>I doubt the components are backdoored by default in stock hardware. More likely, GHCQ was worried that other nations (China, Russia, etc.) were targeting Guardian journalists in an effort to gain access to the Snowden cache. As such, GHCQ probably was simply taking extra precautions in the event that hostile intelligence agencies had installed implants into the Guardian's hardware.
This is it in a nutshell, and, legislation states they had to physically destroy the devices. It was not optional. It was the law. There is absolutely nothing more to it.
> [Edit to Add]
Believe me, I have destroyed the brand new iDevices of senior Government personnel because they plugged it into a classified network to charge it for less than a minute. The law is the law. I actually had a wall of digital devices we had drilled, degaussed etc etc. The Guardian were treated the same way we treated everybody. I had my phone confiscated cause I stupidly did the same thing at the start of my career. shrug
There really is no story here which makes the cloak and dagger theories even more funny. It is almost cargo cult-ish. Some guys at Cheltenham will be rolling in the aisles reading these comments.
> [Legislation Guidance for those asking]
You can Google and read the statutes and policies yourself.
>> Once the classified material had been confirmed, security operators were then legislatively bound to destroy or other render unusable the material in question.
The legislation which required all reasonable and necessary measures are contained within the Official Secrets Act 1989, the National Security Strategy, the Data Protection Act and the Regulation of Investigatory Powers Act 2000 with detailed policy guidance promulgated to intelligence operators via HMG Information Assurance Notes (1/2 (SPF)) and, more importantly, HMG Information Assurance Note 5 and the Joint Services Publication 440 which governs counter-compromise measures.
Ultimate responsibility for HMG security policy lies with the Prime Minister and the Cabinet Office. Departments and Agencies, via their Permanent Secretaries and Chief Executives, must manage their security risks within the parameters set out in the framework, as endorsed by the Official Committee on Security (SO).
All HMG employees (including contractors) have a collective responsibility to ensure that government assets (information, personnel and physical) are protected in a proportionate manner from terrorist attack, and other illegal or malicious activity.
The loss or compromise of such Critically Important Assets would have a severe, widespread impact on a national scale and Departments must work with the National Technical Authorities and the Cabinet Office to ensure they are afforded appropriate levels of protection.
[EDIT TO FURTHER ADD]
I have posted the links to 7 policy and legal frameworks. If you cannot find these documents or you are still asking then frankly, you are too fucking stupid to trying to analyse the law or most other things.
People on HN are not your legal secretary. You not being able to find something is not proof of it's absence.
Don't get me wrong, I'm not saying you're wrong. Just seems odd, is all ^_^;
Zen Pro also derped his way through an unconfirmed and subsequently removed AMA on reddit: http://www.reddit.com/r/IAmA/comments/1vpluh/iama_former_mil...
No wonder he thinks he can bluff about British laws here.
[1] I posted the link to the AMA on HackerNews. Stop acting like you "uncovered" it. It's in my submissions. I also don't think a single one of my replies on that AMA counts as a Derp - if you do, please post the replies in particular. I had a number of PM's from Redditors saying they thought it was actually very clear and interesting.
Unlike your book on Programming Android which currently has 35% of it's reviews listing as terrible. http://www.amazon.com/Android-Application-Development-Progra...
[1] "Whatever your Android programming level is, this book is a complete waste of time and definitely doesn't worth a single penny. "
[2] "I am an avid Oreilly fan. I write software in a number of different languages and environments. This has got to be the absolute worst coverage of android I've seen. It was less informative than the books covering beta releases. There are typos, not just normal sentence typos but method signatures in the examples. I feel pretty ripped off having bought this book."
One of the worst rated books in O'Reilly history it seems. Congratulations. If you want to get into personal attacks Zigurd let's do it, let's get the rulers out and do some measuring. Derp derp.
[2] The AMA was cancelled because I redacated the names of individuals from my documents (Managers etc) so the Reddit Team decided it was not valid since it could be forged. That's fair enough, it's their platform and I was not willing to provide any other than my assessment reports. I can provide you the email chain if it bothers you that much and you present a compelling enough reason to want to verify it. However some very diligent Redditors actually did find my full details and contacted me to continue the ama offline.
EDIT TO ADD: It was all very friendly and the AMA Team kicked the concept around for a over a week before they said that the evidence was not in line with their guidelines of total transparency. One of the guys actually apologised shrug. At no point was there the insinuation of lying.
[3] Unless you can counter my citations of the law with evidence that they are false then your opinion ranks a little bit below that of my daughter and she is not even 5. Last time I checked RIPA, Data Protection, HMG Security Framework were all perfectly readable right here on the internet and the Joint Service Publications were viewable under certain circumstances.
I would expect better from you than this ridiculous cheap shot making me out to be some sort of liar when we have never met and you don't know me. You could have even messaged me on Reddit with your concerns. Hell, I have the same username.
Would you mind furnishing us with your experience of UK Legislation and the UK intelligence community?
"I think ZP is lying about his national security claims"
"Prove it"
"Here's a thread where it looks to me like he's bluffing"
"Well, your book on Android has poor reviews"
--------------------
I'm not passing opinion on whether you are telling the truth about intelligence or not, but I'm honestly puzzled what his book reviews have to do with anything.
After that, it got better.
Perhaps you could take this discussion offline.
Apologies to the HN audience for having a public spat :-)
Which law mandated this? (I'm actually asking for chapter and verse of the lawbook).
If you bring your American laptop into an American secure facility and plug it into a secure network, it then becomes part of the secure network, and you cannot take it back.
You also shouldn't get anywhere near the secure network without being told about this.
EDIT: By "secure" I mean "classified/secret/top secret"
Edit: so plugging your laptop into a secure network = access to classified information, therefore your property can be destroyed?
Its the same idea that malware operators test out mobile malware in faraday cages so that the malware can't jump devices.
At a prior job, we used to joke about "TOP SECRET cupcakes": once you brought them into the SCIF, they could never be taken back out.
While Snowden, WikiLeaks, and others are demonstrating that every country may be a leaky ship information wise, the scale of the USG information security apparatus is absolutely amazing, especially if you've also gotten to see how some smaller countries do it.
Years ago I interviewed at hunting's (a List X arms manufacturer) and the interviews where done in a separate room adjacent to reception you never even went inside the plant.
And by secure I mean environments which may, or may not, have access to (or even information about) classified networks.
Based on his/her comments I suspect ZenPro is somewhat full of it and thinks he's still a spy.
The intelligence community is staffed with literally millions of people who are not spies. TOP SECRET clearance for contractors in the USA alone are >1million
This is the equivalent of me wandering into a debate on the Royal College of Physicians and try to argue the merits of certain healthcare policies.
Let's take you at your assessment - I am a 'fake' spy. Haven't I, even as a fake, demonstrated a breadth of knowledge on the intelligence apparatus that you could only dream of?
What exactly is it you think you are bringing to this discussion?
As for there being no laws; are you just ignoring the posters that have worked in similar US, Australian and International departments who say exactly the same laws exist?
So no, I don't think you are an actual spy. I don't think you've "demonstrated a breadth of knowledge on the intelligence apparatus that you could only dream of" either.
Shorthand for a member of the community is just 'analyst'.
Spook/Spy is a pop culture reference to a very specific role in the intelligence community.
To give you some context about the thing that you think you know about.
>> The United States Intelligence Community (I.C.) is a federation of 17 separate United States government agencies that work separately and together to conduct intelligence activities considered necessary for the conduct of foreign relations and national security of the United States. It includes intelligence agencies, military intelligence, and civilian intelligence and analysis offices within federal executive departments.
>> The Washington Post reported in 2010 that there were 1,271 government organizations and 1,931 private companies in 10,000 locations in the United States that are working on counterterrorism, homeland security, and intelligence, and that the intelligence community as a whole includes 854,000 people holding top-secret clearances.
That is just the USA. That does not take in the 5 EYES Community (UK, CAN, NZ, AUS) or the rest of Europe (FR, DEU, IT, DK etc)
And you think that none of these places legally destroy magnetic media that contains compromised classified information?
Seriously. Are you on crack?
Paragraph 1 here essentially states that anybody who knows enough policy to be able to tell you how classified systems work won't be telling you.
https://www.gov.uk/government/uploads/system/uploads/attachm...
Is an open source article that gives an understanding of the basics.
On the other hand there is evidence he is something of a Walter Mitty.
ZenPro must be lying because he referenced publicly available legislation and discussed the rationale behind destroying Guardian magnetic media. No one involved in the Intelligence Community would do such thing.
Thank God Edward Snowden leaked all those documents.
If you have evidence of me being a Walter Mitty by all means publish it. :-) I would love to see the evidence that mitigates my entire career, genuinely.
Go ahead. For each evidence you publish I will upload 1 x Annual Report and a link to 1 x professional publication in my own name and links to the intelligence reports I wrote which were later published on Wikileaks during the Afghanistan disclosures.
Go.
However, to demonstrate the breadth of your naiveté in your little witch hunt - here is the first line of that document you linked to.
ensure they are appropriately protected; support Public Sector business and the effective exploitation of information; and meet the requirements of relevant legislation and international / bilateral agreements and obligations. It applies to all information that government collects, stores, processes, generates or shares to deliver services and conduct business, including information received from or exchanged with external partners.
This is nothing to do with the Official Secrets Act. We disseminate these documents freely and at industry conferences to ensure List X companies are in compliance and also because the Intelligence Services have a vested interest in ensuring our economic and commercial IT infrastructure is robust. So struck out on the Official Secrets Act claim. Let us see how you do in reviewing policy...
You will find on Page 15 the extant legislation that I referred to in my original post above. So far so credible. It is almost like the intelligence operators were obeying that law or something...
...oh wait, the very next page.
This document should be read in conjunction with the detailed standards and guidance set out in the HMG Security Policy Framework (SPF).
Pretty sure I said that in my original post.
And then the gem of gems - Page 18. Destroy / sanitise to prevent retrieval and reconstitution followed by Guidance about the management and handling of security incidents is available in the SPF documents 'Security Breach Management' and 'Leaks Procedural Guidance' Relevant ICO guidance should also be consulted.
You are 0 for 2 there. Thanks for playing though. That's what happens when you attempt to position yourself as someone qualified to question a process you have neither been trained or educated in.
You will also find above this comment 4 other HN posters who confirm that US and Australian security procedures are the same and another poster confirming that the procedures are the same for civilian IT engineers working in commercially sensitive environments.
Are we all lying?
I know which paragraph of which publication you're referring to but it's protectively marked and as such neither of us will be posting it on here. That's where the Official Secrets Act comes in to it.
That was the original argument before the sub-threads and vote gaming started.
8 Safeguarding of information.
(1)Where a Crown servant or government contractor, by virtue of his position as such, has in his possession or under his control any document or other article which it would be an offence under any of the foregoing provisions of this Act for him to disclose without lawful authority he is guilty of an offence if—
(a)being a Crown servant, he retains the document or article contrary to his official duty; or
(b)being a government contractor, he fails to comply with an official direction for the return or disposal of the document or article,
or if he fails to take such care to prevent the unauthorised disclosure of the document or article as a person in his position may reasonably be expected to take.
(2)It is a defence for a Crown servant charged with an offence under subsection (1)(a) above to prove that at the time of the alleged offence he believed that he was acting in accordance with his official duty and had no reasonable cause to believe otherwise.
(3)In subsections (1) and (2) above references to a Crown servant include any person, not being a Crown servant or government contractor, in whose case a notification for the purposes of section 1(1) above is in force.
(4)Where a person has in his possession or under his control any document or other article which it would be an offence under section 5 above for him to disclose without lawful authority, he is guilty of an offence if—
(a)he fails to comply with an official direction for its return or disposal; or
(b)where he obtained it from a Crown servant or government contractor on terms requiring it to be held in confidence or in circumstances in which that servant or contractor could reasonably expect that it would be so held, he fails to take such care to prevent its unauthorised disclosure as a person in his position may reasonably be expected to take.
TL;DR: if you have sensitive information (and you know it is sensitive, and have not been given it by someone with access who expects you to keep it secret) and do not return or destroy it as you are asked you are committing a criminal offence.
Don't bring rational thought to this thread rcxdude.
Great TL;DR by the way.
> TL;DR: if you have sensitive information (and you know it is sensitive, and have not been given it by someone with access who expects you to keep it secret) and do not return or destroy it as you are asked you are committing a criminal offence.
http://www.asd.gov.au/publications/Information_Security_Manu...
I gather the UK equivalent is "HMG Infosec Standard 5"? The above link is not particularly informative, but it did have this gem on page 166:
Disposal of media
Disposing of media in a manner that does not draw undue
attention ensures that previously sensitive or classified
media is not subjected to additional scrutiny over that
of regular waste.
Control: 0378; Revision: 2; Updated: Sep-11;
Applicability: G, P, C, S, TS; Compliance: must;
Authority: AA
Agencies must dispose of media in a manner that does not
draw undue attention to its previous sensitivity or
classification.
Assuming the British system operates on similar principles, I'm not sure how this clause squares with having your media disposal effort splashed across the Internet and subject to scrutiny by Privacy International. :-)keyboard controller - random chinese ASIC that probably contains MCS51 core and some kind of non-volatile memory (with no meaningful way to ascertain whether it is flash or mask ROM) => it is data storage device
"trackpad controller" - actually serial flash that trackpad controllers apparently boots from => data storage device
"inverting controller" (seriously, wtf? :)) - simple analog chip which probably contains <1k transistors, but it's datasheet says it is "programmable" (by means of few external resistors, so it does not actually store any data), and was probably destroyed in order to destroy everything that stores data or is "programmable".
https://www.blackhat.com/html/bh-us-11/bh-us-11-briefings.ht...
[edit: the "seriously, wtf?" comment has to do with naming it "inverting controller", not with it's destruction]
Keyboard controller can be made to leak RF. Same for touch. Inverter is close to lvds signals, could probably be made to leak picture over FR.
If anything GCHQ targeted THEIR OWN assets.
> People on HN are not your legal secretary. You not being able to find something is not proof of it's absence.
This is needlessly baity. You know the nMes of the legislation and you should have just included those names. Otherwise you are requesting tens of thousands of people to make many websearches to get that information. That feels obstructive and evasive.
Calling people fucking stupid is decidedly suboptimal and peoe will downvote for that.
When someone posts a new javascript lib, they don't explain what the for loop does.
There were reports that US govt ended up destroying desktop PCs because the users had seen Snowden reports on the CNN website. At the time that suggested the prospect of using this as a denial-of-service attack; inject classified material into enough places and the government is legally obliged to either destroy its own IT infrastructure or stop looking at the internet.
Would broadcasting classified material on TV give the government the right to seize and destroy every PVR in the country?
Those of us old enough to remember "Gerry Adams has his words spoken by an actor because we're not legally allowed to broadcast him speaking on TV" know how ludicrous this kind of speech control can get.
However, I can only repeat what I have said all along; regardless of the stupidity or the flaws - it is still the law. Classified material stored on insecure devices results in the device being destroyed to prevent further breaches.
In regards to the CNN reports etc - the US has a history of reacting disproportionately to events. See Hugh Miles book Al Jazeera for some truly frightening examples including the bombing of an Al Jazeera office in response to the allegation AQ were receiving coded news messages. To which the Pentagon responded "Oops. Must have been a mistake...we swear. Thank God you were not in there, you might be next time."
I am biased but I like to think the UK has taken a very scalpel-like and proportionate response to the whole situation.
David Miranda, come with us for a minute. Would you like a lawyer? No. OK. We need your laptop. OK you are free to go. Safe flight.
Guardian. Hi, we need those laptops. If not we can get a warrant for the whole building. Laptops destroyed. OK. Carry on as normal and let's all get back to work, us silo-ing information and you trying to un-silo it.
^^ In a nutshell.
I mean, think about it, how do you think this situation would have been handled in Russia, China, North Korea, Saudi Arabia, Iran or even East Germany back in the day. You think there would have even been a discussion, an option?
Russia, China, North Korea, Saudi Arabia, Iran or even East Germany back in the day
Is that on a motivational poster inside GCHQ? "Not as bad as the Stasi"? Talk about low expectations; don't you think we might aspire to something a little better than "not as bad as North Korea"?
>David Miranda, come with us for a minute.
A 9-hour-long "minute", that was.
>Would you like a lawyer? No.
Afaik, he was not given any chance to contact a lawyer -- the anti-terrorism legislation used does not require it. Which is a disgrace in itself, but hey, it's our UK gov -- illiberal at the best of times.
>OK. We need your laptop.
Yeah, private property of a foreign citizen they had no right to, seized while in-passage through an airport safe-area, and (iirc) not even handed back.
And this tops it:
>regardless of the stupidity or the flaws - it is still the law.
Law enforcement is always executed with a degree of discretionality. Strictly speaking, the average citizen breaks the law every day multiple times for the silliest reasons, but he doesn't get prosecuted. When stupid laws are enforced, it's the duty of a citizen to question why and to react if the answer is unsatisfying. In this case, you probably find the answer satisfying and I don't.
A stupid, illiberal law was enacted in a stupid, illiberal way by a stupid, illiberal government for stupid, illiberal purposes (and it didn't even work, considering they still don't know what Snowden got).
Schedule 7 Anti-Terrorism has been now been improved (at the request of the Home Secretary ironically) to reduce the maximum time and provide for legal counsel as standard. Yes. We are so illiberal we voluntarily reduce our legislative powers.
Are you seriously suggesting that the United Kingdom should not stop and detain foreign nationals who are carrying our Top Secret data and then relieve them of that data?
:-) Good one.
I find it satisfying that a Brazilian civilian travelling through the UK was stop, detained and relieved of British property and then allowed to go freely on his way without further incident. I find that an absolute masterpiece of Government restraint in a highly charged situation.
To sum up -
>>Law enforcement is always executed with a degree of discretionality.
That's an interesting word. I assume you mean discretion or one of it's derived terms.
>> Afaik, he was not given any chance to contact a lawyer
You know nothing Jon Snow. <joke> But seriously, he was offered a lawyer and he felt so threatened that he refused one.
>> Foreign national <snip> no right to seize property etc
The High Court ruled the authorities could examine the seized material for the defence of national security.. It was perfectly within the law according to UK judges. If you don't want your items seized, don't transit UK classified material.
You mean, unlike you? Ye gods. He was not offered a lawyer by any traditional meaning of the phrase. He was offered a stooge selected by the very same people interrogating him and implying he might be a terrorist. When he asked for his own lawyer, that's when he was refused, rather shooting a hole in the idea that he would have been given good representation if he'd gone with the so generous British offer.
> We are so illiberal we voluntarily reduce our legislative powers.
These powers were reduced because of the overwhelming evidence that they were being abused: like by detaining people involved in journalism using powers intended for terrorism. Don't try and spin this as the UK being so awesome and democratic. We passed a stupid law that was repeatedly abused by people living in some kind of reality distortion field, and that's why the powers had to be reduced - despite the natural inclinations of many Tories.
> Are you seriously suggesting that the United Kingdom should not stop and detain foreign nationals who are carrying our Top Secret data and then relieve them of that data?
Whaa? Yes, of course he's seriously suggesting that. Your post speaks volumes about how disconnected you seem to have become from basic common sense. Miranda was working on data that had already been leaked to multiple journalists around the world and was going to go public no matter what. This fact was already public at the time. You can't "take back" information that was deliberately leaked to multiple journalists - at that point under any sensible set of rules the information would cease to be classified, because you can't classify something that's public knowledge.
I'm blown away that you find the British government's oafish response a "masterpiece". Let's see what it achieved, shall we?
* Nothing of value was obtained from Miranda.
* It triggered international outcry from journalists around the globe, making Britain look stupid and illiberal on the world stage.
* It pissed off Miranda's partner who then prioritised GCHQ related information for release.
* It confirmed what most people already suspected or knew: that the British intelligence apparatus will happily classify anyone as a terrorist if it suits them, regardless of how dangerous they actually are (in this case: not at all).
* It means in future journalists working on stories that might embarrass the British government will simply avoid British airports, resulting in the same media coverage with the added bonus that it looks like the UK doesn't care about freedom of the press.
Positive outcomes? None as far as I can tell.
Some masterpiece!
A bit further down this thread you can see how one of his counter-arguments consisted of telling someone his Android book had terrible reviews. What's funny about this is that it fits neatly with one of JTRIG's purposes of destroying reputations.
Although he did such a hilariously bad job of trying to destroy someone's reputation, I doubt he's anything other than a troll.
But now that I think of it, he did succeed in derailing a big part of this thread, so maybe he knows what he's doing.
1. Never proclaimed I was a spook or a spy. Not once, anywhere.
2. If I did proclaim I was a spook and was indeed a JTRIG sockpuppet that would make me a pretty fucking terrible secret provocateur wouldn't it?
3. A poster attacked my writing so I responded with the Amazon reviews calling his own writing terrible. Pretty sure he destroyed his own reputation with his book long before this thread. He could have just linked to the Reddit without criticising my writing.
4. If you can find a factual error with 1-3 then post it.
It was early in my HN posting and it was a stupid title. Not even remotely close to the original Reddit title.
I concede the point. If I am shill I must be a pretty poor one to torpedo my own credibility like that.
shrug
Evidence? Links? Data?
All you have is speculation. Once, you could argue "no reason to worry, what evidence do we have that spy agencies are using every possible avenue to spy on everyone they conceivably could spy on" - but now we've had considerable evidence to that very effect.