Canada Casts Global Surveillance Dragnet Over File Downloads | Hacker News Reader

Canada Casts Global Surveillance Dragnet Over File Downloads

firstlook.org

210 pointsetiam74 comments

So basically, Canada is tapping HTTP to popular sites and logging the IPs and URLs for later searching and correlation, on undisclosed grounds.

For most people that probably means in practice Canada knows who you are what you download, and has it available for searching on a whim. As disgusting as it is, I think the technical among us already assume every spy agency everywhere is doing at least this much behind closed doors, so it's not a shocking revelation.

My reaction can best be summarized as sadness. I was never under the impression my home country was somehow better than the states, but it's sad to have evidence of that.

Does anyone here really believe this is limited to Canada? I think it safe to say that the NSA/GCHQ/MIB have similar/identical programs of their own.

I think it's safe to say that those agencies are their own orthogonal state by now.

Eh, from the phrasing, it seems that it's entirely concerned with HTTP file-sharing sites, while completely avoiding e.g. BitTorrent search engines. Living in Vancouver BC, I've never encountered anyone using a file-sharing site for anything other than to create an ephemeral URL for oversized email attachments.

Canada is a member of the "5 eyes" alliance, so it's prudent to assume our government has access to just about any data the NSA/GCHQ has. It's also wise to assume CSIS and CSEC are far more competent and well-equipped than is let on.

> My reaction can best be summarized as sadness. I was never under the impression my home country was somehow better than the states, ...

AFAICT, you're a timber-and-oil operation with a small enough population to make it profitable; Saudi Arabia with snow. If those of us in the States could still live that way, we would. That said, you seem a bit less eager to exploit your Fellow Man, so you're slightly better.

In general, yeah, but that current government of theirs is a piece of work...

http://sciencewriters.ca/initiatives/muzzling_canadian_feder...

If I read this right, Canada's largest single export is cars (probably from GM Canada to GM America)

https://en.wikipedia.org/wiki/Economy_of_Canada#mediaviewer/...

Russia is the Saudi Arabia with snow:

https://commons.wikimedia.org/wiki/File:Russia_Export_Treema...

Wow. I never would've guessed our aerospace industry outstrips our wheat exports. That's pretty crazy!

Probably the closest thing to pre-crime than any other Snowden leak. Canada FTW.

This is the side-effect of reaching the goal of 'collect-it-all', the next logical step would be to evolve beyond targeted surveillance, or even honey-pots, and start doing large-scale behavioral analysis of raw traffic patterns, and use those as probable-cause indicators for further surveillance.

This is the ultimate promised-land of the surveillance state.

Don't forget to harvest the data for future blackmail or social discrediting use. Also allow for fake records to be added so that those in power have dirt even on the cleanest challengers.

Planting evidence digitally seems like a particularly useful ability.

If that were to prove difficult, slip a USB drive into someone's bag and tip off the authorities.

The fact that these signals intelligence entities are working so hard on the pre-crime angle causes me some optimism. Because most of the countries of the world are not actually at war and are not likely to go to war there is little value in signals intelligence. The idea that it might be possible to predict when individuals are going to do something bad can be seen as a kind of last gasp at relevance for such entities. If it turns out that such prediction is not possible then signals intelligence will simply be defunded in most of the world.

The key is going to be figuring how to demonstrate whether it's effective. The only way to scientifically test a prediction is to do nothing and see if it happens and then publish the result either way, but the probability of the government doing that is zero. The government playbook is obvious: They're either going to arrest the person and declare victory even if the prediction would have been wrong, or send in some agitators to provoke the person into committing a crime and then declare victory if they do or pretend it never happened if they don't.

One way to prove that it isn't working is if there are still terrorist attacks or high crime rates despite all the spying, but then they'll just want to use the empirical evidence that their spying is ineffective as an excuse to do more spying or some other stupid/invasive/expensive thing. Meanwhile if (as seems to be the trend) crime and terrorism remain at low levels, that proves nothing either way because it could just as easily be a result of something like the elimination of leaded gasoline[1] in most countries outside of the middle east.

[1] http://www.motherjones.com/environment/2013/01/lead-crime-li...

A possible solution is to require ultimate disclosure of all criminal investigations. Whenever an investigation is closed or effectively abandoned by having less than e.g. 40 hours dedicated to it in a month, require the target to be notified and provided with all of the evidence and notes the same as they would have gotten in discovery if the case had gone to trial. That way people find out about the failures and can see when their tax dollars are going to investigate innocent people.

> most of the countries of the world are not actually at war

It's sort of hard to reason about this. War has changed significantly in the sense that were there to be an absolute war between Great Powers the collateral damage would be wholely absolute. That doesn't mean the Great Powers haven't come close to all out armed conflict, or even that they aren't currently engaged in proxy measures to increase their spheres of influence.

Take the current crisis in Ukraine. American citizens seem surprised that events are currently unfolding there, as though all of a sudden Russia decided to be a bully, and as if the events in Ukraine unfolded due to activity local to the region. This ignores the context - that NATO and the EU, under the leadership of Germany (who was hacked recently - again - by Russia) with the support of the US has for the past decade pushed hard to absorb former Warsaw Pact nations. It ignores that both Georgia and Moldova before Ukraine were geographically split into breakaway regions and saw West- and Russian- backed separatists, cluster munitions and the rest. It ignores that the West was involved in the funding and training of Euromaiden groups and the Orange Revolution, that Voice of America pushed for political changes in these Baltic states that led to their distancing with Russia. It ignores the conflict between the United States plans to deploy anti-ballistic missile shields in zones technically illegal according to Cold War deals and Russia's responses. It ignores the Russian push to expand influence in parts of Europe and its support of Eurosceptic parties. It ignores the contended areas around the world that both Russia and NATO lay claim to (including areas in the North Arctic, which are important strategic military points). It ignores the stop of disarmament, and in fact rearmament and reassessment of nuclear capability, of nuclear countries (primarily Russia and the United States). It ignores the forming of an alternate world bank between China, Russia, India, and Brazil. It ignores the that the conflict in Syria is both historically grounded as an area of Cold Proxy War and Russia's support for the Syrian Assad regime today. It ignores Russia's ambitions to build stronger ties with the Latin Americas. It ignores the development of hypersonic missile delivery systems by the nuclear proliferated nations (to which there is no known defensive answer, well besides, to small degrees formerly mentioned 'anti-ballistic shields'... say located in the Czech Republic or Poland...), and the sharing of this technology between allies.

This is a long, roundabout way of saying that there is absolutely conflict that errs on the side of violent conflict today and that in fact the areas of most activity - Ukraine and other Baltic states, Syria, Venezuela - and where tensions are building like North Korea and parts of Europe are areas that are inherently and intrinsically linked to Cold War spheres of influence and the interests of Great Powers today.

The nature of war has changed. It has had to. But nations are still at war. If you don't want to call it that, we don't have to call it that. We can call it state violence or something.

The second point to be made here is that most of the capabilities of the intelligence agencies are geopolitical capabilities whose targets are states rather than violent individuals. From the targeting of nationals' cell phones and email records, the hacking of national oil companies and infrastructure, the sabotage of nuclear operations in Iraq and now South Korea, the exfiltration of defense data from the United States and from Israel, the hacking and grounding of the Syrian air force, the cyber attack on Georgia during military intervention - these capabilities are cybermilitary first and cyberpolice second.

Great post, thanks for this.

It's not about winning wars or even predicting crime. It's about having the knowledge to control events to your advantage.

Intelligence agencies are tasked with questions like "If Russia invades the rest of Ukraine, how will Germany react?" That can be answered with data from tapping the leadership's phones, or by how often the words "putin" and "despot" appear together in emails from German citizens.

Will the current German government fall if they do not react? How about if Russia moves the day after an important German election? How much does Russia know about German public opinion? Is there a greater chance that they will invade after/during/before the election?

Replace "German election" with "the Winter Olympics" and you have a very realworld question.

That, sir, is a grown up attitude, and has no place here on Hackernews.

> If it turns out that such prediction is not possible then signals intelligence will simply be defunded in most of the world.

I don't think that's how government works. If it turns out that such prediction is not possible, then they'll receive more funding to do more surveillance and manipulation, and continue the cycle "until it works."

"Because most of the countries of the world are not actually at war and are not likely to go to war..."

I don't agree with that assessment, on many levels - finance, state actors in territorial/resource disputes, national & ethnic issues. Its an 'uneasy peace' for many nations.

A time of relative domestic peace (for us) and the sublimation of conflict into market competition, can lead us to overlook the facts.

Through history war and conflict seem like a natural condition/disposition. This time is no different to any other.

an analyst from the agency jokes about how, while hunting for extremists, the LEVITATION system gets clogged with information on innocuous downloads of the musical TV series Glee.

What that seems to imply is they have no interest in piracy and that it is not considered "extremist" to be a pirate... which is an interesting position for the government to take - the * AA and various other industry associations would love to have access to this data.

Signals intelligence agencies have to deal with enough data as it is. They don't have the resources to care about piracy or even the vast majority of drug offenses.

What about agencies who do have the resources, and who can request that this data be shared with them?

Think Parallel Construction.

If they build some bridges to the *AA it will cost net negative resources to care about piracy.

You know this because? Once stored it can be farmed to anyone with a mapreduce job to spare. Esp when the investigating agency can take some of the bounty, law enforcement can be a nice profit center.

Valid point. We don't know if they're doing that (and I suspect it's probably illegal) on a wide scale (the parallel construction cases appear to be specific help requests made by the FBI/DEA to intelligence agencies), but they certainly could in the future if they're not already.

AFAIK (Canadian here) it's legal to use anything commercial if it's for educational purposes, so they'd have to prove you're profiting off of it (with current laws) to prosecute. Please someone correct me if I'm mistaken ...

I doubt it's that clear-cut; if I'm downloading episodes of Glee or recently released movies to watch on my laptop, I'm not exactly using them for educational reasons, but I'm also not making a profit.

They'd have to prove it before they could go after you for it - you could be reviewing them, perhaps film or acting is your study.

RCMP have said fairly clearly on a couple of occasions that they have no interest in prosecuting individual offenders for piracy. They took down a tracker, stated explicitly that individuals who had downloaded from it had nothing to worry about, and funnily enough nothing ever came of it.

Stephen Harper is about the likeliest person to get a bill through to illegalize downloading, and the most we've got out of him so far is one that actually made it financially unviable for media companies to attempt to sue individual downloaders by capping penalties so low you couldn't even make money using a paralegal in small claims court.

With the election looming, and the economy seemingly committing seppuku just in time to wreck his ability to beat the economy drum like he did last election. So there's a strong possibility he's going to be out, and I don't think the other parties have any interest in passing any new copyright laws.

This is the kind of thing I think of every time someone suggests that there exist sites that "don't need HTTPS".

All sites need HTTPS, and all protocols need TLS or equivalent; plaintext should never appear on the wire.

While I agree, there's a reason that file sharing and video sites have been slow to take up HTTPS, and that's that it removes the ability for any intermediaries to cache the content. It puts more of a burden on ISPs and services to carry the extra load, whether it be through SSL-terminated peering, or more scaling at the home servers. It may be a necessary burden, but still, it's a pretty significant one.

In extreme cases, think of the infrastructure cost of streaming say, a world cup final game over HTTP vs HTTPS.

I see that as a good thing, it's an argument for ISPs to finally invest in upgrading their networks, though if Google Fiber wasn't already enough of a reason I doubt this would make a dent.

I'm not disagreeing with you, but HTTPS is irrelevant if a motivated adversary can detect that you've downloaded 5GB over the past 5 minutes from https://www.example.com/disney-frozen-0day-full-length. Without additional protocols, encrypted channels are still subject to traffic analysis.

They'll only see 5GB from www.example.com:443, the request path is protected by HTTPS. With some kind of DNS security they'd only see 5GB from 12.23.34.45:443.

The IP is well know so I'm not sure I follow the point about DNS. Also note it's not that they see 'about 5GB' but the size of every packet and exactly when they were sent / or in reply to what other packets. They can also have bots watching for all new content as its posted and who downloads files of the same size, etc. I would assume HTTPS will not stop someone from knowing what files you are downloading from a nation-state adversary.

I’d guess exact file size is mostly unique in movies/large files. A good heuristic at least.

This is very handy for doing an end-run around constitutional issues. If each country is not allowed to spy on its own citizens, but is free to spy with impunity on others, all you need is a strategic alliance (Canada <-> USA) where each country spies on the other's citizens and passes along information of interest.

This is already happening, on a large scale. There are numerous posts about this if you are looking for further information.

Aren't they going to be catching only the lowest of the low-hanging fruit using a technique like this, or am I giving terrorists too much credit? Wouldn't the ones engaging in actual criminal actions be using encrypted services, encrypted files, VPNs, etc. and not just randomly uploading things in the open from their devices to mainstream websites?

Replicating stainednapkin's [dead] comment:

> If you think these systems are meant to catch terrorists you are truly misinformed.

Fascist Canada? Doesn't sound right.

Stephen Harper would love nothing better.

Canadian here.

Sounds about right. Hopefully some people with ethics and values are still in politics. Hopefully.

Not fascism, a Public Private Partnership. Win-Win for everyone!

... which is an interesting theory given the fact that the linked slides show them looking through information gathered from videos on bomb-making and abductions.

Clearly all dedicated terrorists start by watching videos on the internet. Kind of a stupid notion to ground your whole argument on.

I had to do some major plumbing repair recently. I watched a lot of plumbing videos on Youtube to make sure I was doing everything correctly, because I had never done any plumbing work before and was worried I might screw something up. If I wanted to construct an IED, I'd probably watch a lot of videos to make sure I was doing everything correctly, because I've never constructed a remotely detonated explosive device capable of destroying a large vehicle and I'd worry that I might screw something up.

Ironclad. You're so right, anyone who watches a video on any government-approved terrorist topic should instantly be droned.

That's quite the strawman argument you've shot back. It goes along nicely with the shifting goalposts - if you recall, the original argument I was replying to simply stated that these programs had nothing to do with terrorism.

My point in my previous comment was that most of the people watching videos on bomb-making are probably interested in building bombs. If you're trying to find people who want to blow stuff up, that's probably not a bad place to start looking. Nowhere in there did I say the government should be blowing up everyone who looks at the wrong Youtube video.

> My point in my previous comment was that most of the people watching videos on bomb-making are probably interested in building bombs.

My point is that your opinion is unconstitutional. You're certainly free to express it. Thanks to the constitution.

Yes, it's a shame that the US constitution doesn't prevent a Canadian intelligence agency from spying on kidnappers in Germany and Algeria who are uploading videos of their hostages, along with Kenyans downloading bomb-making videos from companies in Hong Kong (Megaupload), Switzerland (Rapidshare) and wherever sendspace.com is located (their terms of use just says 'not in the US').

My morality isn't constrained by borders.

How would you know what the program's being used to look for?

> My morality isn't constrained by borders.

Perhaps not, but your constitution is.

> How would you know what the program's being used to look for?

Because I read the article and the accompanying Powerpoint slide deck, and those were the only concrete examples in it. You can't really make many hard conclusions beyond what was shown, and the examples that they did show weren't very infuriating...

Do you have any point worth making? You support the worldwide surveillance state. Everyone gets it.

It's important to note that the kind of 'terrorism' being fought here is in fact a war and thus geopolitical.

First, jihad means holy war.

Second, we are in a 'war on terror', where we have deployed our militaries to neutralize and kill tens of thousands of people. If you think these people were terrorists that had not yet ever attacked anyone - "preterrorists" - then you suggest that the United States and allies have the right to be judge, jurer and executioner on people's intentions, and have the right to indiscriminately kill. But if you say they are soldiers, or factional forces, then the ethics and norms of war applies and it becomes acceptable for us to kill these people in mass, whether they have ever killed someone before or not.

Third, the uniting of forces in the Middle East against Israel and the mandates of the West (who in there eyes differ only in label and not in function from colonialists) have close to a century old history now of being an area of proxy war between other nations. During and after the first world war as punishment and destruction of the Ottoman empire and in the establishment of British control and extraction of resources from the region, and in the development of an Israel, and via the Sykes-Picot agreement the redrawing of boundaries to keep the area unstable and divided. During and after the Second World War as a proxy area of influence of the League of Nations and the USSR. During the Cold War between the USSR and NATO and today between Russia's Syria, a historically divided Egypt, and NATO's Israel.

The 'terrorist' label being targeted is in fact a type of guerrilla fighter, a soldier that is potentially recruitable to a United Arabia that has historically hated its occupation by the West. A soldier who is more likely to attack somewhere at home than even attempt to leave and do violence in a Western country. We do not drone strike any old guerrilla fighter, however. We drone strike the ones whose politics and infighting, at the current instance, are counter to the hopes and dreams of US foreign policy. Those Arabs who learn how to make homemade bombs that are against the Assad regime, for example, are absolutely allowed, even encouraged, to live.

The dumb ones are just as dangerous as the smart ones, and there are far more of them.

Can you provide a single example of these systems stopping an act of terrorism?

They declassified four shortly after the Snowden revelations began: http://intelligence.house.gov/1-four-declassified-examples-m...

Thanks for sharing that information created and disseminated by the NSA itself[0][1][2]. Wasn't the original party line "over fifty"? No reason to think they would ever lie[3][4].

Elected US officials don't have access to enough information to verify those claims, guessing you don't either.

[0] http://www.propublica.org/article/claim-on-attacks-thwarted-...

[1] http://www.huffingtonpost.com/2013/10/23/nsa-attacks-thwarte...

[2] http://www.washingtontimes.com/news/2013/oct/2/nsa-chief-fig...

[3] http://www.slate.com/articles/news_and_politics/war_stories/...

[4] http://www.allgov.com/news/controversies/nsa-director-alexan...

The link was from the House Intelligence Committee, not the NSA. I'm sure they're basing a lot of that on information they got from the NSA, since these are, after all, NSA programs, but those four examples came from an entirely separate branch of the government.

I'm curious if you bothered reading the three articles you cited, because the Washington Post article doesn't address those four cases at all, and the other two in that group you cited are, in fact, the exact same article published in two separate outlets. The arguments that the authors pose against three of the four cases is basically that it was possible to acquire the intelligence differently, not that the programs failed. The argument against the 4th case makes the argument that because Khalid Ouazzani was indicted for separate charges, the programs must not have worked. This article[1] gives more detail on the case, and explains why he wasn't indicted.

The original "party line" was the following (from [2]): Gen. Keith Alexander said these programs enabled the United States to disrupt 54 "events," 42 of which "involved disrupted plots."

Of those 54:

12 involved cases of material support to terrorists; 50 lead to arrests or detentions; 25 occurred in Europe; 11 were in Asia; 5 were in Africa; 13 had a homeland nexus.

Forty-one of the terrorist activities did not involve events in the United States, Alexander said. Alexander went on to say that in 53 of the 54 cases, data collected under Section 702 provided the initial tip to "unravel the threat stream." He said that almost half of terrorist reporting comes from Section 702, ...

When Sen Leahy questioned Gen Alexander on this, it was more of an indictment that the media was getting it wrong and inflating the count by including the 12 material support cases, and clarifying how many cases were the result of the bulk cell phone records program (one or two) versus PRISM (everything else).

> Elected US officials don't have access to enough information to verify those claims, guessing you don't either.

I'm guessing you've never sat in on a classified congressional intelligence committee briefing, and wouldn't have the information to back up your statement.

[1] http://abcnews.go.com/Blotter/al-qaedas-abandoned-ny-stock-e...

[2] http://usnews.nbcnews.com/_news/2013/06/27/19175466-nsa-chie...

> I'm sure they're basing a lot of that on information they got from the NSA

Cite the exact sources the House Intelligence Committee's report was based on. If it's coming directly from the NSA what makes you think it's trustworthy? They've lied under oath.

Your conclusions are debatable.

> I'm curious if you bothered reading the three articles you cited, because the Washington Post article

Curious about your reading ability as well. The article is from the Washington Times, not the Washington Post. The very first paragraph states:

The Obama administration’s credibility on intelligence suffered another blow Wednesday as the chief of the National Security Agency admitted that officials put out numbers that vastly overstated the counterterrorism successes of the government’s warrantless bulk collection of all Americans’ phone records.

They seem to be talking about the exact same numbers you're citing as unassailable truth. Hopefully that satisfies your curiosity.

> I'm guessing you've never sat in on a classified congressional intelligence committee briefing, and wouldn't have the information to back up your statement.

Sorry this doesn't make sense. Not sure how to respond.

> If it's coming directly from the NSA what makes you think it's trustworthy? They've lied under oath.

I love this assertion - it gets tossed around so much when someone just wants to shut an argument down. Because James Clapper (who is not part of the NSA) gave a statement on the NSA to Congress which turned out to be false, every subsequent piece of information on the NSA from a government official that disagrees with your opinion must therefore be a lie - no evidence necessary. Who needs to examine official testimony when we can just say the opposing argument is all lies and call it a day?

> Curious about your reading ability as well.

Classy.

> They seem to be talking about the exact same numbers you're citing as unassailable truth.

You're the one that introduced the numbers with your "party line" comment, not me. My point was that your cited article claims to show Gen Alexander caught in a lie over the '54' number, admitting finally that it was only one or two, when that was never his claim to begin with. For that matter, Sen Leahy isn't questioning the number, either - he released a rather long statement on the matter[1] in which he stated that his issue was that the number of successes for the Section 215 (bulk cell records) and the Section 702 (PRISM) programs were being lumped together. Gen Alexander gave public testimony in June stating that 53 of those 54 successes were from PRISM, but that fact wasn't being adequately conveyed to the public. You'll note that Sen Leahy states in that document that he did, in fact, have access to the complete classified list.

> Sorry this doesn't make sense.

Allow me to break it down for you: you have never been to any of the classified briefings given to either of the two congressional intelligence committees, so you don't know what was briefed to them. You have no idea how much access the congress has been given to classified information. When you say "Elected US officials don't have access to enough information to verify those claims," you have no way to back that statement up.

That's the nature of classified information - the government gets to keep secrets, too. That's why we have intelligence committees to oversee agencies like the NSA, CIA, FBI, etc. If you don't like it, just be honest and make an argument against state secrecy or degrees of transparency instead of making up credibility claims that you can't back up.

[1] https://www.leahy.senate.gov/press/senate-judiciary-committe...

Why can't you answer any of my questions? You seem very evasive.

Every single criticism you just made could apply to your claims as well. Not that you seem particularly interested in examining your own opinions.

Looking at the document it appears that the CSE also collects and actively trawls through web search terms and is in the process of developing the capability to associate collected data not only with IP addresses but with GPS waypoints, other devices close to the target device and associated telephony information.

Apparently they are using Pentaho. See screenshots starting at slide 7: https://www.documentcloud.org/documents/1510163-cse-presenta...

Pentaho Data Integration Kettle: http://www.pentaho.com/product/data-integration , https://github.com/pentaho/pentaho-kettle/

TLS would do a good first-pass of stopping this, right? And SPDY could defeat size-based profiling by using server push to send enough data to pad things out to make transfers all look the same length. (Say round up a max of 10% to create size "bins".)

We were doing this 10 years ago, but we modulated the output to make file downloads look like streaming video.

After looking at the documents, they seem to be harvesting http get requests. The initial get is sent to the hosting service, which then directs the user to wherever they are keeping a copy of the wanted file. That location changes regularly. Only the initial get, the initial link, would be consistent.

If I am right, spoofing the system should be easy. Sending a get doesn't mean you download anything. Sending a few thousand protest gets could mask those you actually follow through on.

>Sending a get doesn't mean you download anything.

I don't think they care.

>Sending a few thousand protest gets could mask those you actually follow through on.

Will only get you on more lists.

You're implying common sense, but there's very little of that.

HTTPS.

Just Do It (R)

I'm wondering which services hasn't changed to HTTPS by now?

Netflix. Do a correlation between IP and watched shows. Flag people who go for "extreme" shows such as say Frontline: United States' Secretes as "dissidents" and apply "appropriate" measures.

HTTPS would help some, but they could probably generate a profile based on transfer size, right?

Reply on news.ycombinator.com