The FBI means that consumers and foreign markets should not have encryption or backdoor-free software. I understand that this is a double standard, but we need to be clear that the double standard doesn't have to do with this most recent breach.
I'm not sure that top intelligence agencies backdooring products has really made that gap so much worse.
I sorry I don't think I fully understood your point.
This has already been done. During Operation Aurora the Chinese hacked into the FBI backdoor built into GMail by Google and used it to gather information about intelligence operations being performed by the United States against Chinese nationals and also used it to perform surveillance of their own against their terrorist and dissident watch lists.
There are probably more examples.
I do not know of a single database that has 'all the keys' to the all software and encryption back doors. If such a thing existed it would be a very valuable target. Somehow, though, I imagine that there isn't such a centralized database.
[citation needed]
https://www.google.com/webhp?sourceid=chrome-instant&ion=1&e...
>Former government officials with knowledge of the breach said attackers successfully accessed a database that flagged Gmail accounts marked for court-ordered wiretaps.
To me it sounds like Gmail was compromised, and during the compromise, the attackers identified a database containing information that was of great intelligence value to them. This database does not appear to have been the vector that allowed the attackers to get in, nor was it a "backdoor". I suspect the attackers also had access to many, many other databases.
It's certainly possible the primary intended goal of the breach was to access this information (for counter-intelligence purposes), but it's not how they actually got in, nor did it help them get in.
I think you'll find that on the whole I am right. That the system was there for US intelligence and the Chinese were there for counter-espionage and that the backdoor allowed the Chinese used the system to access email information that they would have had to compromise a different way to get - thus their getting access through a back door.
I will leave the semantic discussion to whether such a system constituted a 'front door' or a 'back door' to folks who enjoy such deliberations.
Ultimately I hope that readers see how hacking of 'side systems' built for intelligence agencies to make full data requests have been used to gain access to the larger systems they connect - in the spirit of the original thread.
Er, what? No one would call it a front or back door. If someone gets root access to my machine and uses that to get access to data on my machine, that data was not the entry point. The phrase "without oversight or a lengthy and transparent approval process with the requirement for a warrant" shows what a red herring this is.
If you didn't understand that this was a separate system with separate access data, specifically for law enforcement requests, then that should clear it up.
If not we can go over semantics a ton but I don't like those games (everyone loses [time]).
You have a point, but I don't think it applies in this situation. Google was a valuable target for Chinese intelligence for a whole variety of reasons. Google itself suspected that the primary motivation was to gather information on Chinese activists that were using the service.[1] The fact that there was apparently a database of FBI targets is just added benefit for them, and there's no evidence that I've seen to indicate that they knew of the database to begin with.
[1] http://www.independent.co.uk/news/media/china-google-cyberat...
You being in the role and expertise that you are - excluding Operation Aurora for now because you seem to have a certain characterization of it - you know that China and the US hack each other for strategic purposes and that when China hacks the US it is not about dissidents.
We can't predict an alternate history here whether China would have gone after Google for other reasons. What we do know is that China went after the intelligence system linked up to GMail and used it for counter-espionage purposes. One Google personal relations spokesperson did say they suspected China of using the system to collect information of terrorists and dissidents as well.
Attributing motive of course changes the narrative. Making it sound like China wanted to hack Google for the sole purpose of getting to dissidents makes it sound all spooky and evil. The reporting that has China hacking Google to track down terrorists and dissidents usually 'forgets' to mention the counter-espionage link at all or that the database they accessed was for law enforcement or that they gained access to Google's systems exclusively through this system; so I tend to believe the reporting and sources that include more, rather than less, information.
There's purpose behind casting doubt on the intentions of China and the context of the compromise: this is known as spin. Spin is important - for PR and for propaganda - but if you want people to have a real conversation you've got to do what you can to minimize it.
I didn't mean to imply that I have any inside knowledge of the hack - I'm basing my views on this from what I've read in news outlets. I doubt I have any more knowledge on the subject than you. (Unless I'm misinterpreting sarcasm on your part)
> China and the US hack each other for strategic purposes and that when China hacks the US it is not about dissidents.
The Chinese intelligence services are going to focus on targets that will forward their own national goals. This will off course include strategic goals such as increasing economic and regional military influence, but don't discount their desire to maintain internal stability. They invest a significant amount of resources into controlling content on the internet and other media venues. In recent memory, their Great Firewall infrastructure was used to target dissidents hosting their materials within the US (which incensed the HN crowd with the whole Github DDOS).
There's plenty of good reasons for China to target Google. They have every reason to distrust Google as the US government has to distrust Chinese tech companies, and there's bound to be a wealth of information on their servers useful for counter intelligence, economic, political and likely even military gain as well. I don't we'll ever know exactly what all of their reasons were for breaking in, but I don't think the theory that one of the primary motivations was targeting dissidents can be waved away as just spin.
> wealth of information on their servers useful for counter intelligence, economic, political and likely even military gain as well
Perhaps you could go further and tease out why a US company would have information on their servers useful for counter intelligence, political and likely even military gain - beyond of course the merely mundane trope of suggesting that the algorithms or IP are the reason.
I'll take a stab, but I'd love to hear how your characterize it: It's because US tech companies, like other multinational corporations inside the US, partner with the US government which some times means intelligence or military sectors - either to provide products and services - to perform research or to fund research - or to offer capabilities as a de facto extension.
The Foreign Intelligence Surveillance Act weaponized the US tech service sector to provide data and metadata for US intelligence efforts and for the targeting of foreign nationals.
(Incidentally, it's true also that individuals located at Google hacked back into the Chinese C2Cs.)
Chinese Intelligence is fully aware of FISA and the USG use of technology product and service backdoors.
> I don't we'll ever know exactly what all of their reasons were for breaking in, but I don't think the theory that one of the primary motivations was targeting dissidents can be waved away as just spin.
You really don't motivate why we should take the PR statement more seriously than the journalism. And references to 'I don't think we can ever be certain' is an appeal to uncertainty that isn't really there.
I suggested it for much more mundane than you suggested: Google is likely to have valuable political, economic and political information because politicians, businessmen and service members have personal Google accounts, and employees are the weakest link in an organization's security. I don't think anyone's going to be sending out the designs for the next stealth fighter over Gmail, but plenty of people would be sending out innocuous documents, contact information, personal problems, etc. Intelligence services thrive on innocuous information in aggregate.
I'm not sure we want to base policy on something speculative like that. Agreed that conversations should be had - both about widespead backdoors and about centralizing the keys to these backdoors - if the scenario ever comes to pass.
In the meantime we can't say that the backdooring contributed to this Chinese attributed breach.
The point of these backdoor programs is that there is an asymmetry in how the vulnerabilities can be exploited. The point being that the calculus has been done - right now the benefit to national security (the place of the US in the 'world pecking order' - it's ability to project power and protect its strategic interests) is greater than its detriment to national security.
Now, it absolutely does weaken 'personal security'. Broken encryption, backdoors, weak protocols, federated auth, these things decrease the digital security of companies and persons.
As a person not involved in performing the calculus of national security (again global strategic interests) it is easy to see these programs as merely a threat with no obvious gain. Those concerned with national security and global competition see this as a small price to pay to wield a large amount of global influence.
This is a good way to understand why the FBI will say things that seem so plainly wrong to the HN crowd.
I happen to agree with the HN folk wisdom - that the national security apparatus is there to protect our democracy not the other way around - but to really engage with the issue its important to understand what the 'other side' is arguing more fully.
This is a very complicated space. Very important policy scholars (Sunstein) even recommends reinterpreting free speech to mean something closer to what we've historically criticized China for.
Going forward we need as much informed debate as possible. The national security apparatus isn't going to listen to the public if the public can't understand the issues they grapple with and engage it charitably.
I hope I didn't rant too long.
The way the US government would be likely to handle this situation is that they would recognize the threat and mandate that no such single database be created or that one be separated were it to exist. I don't know that they would change their mind about backdooring products and services when they can mitigate the scenario and address concerns a much easier way.
Also, with the FBI promoting an anti-encryption culture and the NSA promoting an anti-security culture in terms of what laws politicians should pass, it's only a matter of time before that culture spills into the government's own agencies, too.
For instance, politicians can be brainwashed so much by the NSA/FBI that encryption is some "dark sorcery that only terrorists and child pornographers use" to the point where they'll start voting against bills that aim to secure government's websites and so on.
Has this happened? Or did a U.S. government official slip up and admit the future intention publicly? (I wouldn't be surprised)
The only CA corruption I've heard of was a MOIS/VAJA operation against DigiNotar and a corporation overstepping its agreement with a CA by abusing a delegate root CA.
Did this play a role in the breach? Almost certainly it did not.
It seems pretty speculative to me that there's some large database with all of the mandated software backdoors and keys to get access to. And if it existed, I don't know that it would be such a large threat.
Certainly security bugs and professionals inside of industry are targeted by hackers already.
Given everything else, I don't know how large an issue this is (compared to say, hacking nuclear defense systems, energy grid, military C2C, etc).
It would be interesting to see whether this is considered a threat scenario by the USG.
You overestimate the competence of government agencies.
> Given everything else, I don't know how large an issue this is
A significantly large issue, seeing as it puts the safety of the vast majority of Americans at risk by exposing their personal information (everything from banking information to patient records to their precise movements).
> It would be interesting to see whether this is considered a threat scenario by the USG.
If it's not, then I've lost any sliver of confidence in the Feds that I might have had previously.
How fully do your think your threat model addresses the scope of national security concerns of the United States?