November 2013 - cypherpunks - lists.cpunks.org

(re: that old-time crypto.religion)
by brian carroll 08 Nov '13

08 Nov '13

#recherchieren manipulation ------------ +---> BELIEF illusion | ------------ | subversion | E | FAITH-based | T | protection... ---+ H | | I | | C v | S verification | -------------- +---> TRUTH accountability -------------- legal & moral foundation http://translate.google.com/#hu/de/whitespace

1 0

fuck these guys
by Eugen Leitl 08 Nov '13

08 Nov '13

https://plus.google.com/+MikeHearn/posts/LW1DXJ2BK8k Mike Hearn Shared publicly - Yesterday 10:30 AM #NSA The packet capture shown in these new NSA slides shows internal database replication traffic for the anti-hacking system I worked on for over two years. Specifically, it shows a database recording a user login as part of this system: http://googleblog.blogspot.ch/2013/02/an-update-on-our-war-against-account.… Recently +Brandon Downey , a colleague of mine on the Google security team, said (after the usual disclaimers about being personal opinions and not speaking for the firm which I repeat here) - "fuck these guys": https://plus.google.com/108799184931623330498/posts/SfYy8xbDWGG I now join him in issuing a giant Fuck You to the people who made these slides. I am not American, I am a Brit, but it's no different - GCHQ turns out to be even worse than the NSA. We designed this system to keep criminals out . There's no ambiguity here. The warrant system with skeptical judges, paths for appeal, and rules of evidence was built from centuries of hard won experience. When it works, it represents as good a balance as we've got between the need to restrain the state and the need to keep crime in check. Bypassing that system is illegal for a good reason . Unfortunately we live in a world where all too often, laws are for the little people. Nobody at GCHQ or the NSA will ever stand before a judge and answer for this industrial-scale subversion of the judicial process. In the absence of working law enforcement, we therefore do what internet engineers have always done - build more secure software. The traffic shown in the slides below is now all encrypted and the work the NSA/GCHQ staff did on understanding it, ruined. Thank you Edward Snowden. For me personally, this is the most interesting revelation all summer. How we know the NSA had access to internal Google and Yahoo cloud data http://www.washingtonpost.com/blogs/the-switch/wp/2013/11/04/how-we-know-th… 732502Nico Lumma's profile photoIan Batterbee's profile photoAmber Yust's profile photoKonrad Rudolph's profile photo 39 comments Jeff WeissYesterday 2:46 PM+19 20 19 Until this article no one had mentioned that the intercepted traffic was on leased fiber, not on the public internet. That makes the cleartext transmission seem like a less glaring error, I suppose I can see how it wouldn't seem necessary. In fact, anyone claiming in was necessary probably would have been seen as paranoid until now. Still, encrypting data sent over the wire is not difficult. Considering the value of the data in question, and the number of parties who could access it (at least two - the fiber owners and the government), it seems like a worthwhile investment. Lesson learned, I suppose. Mike HearnYesterday 3:42 PM+42 3 2 I think the fact that Google uses private fiber has been well known for quite a while actually. Just search for [google dark fiber] and you will find many news stories discussing that, and it was mentioned off-hand in previous stories as well (I think). Yes, that's pretty much it. Encryption was being worked on prior to Snowden but it didn't seem like a high priority because there was no evidence it would achieve anything useful, and it cost a lot of resources. Once it became clear how badly compromised the fiber paths were, there was a crash effort to encrypt everything. Re: "not difficult". I disagree. Doing end to end on the scale of Google is a lot harder than it looks. Ignoring CPU capacity constraints, the entire thing requires a large and complex key distribution and management infrastructure (fortunately already present). Also lots of different protocols flow over our wires, each one of which has to be handled. Jeff WeissYesterday 4:15 PM+9 10 9 At Google's scale, everything is difficult. I meant "not difficult" relative to all the other feats they've pulled off. I can't say I blame them, really. They haven't historically come across as careless with their users' data - just the opposite in fact. If only the NSA manages to steal Google users' personal info, they're doing relatively well. There's always room for improvement. Mike HearnYesterday 4:16 PM+18 9 8 Right, sure. Compared to some other initiatives encrypting cross-dc links wasn't a moonshot. Self driving cars definitely rate as harder :) John A. TamplinYesterday 4:29 PM+18 9 8 I don't know in Google's case, but when I was at an ISP before, dark fiber meant we owned the fiber in the ground and were responsible for terminating it with our repeaters/routers/etc. So, to tap it would require either compromising the equipment we owned or someone physically digging up the fiber, inserting a tap, and putting it back. You could conceivably detect such a tap with TDR, but especially if this happened under the cover of a cable cut you might just assume the tap was an imperfect splice to repair the cut. So, I don't think it was unreasonable to assume that dark fiber was "safe". When I came to Square, it seemed over the top that even connections between services in the same datacenter were secured with mutual auth SSL -- it doesn't seem so excessive now. Jeffrey YunesYesterday 5:49 PM+14 5 4 I don't think this is a "big people vs. little people" thing. I'm little, Google's big, and we're both on the same side of this. Rather, this is a "government vs everyone else" thing. Andree ChristaldiYesterday 6:05 PM+4 5 4 Shocking, disgusting stuff. As you said, laws only matter to common folk, not the state. Good work Mike. Laurent GaffiéYesterday 7:25 PM+1 2 1 Well said Mike, well said. Trevor LoucksYesterday 7:57 PM+1 2 1 >From my very limited knowledge of encryption...Mike, do you think it would be possible for Google,within the next few years, to do end to end encryption for all its services, but not manage or store the keys? I would prefer if everything was encrypted and decrypted locally and I stored the key how I saw fit. Using LastPass, hard copy paper, truecrypt container, or some other mechanism. I realize this would completely obliterate any type of possible password recovery. But man, a system like that would allow me to feel so much better when using Gmail or Google Drive. I guess it would have to be offered as an option, because I don't doubt most Google users would opt for easy usability instead of higher security. In the meantime I feel compelled to transfer my backups to places which offer end to end encryption with keys that aren't stored by the service provider. Jason BraddyYesterday 8:15 PM+6 7 6 +John A. Tamplin It's possible to tap an optical cable without breaking it, by bending it far enough that some of the light leaks out through a gap in the jacket. This can be detected by looking for unexpected drops in the light level via DOM, etc., and I believe that critical defense/intelligence network paths do this already. Jeff WeissYesterday 8:15 PM+1 2 1 +Trevor Loucks that would dramatically change Google's business model, since they generally offer free services in exchange for collecting people's data. Most of the offerings where privacy is a concern, the best private service wouldn't be a service at all. It would just be software you run yourself. Or maybe it would run on some cloud service, but the important point is that the provider doesn't see your data or care about it, they just lease you some computing capacity. John A. TamplinYesterday 8:27 PM+1 2 1 +Trevor Loucks In many cases that would mean the service couldn't operate - for example, GMail couldn't communicate with other SMTP servers if Google never had the decrypted message on its servers. If you have a doc for collaborative editing, how do multiple people get the same key? You certainly wouldn't have the ease of saying "share this document with the following" and it just work. Besides that, decrypting in the web browser using JS is slow and prone to other vulnerabilities. It currently isn't practical for web-based services to operate as you suggest. John MardlinYesterday 8:30 PM +Mike Hearn Was this work started before the most recent revelations made it clear that this was mission critical? I'm sure that implementing encryption on your scale is a massive challenge, it seems counter intuitive that it could be finalized so quickly after these revelations, regardless of whether or not the work had been begun already. Follow on: do you ever wish Edward Snowden would just give you everything you needed to know right away so this could be stopped sooner? Would you try to reach out and encourage that moving forward? Thanks for taking the time to be transparent and clarify to your users, while you're undoubtedly insanely busy. Ian BatterbeeYesterday 8:40 PM +John A. Tamplin Also worked at an ISP, for us, dark fibre was simply something where bits you shoved in one end came out the other untouched. The dark part referred more to the fact that the packet wouldn't congest with other people's traffic on the way, and would typically be a leased service on someone else's CWDM or DWDM network, though it could also be simple patching with no equipment in the way. Stephan BealYesterday 8:51 PM Okay, now admit it: how many of you had to google "Sisyphus" at the end of the article? ;) (i did!) Nicolas FischerYesterday 9:51 PM+4 5 4 These assholes think they're above the law. Fuck them! Let's use bitcoin to defund them. Amber YustYesterday 9:57 PM+3 4 3 +John Mardlin Yes, the project was started well before Snowden. The pace just got ramped up immensely in the past year or so. Jeff WeaverYesterday 10:57 PM+3 4 3 quite a post for bonfire day Guy would be proud :-) Mike HearnYesterday 11:39 PM+13 4 3 Nobody knows how to build services like the ones Google provides but where the service provider is blind to the traffic. It's not as simple as "Google makes money off ads so they don't want to change things". Ad-funded services are actually a good thing from a privacy perspective! A lot of people and media commentators don't realise this. The alternative to advertising is direct payment by end users for a service. Unfortunately, there are no ways to pay someone for something online anonymously. The closest is Bitcoin but it's still very young and immature, most people can't use it. So if the dominant paradigm for Google services was that you paid for them, you'd pay for them with a credit card and then anonymous accounts would be impossible, we'd always know exactly who you were. Even if we couldn't read the message traffic, we would still know immediately and automatically that Edward Snowden of BAH Hawaii had sent a message to Glenn Greenwald of the Guardian, which is obviously of great interest to the NSA. You don't need to be a genius to guess what a message from a high-clearance member of NSA staff to a journalist might say. All you need to know is that they're communicating at all. Currently though, anyone can sign up for a webmail account and provide any bogus name they like (and people do). Neither the webmail provider nor the advertisers know who a user really is, nor do they care. That's a pretty decent situation to be in. Anyway, although I'd love it to be different, there aren't any viable alternatives to the way cloud services operate today. These things either get fixed legislatively, or they don't. Cryptographers are inventing lots of really amazing technology that might one day make a truly private p2p cloud possible, but those techniques are probably decades away from being competitive (if they ever are). Jeroen van Gelderen1:03 AM+3 4 3 +Mike Hearn "These things either get fixed legislatively, or they don't." Then they won't. The TLAs will ignore the laws and lie about it until caught. Then do it again. Lauren Weinstein2:13 AM+12 3 2 I've had quite a few people ask why I haven't seemed to be more upset publicly about all the recent NSA and other surveillance disclosures. It's real simple -- there has been nothing disclosed that I (and many others) haven't assumed was going on at the hand of every capable surveillance org around the world for decades, one way or another. This sort of behavior goes back to the dawn of written communications -- tech has just made it easier in some ways (by concentrating flows and making storage so cheap) and harder in other ways (by providing means for robust encryption, when it's used). And recent history (that is, some decades) speaks clearly to the following. No matter what the politicians tell you, not matter what any countries' agencies say, there will be no substantive long-term change in these practices. Opportunistic gathering of all data they can get their hands on will continue, especially if it can be declared to be foreign or international in nature and so not subject to purely domestic restrictions (when those exist). At the best, we can hope for a bit more oversight (at least in the short term) and push hard for more transparency so that companies like Google can explain to the public what really happens in terms of data demands from government, and not be faced with when did you stop beating your wife? no-win situations where hyperbolic, false accusations can't even be legally refuted. Above all from a practical standpoint, it has to be encrypt, encrypt, encrypt -- as Google is now engaged in big time. Contrary to the assertions of the spooks, encryption to block or degrade opportunistic mass data collection is unlikely to significantly damage major targeted anti-terrorism efforts. When the agencies have something they really want to target, they can use warrants and even user endpoint attacks to deal with most kinds of common encryption. But what's so important about encryption at Google scale is that by making it significantly harder to do the mass, vacuum cleaner type surveillance, the opportunity for governments building up enormous databases of such material composed almost entirely of innocent parties' data can likely be curtailed in meaningful ways. And it's that sort of data collection that is most potentially subject to abuse, especially retrospective abuse under some future government quite possibly with a very different set of motives entirely. Jeff Weiss3:22 AM+1 2 1 +Mike Hearn in many cases it is simply not necessary to ship your personal info to someone else to organize. If you have a good internet connection at home, you can just put a modest box alongside your cablemodem that is capable of storing all your data and organizing it (with the right software, of course). And you would control your own privacy. The big missing piece is the software. Unfortunately all the effort has been poured into services like Google's because quite frankly, people don't know any better. Nobody knows the value of their data so they give it away. I would much rather contribute to a kickstarter for open source software to do the same thing. That way I know the application is working for me, not someone else. Ed Burnette3:31 AM + 1000000 from the US Michael Schwartz3:46 AM+3 4 3 Way to go Google for stopping all the hackers (even the ones my tax dollars are funding to spy on me!). Thanks to the crypto geniuses of the 90's, encryption is no longer a monopoly of the NSA. We have the power to have privacy, and if we work on open standards and open source software, we will also have the economies to make it ubiquitously supported by all domains on the Internet. Thank you for your transparency on the issue! Watson Ladd5:42 AM "Fuck You" is nice. Service and a court date is a lot nicer. Henrik Sjölander6:51 AM+5 6 5 I know that Googlers work for the security to help people in all countries for the right to privacy and spying governments, not only when it concerns free speach. I'm confident that you at Google are working on even things like these. That's why i like what google, and also employees like you Mike, are doing for everyone in the world. Thanks. Chuck McManis6:57 AM Knowing what Brandon and the opsec team is capable of, I am sure that given your new found understanding of the risks involved you will be up to the task mitigating this latest attack against the infrastructure. Kind of defines APT in a whole new way. Marco Tedaldi7:20 AM+1 2 1 The spy services are clearly criminal organizations. And the law is quite clear on how to handle criminal organizations and the members. Jay Perkins7:50 AM Today, in its world, Google is bigger than the government. It is time to start acting like it. Of course, advertising revenue is the milk that feeds the Google. Governments can cut off the milk. Kudos to Mike for speaking out as Brit. Americans suddenly have a fear that speaking out against the actions of its government will have real world consequences. Like investigations of your internet use and your finances. Americans have gained a fear of speaking out since the government convinced them that helping fight the war on "terror" meant that they voluntarily surrender the rights and freedoms that previous generations thought worthy of dying for, and it would somehow be patriotic, rather than idiotic. Anatoliy Lisovskiy8:04 AM+1 2 1 I heard a rumor as if in USSR some copper cables were going in pipes with dry air, or an inert gas, under certain pressure that was constantly monitored. Jerome Chan8:37 AM What is there to prevent the NSA from demanding the private keys for the encrypting software? Kazimierz Kurz8:43 AM encryption, hower complicated, is the only sollution. And even if encryption would be not very strong, it has to be done! Because even if it is easy to breake, it rise the cost for the atacker. It is a trade game. If You do something, even simple, - it may work for some time... Justin Lolofie8:44 AM brit outrage is classy outrage ++ Brandon Downey8:46 AM+1 2 1 While I can't comment about our employer's use of encryption, but if your concern is the compromise of current private keys revealing things about past encrypted sessions, technologies like this can help: https://www.eff.org/deeplinks/2013/08/pushing-perfect-forward-secrecy-impor… Danny Sullivan8:56 AM As an American, I'm finding the spying revelations disgusting. We do have laws against such warrantless tapping, and it shouldn't be allowed. But Google's "big people" that can go after the big people you feel will escape these illegalities. Right now, aside from whatever private lobbying is almost certainly going on, all Google is doing publicly is arguing for a right to reveal number of requests you give out. It would be nice if Google stepped up the game. File a lawsuit against the US government. Go after the big people. When Google felt China violated its security, Google pulled out of the entire country. It seems to have a much higher tolerance for US spying -- or bottom line, while it doesn't like it, it'll hurt the bottom line too much to do a similar withdrawal. But a big fat huge legal action would be the F-You you really want, and that many would feel only a company of Google's size could pull off. It'll be interesting to see if the higher-ups act on your call. Larry Gritz8:58 AM+1 2 1 I really hope this is making Google (and other companies) think hard about their "free services in exchange for mining data and selling ads" strategy. It's that business model that made all this surveillance easy. I'd like to see Google offer to make us the customers rather than the advertisers, allow us to pay for legitimately private and secure services, and as a bonus finally stop being bombarded with ads. Simon Zerafa9:16 AM I wonder of having the traffic on leased fibre was really the smart move in the end? All of the traffic on that fiber was Google's. If it had been on a public link it would have been encrypted and far safer. Greg Hennessy9:33 AM If the system allows the perversion of the course of justice to such an extent that the CEO of QWest can be indicted and jailed on 'insider' trading charges for allegedly not co-operating with 3 letter organisations. One hopes that the executive leadership team @ Google have retained some suitably capable legal resources to deal with what is inevitably coming down the pike. The state and it's securocrats do not like to be defied in private, let alone in public. Kevin Lyda9:36 AM +Larry Gritz Did you not read +Mike Hearn comment above? There is no widespread, easy to use anonymous payment system. If you pay for your Google services, you're traceable. If advertisers pay for your account, you are not. This is not rocket science.

7 6

Re: fuck these guys
by john＠johnlgrubbs.net 08 Nov '13

08 Nov '13

The problem is the State of Ethics here and abroad, not just in the US but everywhere. Crypto will protect against the effect but will not solve the root cause. -John ------Original Message------ From: Florian Weimer To: Eugen Leitl Cc: cypherpunks(a)al-qaeda.net Subject: Re: fuck these guys Sent: Nov 7, 2013 12:23 PM * Eugen Leitl quotes: > The traffic shown in the slides below is now all encrypted and the > work the NSA/GCHQ staff did on understanding it, ruined. Encryption is not a solution to the problem. The attack on Google shows that NSA/GCHQ that companies in Western countries and their employees are legitimate targets for covert operations by their intelligence services (same for the BND attacks on 1&1 and other German ISPs, we don't have to single out the Obama administration or the British here). Once that is established, those intelligence services can use all the tools in their portfolio. This includes turning employees against their colleagues and their employer, and things far worse. Suddenly, passive eavesdropping might not have been so bad after all. If you are their target, you lose. The solution is to make it illegal that they target you, reign in executive privilege (again, a global issue) and restore the rule of law. Obviously, that's a bit more difficult to turn on some crypto. Sent on the Sprint® Now Network from my BlackBerry®

1 0

[IP] C.I.A. Is Said to Pay AT&T for Call Data
by Eugen Leitl 07 Nov '13

07 Nov '13

----- Forwarded message from Dave Farber <dave(a)farber.net> ----- Date: Thu, 7 Nov 2013 05:52:03 -0500 From: Dave Farber <dave(a)farber.net> To: ip <ip(a)listbox.com> Subject: [IP] C.I.A. Is Said to Pay AT&T for Call Data Message-ID: <CAKx4trit6huM2PGQ6mXDPiDMLt6MneNG6oH2W46sZ_vb6687KQ(a)mail.gmail.com> Reply-To: dave(a)farber.net ---------- Forwarded message ---------- From: *Dewayne Hendricks* Date: Thursday, November 7, 2013 Subject: [Dewayne-Net] C.I.A. Is Said to Pay AT&T for Call Data To: Multiple recipients of Dewayne-Net <dewayne-net(a)warpspeed.com> November 7, 2013 C.I.A. Is Said to Pay AT&T for Call Data By CHARLIE SAVAGE < http://www.nytimes.com/2013/11/07/us/cia-is-said-to-pay-att-for-call-data.h… > WASHINGTON — The C.I.A. is paying AT&T more than $10 million a year to assist with overseas counterterrorism investigations by exploiting the company’s vast database of phone records, which includes Americans’ international calls, according to government officials. The cooperation is conducted under a voluntary contract, not under subpoenas or court orders compelling the company to participate, according to the officials. The C.I.A. supplies phone numbers of overseas terrorism suspects, and AT&T searches its database and provides records of calls that may help identify foreign associates, the officials said. The company has a huge archive of data on phone calls, both foreign and domestic, that were handled by its network equipment, not just those of its own customers. The program adds a new dimension to the debate over government spying and the privacy of communications records, which has been focused onNational Security Agency programs in recent months. The disclosure sheds further light on the ties between intelligence officials and communications service providers. And it shows how agencies beyond the N.S.A. use metadata — logs of the date, duration and phone numbers involved in a call, but not the content — to analyze links between people through programs regulated by an inconsistent patchwork of legal standards, procedures and oversight. Because the C.I.A. is prohibited from spying on the domestic activities of Americans, the agency imposes privacy safeguards on the program, said the officials, speaking on the condition of anonymity because it is classified. Most of the call logs provided by AT&T involve foreign-to-foreign calls, but when the company produces records of international calls with one end in the United States, it does not disclose the identity of the Americans and “masks” several digits of their phone numbers, the officials said. Still, the agency can refer such masked numbers to the F.B.I., which can issue an administrative subpoena requiring AT&T to provide the uncensored data. The bureau handles any domestic investigation, but sometimes shares with the C.I.A. the information about the American participant in those calls, the officials said. Dean Boyd, a spokesman for the C.I.A., declined to confirm the program. But he said the agency’s intelligence collection activities were lawful and “subject to extensive oversight.” “The C.I.A. protects the nation and upholds privacy rights of Americans by ensuring that its intelligence collection activities are focused on acquiring foreign intelligence and counterintelligence in accordance with U.S. laws,” he said. “The C.I.A. is expressly forbidden from undertaking intelligence collection activities inside the United States ‘for the purpose of acquiring information concerning the domestic activities of U.S. persons,’ and the C.I.A. does not do so.” Mark Siegel, an AT&T spokesman, said: “We value our customers’ privacy and work hard to protect it by ensuring compliance with the law in all respects. We do not comment on questions concerning national security.” The C.I.A. program appears to duplicate work performed by the N.S.A. But a senior American intelligence official, while declining to address whether the AT&T alliance exists, suggested that it would be rational for the C.I.A. to have its own program to check calling patterns linked to overseas terrorism suspects. With on-the-ground operatives abroad seeking to disrupt terrorist activities in “time-sensitive threat situations,” the official said, the C.I.A. requires “a certain speed, agility and tactical responsiveness that differs” from that of other agencies. “That need to act without delay is often best met when C.I.A. has developed its own capabilities to lawfully acquire necessary foreign intelligence information,” the official said. Since June, when documents leaked by the former N.S.A. contractor Edward J. Snowden began to surface, an international debate has erupted over the scope of N.S.A. surveillance and the agency’s relationships with American companies that operate networks or provide Internet communications services. Many of the companies have protested that they are legally compelled to cooperate. The AT&T-C.I.A. arrangement illustrates that such activities are not limited to the N.S.A., and that cooperation sometimes is voluntary. While officials in Washington are discussing whether to rein in the N.S.A. on American soil, governments in Europe are demanding more transparency from the companies and threatening greater restraints. AT&T is exploring a purchase of Vodafone, a European cellphone service provider, and European regulators and politicians have vowed to intensely scrutinize such a deal. [snip] Dewayne-Net RSS Feed: <http://dewaynenet.wordpress.com/feed/> ------------------------------------------- Archives: https://www.listbox.com/member/archive/247/=now RSS Feed: https://www.listbox.com/member/archive/rss/247/25094221-ddf8422b Powered by Listbox: http://www.listbox.com ----- End forwarded message -----

1 0

[Freedombox-discuss] Perfect Forward Security (PFS) on Linux Weekly News (LWN)
by Jonas Smedegaard 07 Nov '13

07 Nov '13

Hi, Linux Weekly News has an article on Perfect Forward Security: http://lwn.net/SubscriberLink/572926/34b86d70a0e9cda2/ If you have comments/rants about the article, I recommend that you consider posting them to the comments section of that article, rather than (only) here, as a way to contribute to their fine service. - Jonas -- * Jonas Smedegaard - idealist & Internet-arkitekt * Tlf.: +45 40843136 Website: http://dr.jones.dk/ [x] quote me freely [ ] ask before reusing [ ] keep private _______________________________________________ Freedombox-discuss mailing list Freedombox-discuss(a)lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/freedombox-discuss

1 0

[cryptome] * live coverage announcement * for those with an interest in following the NSA/GCHQ debacle
by taxakis 07 Nov '13

07 Nov '13

Do propagate the following: For live coverage of British howling spook work (testimonies MI5, MI6 and GCHQ directors), the following link should work as of 2 pm GMT/UTC: http://www.parliament.uk/business/news/2013/november-/isc-open-evidence-sess ion/

1 0

Re: [liberationtech] dark mail alliance
by phreedom＠yandex.ru 07 Nov '13

07 Nov '13

On Monday, November 04, 2013 01:17:49 PM Jonathan Wilkes wrote: > On 11/04/2013 05:28 AM, phreedom(a)yandex.ru wrote: > > On Sunday, November 03, 2013 04:06:11 PM Bill Woodcock wrote: > >>> On Nov 3, 2013, at 3:30, "phreedom(a)yandex.ru" <phreedom(a)yandex.ru> > >>> wrote: > >>> > >>> I don't see how "pasting over" a QR code in a way that's not easily > >>> detectable is somehow harder than pasting over a domain/email, or > >>> printing a real-looking fake ad and pasting it over the real one. > >> > >> A QR code is already isolated in an opaque white square. It's single > >> color, and moreover, that color is black. And it's smaller than a > >> billboard. > >> > >> By contrast, a textual URL or email address will be in a specific > >> typeface, > >> probably matched to the rest of the billboard. It's also likely > >> size-matched to other text. Most importantly, it's likely printed right > >> over a patterned and colored background. > >> > >> While you're correct that you can address, to some degree, all of those > >> issues by wheatpasting over the entire billboard, provided you're at > >> least > >> as competent a visual designer as the person who executed the original > >> ad, > >> which is easier to print and transport? A full-color billboard, or a > >> black-on-white sheet of tabloid-sized paper? > >> > >> To put this all in more practical terms, since these issues were not > >> apparent to you, you're a less-skilled visual designer than anyone who > >> would be paid to produce an advertisement. Therefore, you would not be > >> capable of covertly coopting their advertisement. Yet you'd still be > >> perfectly capable of successfully pasting over their QR code without > >> anyone > >> being the wiser. > > > > I can't talk about others, but I'd be quite suspicious if I saw a second > > layer of paper exactly where the qr code is located. If such attacks > > gained momentum, I guess people would be more careful. > > Now you are climbing up on a billboard and inspecting the QR code > personally as a way to prove human readable addresses are a solution > looking for a problem? Can you name a specific attack which actually happened, and which involved altering an ad url in any way or posting a fake physical ad? Are we talking about something that actually exists? It's not like an ad by microsoft can't point to a legitimately-looking domain name which isn't microsoft.com eg getthefacts.com > You already mentioned the idea of domain names that aren't "as > widely-known" as others. "Widely-known" is a feature-- that feature > doesn't exist with QR codes so you clearly understand the issue. I'm not > saying that issue cannot be solved, nor that the current domain name > system is immune to exploits. But if you don't understand the benefits > of human readable addresses you're likely to end up with a less secure > system to replace it. I understand also that: * these benefits exist for maybe top 100 domains * it's usual for well-known entities to use campaign-specific domain names * even if you know the entity name to be $NAME, the domain can still be $NAME.com, $NAME.org, $NAME-project.org, get$NAME.com etc The "security" of physical ads is pretty much about the cost/benefit, and that's why we don't see such attacks in the first place. > (Especially when the smartphones people must use > to read the QR code in the first place are almost all locked down and > not under the user's own control.) There are gateways like tor2web.org and onion.to, and these can be encoded into the QR code for compatibility purposes since there's 1:1 mapping beween darknet and gateway urls. For all practical purposes, the DNS replacement is already available in the form of tor hidden services, tested and known to be quite reliable. The status-quo is: 1) you pay money to get a DNS record which: a) can be revoked at will by a number of entities b) requires you to identify yourself, unless you're willing to play spy games(and noone know for how much longer the loopholes will exist, see (a)) c) requires you to be able to pay, which may exclude "children" who can't get the bank account/card, residents of sanctioned countries. 2) you get a ssl cert, with MITM-by-advanced-adversary as an inherent "security feature". This also may come with random and potentially ridiculous hops to jump thru, the list is subject to change 3) wait for hours/days for payments to complete and records to propagate. Tor hidden service: 1) add 2 lines to torrc, or use vidalia to do the same 2) grab the service address from tor's dir 3) the service goes online in 5-10 minutes, with encryption and authentication always on. HTTP gateway is available for legacy platforms. Bookmarking and address book features are widely available thus making the appearance of the url itself not that important. Both client and service can opt to drop their half of the circuit, which turns it into a more or less direct tcp connection, with nat traversal capabilities. Yes there are caveats, yes tor devs are spending their effort on making tor hide users, rather than optimizing "we don't want no anonymity" use cases, but the foundation is solid. The only known issue that bothers me is that tor doesn't let you keep the root keys for the service offline. A 2-level setup would be really nice, tor devs. pretty please? For all I care, the solution has been available for several years. It works well, but I'm afraid that getting it adopted would require the current gatekeepers to step up abuses by a couple orders of magnitude. -- Liberationtech is public & archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu.

1 0

Re: latest Snowden docs show NSA intercepts all Google and Yahoo DC-to-DC traffic
by Valdis.Kletnieks＠vt.edu 07 Nov '13

07 Nov '13

On Wed, 06 Nov 2013 08:50:06 +0900, Masataka Ohta said: > Valdis.Kletnieks(a)vt.edu wrote: > > >>> How do you intend to *find* the agents > >>> who were hired at a government agency's under-the-table request that > >>> never had a written record that the company had access to? > >> > >> By memories of those who are at the table. > Hint: I'm not talking about a way to have perfect security. I'm talking > about possible/good/recommended approach to improve the security without > witch hunting. You still haven't explained how "the memories of those who are at the table" help, when the NSA plant has very good reasons to say they're not an NSA plant, and you haven't explained how you can show they *are* a plant.

2 1

[liberationtech] How Much Surveillance Can Democracy Withstand?
by Yosem Companys 07 Nov '13

07 Nov '13

http://www.gnu.org/philosophy/surveillance-vs-democracy.html How Much Surveillance Can Democracy Withstand? by Richard Stallman A version of this article was first published in Wired in October 2013. The current level of general surveillance in society is incompatible with human rights. To recover our freedom and restore democracy, we must reduce surveillance to the point where it is possible for whistleblowers of all kinds to talk with journalists without being spotted. To do this reliably, we must reduce the surveillance capacity of the systems we use. Using free/libre software, as I've advocated for 30 years, is the first step in taking control of our digital lives. We can't trust nonfree software; the NSA uses and even createssecurity weaknesses in nonfree software to invade our own computers and routers. Free software gives us control of our own computers, but that won't protect our privacy once we set foot on the Internet. Bipartisan legislation to “curtail the domestic surveillance powers” in the U.S. is being drawn up, but it relies on limiting the government's use of our virtual dossiers. That won't suffice to protect whistleblowers if “catching the whistleblower” is grounds for access sufficient to identify him or her. We need to go further. Thanks to Edward Snowden's disclosures, we know that the current level of general surveillance in society is incompatible with human rights. The repeated harassment and prosecution of dissidents, sources, and journalists provides confirmation. We need to reduce the level of general surveillance, but how far? Where exactly is the maximum tolerable level of surveillance, beyond which it becomes oppressive? That happens when surveillance interferes with the functioning of democracy: when whistleblowers (such as Snowden) are likely to be caught. The Upper Limit on Surveillance in a Democracy If whistleblowers don't dare reveal crimes and lies, we lose the last shred of effective control over our government and institutions. That's why surveillance that enables the state to find out who has talked with a reporter is too much surveillance—too much for democracy to endure. An unnamed U.S. government official ominously told journalists in 2011 that the U.S. would not subpoena reporters because “We know who you're talking to.” Sometimesjournalists' phone call records are subpoenaed to find this out, but Snowden has shown us that in effect they subpoena all the phone call records of everyone in the U.S., all the time. Opposition and dissident activities need to keep secrets from states that are willing to play dirty tricks on them. The ACLU has demonstrated the U.S. government's systematic practice of infiltrating peaceful dissident groups on the pretext that there might be terrorists among them. The point at which surveillance is too much is the point at which the state can find who spoke to a known journalist or a known dissident. Information, Once Collected, Will Be Misused When people recognize that the level of general surveillance is too high, the first response is to propose limits on access to the accumulated data. That sounds nice, but it won't fix the problem, not even slightly, even supposing that the government obeys the rules. (The NSA has misled the FISA court, which said it was unable to effectively hold the NSA accountable.) Suspicion of a crime will be grounds for access, so once a whistleblower is accused of “espionage,” finding the “spy” will provide an excuse to access the accumulated material. The state's surveillance staff will misuse the data for personal reasons too. Some NSA agents used U.S. surveillance systems to track their lovers—past, present, or wished-for—in a practice called “LOVEINT.” The NSA says it has caught and punished this a few times; we don't know how many other times it wasn't caught. But these events shouldn't surprise us, because police have long used their access to driver's license records to track down someone attractive, a practice known as “running a plate for a date.” Surveillance data will always be used for other purposes, even if this is prohibited. Once the data has been accumulated and the state has the possibility of access to it, it canmisuse that data in dreadful ways. Total surveillance plus vague law provides an opening for a massive fishing expedition against any desired target. To make journalism and democracy safe, we must limit the accumulation of data that is easily accessible to the state. Robust Protection for Privacy Must Be Technical The Electronic Frontier Foundation and other organizations propose a set of legal principles designed to prevent the abuses of massive surveillance. These principles include, crucially, explicit legal protection for whistleblowers; as a consequence, they would be adequate for protecting democratic freedoms—if adopted completely and enforced without exception forever. However, such legal protections are precarious: as recent history shows, they can be repealed (as in the FISA Amendments Act), suspended, or ignored. Meanwhile, demagogues will cite the usual excuses as grounds for total surveillance; any terrorist attack, even one that kills just a handful of people, will give them an opportunity. If limits on access to the data are set aside, it will be as if they had never existed: years worth of dossiers would suddenly become available for misuse by the state and its agents and, if collected by companies, for their private misuse as well. If, however, we stop the collection of dossiers on everyone, those dossiers won't exist, and there will be no way to compile them retroactively. A new illiberal regime would have to implement surveillance afresh, and it would only collect data starting at that date. As for suspending or momentarily ignoring this law, the idea would hardly make sense. We Must Design Every System for Privacy If we don't want a total surveillance society, we must consider surveillance a kind of social pollution, and limit the surveillance impact of each new digital system just as we limit the environmental impact of physical construction. For example: “Smart” meters for electricity are touted for sending the power company moment-by-moment data about each customer's electric usage, including how usage compares with users in general. This is implemented based on general surveillance, but does not require any surveillance. It would be easy for the power company to calculate the average usage in a residential neighborhood by dividing the total usage by the number of subscribers, and send that to the meters. Each customer's meter could compare her usage, over any desired period of time, with the average usage pattern for that period. The same benefit, with no surveillance! We need to design such privacy into all our digital systems. Remedy for Collecting Data: Leaving It Dispersed One way to make monitoring safe for privacy is to keep the data dispersed and inconvenient to access. Old-fashioned security cameras were no threat to privacy. The recording was stored on the premises, and kept for a few weeks at most. Because of the inconvenience of accessing these recordings, it was never done massively; they were accessed only in the places where someone reported a crime. It would not be feasible to physically collect millions of tapes every day and watch them or copy them. Nowadays, security cameras have become surveillance cameras: they are connected to the Internet so recordings can be collected in a data center and saved forever. This is already dangerous, but it is going to get worse. Advances in face recognition may bring the day when suspected journalists can be tracked on the street all the time to see who they talk with. Internet-connected cameras often have lousy digital security themselves, so anyone could watch what the camera sees. To restore privacy, we should ban the use of Internet-connected cameras aimed where and when the public is admitted, except when carried by people. Everyone must be free to post photos and video recordings occasionally, but the systematic accumulation of such data on the Internet must be limited. Remedy for Internet Commerce Surveillance Most data collection comes from people's own digital activities. Usually the data is collected first by companies. But when it comes to the threat to privacy and democracy, it makes no difference whether surveillance is done directly by the state or farmed out to a business, because the data that the companies collect is systematically available to the state. The NSA, through PRISM, has gotten into the databases of many large Internet corporations. AT&T has saved all its phone call records since 1987 and makes them available to the DEA to search on request. Strictly speaking, the U.S. government does not possess that data, but in practical terms it may as well possess it. The goal of making journalism and democracy safe therefore requires that we reduce the data collected about people by any organization, not just by the state. We must redesign digital systems so that they do not accumulate data about their users. If they need digital data about our transactions, they should not be allowed to keep them more than a short time beyond what is inherently necessary for their dealings with us. One of the motives for the current level of surveillance of the Internet is that sites are financed through advertising based on tracking users' activities and propensities. This converts a mere annoyance—advertising that we can learn to ignore—into a surveillance system that harms us whether we know it or not. Purchases over the Internet also track their users. And we are all aware that “privacy policies” are more excuses to violate privacy than commitments to uphold it. We could correct both problems by adopting a system of anonymous payments—anonymous for the payer, that is. (We don't want the payee to dodge taxes.) Bitcoin is not anonymous, but technology for digital cash was first developed 25 years ago; we need only suitable business arrangements, and for the state not to obstruct them. A further threat from sites' collection of personal data is that security breakers might get in, take it, and misuse it. This includes customers' credit card details. An anonymous payment system would end this danger: a security hole in the site can't hurt you if the site knows nothing about you. Remedy for Travel Surveillance We must convert digital toll collection to anonymous payment (using digital cash, for instance). License-plate recognition systems recognize all license plates, and the data can be kept indefinitely; they should be required by law to notice and record only those license numbers that are on a list of cars sought by court orders. A less secure alternative would record all cars locally but only for a few days, and not make the full data available over the Internet; access to the data should be limited to searching for a list of court-ordered license-numbers. The U.S. “no-fly” list must be abolished because it is punishment without trial. It is acceptable to have a list of people whose person and luggage will be searched with extra care, and anonymous passengers on domestic flights could be treated as if they were on this list. It is also acceptable to bar non-citizens, if they are not permitted to enter the country at all, from boarding flights to the country. This ought to be enough for all legitimate purposes. Many mass transit systems use some kind of smart cards or RFIDs for payment. These systems accumulate personal data: if you once make the mistake of paying with anything but cash, they associate the card permanently with your name. Furthermore, they record all travel associated with each card. Together they amount to massive surveillance. This data collection must be reduced. Navigation services do surveillance: the user's computer tells the map service the user's location and where the user wants to go; then the server determines the route and sends it back to the user's computer, which displays it. Nowadays, the server probably records the user's locations, since there is nothing to prevent it. This surveillance is not inherently necessary, and redesign could avoid it: free/libre software in the user's computer could download map data for the pertinent regions (if not downloaded previously), compute the route, and display it, without ever telling anyone where the user is or wants to go. Systems for borrowing bicycles, etc., can be designed so that the borrower's identity is known only inside the station where the item was borrowed. Borrowing would inform all stations that the item is “out,” so when the user returns it at any station (in general, a different one), that station will know where and when that item was borrowed. It will inform the other station that the item is no longer “out.” It will also calculate the user's bill, and send it (after waiting some random number of minutes) to headquarters along a ring of stations, so that headquarters would not find out which station the bill came from. Once this is done, the return station would forget all about the transaction. If an item remains “out” for too long, the station where it was borrowed can inform headquarters; in that case, it could send the borrower's identity immediately. Remedy for Communications Dossiers Internet service providers and telephone companies keep extensive data on their users' contacts (browsing, phone calls, etc). With mobile phones, they also record the user's physical location. They keep these dossiers for a long time: over 30 years, in the case of AT&T. Soon they will even record the user's body activities. It appears that the NSA collects cell phone location data in bulk. Unmonitored communication is impossible where systems create such dossiers. So it should be illegal to create or keep them. ISPs and phone companies must not be allowed to keep this information for very long, in the absence of a court order to surveil a certain party. This solution is not entirely satisfactory, because it won't physically stop the government from collecting all the information immediately as it is generated—which is what theU.S. does with some or all phone companies. We would have to rely on prohibiting that by law. However, that would be better than the current situation, where the relevant law (the PATRIOT Act) does not clearly prohibit the practice. In addition, if the government did resume this sort of surveillance, it would not get data about everyone's phone calls made prior to that time. But Some Surveillance Is Necessary For the state to find criminals, it needs to be able to investigate specific crimes, or specific suspected planned crimes, under a court order. With the Internet, the power to tap phone conversations would naturally extend to the power to tap Internet connections. This power is easy to abuse for political reasons, but it is also necessary. Fortunately, this won't make it possible to find whistleblowers after the fact. Individuals with special state-granted power, such as police, forfeit their right to privacy and must be monitored. (In fact, police have their own jargon term for perjury, “testilying,” since they do it so frequently, particularly about protesters and photographers.) One city in California that required police to wear video cameras all the time found their use of force fell by 60%. The ACLU is in favor of this. Corporations are not people, and not entitled to human rights. It is legitimate to require businesses to publish the details of processes that might cause chemical, biological, nuclear, fiscal, computational (e.g., DRM) or political (e.g., lobbying) hazards to society, to whatever level is needed for public well-being. The danger of these operations (consider the BP oil spill, the Fukushima meltdowns, and the 2008 fiscal crisis) dwarfs that of terrorism. However, journalism must be protected from surveillance even when it is carried out as part of a business. ________________________________ Digital technology has brought about a tremendous increase in the level of surveillance of our movements, actions, and communications. It is far more than we experienced in the 1990s, and far more than people behind the Iron Curtain experienced in the 1980s, and would still be far more even with additional legal limits on state use of the accumulated data. Unless we believe that our free countries previously suffered from a grave surveillance deficit, and ought to be surveilled more than the Soviet Union and East Germany were, we must reverse this increase. That requires stopping the accumulation of big data about people. Copyright 2013 Richard Stallman Licensed under the Creative Commons Attribution-NoDerivs 3.0 United States License -- Liberationtech is public & archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu.

1 0

[IP] How Much Surveillance Can Democracy Withstand? - GNU Project - Free Software Foundation
by Eugen Leitl 07 Nov '13

07 Nov '13

----- Forwarded message from David Farber <farber(a)gmail.com> ----- Date: Wed, 6 Nov 2013 11:32:21 -0500 From: David Farber <farber(a)gmail.com> To: ip <ip(a)listbox.com> Subject: [IP] How Much Surveillance Can Democracy Withstand? - GNU Project - Free Software Foundation Message-Id: <BFDB3058-C627-42F5-A998-D6CFCEC16929(a)gmail.com> X-Mailer: Apple Mail (2.1816) Reply-To: dave(a)farber.net [ I would like to hear comments on this djf] http://www.gnu.org/philosophy/surveillance-vs-democracy.html How Much Surveillance Can Democracy Withstand? by Richard Stallman A version of this article was first published in Wired in October 2013. The current level of general surveillance in society is incompatible with human rights. To recover our freedom and restore democracy, we must reduce surveillance to the point where it is possible for whistleblowers of all kinds to talk with journalists without being spotted. To do this reliably, we must reduce the surveillance capacity of the systems we use. Using free/libre software, as I've advocated for 30 years, is the first step in taking control of our digital lives. We can't trust nonfree software; the NSA uses and even creates security weaknesses in nonfree software to invade our own computers and routers. Free software gives us control of our own computers, but that won't protect our privacy once we set foot on the Internet. Bipartisan legislation to “curtail the domestic surveillance powers” in the U.S. is being drawn up, but it relies on limiting the government's use of our virtual dossiers. That won't suffice to protect whistleblowers if “catching the whistleblower” is grounds for access sufficient to identify him or her. We need to go further. Thanks to Edward Snowden's disclosures, we know that the current level of general surveillance in society is incompatible with human rights. The repeated harassment and prosecution of dissidents, sources, and journalists provides confirmation. We need to reduce the level of general surveillance, but how far? Where exactly is the maximum tolerable level of surveillance, beyond which it becomes oppressive? That happens when surveillance interferes with the functioning of democracy: when whistleblowers (such as Snowden) are likely to be caught. The Upper Limit on Surveillance in a Democracy If whistleblowers don't dare reveal crimes and lies, we lose the last shred of effective control over our government and institutions. That's why surveillance that enables the state to find out who has talked with a reporter is too much surveillance—too much for democracy to endure. An unnamed U.S. government official ominously told journalists in 2011 that the U.S. would not subpoena reporters because “We know who you're talking to.” Sometimes journalists' phone call records are subpoenaed to find this out, but Snowden has shown us that in effect they subpoena all the phone call records of everyone in the U.S., all the time. Opposition and dissident activities need to keep secrets from states that are willing to play dirty tricks on them. The ACLU has demonstrated the U.S. government's systematic practice of infiltrating peaceful dissident groups on the pretext that there might be terrorists among them. The point at which surveillance is too much is the point at which the state can find who spoke to a known journalist or a known dissident. Information, Once Collected, Will Be Misused When people recognize that the level of general surveillance is too high, the first response is to propose limits on access to the accumulated data. That sounds nice, but it won't fix the problem, not even slightly, even supposing that the government obeys the rules. (The NSA has misled the FISA court, which said it was unable to effectively hold the NSA accountable.) Suspicion of a crime will be grounds for access, so once a whistleblower is accused of “espionage,” finding the “spy” will provide an excuse to access the accumulated material. The state's surveillance staff will misuse the data for personal reasons too. Some NSA agents used U.S. surveillance systems to track their lovers—past, present, or wished-for—in a practice called “LOVEINT.” The NSA says it has caught and punished this a few times; we don't know how many other times it wasn't caught. But these events shouldn't surprise us, because police have long used their access to driver's license records to track down someone attractive, a practice known as “running a plate for a date.” Surveillance data will always be used for other purposes, even if this is prohibited. Once the data has been accumulated and the state has the possibility of access to it, it can misuse that data in dreadful ways. Total surveillance plus vague law provides an opening for a massive fishing expedition against any desired target. To make journalism and democracy safe, we must limit the accumulation of data that is easily accessible to the state. Robust Protection for Privacy Must Be Technical The Electronic Frontier Foundation and other organizations propose a set of legal principles designed to prevent the abuses of massive surveillance. These principles include, crucially, explicit legal protection for whistleblowers; as a consequence, they would be adequate for protecting democratic freedoms—if adopted completely and enforced without exception forever. However, such legal protections are precarious: as recent history shows, they can be repealed (as in the FISA Amendments Act), suspended, or ignored. Meanwhile, demagogues will cite the usual excuses as grounds for total surveillance; any terrorist attack, even one that kills just a handful of people, will give them an opportunity. If limits on access to the data are set aside, it will be as if they had never existed: years worth of dossiers would suddenly become available for misuse by the state and its agents and, if collected by companies, for their private misuse as well. If, however, we stop the collection of dossiers on everyone, those dossiers won't exist, and there will be no way to compile them retroactively. A new illiberal regime would have to implement surveillance afresh, and it would only collect data starting at that date. As for suspending or momentarily ignoring this law, the idea would hardly make sense. We Must Design Every System for Privacy If we don't want a total surveillance society, we must consider surveillance a kind of social pollution, and limit the surveillance impact of each new digital system just as we limit the environmental impact of physical construction. For example: “Smart” meters for electricity are touted for sending the power company moment-by-moment data about each customer's electric usage, including how usage compares with users in general. This is implemented based on general surveillance, but does not require any surveillance. It would be easy for the power company to calculate the average usage in a residential neighborhood by dividing the total usage by the number of subscribers, and send that to the meters. Each customer's meter could compare her usage, over any desired period of time, with the average usage pattern for that period. The same benefit, with no surveillance! We need to design such privacy into all our digital systems. Remedy for Collecting Data: Leaving It Dispersed One way to make monitoring safe for privacy is to keep the data dispersed and inconvenient to access. Old-fashioned security cameras were no threat to privacy. The recording was stored on the premises, and kept for a few weeks at most. Because of the inconvenience of accessing these recordings, it was never done massively; they were accessed only in the places where someone reported a crime. It would not be feasible to physically collect millions of tapes every day and watch them or copy them. Nowadays, security cameras have become surveillance cameras: they are connected to the Internet so recordings can be collected in a data center and saved forever. This is already dangerous, but it is going to get worse. Advances in face recognition may bring the day when suspected journalists can be tracked on the street all the time to see who they talk with. Internet-connected cameras often have lousy digital security themselves, so anyone could watch what the camera sees. To restore privacy, we should ban the use of Internet-connected cameras aimed where and when the public is admitted, except when carried by people. Everyone must be free to post photos and video recordings occasionally, but the systematic accumulation of such data on the Internet must be limited. Remedy for Internet Commerce Surveillance Most data collection comes from people's own digital activities. Usually the data is collected first by companies. But when it comes to the threat to privacy and democracy, it makes no difference whether surveillance is done directly by the state or farmed out to a business, because the data that the companies collect is systematically available to the state. The NSA, through PRISM, has gotten into the databases of many large Internet corporations. AT&T has saved all its phone call records since 1987 and makes them available to the DEA to search on request. Strictly speaking, the U.S. government does not possess that data, but in practical terms it may as well possess it. The goal of making journalism and democracy safe therefore requires that we reduce the data collected about people by any organization, not just by the state. We must redesign digital systems so that they do not accumulate data about their users. If they need digital data about our transactions, they should not be allowed to keep them more than a short time beyond what is inherently necessary for their dealings with us. One of the motives for the current level of surveillance of the Internet is that sites are financed through advertising based on tracking users' activities and propensities. This converts a mere annoyance—advertising that we can learn to ignore—into a surveillance system that harms us whether we know it or not. Purchases over the Internet also track their users. And we are all aware that “privacy policies” are more excuses to violate privacy than commitments to uphold it. We could correct both problems by adopting a system of anonymous payments—anonymous for the payer, that is. (We don't want the payee to dodge taxes.) Bitcoin is not anonymous, but technology for digital cash was first developed 25 years ago; we need only suitable business arrangements, and for the state not to obstruct them. A further threat from sites' collection of personal data is that security breakers might get in, take it, and misuse it. This includes customers' credit card details. An anonymous payment system would end this danger: a security hole in the site can't hurt you if the site knows nothing about you. Remedy for Travel Surveillance We must convert digital toll collection to anonymous payment (using digital cash, for instance). License-plate recognition systems recognize all license plates, and the data can be kept indefinitely; they should be required by law to notice and record only those license numbers that are on a list of cars sought by court orders. A less secure alternative would record all cars locally but only for a few days, and not make the full data available over the Internet; access to the data should be limited to searching for a list of court-ordered license-numbers. The U.S. “no-fly” list must be abolished because it is punishment without trial. It is acceptable to have a list of people whose person and luggage will be searched with extra care, and anonymous passengers on domestic flights could be treated as if they were on this list. It is also acceptable to bar non-citizens, if they are not permitted to enter the country at all, from boarding flights to the country. This ought to be enough for all legitimate purposes. Many mass transit systems use some kind of smart cards or RFIDs for payment. These systems accumulate personal data: if you once make the mistake of paying with anything but cash, they associate the card permanently with your name. Furthermore, they record all travel associated with each card. Together they amount to massive surveillance. This data collection must be reduced. Navigation services do surveillance: the user's computer tells the map service the user's location and where the user wants to go; then the server determines the route and sends it back to the user's computer, which displays it. Nowadays, the server probably records the user's locations, since there is nothing to prevent it. This surveillance is not inherently necessary, and redesign could avoid it: free/libre software in the user's computer could download map data for the pertinent regions (if not downloaded previously), compute the route, and display it, without ever telling anyone where the user is or wants to go. Systems for borrowing bicycles, etc., can be designed so that the borrower's identity is known only inside the station where the item was borrowed. Borrowing would inform all stations that the item is “out,” so when the user returns it at any station (in general, a different one), that station will know where and when that item was borrowed. It will inform the other station that the item is no longer “out.” It will also calculate the user's bill, and send it (after waiting some random number of minutes) to headquarters along a ring of stations, so that headquarters would not find out which station the bill came from. Once this is done, the return station would forget all about the transaction. If an item remains “out” for too long, the station where it was borrowed can inform headquarters; in that case, it could send the borrower's identity immediately. Remedy for Communications Dossiers Internet service providers and telephone companies keep extensive data on their users' contacts (browsing, phone calls, etc). With mobile phones, they also record the user's physical location. They keep these dossiers for a long time: over 30 years, in the case of AT&T. Soon they will even record the user's body activities. It appears that the NSA collects cell phone location data in bulk. Unmonitored communication is impossible where systems create such dossiers. So it should be illegal to create or keep them. ISPs and phone companies must not be allowed to keep this information for very long, in the absence of a court order to surveil a certain party. This solution is not entirely satisfactory, because it won't physically stop the government from collecting all the information immediately as it is generated—which is what the U.S. does with some or all phone companies. We would have to rely on prohibiting that by law. However, that would be better than the current situation, where the relevant law (the PATRIOT Act) does not clearly prohibit the practice. In addition, if the government did resume this sort of surveillance, it would not get data about everyone's phone calls made prior to that time. But Some Surveillance Is Necessary For the state to find criminals, it needs to be able to investigate specific crimes, or specific suspected planned crimes, under a court order. With the Internet, the power to tap phone conversations would naturally extend to the power to tap Internet connections. This power is easy to abuse for political reasons, but it is also necessary. Fortunately, this won't make it possible to find whistleblowers after the fact. Individuals with special state-granted power, such as police, forfeit their right to privacy and must be monitored. (In fact, police have their own jargon term for perjury, “testilying,” since they do it so frequently, particularly about protesters and photographers.) One city in California that required police to wear video cameras all the time found their use of force fell by 60%. The ACLU is in favor of this. Corporations are not people, and not entitled to human rights. It is legitimate to require businesses to publish the details of processes that might cause chemical, biological, nuclear, fiscal, computational (e.g., DRM) or political (e.g., lobbying) hazards to society, to whatever level is needed for public well-being. The danger of these operations (consider the BP oil spill, the Fukushima meltdowns, and the 2008 fiscal crisis) dwarfs that of terrorism. However, journalism must be protected from surveillance even when it is carried out as part of a business. Digital technology has brought about a tremendous increase in the level of surveillance of our movements, actions, and communications. It is far more than we experienced in the 1990s, and far more than people behind the Iron Curtain experienced in the 1980s, and would still be far more even with additional legal limits on state use of the accumulated data. Unless we believe that our free countries previously suffered from a grave surveillance deficit, and ought to be surveilled more than the Soviet Union and East Germany were, we must reverse this increase. That requires stopping the accumulation of big data about people. Copyright 2013 Richard Stallman Licensed under the Creative Commons Attribution-NoDerivs 3.0 United States License ------------------------------------------- Archives: https://www.listbox.com/member/archive/247/=now RSS Feed: https://www.listbox.com/member/archive/rss/247/25094221-ddf8422b Powered by Listbox: http://www.listbox.com ----- End forwarded message -----

1 0