yeah... a lot of ink has been spilled over there should be a Warrent requirement for the FBI but imo the data broker loophole is the bigger issue. NSA buys netflow data in bulk for petes sake.
189 karma · joined May 13, 2021
https://rt4.mn/about
feel free to reach out at
contact@rt4mn.org
The good judiciary ammendments would: requiring fbi obtain a warrant before querying 702 data, close data broker loophole, prohibit restarting "abouts" collection. All good things.
Intel committee ammendments are really bad. expands the definition of Foreign Intelligence Information to include counternarcotics, Unnecessarily expands suspicionless vetting of immigrants, including people allready in in the United States, and Includes one of the biggest expansions of surveillance in recent history, or what Rep. Lofgren calls "Patriot Act 2.0," by expanding the categories of businesses that can be subject to a *gagged directive* under Section 702
This has been an incredibly annoying issue to track and mobilize around because things are moving quickly and behind the scenes but just raising the issue helps. Even if you think your house rep sucks on everything else, its worthwhile to reach out on this issue. Its hard to know where people stand when folks from trump-land and the squad are both calling for reform.
Patrick Gray is a good interviewer and news source but he is also a big booster of the American surveillance apparatus, and has spoken against such reasonable reforms as requiring the the FBI get a bloody warrant when it searches for Americans data in the 702 database (data that is collected specifically for foreign intel purposes and thus subject to less constitutional scrutiny). He recently defended the NSA's acquisition of netflow data because the NSA needs it to do its work. as if constitutional privacy rights should give way to a spy agencies priorities.
He is just way to trusting of these agencies abilities to police themselves. I swear his quote when they talked about nsa getting netflow data was something along the lines of "if people only knew how many meetings they had to have before they would understand". Those are both examples I am pulling from memory so don't take them as gospel. And of course, no source of news / commentary is unbiased.
I listen to and enjoy the risky buiz podcast. And institutional trust is a legitimate aspect of security, especially in infosec. I just wish he was more skeptical of western law enforcement and intelligence agencies (he is already more then skeptical of non-western law enforcement and intelligence agencies, which is fine, I just wish he did not give the five eyes countries a pass because we are "the good guys"). He recently interviewed people at NSA headquarters for petes sake.
and more "Please dont take away our post-9/11 powers (702), and not because we forgot how to do our jobs without them we actually do need them for realz!"
See also the terrible op-ed by ex head of NSA in washignton post. https://archive.ph/WfvtR
And the reason the spooks and their apologists on the HPSCI are so freaked out? because they don't want to have to go to a judge to get Americans data. They would rather secretly buy that data from data brokers.
This bill is an attempt to fix that. This bill is probably the best hope we currently have of enacting substantive reforms to Section 702, EO 12333, the data broker loophole, and a bevy of other surveillance issues. It even has a section on Cell Site simulators!
If you are curious about some of the details of the bill, you can read a one-page summary of the bill [here](https://www.wyden.senate.gov/imo/media/doc/government_survei...)
Some highlights:
> The Act ends warrantless collection of business records, ensures that the government provides accurate information to the Foreign Intelligence Surveillance Court, and requires meaningful accountability for violations of the law.*
> [The bill] requiring warrants for surveillance of Americans’ location data, web browsing and search records, and by prohibiting the government from purchasing Americans’ data from data brokers.
A section-by-section summary of the bill is [here](https://www.wyden.senate.gov/imo/media/doc/government_survei...)
Read the full bill [here](https://www.wyden.senate.gov/imo/media/doc/government_survei...)
Some more analysis/history [here](https://www.justsecurity.org/89786/the-year-of-section-702-r...)
IE, if somone intercepts the SMS code, even with reglock, you can forcibly de-register somone. This means if you use loose access to your phone number, you can easily loose access to your signal account.
https://github.com/signalapp/Signal-Android/issues/12595#iss...
They justify this by saying "The intention of reglock is to prevent hijacking of numbers you actually own, not to guarantee the number for yourself for life", but its way to easy for activists and dissidents to lose ownership (temperately or permanently) of phone numbers for the phone number system to be the backbone identity system for a secure messaging platform
> Although it is physically impossible for the single guard to observe all the inmates' cells at once, the fact that the inmates cannot know when they are being watched motivates them to act as though they are all being watched at all times. They are effectively compelled to self-regulation.
This is the fundamental idea of the Panopticon, and you see it baked into parts of the modern surveillance State as well. But outside of some workplace and carceral contexts i don't think its actually the direction we are headed. The spooks want the power to actually use the data surveillance gives them, they are not really interested in social control as far as I can tell. At least not yet.
True, most of the data hoovered up by the "Intelligence community" is almost never actually looked at with human eyes, but they are actively trying to work towards building a system whereby all that data is still analyzed and used, or quickly searched with just the right keywords.
The panopticon is useful for illustrating one of the many side dangers of surveillance (namely that it instills fear and stifles expression) but it does not cut to the core issue: Mass surveillance drastically upsets the power balance between the government and the governed.
Many, Many reporters put their signal number in twitter bio seeking tips. Many activists (including me) use signal group chats to organize volenteers and staff, and publicly share room links. In other words, we have to either share our number publicly or buy a burner phone number if we want people to interact with us on signal.
You can argue its not social media, but I think the stories feature definitely puts it on the social media spectrum to some degree.
These are the people whose job it is to make complex topics understandable for both parties of congress. Its a fantastic source if you want to set aside 10 minutes to quickly digest a complicated topic.
For a fun example, see some of their reports on Directed Energy Weapons: https://crsreports.congress.gov/product/details?prodcode=R46...
Its not really a news source, but then again you did not actually specify news and I wanted to shill CRS since they do fantastic work, especially given the tightrope they probably have to walk every day.
The point is that its not really relevant to the point they are making, which is that the FDA as an institution has some weird incentives.
> motte-and-bailey.
I'm not familiar with this idiom so I cant say.
Another think piece by the author pushing for the infamous clipper chip: https://www.wired.com/1994/06/nsa-clipper/
Of course the FDA is not, itself, a democratic instution. But then neither is your local police department or NASA. The reason those institutions are accepted despite the lack of direct democratic accountability is because they are still situated within the larger democratic institution (the US government) and subject to oversight by those elected representatives.
If you hate the FDA your best bet is to lobby against it yourself (or help others that do). Its to much of an in-the-weeds issue for it to be a high priority for most lawmakers (unless maybe you live in a district with a lot of businesses regulated by FDA)
- gift cards involves getting in a car and driving to a place to buy them, which introduces annoying logistical issues
- the purchases made on a single card are linked together, so you have to keep track of cards you use for x store and what cards you use for y product (this is also true with bitcoin though, which is why I prefer other more privacy-focused cryptocurrencies)
- with gift cards there is a very high chance that your funds will be rejected or flagged as suspicious. which also limits the amount you can spend to around 100-200 dollers, since any more risks having all the money you put into that card flushed down toilet
I do personally keep a couple of gift cards on hand for the rare occasion I find myself needing to pay for something online and there is no alternative vender that accepts cryptocurrency (usually event tickets or membership subscriptions), but its a pain and I much prefer paying for things with cryptocurrency.
Cryptocurrency is an unregulated and environmentally disastrous ecosystem rife with monopolistic vender lock in, fraud and abuse, and little to no accountability or legal recourse for end users. But that's also true with the credit card / debit card / other electronic payment ecosystem.
At least with cryptocurrency I get a modicum of privacy.
The connection between E2EE and privacy is to ephemeral to make that kind of judgment. If you live in the united states or similar country with a strong rule of law, the idea of paying for or using a specific E2EE app is functionally like asking somone to pay for free speech.
And even if it was more clear, privacy is like free speech in that you cant really measure enthusiasm for it in that way. Free speech and privacy are fundimental values that people dont want to pay for (for good reason!). But that does not mean they dont care.
People really do care about these things. And many many people will change how they vote and how they engage in civic action based on these principals. But asking someone to change how they live/communicate with others requires more then an intelectual "which party / candidate should I vote for?" kind of thing. For most people you need emotional investment for someone to overcome switching costs based on nothing but ethical / political principal.
As long as the harm to losing these core rights remains abstract you wont be to measure how much they care with metrics like that. Its a value that is too ephemeral and disconnected from day-to-day life to measure with a stick like "who will use this app".
But people can and do donate to groups like the EFF, and vote with their actual votes on this stuff. People really do care. Just like how people really do care about honesty, free speech, candor, trust, and other values of that sort. its just, you know, hard to measure.
While I agree the implications are concerning, I think its difficult to overstate just how much of a stranglehold the US regulatory and surveillance machine has over the global financial system.
Trying to buy and sell things online without sharing your real name or address is functionally impossible for 99% of people (unless you are willing to break the law or learn how to use cryptocurrency). This is because the gatekeepers to the Internets finances (banks, credit cards, etc) are required by law to identify who they are working with.
This makes a sort of sense until you zoom out and see the scope of the problem. Because it is impossible in 99% of cases to move money around online without using those gatekeepers, there functionally is no financial privacy online.
I should not have to share my bloody name or address with anyone to order a god damn box of chocolate.
> Ultimately we're far more tracked by corporations anyhow now,
True, and thats very concerning and should be pushed back against. But when corporations collect data on you, the worst thing they do with that data (generally speaking) is not treat it with care and the data gets stollen / made public.
When the government collects data on you, the worst thing they do with it (generally speaking) is throw you in jail or kill you. The scope of the concern is astronomically higher.
https://www.theatlantic.com/politics/archive/2014/12/a-brief...
https://www.intelligence.gov/assets/documents/702%20Document...
> A report on the audit, only recently declassified, found that in the first half of 2020, FBI personnel unlawfully searched raw FISA data on numerous occasions. In one incident, agents reportedly sought evidence of foreign influence linked to a US lawmaker. In another, an inappropriate search pertained to a local political party. In both cases, these “errors” attributed to a “misunderstanding” of the law, the report says.
I don't think I did a good enough job in my initial reply emphasizing that from my perspective a nickname that you only used in certian social contexts is functionally a persona. If your wife calls you Jason but all your drinking buddies call you Jack because of a hilarious collage hijink (or something), a random passer by at the bar would have no clue that the name on your birth certificate (the one that can be used to impersonate you) is actually Jason.
Thats really what I am talking about. As long as you dont lie about the fact that "Jack" is a nickname when asked, your not being unethical, in my view.
The primary "ethical loophole" here is that there is no viable ethical alternative. Something can not be immoral if it is the best of a series of bad options, and if you want to exsist in the world and protect your privacy, the only real option is to create a persona.
There is literally no other option that I have been able to find that both protects your privacy and also does not require you to sequester yourself from humanity entirely.
Pure anonymity bars you from the following activities: joining a social group, signing up for some longish term business relationship (hiring a contracter, signing up for a service), engaging in the political process, holding a job, and probably more that I cant think of. You simply wont be able to do any of those things if you tried to give your name as "chaboud" or "rt4mn".
The best option if you care about your privacy, in those scenarios, is to use a nickname/alias/persona, and be honest and say "no its not" in the vanishingly rare case where you are asked directly whether or not that's the same name you have your birth certificate.
Why the heck does there need to be backdoor negotiations regarding which amendments will be heard by the larger body?. Which amendments get heard is a procedural question, right? so why do the objections / hold up seem to be based on policy?
To be clear, Im not really interested in the answer to that question. I'm sure there is a "good" reason for it, and I understand in the abstract why legislative procedure is often used as a tool for negotiations and political messaging.
But if I can get on my soap box and vent a bit, it never ceases to amaze me how much congress has hobbled itself by over-complicating the lawmaking process. Over-complicated lawmaking processes inevitably leads to further erosion of congressional power by delegating authority to some executive branch department, which are (comparably) far more effective and responsive.
Like, I'm not saying they should just swap to Roberts Rules of order, but for petes sake. Congress gets to set its own rules about how it operates, you only need a majority vote to change the process, IIRC. The house I can somewhat forgive, since they only have a year or so of real time in office before they need to start campaigning again. But senators get 4-5 good years, whats their excuse?
You would think that enough senators would be interested in actually wielding the power of their office to pass laws (or to pass laws that repeal laws) that they would get off their collective butts to make their institution actually semi-effective.
Privacy is a lot like other civil liberties, it feels ideological and airy-fairy until you need it and don't have it.
Take for example web hosting. I could have paid for the website that we used to lambast the Minneapolis police department and argue that they should not have access to the toys they want using a credit card, but then the Minneapolis police could send a sternly worded letter to the webhost and learn where I live. Which is a reasonable consern if you know anything at all about the Minneapois police department. So I pay for webshosting with cryptocurrency.
That's a real clear cut example of why financial privacy matters, but that same concern extends to pretty much every thing you do online. Cardinal Richelieu has the right of it when he said "If you give me six lines written by the hand of the most honest of men, I will find something in them which will hang him", and recall that The US government kills people based on metadata. Its easy to dismiss me buying a box of candy as not important enough to worry about, but its the entire history of every financial transaction you make that paints a very accurate and very useful picture of who you are what you get up to that is of great interest to people who can do you real harm.