. The news is the scope of the intrusions (installing malware on 50k computers), and of the motivations for the behavior. We've been told it's to protect us from the extremist muslims attempting to establish a caliphate here in America [1]. That was a lie. 50k computers with US-planted malware on them is not a defensive maneuver. It's an offensive one. It's not about protecting America. It's about global information dominance.

Now, whether we want that or not is a different question; there are advantages and disadvantages to the issue depending to a large degree on whether or not you believe in American exceptionalism. But this is about an executive power grab, not about "spies spy, let's all go home now," and you're deluding yourself if you believe otherwise.

[1] http://www.nsa.gov/public_info/_files/speeches_testimonies/T...

The NSA was breaking into huge numbers of computers long before we were worried about a "caliphate", and the fact that they were doing it was showing up on people's resumes before 9/11 as well.

And this isn't about "American Exceptionalism". China didn't hack Google because they were upset about NSA hacking; they did it because Google had information they wanted, so they took it.

Then let's stop deluding ourselves and make it clear that the NSA's charter is about promoting what a small number of powerful unelected beaurocrats believe to be American interests, both politically and economically [1], without significant oversight. Then we can have an honest discussion on whether or not that's a good thing.

[1] http://www.theguardian.com/world/2013/sep/09/nsa-spying-braz...

Where do I sign your petition? I'm right there with you.

And while we're at it, let's stop letting them wave the "but the terrorists" flag every time they justify a program for which the goal is a lot more than terrorism (assuming many programs are about terrorism at all. Personally, I suspect most programs have nothing to do with terrorism, but that there is no better way to push through support than to argue "but the terrorists").

Many attacks against USA are motivated because of actions like the ones from NSA. Other countries are starting to consider the USA an enemy to be defeated because bulshit likes this is getting shown. If citizens of other countries start to make an outcry their leaders will make retaliations even if just for show.

> The news is the scope of the intrusions (installing malware on 50k computers), and of the motivations for the behavior.

GCHQ have said for at least 15 years that their mission is to monitor all communications, world wide, at frequencies from DC to light. They've said that they provide intelligence for their customers, who are the Ministry of Defence and other parts of government. (MI5, MI6, etc).

> It's about global information dominance.

GCHQ / NSA have never ever said anything different.

> But this is about an executive power grab,

It's a grab that happened a decade or more ago.

I don't know anything about GCHQ, but I don't want British intelligence to have intimate details about my life stored in some nosql database, and I see it as an offensive maneuver by a foreign government from which my government fails to protect me. See my reply to tptacek's post sibling to yours for a general response to your inquiry.

Well, they do. Just like Russia and China. I agree it's offensive. Now what? Next you'll tell me governments routinely have foreigners killed.

>Well, they do. Just like Russia and China.

I seriously doubt that. Russia, for example, could not care less about 99.9% of western citizens (whereas for western spying agencies, those are potential dissidents to be kept on check).

And even if they cared, what exactly would they do with that information? It's not like they are particularly powerful, imperialist or try to play global cop (post USSR). It's also not like they arrange puppet politicians and governments in foreign countries, as western powers are known to do.

I see it as an offensive maneuver by a foreign government from which my government fails to protect me.

Which is why you should be angry at your government for failing to protect you.

GCHQ have said for at least 15 years that their mission is to monitor all communications, world wide, at frequencies from DC to light

That's a truly appalling aspiration. If that is indeed their aspiration, which apparently it is (total information awareness, master the internet etc), we'd be safer with them shut down completely. Otherwise as more and more data becomes available online, they'd be in a position of absolute power over the populace (including those who are supposed to control their activities).

That's not keeping us safe, that is endangering the things they purport to defend.

Don't you find this aspiration frightening?

It's a grab that happened a decade or more ago.

Oh, that's ok then. Business as usual. Would you prefer people just didn't bother to discuss this topic, or do you have something to say about where the limits on this behaviour should be?

> Would you prefer people just didn't bother to discuss this topic,

I would prefer that people stop saying that it's a modern development, or that there was no sign of it until Snowden leaked, or that it's some weird new thing. GCHQ at least has been open about their behaviour for years and years. ECHELON was discussed in EU parliament.

> do you have something to say about where the limits on this behaviour should be?

My view is tricky for me to explain, but I'll try.

1) GCHQ need to be allowed to do stuff. The limits should be clear, and defined by law.

2) GCHQ is a secret organisation, thus their oversight must be by people who keep secrets, but who are accountable to the public. GCHQ oversight failed, hard. I'm not sure what should happen. I hope that, in secret, someone is getting a kicking.

3) I don't care what GCHQ does to people who are not subjects of the UK (or whatever the hell England plus others is called now)

4) For UK subjects I would prefer that GCHQ does not collect meta data. I could be persuaded that they can collect targeted meta data, if they have suitable oversight. EG: They know that Bob is a terrorist-sympathiser. (Beyond just looking at a few YouTube videos - this would be things like sending money, fly-posting, fund raising, associating with other terrorists, etc.) GCHQ would apply for, and get, a warrant, and be allowed to collect meta data for that person. Warrants would require oversight, not just by the courts but by the oversight body.

5) For UK subjects I strongly prefer that GCHQ does not collect content data unless they get a warrant.

6) GCHQ claim to obey the law. I want oversight to be stronger, and I want some of the GCHQ choices to be challenged. I don't want weird interpretations of words to guide their behaviours. (EG: Clinton's "I did not have sexual relations" - well, a blow job is sexual to most people.)

Having said all that, I am a lot less bothered by GCHQ data slurping than I am by other potential privacy invasions.

GCHQ has a many petabyte dump of data but there's no impact on me unless they grep my name. (I'm aware that this is like me saying I'm not so bothered by police stop and search powers; me being white and rarely leaving the house means that I'm never stopped and searched.) Plenty of other organisations have my data, and we have many examples of them breaching confidentiality through corruption, incompetence, maliciousness, and so on. I said a bit more about that in this post. https://news.ycombinator.com/item?id=6767612

Thanks for commenting. I do think this is a subject worth discussing until it is fixed.

GCHQ has a many petabyte dump of data but there's no impact on me unless they grep my name.

I'd disagree there - if GCHQ is collecting huge dumps of data, it doesn't have to be your data to affect you directly. For example if your MP or prime minister is deposed because of selective leaks of their data, that could easily affect your life in dramatic ways.

Yup. TBH I simply don't understand the logic that makes an offensive act against a non-combatants by an individual illegal, but somehow permits that same act against non-combatants by a nation state.

It it is illegal for an individual to murder someone, then it should be illegal for the government to do so. If it is illegal for a programmer to infect thousands of computers of innocent people with malware, then it should be illegal for the government to do so.

I have no doubt in my mind that among those 50k are many innocent people (foreign and domestic), and that among the domestic infections, I doubt the NSA could produce a warrant or other legal instrument that permits them to have caused that infection.

Under what wacky laws do we actually permit such malware. And are there any provisions in those laws proscribing corrections for any offensive malware programs that cause collateral damage.

What does illegal mean in the context of government? The government decides what's illegal. If you want to declare some government's action illegal, you need to find a bigger government to impose their laws on the little government.

If you live in a nation of laws, i.e. some form of functioning democracy, the people decide what is legal through their representatives, and this can change gradually as attitudes shift. The government is supposed to be an instrument of the people, not the other way around.

I assume the parent is talking about the USG spying on or murdering other not-US people, in which case the people of the US have more or less decided that's what they want.

Has there ever been an NSA thread where you didn't take the opportunity to tell us why whatever the NSA has been doing is completely normal and expected?

Yes. For instance, I was not a believer in the NSA curve backdoors.

Unfortunately for whatever innuendo you're trying to evoke here, I'm on pretty firm ground when I say that NSA sponsoring computer hacking is normal and expected. I say that because you can find it on people's fucking resumes.

Not many of the people commenting in this thread, to say nothing of the general population, are founders of security research firms. We may have seen noisy rumours of these things, and even noisier hints at their scope and extent, but we're not being personally mailed verifiable primary documents by first-party actors.

The only thing I find even more fascinating than his unwavering attempt to defend the despicable actions of the NSA is how these posts end up every time as the top comments.

I don't think I've seen him defend their actions, just explain them. I, for one, appreciate it. He is in a sphere that I am not in, and were I to guess whether or not this was well-known behavior, I would have guessed not. And, apparently, I would have been wrong.

So I thank tptacek for sharing what he knows that I don't know. That is, after all, why I come here.

That's a really good mindset to have. However, saying that what the NSA is doing is expected really doesn't explain anything.

(Sorry for the late reply)

It was unexpected for me, but I think it is important for us to understand that it wasn't unexpected for everybody. It's kind of like if we found out that Gitmo really wasn't exceptional. That would be important.

It would imply that this something is a standard practice, many groups are aware of it and for some reason, over time and through many events, they've decided it's the best policy that they can hope for (or else they would have blown the whistle earlier).

It means you should consider changing policy carefully, because the policy was put in place (and stayed there) not on a whim but rather after some consideration and re-consideration. Unless you think that all of these groups are filled with horrible people whose only aim is power and control you might have to allow that some of them have different insights into the problem from their experiences.

Please understand that I'm not defending anything- just showing how it could be important to learn this type of information.

But this is exactly the point!

We could close down all news sites and stop reporting on all crimes - because, hey, the cop, the robber and the victim knew already hours ago that somebody had been robbed.

The argument that something should be a no-story, just because I personally suspected/knew about it already for some time screams of delusional self-importance worldview to me.

Don't you think that he's being a little inflammatory with statements this?

  But it is intellectually dishonest to pretend that
  people are just now discovering that NSA was breaking 
  into computers around the world.

By your own admission, you are just now discovering that the NSA was breaking into computers around the world.

^wrong assumptions. You're assuming he didn't know already. Why would one make a statement like that if one didn't know beforehand?

(sorry for the late reply)

Perhaps somewhat, but not really. I read the word 'people' in the sense of 'some group' instead of 'any single person.' In other words, 'people now know that eggs aren't bad for you' doesn't mean that every single person has learned this, just that the knowledge is in the generally accepted body of knowledge and those with business or interest in nutrition know it. At least that's how I read it.

But if a person does not know that the NSA is doing this (and possibly would tell you that they aren't doing it, were you to ask), then is that person being intellectually dishonest in acting like this knowledge is new to everyone?

I think that leveling a claim of intellectual dishonesty at someone who thinks that everyone else was as ignorant as they were is a bit harsh, and sort of inflammatory.

I think that most people would reasonably believe that if there were such strong signals that the NSA was doing this it would be closer to public knowledge than it was.

I don't mean to drag this on forever, but I read the comment differently- as I said in the reply linked below. In short, that person isn't being intellectually dishonest. But the organizations who did know better and are pretending otherwise are.

https://news.ycombinator.com/item?id=6796335

>I don't think I've seen him defend their actions, just explain them.

Explain them as "business as usual" to take away the outrage.

Might as well have been explaining the actions of the KKK.

(sorry for the late reply)

I didn't take it that way. In fact, you could argue for more outrage: "There are certain groups who knew about this behavior all along and for them to pretend that this is news to them is bullshit" is how I read it.

So if you are going to be outraged, you should be outraged at the groups "in the know" as well.

I don't think it's defending. It's one part nerd-based "I've known about this forever. It's obvious!" and one part "this is their purpose — yes, it's abhorrent, but that's the entire mission, so don't be surprised when they do what they are chartered to do."

I'd take a bet that it's mostly the former (and the latter is rather similar to it). It's not just that some people get off on pointing out that something is 'obvious', it's that lots of other people feel the same way. So they upvote.

A somewhat similar example that always comes to mind in these cases (and for some reason happens relatively often among my 'geekier' friends) is when someone says 'I don't dream'. There's always a smart-ass around to point out that everybody dreams, but they just don't always remember it. I don't know if that's true, but that's irrelevant..

It might be technically true, but it's pedantic and misses the point of the statement. And it cuts off a potentially interesting conversation for the sole purpose of making this person sound smart.

I've noticed myself doing this too (I privately call it 'snoping' someone), and have been trying to avoid it as much as possible since I became aware of it.

Well, I am in the software industry, but not the security industry. And I don't recall anyone mentioning to this to me. Or on HN.

Can you point to some HN threads that discussed this in detail before Snowden? For example, when China was hacking Google, some people may off-handedly said, "well we do it too", but nobody gave specifics as Snowden did. His revelations were extremely useful.

Ditto. During all the "China is hacking us" stories, I never once recall any piece of news that talked about what we were doing to the rest of the World. As someone who is also in software, if such a story had been published, I would have been among those in the United States most likely to have read such a story.

If you have articles with publish dates pre-Snowden with lots of examples like the revelations in the posted story, please share. I want to figure out how I missed this.

>We don't need the Snowden disclosures to know this; it has for 15 years been the worst kept secret in computer security.

Just 1 year before, people would deny such thing occured and treat you like a conspiracy theorist, including here on HN.

>But it is intellectually dishonest to pretend that people are just now discovering that

A, the "we knew it all along so it's ok" defense -- with the "and furthermore, you should be ashamed for pretending to have learned about it just now" extension...

> "and furthermore, you should be ashamed for pretending to have learned about it just now"

You are wrong.

People have been saying for as long as email has existed that it is not private and that anyone can read it. People have been warning that if you have something secret you must not put it online, or that you must use sensible encryption carefully if you do so.

Risk assessment has always been part of online security considerations.

Online privacy is not a new thing. Knowing that governments have access to everything is not a new thing. Being annoyed that governments do it is a new thing.

What did you think they were doing with the huge secret budget and more computing power than anywhere else?

It's news to my mother. Half of the UK and US government are saying it's news to them. The world's press seems to think it qualifies as news.

> It's news to my mother.

2001, in mainstream UK newspaper http://www.theguardian.com/world/2001/may/30/eu.politics4

> the European Parliament warned EU citizens of the threat to their privacy from Echelon, a global eavesdropping network run by the US National Security Agency in cooperation with Britain, Canada, Australia and New Zealand. As we reported on Saturday, it concluded that the primary purpose of the system is to "intercept private and commercial communications". It urged individuals and businesses to use codes to protect their communications.

> Half of the UK and US government are saying it's news to them

1999, from the website of this secret agency https://web.archive.org/web/19990428012157/http://www.gchq.g...

> GCHQ employs one of the largest long term bulk near line storage systems in the world. Data is stored in a number of locations on a variety of media, including magnetic tape, cartridges, recordable Compact Disc and optical storage technologies.

What did they think was being done with the largest long term storage system in the world?

> GCHQ has an interest in all aspects of modern telecommunications and uses a variety of systems designed to operate on all frequencies over which data can be transmitted.

I'll admit that the GCHQ FAQ got a bit slimier later on. See this page from 2004 https://web.archive.org/web/20040604234303/http://www.gchq.g...

> People sometimes think that we cannot be accountable because we do not disclose much about GCHQ's operations and methods.

> Nothing could be further from the truth.

> In fact, GCHQ is subject to very rigorous oversight both by Parliament and senior members of the judiciary, and works entirely within a legal framework which complies with the European Convention on Human Rights.

> Activities at GCHQ are underpinned by the Intelligence Services Act 1994 (amended most recently by the Anti-Terrorism, Crime and Security Act 2001) and the Regulation of Investigatory Powers Act 2000. The purposes for which interception may be permitted are set out explicitly in these Acts: national security, safeguarding economic wellbeing, and the prevention and detection of serious crime. Interception for other purposes is not lawful, and we do not do it.

But I've already condemned this kind of wording used to justify unjustifiable privacy violation.

EDIT: It's mildly interesting reading through the technology pages to see it iterating. They list Win3.1 in the early versions!

It could maybe be described as hidden in plain sight. If you dug around there were pieces in the public domain that you could put together. But if you suggested this, you would have been dismissed as a tinfoil hatter by most people.

More to the point, the fact that it is a huge story in the news across the world proves that most people were simply unaware. So it doesn't mean much to say that this was already known when to most it wasn't. That could be taken to imply that there is nothing to see here and that people who are bringing it up are a little slow - which is simply disingenuous. The fact that my mother doesn't read every page of every newspaper doesn't mean she should be disenfranchised. And it also doesn't change the fact that many businesses are only now changing their behaviour and moving away from US companies and reconsidering architecture for IT projects and business operations.

You're managing to change my mind.

I should say that I'm glad it's now being taken seriously by many people. I'm a bit worried about the number of toy crypto systems popping up. I'm frustrated that people still release apps that have over-broad privacy intrusions.

May I suggest a different perspective: We did need the Snowden disclosures to know this, for some value of we. A lot of members here on HN appear to realize this for the first time, and this is obviously a computer-related community. Non-technical people, considering who to vote for next time, certainly needed the Snowden disclosures to know this. The press could have picked up this story from resumes, but didn't, so the disclosures do allow for a democratic discourse on the subject, which wasn't possible earlier.

I do appreciate you sharing the fact that among computer security circles it was a well-known fact, and it's sad that you get so much hate for your informative comments.

You might also reasonably ask why tptacek and friends weren't blowing the whistle as this is huge news to most.

I can't speak for tptacek. I don't know what he and his friends were doing.

But I've been telling people to encrypt everything, and to assume the government can read everything, for very many years.

Sure, I lack gravitas, but still. We were telling people about it.

A Google web search for Echelon before 1999 reveals many hits for the secret codename (as well as many not relevant hits)

https://www.google.co.uk/search?q=echelon&sa=X&ei=IXWRUpCGE8...

We successfully fought against idiotic ideas from government to control use of encryption (EG Clipper chip). We told you to use encryption. We told you they could listen. We told you they were listening.

What more could people have done?

http://webjcli.ncl.ac.uk/1997/issue1/akdeniz1.html#ukpolicy

I think there's a strong distinction between "the government can read everything unencrypted" and "the government has a horde of vulnerability researchers, and routinely infects huge numbers of computers with their code". For the sake of discussion, I will concede that the former was well-known. The latter, IMO, wasn't.

What more could people have done? Good question. Maybe try and contact investigative journalists, although I have had no luck doing that for an unrelated issue I feel strongly about (NBA game fixing).

We didn't do it. We didn't do it. We didn't do it. We didn't do it. Its old news.

That it is old news is a simple, verifiable fact. I don't care what NSA said in public.

But it's interesting to know the scale of this, because the bigger the scale, the more people and institutions around the world will starting to think that "hey, they must be doing this to everyone, possibly even to us - so maybe we should do something to protect ourselves better".

I guess that makes it ok then.

Sovereign countries interact in the state of nature. Your country has a problem with the NSA? Pick up a SAT solver and build yourself some ROP shellcode and hit us back. Oh wait: your country's already doing that.

Do I like it? No. We don't work with the USG, and that's one of many reasons why.

I’m not sure what intrusions you’re referring to. Would you care to elaborate?

My country? Are you kidding, they couldn't hack their way out of a paper bag. Any expertise and equipment they have is provided by the NSA, and they're a bunch of B-players with no budget.

The whole situation is uncomfortably asymmetric. Economies of scale I guess. Winner takes it all.

Cheer up. We're also protecting the world's shipping lanes.

From whom? Last I checked we had most of our fleet sitting outside countries with whom we have conflicts of interest and not countries known for harboring pirates taking over private vessels. When was the last time a US war ship captured a Somali pirate vessel?

The US Navy capture smaller vessels quite regularly. The larger pirate boats may have non-combatants and/or hostages aboard so the rules-of-engagement limit the Navy actions.

Yup. Winner takes all. Everybody else gets their noses rubbed in the dirt.

Planes in buildings are also a good choice. Many planes, many buildings

Be outraged that we're spying on your country if that makes you feel better, I guess. I'd rather nobody spied on each other either.

Opposition to the tactics of the NSA/GCHQ does not require you to be opposed to the existence of spies. That's an old, tired argument, which we didn't need to go into the first time. Of course spies spy, but should they do so without boundaries, without proper supervision, and above the law? Should they do so outside wartime and on allies? Should they be given the very real capacity to subvert our democracies and networks worldwide? Who then will keep them in check if the head of the NSA decides he wants regime change at home? How will we know if this has happened?

Personally I don't think this world-weary acceptance of lawbreaking is an appropriate response, and I'm outraged that spies in my country (GCHQ) have been collaborating with collection of data worldwide and handing it over to the NSA, without any respect for international law or the interests of their own country.

The important discussion to be had is on where the boundaries to NSA surveillance lie, and how to perform adequate supervision of them, and just what laws they are not allowed to break. At the very least I think we need a proper inquiry into those topics, which we have not been offered thus far. Spies could (and have) assassinate, kidnap, subvert the political process, and break into networks worldwide but should they do those things to allies and domestically? Should we fund them to keep doing it? Should we accept the perpetual state of war which has been engendered by wars on terrorism and drugs, and the use of that to justify tyranny, assassination and subversion of the democratic process? If we say they can and will do all these things, because it's just what they do, we might as well given up on the pretence of a democracy we currently enjoy.

There are very good reasons the NSA is not supposed to be used domestically, and I'd argue those reasons should also extend to allies, if only because not doing so means your country will no longer have any real allies at all. Why should anyone trust the US or UK in trade negotiations when they've been shown to cheat and steal at every opportunity? Why should Sri Lanka say not just laugh in the face of the UK when Cameron talks of human rights, and China laugh in the face of the US when it complains about intrusive industrial espionage? The blowback on this topic is very real and deep and is only going to be reinforced by reactions like yours above which come down to 'spies will be spies'. The defensive capabilities of the NSA should be far more important than the offensive ones in my opinion, particularly in times of peace. Acting as if you are in a perpetual state of war with other nations, including your closest allies and even domestic population, will lead them to treat you the same way.

The spies have become a supranational organisation which apparently doesn't feel it is answerable to anyone; even the politicians who are ostensibly in charge of them. I think that's dangerous and worthy of note.

Reply on news.ycombinator.com