How the NSA Plans to Infect “Millions” of Computers with Malware

But, as Huxley was so keen to point out, that's not going to happen when people are staring at Honey Boo Boo and Hollyoaks.

They will: it costs a lot of money to keep data alive.

And it is a shame, NSA data for research purpose should be put under the UNO protection: - it holds lower bits of informations interlaced with the "big data" like how flu is propagating; - we could analyse causality chains and propagation of ideas (the impact of culture); - we could see corruptions effects, measure it and decide if it worths the price; - we can record the variation and evolution of natural langage/style;

These data are a treasure, the should be opened after X years, but for economic reason, they will be deleted.

The key to effective political action is getting all the other existing politically active groups to realise that they don't want to do politics under surveillance either. Everyone from the NRA to the NAACP should oppose this.

Talk about guns on the internet? It's trivial to keyword match make and model names, and the NSA can presumably correlate this back to home addresses. They already have the database of who the gun owners are if they were to want to confiscate them.

Remind nonwhite people about the FBI's attempts to blackmail MLK. http://www.theguardian.com/world/2014/jan/07/fbi-office-brea...

Everyone should understand that this infrastructure can and will be used to interfere with domestic politics, not to mention being used to attack democracy abroad (see 20th century South American history). You cannot support a system that is unjust to your enemies and assume smugly that it will never be turned around on you (Diane Feinstein passim).

For now it's probably useful to concentrate upon emphasising how illegal/unconstitutional all of the above activity is and that the buck has to stop somewhere. Someone has to be held accountable.

Also, they don't "vacuum up everything they can lay their hands on." According to this article, they exploit on the order of tens of thousands of systems and have a control system to pull data and recordings from targeted users.

Not impossible for NSA to get in but a lot more difficult.

Very frustrating as I work with a Microsoft-oriented company at the moment. Any mention of this to their architectural team results in nothing short of "mwuhahaha you're talking shit". There is some weird universal trust there that really makes no sense at all.

To add insult to injury they don't log, don't have an IDS and don't have a clue stick to hit themselves with.

Their funeral!

Microsoft gets information about vulnerabilities from the same sources as everyone else. They outspend every other software vendor by something like 4:1 on outside software security consultants. If they are in a privileged position regarding WinAPI software vulnerabilities at all, it is a marginally privileged position. No security person working at Microsoft would tell you they were confident that outsiders weren't holding severe, exploitable vulnerabilities back.

NSA, meanwhile, is as competent at sourcing vulnerabilities as any organization on the planet. They have internal research teams that generate them that are presumably competitive with any private research team, and they apparently purchase vulnerabilities like everyone else --- not from Microsoft, but from research teams that sell vulnerabilities.

Microsoft gives pre-release information about vulnerabilities to lots of different organizations; for instance, the IDS and network security vendors get pre-release info to create signatures. This program is, IIRC, over a decade old.

NSA is a dual-role organization; it also houses the USG's center for defensive technology expertise. It is the opposite of surprising that NSA would have the same relationship with Microsoft as, say, Symantec would.

Finally, CISPA does nothing resembling what you claimed it does. CISPA is opt-in; it cannot be used to force a company to disclose anything. CISPA is about incident data, not vulnerabilities. It is already lawful to share vulnerability information with the government. The gray area in data sharing is non- anonymized incident data, which can be covered by any of 10+ different regulations that make even IP-level metadata risky to share for collaborative defense.

CISPA is an extraordinarily short bill; you can simply read it instead of taking my word for it.

Perhaps if research were to show that "soldier" could be more broadly interpreted to mean "agent of security," you could really get some momentum going for this line of though. After all, we aren't required to keep other pieces of security enforcement in our homes, such as turrets on the roof controlled by the government.

Keep it up.

Nowadays, especially from the start of the "War on terror", this distinction has been artificially demolished; one of the consequences is that there is way more leverage to wark around laws (and to do many other nasty things).

You're welcome.

I'd welcome that in general! Make the switch open up the camera app directly, and a similar one for the mics; binding it to your phone or recording app, depending on what you prefer.

Make each switch a LED which -if they are- signals ON-state as the screen is turned on or off.

Edit: And incoming call screen would have to reflect the mic being off, in which case flicking the switch would accept the call.

See http://time.com/10115/google-project-ara-modular-smartphone/ and similar projects.

a) The breadth of the spying, including many, many innocent people.

b) The long-term storage of data, likewise.

c) Deliberate weakening of security standards we all rely upon.

d) The fact it's all happening without democratic debate.

If instead of the above, they threw innocent people's data away, targeted their intrusions, engaged with the democratic mechanisms, and used their expertise to improve internet security, a lot of people would be much happier.

In this fast-breaking story, the expression "computer servers" has joined "software program" and "underground tunnel" at the Department of Redundancy Department.

Unless you're asserting that adding back doors makes a system more secure.

Simple: every process running on a system is a process that can be exploited, especially those processes that involve network communication. The NSA's exploits are processes running on the system they are attacking. They utilize network communications. These processes are open to exploitation by third parties, just like all the other legitimate processes.

The big news is that the most powerful people on the planet are now using the same script-kiddie techniques against the rest of the world, in secret, without oversight, on an industrial scale.

EDIT: Judging from your github account, you appear to be a developer working on a open-source whistleblower platform. Given that the NSA's efforts would likely be focused on the users applications such as yours, do you not find these revelations to be directly relevant to your goals in developing this software?

>All the hyperbole about how this is somehow unique is really getting old.

The issue isn't that the spooks have developed some superweapon. The issue is that they've signaled intent and means to do mass espionage on citizens, not just at the network level, but at the machine level. This is as if your local law enforcement handed out burglars tools to all their officers so they could get into everyone's homes "to check for drugs". "Eh, burglars tools are nothing special" totally misses the point.

"Having or showing the capacity to develop into something in the future"

Or alternatively

"Having possibility, capability, or power."

Or in Merrium-Webster:

"expressing possibility ; specifically : of, relating to, or constituting a verb phrase expressing possibility, liberty, or power by the use of an auxiliary with the infinitive of the verb (as in “it may rain”)"

I can see no difficulty in the authors expression of the idea of possibility.

When phones are found to have close 'relationships' with phones that have at least at one point been used by 'baddies', sometimes the computer decides that the phone must be executed. It prints out an order, which is passed up the line to the President. The President rubber stamps the order. The order goes back down the line and eventually finds it's way back to the computer. The computer, using the before mentioned drones, locates that phone and informs a drone operator. The drone operator then tells the drone to execute that phone, and any people who may happen to be in the area with it. The drone carries out the execution.

Nothing but a bureaucratic skynet.