- cypherpunks - lists.cpunks.org

WHY make a fake GCHQ slide?
by Michael Best 12 Oct '15

12 Oct '15

Here's my preliminary list of potential reasons for faking a GCHQ slide. Not meant to be comprehensive, and not every possibility is highly likely. Some are included only for completeness, but I'm sure there are possibilities I missed. There have been a few incidents already where the slides have been challenged or at least partially debunked. The German prosecutor found a lack of evidence that the NSA was illegally monitoring their government and concluded that the alleged NSA order was a fake. Snowden has also accused The Independent of attributing slides to him that he never gave to them. The why depends on the who. Candidates include: - GCHQ - Snowden (included for completeness, but least likely. Why fake this particular slide among many apparently legitimate ones?) - Russian chekist agencies - Chinese intelligence agencies - The Intercept - Intel service X - If the GCHQ, then there are a few possible reasons: 1. Part of a proposal/demo 2. Disinfo to discourage visitors from going to Cryptome 3. Disinfo to create paranoia 4. Disinfo to discredit other slides (Snowden suggests something like that here http://www.theguardian.com/commentisfree/2013/aug/23/uk-government-independ… ) 5. Disinfo to convince a FIS (foreign intel service) that their capabilities are better/more complete than they are (or were better than they were at the time) If Snowden: 1. ??? 2. Makes no sense as an isolated incident, little evidence to the contrary 3. Would not necessarily recognize a fake slide, since he didn't examine all of the ones he passed on If Russian disinfo: 1. Discredit the GCHQ 2. Discredit western governments and undermine their intelligence agencies 3. Inflate the importance of Cryptome prior to attempting to use them to release disinfo If Chinese disinfo: 1. Smear British cyber operations as part of their ongoing cyberwar with the west and related cognitive warfare 2. Discredit the GCHQ 3. Discredit western governments and undermine their intelligence agencies 4. Inflate the importance of Cryptome prior to attempting to use them to release disinfo If The Intercept: 1. Fame 2. Money from being paid to publish a fake by any interested party 3. Financial compensation from media attention as suggested by Razer/Rayzer(a)riseup.net If Intel service x: 1. Any of the above *Juan* juan.g71(a)gmail.com > > <juan.g71%40gmail.com?Subject=Re%3A%20Why%20cryptome%20sold%20web%20logs%20to%20their%20paying%20customers%3F&In-Reply-To=%3C5619825d.361f8c0a.691ce.fffffe96%40mx.google.com%3E> > *Sat Oct 10 17:31:29 EDT 2015*>*I still don't get who would make such a > fake and why. *

9 28

[cryptome] Re: NatSecGeek
by Michael Best 12 Oct '15

12 Oct '15

> > His use of a sig with all his social networks is one of the reasons I > earlier said Best has some income-related motive, and that he's most > likely dealing in 'future rewards'. "All his social networks" being twitter? I have a LinkedIn somewhere, but I don't publicize that. I'm not sure what "sig" you mean. I don't have an email signature. On that1archive.neocities.org ? Yeah, I have my contact information posted. Of course, JYA also has his email and twitter posted there, but no accusations about a profit based motive against him. No double standard there.

1 0

Why cryptome sold web logs to their paying customers?
by Dr. J Feinstein 12 Oct '15

12 Oct '15

Resend–HTML email scrubbed Calling bullshit. Mirimirs right, this makes no sense. And JYA says netsol won't let him delete the logs but Netsol says logs are disabled by default[https://www.networksolutions.com/support/how-to-enable-download-the… and you have to turn them on. So how the fuckd this really happen? Mirimir <mirimir(a)riseup.net> Are you arguing that users could have found those logs? I almost can't imagine that. Logs are normally in /var/log/ somewhere, and I can't imagine making them searchable. And indeed, I can't imagine how Cryptome archives would have included anything from /var/log/, even after system restore from backups. <--SNIP--> > Should access logs be kept for that long? Absolutely not. From what I> have read in the email exchange that was posted, the log files were> included in a NetSol total restore. My guess is that John/Cryptome did> not intentionally keep these files, and did not realize these files were> included in the archive. But that's the thing. Logs should have been in /var/log/. And how would the "NetSol total restore" have changed that? > When I do incremental backups or updates on my own systems, I don't> usually go back and check the integrity of files I've already archived> in my closed system. I can see where this could be an honest mistake> that has gotten blown way out of proportion. It's a good lesson to be> more aware of these types of glitches. I still don't get how logs would have ended up in archives. Maybe JYA prepared a special set of archives for a collaborator. Maybe for someone helping him to understand what had happened. And then maybe he forgot about doing that. Hard to say.

10 33

What is the point to replying to natsecgirls when their mission is entirely clear?
by Georgi Guninski 12 Oct '15

12 Oct '15

What is the point to replying to natsecgirls when their mission is entirely clear? Except for OOBC I don't see any, though I am quite dumb.

1 0

Why cryptome sold web logs to their paying customers?
by Michael Best 12 Oct '15

12 Oct '15

You mean the Cryptome logs? John mailed them to me. And many, many other people since 2013. According to him. (Not the many, many part.) > *Razer* Rayzer(a)riseup.net > > <Rayzer%40riseup.net?Subject=Re%3A%20Why%20cryptome%20sold%20web%20logs%20to%20their%20paying%20customers%3F&In-Reply-To=%3C561BCCC2.6080501%40riseup.net%3E> > *Mon Oct 12 11:07:46 EDT 2015*What you claim to be doing is starting an > archive of dox you 'found' in > the wild, (but no one seems to know exactly knows how they went wild) > from a specific site, Cryptome, without the site owner's permission, at IA? But if you wanna pull on that thread, someone could easily do the same to JYA since he's reposted many pieces of copyrighted material on his site, without reprint permission or proper copyright notice (which cuts off any fair use claim). GASP Is that proof of this vendetta of which speak? Not the one John has against me where he's smeared me and accused me of faking disinfo, I mean the fake one I apparently have against him. (Though I do admit to being a little bit bitter since he made so many bogus accusations against me)

2 1

How to go about sharing (was: one of a dozen threads about Cryptome)
by Michael Best 12 Oct '15

12 Oct '15

Thoughts - All good advice in it's own way, but mostly it seems unnecessary. Aside from copyright and reprint issues, 99% of what's on Cryptome is not only open source, it's not really objectionable in terms of hosting it. TheCthulhu does a great job of distributing large amounts of data, but that's it's own thing and requires an ongoing budget and infrastructure. I figure with Archive.org I can distribute 99.9% of material and not worry about copyright, bandwidth, etc. If it turns out there's a violation I missed, the item gets taken down - not the entire site or all the uploads. On the rare occasion that there's something else, I'd rather take whatever steps are needed to distribute it then rather than try to build my own independent infrastructure ahead of time. Things to add? Holes to poke in my logic? > On Mon, Oct 12, 2015, at 12:32 PM, Travis Biehn wrote: > >* You can start by re-posting the leaked traffic logs... (Editorial *>* > discretion is frowned upon amongst the idealists.) *> > >* Maybe set up an onion, host on i2p, freenet (hehehe), ethereum, the *>* > blockchain, torrents. Spread it far and wide, set up a PKI, set up a *>* > WOT, keep it all offline. *> > >* If you're a real masochist you'll host the docs on some crazy *>* > 'website' with no indirection protecting you from legal/illegal/TLA *>* > action. Keep the info off the dark web, off the deep web and in the *>* > search indexes. *> > >* Warrant canary (which won't work), encryption (you won't be safe) and * > >* signatures (secrets will be stolen.) *> > >* If you think you can survive as well as JYA, Deb & fare better than *>* > Assange, go for it. Be prepared. *> > >* It doesn't pay very well. You'd have to be crazy to do this. * Or you > can be like TheCthulhu and run your own data centre with > good lawyers. Alfie

3 2

Re: WHY make a fake GCHQ slide?
by Michael Best 12 Oct '15

12 Oct '15

I never said I proved the slide is fake, Travis. In fact, I've said several times that I've all done is prove that it could be fake. I said it in the mailing list and in the original posts on my site. *Please* try to read what you're criticizing/arguing/responding to. I know it can be hard, or boring, or frustrating, but it's essential to a dialogue that you respond to what the other person/side/position said and not confabulate something (as is human nature) or worse yet, build a strawman. Forcing your targets to *ahem* 'go dark' by instilling paranoia is exactly > the opposite of what 'an IA / TLA' wants. So categorical, monolithic and single minded! One might even say "overly so" lol On Mon, Oct 12, 2015 at 10:02 AM, Travis Biehn <tbiehn(a)gmail.com> wrote: > Mike, > You haven't proven that they were fake. Being able to counterfeit a dollar > bill does not all dollar bills counterfeit make. It's been one giant navel > gazing exercise. > > These disclosures only serve to further confirm opsec procedures long > recommended and employed. This slide is an advertisement for Tor (which > some hold to be a government honeypot, I do not.) > > Forcing your targets to *ahem* 'go dark' by instilling paranoia is exactly > the opposite of what 'an IA / TLA' wants. > > -Travis > > On Mon, Oct 12, 2015 at 9:55 AM, Michael Best <themikebest(a)gmail.com> > wrote: > >> I think Snowden has become such a folk hero that some people may leap to >> defend what seems like an attack on him without taking as much time to look >> at the data/posts as they would otherwise. >> >> On Mon, Oct 12, 2015 at 9:46 AM, Shelley <shelley(a)misanthropia.org> >> wrote: >> >>> On October 12, 2015 6:20:46 AM Michael Best <themikebest(a)gmail.com> >>> wrote: >>> >>> I tried to list their motives under the GCHQ/UK motives, who would be >>>> more >>>> likely to fake the slide anyway and are the ones alleged of having >>>> leaked >>>> documents to the Independent on behalf of JTRIG, are a fairly likely >>>> candidate. >>>> >>> >>> Yes, you did list a number of possibilities. It sometimes seems as >>> though the same few people do not read and/or comprehend responses before >>> replying to them. >>> >>> Faking a slide like this would be a good way to inspire paranoia >>>> and divide a community, no? It got Cryptome to post a notice on their >>>> site >>>> for a week or two, alerting people to the possibility that they'd been >>>> targeted by GCHQ by visiting Cryptome. Sounds like JTRIG-ish paranoia, >>>> no? >>>> >>> >>> Agreed. It could be an effective way to deter visitors to Cryptome, >>> possibly to divert attention away from something posted there around the >>> time this all began. >>> >>> -S >>> >>> >>> >>>> On Mon, Oct 12, 2015 at 9:10 AM, Georgi Guninski <guninski(a)guninski.com >>>> > >>>> wrote: >>>> >>>> > >>>> > >>>> https://en.wikipedia.org/w/index.php?title=Joint_Threat_Research_Intelligen… >>>> > >>>> > Joint Threat Research Intelligence Group >>>> > >>>> > In June 2015, NSA files published by Glenn Greenwald revealed new >>>> > details about JTRIG's work at covertly manipulating online >>>> > communities.[6] >>>> > >>>> > >>>> > On Mon, Oct 12, 2015 at 08:58:33AM -0400, Michael Best wrote: >>>> > > > >>>> > > > So assuming Snowden "borrowed" the slide from the NSA and he >>>> didn't get >>>> > > >>>> > > owned, the slide is _REAL_. >>>> > > >>>> > > >>>> > > I don't think I understand your mean, if we assuming it's real, it >>>> > follows >>>> > > that it's real? I think I walked into a language barrier. >>>> > > >>>> > > >>>> > > > Having in mind Snowden likely have large pile of slides, if he got >>>> > > > owned, likely all/the majority of them would likely be fake. >>>> > > > Is this plausible? >>>> > > >>>> > > >>>> > > Not necessarily, that's not how disinfo works a lot of the time. >>>> > > >>>> > > And did you missed the us-natsec trolling about the eu appearing to >>>> > > > trust Snowden's slides (though sometimes they can't prove it)? >>>> > > >>>> > > >>>> > > No, there just wasn't much to respond to. >>>> > > >>>> > > On Mon, Oct 12, 2015 at 8:55 AM, Georgi Guninski < >>>> guninski(a)guninski.com> >>>> > > wrote: >>>> > > >>>> > > > So assuming Snowden "borrowed" the slide from the NSA and he >>>> didn't get >>>> > > > owned, the slide is _REAL_. >>>> > > > >>>> > > > Having in mind Snowden likely have large pile of slides, if he got >>>> > > > owned, likely all/the majority of them would likely be fake. >>>> > > > >>>> > > > Is this plausible? >>>> > > > >>>> > > > And did you missed the us-natsec trolling about the eu appearing >>>> to >>>> > > > trust Snowden's slides (though sometimes they can't prove it)? >>>> > > > >>>> > > > >>>> > > > On Mon, Oct 12, 2015 at 08:22:37AM -0400, Michael Best wrote: >>>> > > > > No but as I and others have noted, he didn't look at all of the >>>> > materials >>>> > > > > he handed over to journalists and couldn't possibly be expected >>>> to >>>> > > > remember >>>> > > > > all the ones he did see well enough to possibly be able to ID >>>> this >>>> > one as >>>> > > > > altered or forged. He was only able to argue against the other >>>> > documents >>>> > > > > because he had never been in touch with the outlet releasing >>>> them, >>>> > > > contrary >>>> > > > > to their apparent belief. >>>> > > > > >>>> > > > > On Mon, Oct 12, 2015 at 8:19 AM, Georgi Guninski < >>>> > guninski(a)guninski.com> >>>> > > > > wrote: >>>> > > > > >>>> > > > > > On Mon, Oct 12, 2015 at 07:50:14AM -0400, Michael Best wrote: >>>> > > > > > > As I think I said in the other thread, less specific >>>> charges that >>>> > > > require >>>> > > > > > > more specific proof and almost never leveled before a trial >>>> is >>>> > set, >>>> > > > > > because >>>> > > > > > > it forces the issue to be tried in the court of public >>>> opinion, >>>> > > > where a >>>> > > > > > lot >>>> > > > > > > of information can't be released lest it spoil an >>>> investigation >>>> > or >>>> > > > > > > potential trial. There's also the fact that there'd be >>>> little to >>>> > > > gain at >>>> > > > > > > this point by alleging that the slides are fake since there >>>> > would be >>>> > > > few >>>> > > > > > > people to believe it, >>>> > > > > > > >>>> > > > > > > "NSA hasn't said it's fake" doesn't seem like a strong >>>> argument - >>>> > > > > > > especially for a non-NSA slide. And again - *Snowden >>>> himself* has >>>> > > > accused >>>> > > > > > > outlets of releasing slides attributed to him that *he says >>>> he >>>> > did >>>> > > > not >>>> > > > > > > provide*. >>>> > > > > > > >>>> > > > > > Likely the NSA would distribute fake slides just to discredit >>>> > Snowden. >>>> > > > > > >>>> > > > > > Does Snowden deny the authencity of this slide? >>>> > > > > > >>>> > > > > > This slide appeared in _too many_ news AFAICT to get >>>> unnoticed. >>>> > > > > > >>>> > > > >>>> > >>>> >>> >>> >>> >> > > > -- > Twitter <https://twitter.com/tbiehn> | LinkedIn > <http://www.linkedin.com/in/travisbiehn> | GitHub > <http://github.com/tbiehn> | TravisBiehn.com <http://www.travisbiehn.com> | > Google Plus <https://plus.google.com/+TravisBiehn> >

4 9

Why cryptome sold web logs to their paying customers?
by Michael Best 12 Oct '15

12 Oct '15

> > *Razer* Rayzer(a)riseup.net > <Rayzer%40riseup.net?Subject=Re%3A%20Why%20cryptome%20sold%20web%20logs%20to%20their%20paying%20customers%3F&In-Reply-To=%3C561BCDBE.6000403%40riseup.net%3E> > *Mon Oct 12 11:11:58 EDT 2015*Sounds like a lovers quarrel. Sad, but true. The first time John and I made love, it was tender and sweet. These days, he hardly ever fingers me, and I can't remember the last time he pinged my brains out. If I'm lucky, he'll trace my route once in a blue moon (if you know what I mean) ;)

1 0

Why cryptome sold web logs to their paying customers?
by Michael Best 12 Oct '15

12 Oct '15

Yes, my vendetta is so complex and well schemed that I got John to say the problem was the ISP, and I got coderman to agree that the ISP is shite and he and others are wondering what will be the final straw. My turning that statement into a question was just the logical extension of what you've exposed as a clearly merciless attack against JYA. *cue eyeroll* As opposed to his accusations against me, (spy, disinfo, faked data, stole data, "overstated" his "understated" admission, etc.) all I've done is present data proving what John did, and only to get the discussion on the GCHQ slide to move forward. On 10/11/2015 07:27 PM, Michael Best wrote: >* Any chance you'll look for a new ISP, John? *> And there you have it. Michale Best engaged in a vendetta for some reason against JYA. Sounds like a lovers quarrel. RR

1 0

Re: Why cryptome sold web logs to their paying customers?
by Michael Best 12 Oct '15

12 Oct '15

Normally I'd give you the benefit of the doubt, John, but the last time in this discussion you said something was disinfo it was the logs. > Date: Sun, 11 Oct 2015 20:21:24 -0400 > From: John Young <jya(a)pipeline.com> > To: cypherpunks(a)cpunks.org > Subject: Re: ***SPAM*** Re: Why cryptome sold web logs to their paying > customers? > Message-ID: <E1ZlQqs-0004zf-Hg(a)elasmtp-masked.atl.sa.earthlink.net> > Content-Type: text/plain; charset="us-ascii"; format=flowed > > At 08:03 PM 10/11/2015, you wrote: > >The Netsol support pages are disinfo? bullshit > > They are indeed that. Requests languor unanswered. > Nowadays standard business practice, off-shore no longer > reliable either. Just don't respond. Get bought out by > Web.com and slowly disappear after handing over decades > of user data for exploitation. The Apple future, or maybe > present if hobnobbing with US and CN leaders give a > clue. >

6 13