NSA Spied On Human Rights Groups, Says Snowden
techcrunch.com
techcrunch.com
That's amazing. Imagine being able to construct a regular expression that get's applied on every single piece of communication in the world. Yes, it's far too much power to entrust to anyone, much less an unaccountable secretive organization, but I'll be damned if that's not an incredibly fascinating and attractive proposition. No wonder these bureaucrats are willing to so thoroughly overstep the law, that kind of power must be very tempting.
"Too many secrets" indeed.
Plus, it's not like anyone will use their information to make their life hell or put them in jail. At worst, they might be denied some promotion.
- Richard Clark, former Counter-Terrorism Czar
While evidence is insufficient to draw conclusions in that specific case, the fact that it is so plausible should be extremely worrying. (Hi, NSA spiders.)
Many of the groups targeted are involved with actively investigating human rights abuses conducted by many countries in the world - including the USA in Guantanamo Bay, Abu Ghraib, drone strikes, secret prisons, etc. I fail to see exactly what the US National Security interest is in investigating these groups (Caveat: not all NGOs worldwide should be outside scrutiny, ie ones which funnel arms to Al Qaeda obviously but these ones certainly don't do that). The security community (as has happened in many countries over the years - the UK in Northern Ireland for example) has confused "National Security" with "embarrassment." I say "security community" as there are many fantastic people within US government and private institutions that are capable of looking at the long-term interest and are doing a good job of supporting human rights and freedom on the internet. For example, it is a credit that so much great work like The Guardian Project and Whisper Systems is underway to address such problems.
Human rights groups and journalists have been consistently the victim of high-level APT from China, Russia and elsewhere - there are many cases documented online. Many of these have been targeted through the exact same methods that large corporations like banks, defence companies, nuclear energy businesses. It's somehow morally wrong that organisations like GCHQ and the NSA actively thwart attacks (and share information) on such companies, while ignoring and obviously exploiting threats against human rights groups (which often end in the deaths of human rights defenders, aid workers and journalists).
The long-term national interest of the USA and other countries is the spread of our good values - freedom of speech, freedom of assembly, self determination, respect for international law etc. The "war on terror" has caused too many to lose sight of these soft-power instruments and that is a pity. Which does more long-term good for our way of life, values and foreign policy these days, Lockheed Martin or Amnesty International?
That's not really an interest, short or long term. What are the various lobbies to gain from this? What is indeed an interest, and has been for over a century, is being the top dog, and taking advantage of that (using propaganda, lackeys and military power when needed) to get cheap resources, favorable trade deals and allies that ensure this goes on forever.
Playing on a level playing field has never been of interest.
I am very disappointed that you think the DoD is not organized under the Executive. Please learn to citizen.
We have heard a lot about how people don't want their cloud computing in the US any more, however, as of yet, there has not been a lot about how those that now know they are effectively being targeted have changed procedures.
Anyone in a 'save the world' group care to comment?
These days everyone drinks at the NSA bar. where everything is on tap, all the time.
Even furthermore, the various intelligence agencies also weaken systems for their own convenience, and yet there is nothing stopping anyone else from exploiting such weaknesses. Isn't this simply recklessness and negligence?
We keep hearing about hackers getting customer data over and over again, is that because of what our government has done?
It's not just spying.
I guess we also have to ask ourselves if this was deliberate on their part, or did they just miss the emergence of the credit-card-as-electronic-money?
The story of it is interesting: Clifford Cocks was working on it, he went home, and had the realisation at home. He could not write it down because that's not what mathematician spies do, so he had to remember it overnight u til he went back to the office the next morning.
Want to consult with person X who is trusted by authority Y to do Z at a level L? This is straightforward without a bespoke who-trusts-whom website (heck, it's possible without "users") if we have PKI.
Every year we don't have PKI is quite possibly trillions lost globally. If the NSA has been the one preventing the adoption of widespread PKI, then this is the cost they have imposed.
For 99% of the population, excel formulas are the pinnacle of their technical prowess.
People learn when it's sufficiently important that they do so.
How do you sell understanding cryptography, using it in real life and whatnot?
As more criminals pour through the holes opened by the NSA and their ilk, it will become difficult and then impossible for most of those victims to be made whole.
At that point you can easily sell security, privacy and good government. That is, if it isn't taken violently at the point of a pitchfork. [Hey, NSA, have you reinforced your buildings?]
As some guy said, you can't start with the technology and work backwards to customer experience.
Unfortunately, Skype hold all your keys and Microsoft changed the architecture to make legal intercept and tapping much simpler. I do not believe it is safe to assume that Skype conversations are private.
Current systems really do rely on users having some understanding of how trust in the application works.
For example, TextSecure really requires you to confirm keys in person (or via QR code etc) if you want to be sure you are not MITM'd. This is not obvious to most users I have spoken to.
As for web-of-trust for store and forward communication, social networks are an great way to provide secure key-signing.
The available solutions are shared secrets with zero knowledge proof (like OTR does), voice verification (like various "secure phones", a web of trust, or CA infrastructure.
Crypto everywhere will improve things immensely, but (repeating myself) ultimately the user needs to understand how they can trust that the other party is who they say they are. So far we do not have a magic (automatic) way to do that for the user.
For store and forward you need public key exchange and a mechanism for trusting identity. However, in most use cases where you have a mix of realtime and store and forward communication, you have ample opportunity for key signing where you can trust the identity of the person asking for your signature.
tr;dr: There really are no usability excuses.
I am in two Dutch groups that are saving the world, both of them were not hosted there but definitively won't now. Also a company I work for was collecting client customer data, they moved storage from US to Netherlands.
Evidently, none of the big three UK political parties have any interest in reining in GCHQ, just as neither the Democrats nor Republicans have any interest in constraining the NSA. Who does wish to pull that leash back?
There is likely no agenda related to those groups in particular. They are spying on everyone.
The agenda one would guess is: get them to stop, intimidate people who follow a hot lead, know anything that's about to be reported in advance, etc.
It even happens for ecology groups. Here's a case from Britain -- see how far these things can go:
http://www.theguardian.com/uk/2012/jan/20/undercover-police-...
Certain groups that the US deems contrary to their national interests may come to an aid agency for help.
I think this goes against the grain for a lot of HN.
Despite common perception, almost all libertarians are "minarchists" not anarchists. They want to minimize government, not have no government.
An agency such as the NSA could actually fit into that model of governance if it had a defensive focus instead of an offensive one (ie. protecting citizens interests first instead of the state).
It diminishes the sovereignty of Austrians. It makes us a global spook. It didn't prevent a single bit of terrorism. Activity like this only enhances power to the short-sighted and self-important. There is a lot we should simply stop doing, and stop paying for it to be done, and spend that on things that make the lives of Americans better, because we rate poorly on quality of life measures.
Power comes from a strong, productive economy. Putting ourselves in a panopticon is not productive.