US hit by 'massive data breach'

Today's data breach at the very least shows that we shouldn't allow them to push for that. The fingerprint should always stay on our devices in a hardware secure module.

The FBI means that consumers and foreign markets should not have encryption or backdoor-free software. I understand that this is a double standard, but we need to be clear that the double standard doesn't have to do with this most recent breach.

But who uses the term "database" to refer to anything but a store of data on a computer system?

I realize the BBC has some old-fashioned style guide it's using here, but "cyber databases" betrays a bit of a need to revisit that guide.

Edit: I've made a couple of recommended edits for the BBC as seen here: http://i.imgur.com/cewmams.png

Bruce Schneier's latest book 'Data and Goliath' examines the implications of mass surveillance in a calm, levelheaded manner. He also outlines detailed, and realistic, solutions that recognize the benefits of data- mining and covert surveillance while reining in the excessively secret bulk data collection practices of state intelligence agencies and the bulk data-mining practiced by corporations like Google and Facebook.

The US of course will reply in kind. It is US defense policy in cyber to retaliate for cyber attacks - specifically this is part of a deterrence strategy.

(See http://map.ipviking.com/ if you want a live demonstration.)

For a typical example for why this may be okay to exist, we can simply posit (for the sake of argument) someone who 0-days every server in the world and holds everything on any of their hard-drives for the ransom of 1 milliiiion dollars, oh not individually per person but total, from behind tor relays and to be paid in bitcoin, divided out among a few thousand or ten thousand or million or ten million targets. Brazenly. What does the world do - just pay? (collectively, individually, whatever.) That means he now has a budget of 1 milliiiiion dollars for round 2. So in a case like this, I would think that society would want to say, all right, enough is enough of these shenanigans, we are going to peek behind the curtain here (violating your privacy). It's not that there's any disagreement that it's illegal, it's that you need to violate privacy to prevent this very real possibility that actually occurs every day, today. As I mentioned however, I do not have very firm opinions on the subject. This kind of ransomware isn't a theoretical exercise however - it exists, and it's great when we have resources like this: https://noransom.kaspersky.com/ that nullify it. There is also generally a reason that there is a legal system in place and if you didn't have laws, people would do whatever they can physically get away with, which in a technological society that puts multipliers and levers on all of our efforts, is a lot. That the mechanism for getting that data have to be extraordinary is a given, however.

But even though I think a small amount of surveillance may be important, by my current impression I am massively opposed to very large amounts of surveillance, I think it's a tremendous waste of resources. See this thread for my opinions about when companies receive huge windfall payments for it - https://news.ycombinator.com/item?id=9549597 -- I'm simply opposed.

So far my theoretical model (as a personal philosophical exercise, and bearing in mind that I am undecided on a larger scale) extends to within a single country, or group of closely allied countries. It makes sense to encourage companies to innovate, to grow, to create things - creative innovators are the things we as a society are protecting, from people who would, for example, steal their designs and hold them for ransom.

But I'd like to ask people's opinions about countries such as China, which I believe have much to learn before they can be as "good" actors as Western powers - including for their own populations. (i.e. this is a separate question from what is good.)

Just some of the factors that are important for China although they may not realize it are environmental issues, I mean you can hardly breathe in Beijing, continued very high economic growth and, yes, increased "lawfulness" in several areas where they will be well ahead by, for example, respecting IP and innovation of both foreign companies and their own. Now here specifically, we can use a simple example: if their hackers (people just like the readership here, except reading everything in Chinese but like us also clever computer geeks, except sitting in some hacking center doing 8 hour shifts of hacking, instead of building millions of dollars of real economic value with their same mental cycles) - they are busy hacking the US government, they're not busy creating the next Google, Microsoft, Apple, and so forth. We're also not benefiting from their research either.

So it seems, to me, that they are not ahead from this overseas hacking. Specifically, I think it holds their economy back.

But more broadly - and here is where I am getting into something philosophical and on a topic where I'm very undecided: isn't it fair to say that it would be quite impossible to imagine the FBI actively hacking another Federal government agency? Likewise, if in some sense there were a more international version of a democratic world power, wouldn't this save massive state resources on all sides?

That is to say, although I am trying to reason from first principles and extreme use cases, it seems to me that if there isn't a world order today, there should be. (This is a tentative impression!!) I also think that the readership here - the computer geeks, the entrepreneurs, the scientists, the smartest of the smart, all over the world automatically do form a community. While we might not have many Chinese readers today, I doubt the same would be true in ten years, especially given the fact that English for better or for worse is the de facto international language of communications and technology, (and science/research) in particular.

Basically, what I am asking about is why we wouldn't want to live under a flag of the Earth representing some ecumenical world power. As an advantage, we would save precisely the costs that the FBI saves by not trying to hack the other agencies of America. (Since they're all under one flag, why would they waste resources hacking each other.)

This is quite a separate issue from surveillance, which is sort-of orthogonal to this question. Basically, what if anything would be the cons to an international world order? At a minimum, wouldn't this stop the acts of "your country hacked by a foreign power" as we would expect them to? Wouldn't those resources be automatically put to better use? The guy who can't get work hacking some government while that government hacks his, would instead use his powers more creatively.

I ask this with the distinct goal of attempting to better understand what kind of world we would even want to live in. If this is much too tangential or I elicit very unconstructive responses I can delete this comment.

Basically, on the level of economic growth, productivity, and, yes, freedom - what is wrong with a world order and cooperation? (I assume there's something wrong with it, because the phrase "world order" is a negative one!)

-

EDIT: I want to emphasize that by world order I mean like ths - http://en.wikipedia.org/wiki/New_World_Order_%28conspiracy_t... which is quite a negative spin on countries colluding.

http://www.washingtonpost.com/world/national-security/us-spy...

I'd imagine it gets higher each year.

There is a type of encryption called "homomorphic" which could allow you to perform operations on encrypted information. I haven't ever tried to implement it and consider it one of those seductive ideas that probably can't get implemented correctly in practice. But if there was a way to deliver an entire encrypted database and still make it useful, homomorphic encryption is the only way I am aware of that would make it work.

* A breach to internal database level would, in the majority of systems mean the attacker already has all the keys to use the database system

* A database cannot perform a lot of its functionality (e.g. JOINs) without access to the data & if the encryption keys were usable at the database level to perform such functionality it would make the encryption redundant.

A working 'encrypted database' system would likely need to use Hardware Security Modules (HSMs) to prevent key exfiltration, you would distribute these to people who need to use the database, who would need to decrypt it in mostly its entirety to use it.

It's possible by reworking entirely how modern databases work (fully homomorphic encryption is probably useful here) you could create a system where the database doesn't have to already be fully decrypted for you to use it, but as far as I know it doesn't exist (startup idea?).

If this had been a land incursion, and the public Army had been the responding department, there'd be no question, and we'd have pictures of tanks and AK-47s on the front page of every newspaper. Congress would be discussing nothing else.

However, it's the spies, and FBI wannabe-spies that are probably handling this. The proof is not as obvious as a tank in North Dakota, but I suspect that there's is enough evidence and forensics to prove to the NSA and their ilk who did it and how.

But a spy's natural instinct is to hide the fact that they know something. It's a card up the sleeve, and their concern is more about being able to continue to spy than to stop a currently ongoing crime.

But the US does have cyberwarfare policies. As part of a deterrence strategy the US strikes back when it can attribute attacks to a specific party. You may also remember the recent Executive Order from the Obama Administration whereby a series of policies were joined so that the US is organized to levy sanctions against governments, actors and corporations overseas that are involved in sponsoring intrusions into US networks.

However with appropriate signals intelligence, sources of attacks can be determined.

We don't know that China was really behind these attacks, but the US has a pretty good track record at attestation so far.

The backdooring and lack of encryption in software is because the US is still a primary exporter of technology and we want to be able to continue to hack, surveil, message and control those who get US technology. US FedRAMP and other compliance minimums insist on the use of properly configured encryption in private industry to protect government information and cyber sharing programs enable both the sharing of data between private and public sectors for surveillance and for the detection and analysis of foreign cyber attacks. The US government has state of the art encryption (for the most part) and some of the most heavily monitored perimeters.

None of this is enough to stop cyberattacks, which have all of the advantages in their favor.

So while I'm inclined to agree with you that the US should stop mandating backdoors and weak encryption I don't think its a fair characterization to suggest this anything to do with why the US was breached.

China and the US are battling each other in several arenas of influence, as are Russia and the US. In this case the US is trying to stop Russia and China's global and regional power projection and these countries do not accept the US world order and their current place in it.

Conflict is inevitable. It will be interesting to read the history books to see what gets written about the role of the information warfare space and what role it plays in whatever outcome we get.