- cypherpunks - lists.cpunks.org

Re: Tox.im
by Dāvis Mosāns 10 Jul '14

10 Jul '14

2014-07-06 23:28 GMT+03:00 rysiek <rysiek(a)hackerspace.pl>: > Dnia niedziela, 6 lipca 2014 22:25:59 piszesz: > > hmm, I wonder are there any such open protocol specification created? I > > know about XMPP, but nothing more... > > Well, there's the Diaspora protocol: > https://wiki.diasporafoundation.org/Federation_protocol_overview > > And... StatusNet/OStatus, PumpIO, TentIO, ActivityStreams, BuddyCloud > (XMPP- > based, I guess), and quite a few others I don't really remember. Some of > them > are related, all are incompatible. And all the devs are showing strong > symptoms of the NIH syndrome. > > Which is absurd. > > -- > Pozdr > rysiek that indeed is stupid and so no one have solved it yet... for social network or basically any IM/chat/etc to be usable it must have majority of people (eg. your friends) users there, otherwise without people they are totally useless so currently we're stuck with no-so-great applications/protocols only because everyone already are on them like Facebook and Skype. On that mailing list there were discussion about a polyglot protocol/application which could support all networks so users wouldn't be forced to migrate which I think is essential because a lot of people won't bother. There was mention to Sockethub <http://sockethub.org/>which seems quite cool, only for a bit different use case I would say. Another thing I would like to mention is BitlBee <http://bitlbee.org> it is a gateway between various IM/chat networks and IRC so you can chat with friends on Facebook using your favorite IRC client, or post a tweet on your Twitter and use various other protocols. It even supports OTR.

9 21

Re: [liberationtech] data mine the snowden files [was: open the snowden files]
by Griffin Boyce 09 Jul '14

09 Jul '14

Nick wrote: > Quoth edhelas: >> What about a Torrent ? We can easily share the magnet everywhere > > Note that there is a torrent of the cryptome archive up to 2011: > magnet:?xt=urn:btih:ba401110a60ad844a09d4219e5f95a46385f7410 > > But yes, bittorrent seems like a reasonable way to distribute this > sort of stuff. That said, it is not anonymous, so a hidden service > as the originating place seems sensible. Also keep in mind that it's possible to spy on who downloads these just by seeding the torrent and monitoring connections to your box. So it's certainly not anonymous. I'd say hidden service first, a website second, and torrent third. ~Griffin -- Wherever truth, love and laughter abide, I am there in spirit. -Bill Hicks

1 0

Re: <nettime> Facebook's Mood Study: Orwellian newspeak 2.0
by Eugen Leitl 09 Jul '14

09 Jul '14

----- Forwarded message from nettime's avid reader <nettime(a)kein.org> ----- Date: Wed, 9 Jul 2014 07:53:13 +0200 From: nettime's avid reader <nettime(a)kein.org> To: nettime-l(a)kein.org Subject: Re: <nettime> Facebook's Mood Study: Orwellian newspeak 2.0 Message-ID: <20140709055313.GA98400(a)mx.kein.org> User-Agent: Mutt/1.4.2.3i Facebook's Psychological Experiments Connected to Department of Defense Research on Civil Unrest http://scgnews.com/facebooks-psychological-experiments-connected-to-departm… 01.Jul.2014 | SCG It turns out that one of the researchers who ran Facebook's recent psychological experiments received funding from the U.S. Department of Defense to study the contagion of ideas There has been quite a bit of chatter this past week after it was revealed that a recent Facebook outage was the result of a psychological experiment that the company conducted on a portion of its users without their permission. The experiment, which was described in a paper published by Facebook, and UCSF, tested the contagion of emotions on social media by manipulating the content of personal feeds and measuring how this impacted user behavior. Over 600,000 users were used as guinea pigs without their consent, which raises a number of serious ethical and legal questions (particularly due to the fact that this study received federal funding), however there is an even more disturbing angle to this story. It turns out that this research was connected to a Department of Defense project called the Minerva Initiative, which funds universities to model the dynamics, risks and tipping points for large-scale civil unrest across the world. In the official credits for the study conducted by Facebook you'll find Jeffrey T. Hancock from Cornell University. If you go to the Minerva initiative website you'll find that Jeffery Hancock received funding from the Department of Defense for a study called "Cornell: Modeling Discourse and Social Dynamics in Authoritarian Regimes". If you go to the project site for that study you'll find a visualization program that models the spread of beliefs and disease. Cornell University is currently being funded for another DoD study right now called "Cornell: Tracking Critical-Mass Outbreaks in Social Contagions" (you'll find the description for this project on the Minerva Initiative's funding page). The Department of Defense's investment in the mechanics of psychological contagion and Facebook's assistance, have some very serious implications, particularly when placed in context with other scandals which have broken in the past two years. First of all we know that Facebook willingly participated (and presumably is still participating) in the NSA's PRISM program by giving the agency unfettered access to user communications. We also know that the U.S. government has invested heavily in technology used to track and model the spread of opinions on social media. The U.S. government hasn't sought these capabilities for the sake of science. We know from the Cuban Twitter scandal, where the U.S. State Department where got caught red handed attempting to topple the Cuban government through social media, that these capabilities are already being used for offensive operations. Combine that with the fact that the U.S. Military got exposed in 2011 for developing 'sock puppet' software to create fake online identities and spread propaganda and an ominous picture snaps into focus. The U.S. government is militarizing social media through a combination of technology and social sciences, and Facebook is helping them. # distributed via <nettime>: no commercial use without permission # <nettime> is a moderated mailing list for net criticism, # collaborative text filtering and cultural politics of the nets # more info: http://mx.kein.org/mailman/listinfo/nettime-l # archive: http://www.nettime.org contact: nettime(a)kein.org ----- End forwarded message -----

2 1

Meet the Muslim-American Leaders the FBI and NSA Have Been Spying On
by coderman 09 Jul '14

09 Jul '14

latest from The Intercept: https://firstlook.org/theintercept/article/2014/07/09/under-surveillance/ a choice excerpt: """ The FBI—which is listed as the “responsible agency” for surveillance on the five men—has a controversial record when it comes to the ethnic profiling of Muslim-Americans. According to FBI training materials uncovered by Wired in 2011, the bureau taught agents to treat “mainstream” Muslims as supporters of terrorism, to view charitable donations by Muslims as “a funding mechanism for combat,” and to view Islam itself as a “Death Star” that must be destroyed if terrorism is to be contained. John Guandolo, a former FBI counterterrorism official who takes credit for developing a training program for agents on the “Muslim Brotherhood and their subversive movement in the United States,” told The Intercept that he participated in investigations of some of the individuals whose email accounts were monitored. Echoing the “red under every bed” hysteria of the McCarthy era, Guandolo believes that “hundreds” of covert members of the Muslim Brotherhood are active in the United States, that some of them have succeeded in infiltrating the Pentagon, and that CIA director John Brennan is a secret Muslim. Other former and current federal officials say such beliefs are not representative of the FBI or Justice Department. But blatant prejudice against Muslim-Americans is also documented in the Snowden archive. In one 2005 document, intelligence community personnel are instructed how to properly format internal memos to justify FISA surveillance. In the place where the target’s real name would go, the memo offers a fake name as a placeholder: “Mohammed Raghead.” """ best regards, Brother Coder Raghead Muhammed

1 0

[tor-talk] Tor Weekly News — July 9th, 2014
by Lunar 09 Jul '14

09 Jul '14

======================================================================== Tor Weekly News July 9th, 2014 ======================================================================== Welcome to the twenty-seventh issue of Tor Weekly News in 2014, the weekly newsletter that covers what is happening in the Tor community. On being targeted by the NSA ---------------------------- Das Erste has published an article [1] and supporting material [2] showing how the NSA explicitly targets Tor and Tails user through the XKEYSCORE Deep Packet Inspection system. Several other media picked up the news, and it was also discussed in various threads on the tor-talk mailing list [3,4,5,6,7,8,9]. The Tor Project’s view has been reposted [10] on the blog. To a comment that said “I felt like i am caught in the middle of a two gigantic rocks colliding each other”, Roger Dingledine replied [11]: “You’re one of the millions of people every day who use Tor. And because of the diversity of users […], just because they know you use Tor doesn’t mean they know *why* you use Tor, or what you do with it. That’s still way better than letting them watch all of your interactions with all websites on the Internet.” [1]: http://daserste.ndr.de/panorama/aktuell/nsa230_page-1.html [2]: http://daserste.ndr.de/panorama/xkeyscorerules100.txt [3]: https://lists.torproject.org/pipermail/tor-talk/2014-June/033473.html [4]: https://lists.torproject.org/pipermail/tor-talk/2014-July/033564.html [5]: https://lists.torproject.org/pipermail/tor-talk/2014-July/033640.html [6]: https://lists.torproject.org/pipermail/tor-talk/2014-July/033642.html [7]: https://lists.torproject.org/pipermail/tor-talk/2014-July/033656.html [8]: https://lists.torproject.org/pipermail/tor-talk/2014-July/033703.html [9]: https://lists.torproject.org/pipermail/tor-talk/2014-July/033749.html [10]: https://blog.torproject.org/blog/being-targeted-nsa [11]: https://blog.torproject.org/blog/being-targeted-nsa#comment-64376 More monthly status reports for June 2014 ----------------------------------------- The wave of regular monthly reports from Tor project members for the month of June continued, with submissions from Georg Koppen [12], Lunar [13], Noel David Torres Taño [14], Matt Pagan [15], Colin C. [16], Arlo Breault [17], and George Kadianakis [18]. Mike Perry reported on behalf of the Tor Browser team [19]. [12]: https://lists.torproject.org/pipermail/tor-reports/2014-July/000576.html [13]: https://lists.torproject.org/pipermail/tor-reports/2014-July/000577.html [14]: https://lists.torproject.org/pipermail/tor-reports/2014-July/000578.html [15]: https://lists.torproject.org/pipermail/tor-reports/2014-July/000579.html [16]: https://lists.torproject.org/pipermail/tor-reports/2014-July/000580.html [17]: https://lists.torproject.org/pipermail/tor-reports/2014-July/000583.html [18]: https://lists.torproject.org/pipermail/tor-reports/2014-July/000585.html [19]: https://lists.torproject.org/pipermail/tor-reports/2014-July/000584.html Miscellaneous news ------------------ An Austrian Tor exit node operator interpreted [20] their conviction in a first ruling as judging them “guilty of complicity, because he enabled others to transmit content of an illegal nature through the service”. Moritz Bartl from Torservers.net [21] commented [22]: “We strongly believe that it can be easily challenged. […] We will definitely try and find some legal expert in Austria and see what we can do to fight this.” [20]: https://network23.org/blackoutaustria/2014/07/01/to-whom-it-may-concern-eng… [21]: https://www.torservers.net/ [22]: https://lists.torproject.org/pipermail/tor-talk/2014-July/033613.html Linus Nordberg is expanding the idea of public, append-only, untrusted log à la Certificate Transparency [23] to the Tor consensus. Linus submitted a new draft proposal to the tor-dev mailing list for reviews [24]. [23]: http://www.certificate-transparency.org/ [24]: https://lists.torproject.org/pipermail/tor-dev/2014-July/007092.html Miguel Freitas reported [25] that twister [26] — a fully decentralized P2P microblogging platform — was now able to run over Tor. As Miguel wrote, “running twister on top of Tor was a long time goal, […] the Tor support allows a far more interesting threat model”. [25]: https://lists.torproject.org/pipermail/tor-talk/2014-July/033580.html [26]: http://twister.net.co/ Google Summer of Code students have sent a new round of reports after the mid-term: Israel Leiva on the GetTor revamp [27], Amogh Pradeep on Orbot and Orfox improvements [28], Mikhail Belous on the multicore tor daemon [29], Daniel Martí on incremental updates to consensus documents [30], Sreenatha Bhatlapenumarthi on the Tor Weather rewrite [31], Quinn Jarrell on the pluggable transport combiner [32], Noah Rahman on Stegotorus enhancements [33], Marc Juarez on website fingerprinting defenses [34], Juha Nurmi on the ahmia.fi project [35], and Zack Mullaly on the HTTPS Everywhere secure ruleset update mechanism [36]. [27]: https://lists.torproject.org/pipermail/tor-dev/2014-July/007074.html [28]: https://lists.torproject.org/pipermail/tor-dev/2014-July/007083.html [29]: https://lists.torproject.org/pipermail/tor-dev/2014-July/007086.html [30]: https://lists.torproject.org/pipermail/tor-dev/2014-July/007087.html [31]: https://lists.torproject.org/pipermail/tor-dev/2014-July/007091.html [32]: https://lists.torproject.org/pipermail/tor-dev/2014-July/007094.html [33]: https://lists.torproject.org/pipermail/tor-dev/2014-July/007095.html [34]: https://lists.torproject.org/pipermail/tor-reports/2014-July/000581.html [35]: https://lists.torproject.org/pipermail/tor-reports/2014-July/000582.html [36]: https://lists.eff.org/pipermail/https-everywhere/2014-July/002182.html sajolida, tchou and Giorgio Maone from NoScript drafted a specification [37] for a Firefox extension to download and verify Tails. [37]: https://mailman.boum.org/pipermail/tails-dev/2014-July/006288.html Tor help desk roundup --------------------- One way to volunteer for Tor is to run a mirror [38] of the Tor Project website. Instructions [39] are available for anyone wanting to run a mirror. Mirrors are useful for those who, for one reason or another, cannot access or use the main Tor Project website. Volunteers who have successfully set up a synced a mirror can report their mirror to the tor-mirrors mailing list [40] to get it included in the full mirrors list. [38]: https://www.torproject.org/getinvolved/mirrors.html [39]: https://www.torproject.org/docs/running-a-mirror.html [40]: https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-mirrors Easy development tasks to get involved with ------------------------------------------- ooniprobe is a tool for conducting network measurements that are useful for detecting network interference. When ooniprobe starts it should perform checks to verify that the config file is correct [41]. If that is not the case, it should fail gracefully at startup. The ticket indicates where this check should be added to the ooniprobe codebase [42]. If you’d like to do some easy Python hacking, be sure to give this ticket a try. [41]: https://bugs.torproject.org/11983 [42]: https://gitweb.torproject.org/ooni-probe.git Upcoming events --------------- July 11 16:00 UTC | Pluggable transports online meeting | #tor-dev, irc.oftc.net | https://lists.torproject.org/pipermail/tor-dev/2014-July/007114.html | July 15 | Researchers & Practitioners Meetup @ PETS | Amsterdam, The Netherlands | https://blog.torproject.org/events/researchers-practitioners-meetup-pets-am… | July 15-19 | 14th Privacy Enhancing Technologies Symposium | Amsterdam, The Netherlands | https://petsymposium.org/2014/ This issue of Tor Weekly News has been assembled by Lunar, harmony, Matt Pagan, and Karsten Loesing. Want to continue reading TWN? Please help us create this newsletter. We still need more volunteers to watch the Tor community and report important news. Please see the project page [43], write down your name and subscribe to the team mailing list [44] if you want to get involved! [43]: https://trac.torproject.org/projects/tor/wiki/TorWeeklyNews [44]: https://lists.torproject.org/cgi-bin/mailman/listinfo/news-team -- tor-talk mailing list - tor-talk(a)lists.torproject.org To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk

1 0

BPjM blacklist reversed
by Eugen Leitl 09 Jul '14

09 Jul '14

https://bpjmleak.neocities.org/ tl;dr: Germany has a censorship federal agency called BPjM which maintains a secret list of about 3000 URLs. To keep the list secret it is distributed in the form of md5 or sha1 hashes as the "BPJM-Modul". They think this is safe. This leak explains in detail that it is in fact very easy to extract the hashed censorship list from home routers or child protection software and calculate the cleartext entries. It provides a first analysis of the sometimes absurd entries on such a governmental Internet censorship list.

1 0

Re: [FoRK] What3words -- convert lat,long into 3 English words
by Eugen Leitl 09 Jul '14

09 Jul '14

----- Forwarded message from "Stephen D. Williams" <sdw(a)lig.net> ----- Date: Tue, 08 Jul 2014 16:30:43 -0700 From: "Stephen D. Williams" <sdw(a)lig.net> To: Friends of Rohit Khare <fork(a)xent.com> Subject: Re: [FoRK] What3words -- convert lat,long into 3 English words Message-ID: <53BC7F23.7050809(a)lig.net> User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:24.0) Gecko/20100101 Thunderbird/24.6.0 Reply-To: Friends of Rohit Khare <fork(a)xent.com> Interesting choices. I thought perhaps they were using lat/long to index into a dictionary, maybe with a hash, but it seems they have semi-manually tuned the mapping of 3 words to every 3m by 3m square on the Earth's surface, perhaps minus ocean space. Nicer IDs, but you need the proprietary database online for use. They have "extra info", but so far I don't see any kind of semantic tagging, which is sad. I noticed GeoHash and related not long ago. This is a new twist. I was involved with helping the startup of a friend of a friend of mine long ago called NetWord. The premise was very close to the private OneWord for What3words. A while back, I sent a letter to the USPS head suggesting a moveable 9+ digit unique zip code. This would allow people to have a unique short address that would be looked up in a database and sent to the currently registered location. Perfect for students, consultants, or others who move frequently. And private from the sender potentially. No surprise: no response. Then I thought about a service that would open and scan your mail for you. A few difficulties, but would be useful. But I thought better of it. Another company did it later, using veterans to open the mail as a security selling point. Related links: https://en.wikipedia.org/wiki/Geohash https://en.wikipedia.org/wiki/Geohash-36 http://geohash.org/ http://www.bigdatamodeling.org/2013/01/intuitive-geohash.html Use of variable precision bounding box addresses in 2D or 3D, but closely held and proprietary: https://en.wikipedia.org/wiki/Natural_Area_Code http://www.nacgeo.com/ Similar: https://en.wikipedia.org/wiki/Military_grid_reference_system http://tools.wmflabs.org/geohack/geohack.php?pagename=Military_grid_referen… http://www.colorado.edu/geography/gcraft/notes/coordsys/coordsys_f.html https://www.maxmind.com/en/worldcities http://opengts.sourceforge.net/ http://www.swarmly.co/ http://www.geoplace.it/ http://www.loc.is/ https://en.wikipedia.org/wiki/Irish_Geocodes#The_GeoDirectory http://www.cdxtech.com/Blog/post/Latitude-and-Longitude-as-an-Alternative-t… https://developers.google.com/maps/documentation/geocoding/ http://www.gpsvisualizer.com/geocoding.html http://incurlybraces.com/gps-location-coordinates-android.html https://en.wikipedia.org/wiki/Category:Geocodes http://mygeoposition.com/ https://productforums.google.com/forum/#!topic/maps/Kc0jjqzmlR8[1-25-false] Just for fun: https://tech.lds.org/wiki/Geo_code Stephen On 7/8/14, 10:14 AM, Gregory Alan Bolcer wrote: > cage.gust.regular -- the ICS building at UCI. 5 feet later: trillions.socket.added. Seems legit. > > Greg > > On 7/8/2014 9:38 AM, Ken Meltsner wrote: >> Cannot decide whether this is brilliant or stupid: >> >> http://what3words.com/ >> >>> From the FAQ: >> >> What is what3words and what does it do? >> >> what3words is a service which pinpoints any location on the globe (to >> the nearest 2 metres) with a unique 3 word combination. This is far >> more accurate than you can achieve with a postal address (if indeed >> the location you are trying to pinpoint even has a postal address), >> and definitely easier than remembering a set of GPS co-ordinates. >> >> We also offer a service called OneWord which allows you to create a >> customised, shorter, and even easier reference for any location of >> your choice, accurate to the nearest metre. >> >> Ken Meltsner at blues.skinny.nurses >> > _______________________________________________ FoRK mailing list http://xent.com/mailman/listinfo/fork ----- End forwarded message -----

1 0

Re: You need to update your Flattr account
by coderman 08 Jul '14

08 Jul '14

thank you Linus, for responding constructively and with patience to my rude assumptions. i am replying to cpunks too, as this is in the general interest and my apology to you should be public. i have two questions: On Mon, Jul 7, 2014 at 12:29 AM, Linus Olsson <linus(a)flattr.com> wrote: > ... We would love to not need to do the KYC if it where possible. But we can not risk going to jail for it. It's enough that one of us is there already :( is this related to the lack of KYC? i had heard of some processors getting "strong arm'ed" by their parent banks into particular KYC requirements, but never to the extent that jail time was used to push KYC reform in a vendor or processor. > On bitcoins or crypto currency are that a niche market that is so small that moving over to something like that would topple Flattr over night. Proved by the minuscule usage when we supported it. Maybe they will be more widely adopted in 3-5 years and that we could do something with them then. If we still are around. And yes the people that created the bitcoin processor we used, BIPS probably where rather incompetent. Never the less did we get the stats we needed to decide it was not for us. it does sounds like the problem is with BIPS and presentation. BTC is quite successful in many circumstances, and i hope that you don't let a bad experience with a bad processor forever taint your perspective. why did you pick BIPS instead of another? (the bank you're using?) best regards, and apologies for my rudeness,

1 0

US enhanced airport security checks target electronics
by coderman 08 Jul '14

08 Jul '14

http://www.bbc.co.uk/news/world-us-canada-28185149 """ US enhanced airport security checks target electronics in latest stretch for Total Information Awareness - not by the BBC 6 July 2014 Last updated at 28:45 GMT Frustrated by technically savvy privacy extremists using encryption to protect confidentiality of their data, the United States is preparing a particularly clever ruse to rummage through your digital detritus. The US announced new security measures last week, apparently in response to a terror threat, but gave hints that multiple privacy enhancing technology conferences occurring this summer were of the utmost interest. Analysts say the changes have been couched in a conceit made to appear to be in response to intelligence that Islamic militants in Syria and Yemen developing bombs that could evade airport security. "It's really clever if you think about it.", one anonymous expert on the wiki explained. "First, they put the real terrorists on notice, adding to operational paranoia. But second, they get to enable every device crossing the border at their discretion with minimal concern!" When asked for comment, the National Security Agency replied they could 'neither confirm nor deny any knowledge of "mobile phones"'. [EDITORS' NOTE: The NSA asked us to use scare quotes and not normal quotes, yet in a brave show of defiance we stood up for our readership and refused. "" Take that NSA! With Love, The Editors.] "During the security examination, officers may also ask that owners power up some devices, including cell phones," it said. "All devices must be fully unlocked and past any full disk encryption authentication to properly test the battery." "Powerless devices will not be permitted on board the aircraft. The traveller may also undergo additional screening once the device is powered on and keyed up to be sure it is working correctly in CUSTOMS." Reuters news agency reported that officials had singled out mobile phones made by Apple and Samsung for extra checks. Apparently these devices are most often used by developers and other privacy extremists. More as this story develops. Back to you, Tom.

4 4

The Ex-Google Hacker Taking on the World’s Spy Agencies
by Eugen Leitl 08 Jul '14

08 Jul '14

http://www.wired.com/2014/07/morgan-marquis-boire-first-look-media/ The Ex-Google Hacker Taking on the World’s Spy Agencies BY ANDY GREENBERG 07.08.14 | 6:30 AM | PERMALINK Ariel Zambelich/WIRED During his last six years working as an elite security researcher for Google, the hacker known as Morgan Mayhem spent his nights and weekends hunting down the malware used to spy on vulnerable targets like human rights activists and political dissidents. His new job tasks him with defending a different endangered species: American national security journalists. For the last month, 34-year-old Morgan Marquis-Boire has been the director of security for First Look Media, the journalism startup founded by Glenn Greenwald and Laura Poitras. The website has become the most prolific publisher of NSA leaker Edward Snowden’s remaining secrets. Marquis-Boire’s daunting task is to safeguard those documents, and the communications of reporters who have perhaps the press’ most adversarial relationships with Western intelligence agencies. Beyond protecting Snowden’s favorite journalists, Marquis-Boire sees his decision to leave Google for First Look as a chance to focus full-time on the problem of protecting reporters and activists as a whole, groups he sees as some of the most sensitive targets for governments globally. “I look at the risk posed to individuals in the real world,” says Marquis-Boire, an imposing, often black-clad New Zealander with earrings, dreadlocks, and a taste for death metal. “In human rights and journalism, the consequences of communications being compromised are imprisonment, physical violence, and even death. These types of users need security assistance in a very real sense.” Marquis-Boire already has distinguished himself as a relentless counter-surveillance researcher and a vocal critic of the companies that have created an industry hawking spyware to governments. In 2012, he and researchers at the University of Toronto’s Citizen Lab were the first to identify Finfisher, a stealthy collection of spying tools sold by the British firm Gamma Group that they eventually tracked to command-and-control servers in 25 countries. Later that year he helped trace how a piece of software sold by the Italian firm Hacking Team was used by the government of the United Arab Emirates to spy on a political dissident beaten by thugs. Just last month he revealed new findings that showed how that company’s tools have evolved to target iPhones, Android devices and other mobile targets. And in early 2013 Marquis-Boire and Citizen Lab researchers mapped the spread of surveillance and censorship tools sold by the Palo Alto, California firm Blue Coat to 61 countries, including Iran. In the detective work required to pin those stealthy spying incidents on repressive governments and Western companies, Marquis-Boire is “extraordinarily talented,” says Ron Deibert, a professor of political science at the University of Toronto and Citizen Lab’s director. ”There are some people who are phenomenally adept at forensics, who have an intuitive sense of how to make connections through different pieces of evidence,” he says. “Morgan has those skills…But what I very much appreciate about him is his passion for human rights.” A Cypherpunk In The Newsroom First Look and Marquis-Boire aren’t saying much about exactly what he’ll do at the closely-watched new media startup. But Marquis-Boire says he was convinced early in their recruitment meetings that First Look will treat security as a central tenet. (More about First Look’s plans in the video below.) The job also presents a challenge worthy of leaving his high profile position at Google: Protecting the communications between non-technical reporters and their highly-sensitive sources in a post-WikiLeaks and -Snowden era where they’re both increasingly targeted by spooks. Marquis-Boire hints that he’s already researching security vulnerabilities that affect journalists, and working with several companies to release security fixes to their services in the next couple of months. Brian Sweeney, First Look’s head of technology operations, says Marquis-Boire’s work likely will extend into research designed to protect reporters beyond the company’s firewall. “The idea that all digital citizens, including and especially journalists, have access to data privacy is something that we strongly believe in,” says Sweeney. Marquis-Boire, the son of two literature professors at the University of Auckland, got started with security experimentation as a teenager in the New Zealand hacker scene under the handle “headhntr.” After starting college at Auckland, he and a group of friends wrote an article for the university magazine about breaking into the school’s website to take over the server that ran it. On another occasion he was called into a local telecom’s office and “given a stern talking to about using their services as a test lab.” But from the beginning, his interest in hacking was also political: In the late 1990s the kiwi teenager discovered the Cypherpunks Mailing List, a group of cryptographers and radical libertarians bent on foiling government surveillance and empowering individuals with privacy tools. The group eventually would foster projects like the anonymous remailers that relay emails to obscure their senders’ identities, the anonymity software Tor, WikiLeaks, and countless other privacy and encryption projects. “People realized that to actually have free speech, we have to be sure we won’t be monitored or persecuted,” says Marquis-Boire. “The intertwined nature of privacy and free expression was at the core of the cypherpunk movement.” Marquis-Boire and friends soon hosted what he says was the first anonymous remailer server in New Zealand out of a “dingy warehouse apartment with far too many blinking lights and whirring things.” Eventually, he ran five Tor relays, the nodes in the Tor network that bounce users’ traffic to obscure their location. But Marquis-Boire’s first real job in security, penetration-testing banks, power plants, and other clients for a New Zealand auditing firm, was unsatisfying. “I spent a bit of time musing about how much it costs to hire security consultants to do something like a black box [penetration test] of your whole enterprise,” he says. “I wanted to give my skills to the people who really needed them.” “He Has Quite a Hacker Mind” In 2008, Google hired Marquis-Boire in its Zurich, Switzerland office. He was assigned to cybersecurity incident response at the company not long before the biggest known security crisis in its history: the so-called Aurora hacking operation, in which Chinese hackers breached Google’s network for months and stole information that included source code from its servers. Marquis-Boire became an early member of the core team of network defenders assigned to battle the state-sponsored spies trying to eavesdrop on Google’s users. “He has quite a hacker mind,” says Heather Adkins, Google’s manager of information security, “Of everyone I’ve ever hired at Google, I’d put him in the top one percent of technical capability.” When the Arab Spring began a year later, human rights activists like those at Citizen Lab who had seen Marquis-Boire’s presentations on state-sponsored hacking began seeking his help analyzing attacks on vulnerable groups across the Middle East. As revolutions and political unrest blossomed from Tunisia to Egypt to Libya to Syria, his detective work became nearly a full-time job. “There have been a lot of books not read and canceled vacations,” he says. In the meantime, Google’s Adkins adds, Marquis-Boire frequently uncovered weaknesses in the company’s defenses for users—and he’s been just as focused on locking out the NSA as China’s People’s Liberation Army. In the wake of revelations from Snowden’s leaks that the NSA spied on unencrypted Google data moving between the company’s data centers, Marquis-Boire was one of the first at the company to push for encryption not only of the company’s internal data transfers, but also the exchange of emails between Gmail and other providers. That pressure led Google earlier this month to start publicly naming which email services do and don’t allow for that encryption in a bid to pressure other companies to safeguard users’ privacy. Marquis-Boire’s focus turned to protecting journalists in particular earlier this year, when he and other Googlers released research in March showing that 21 out of the 25 top media organizations in the world had been targeted in digital attacks that were likely the work of state-sponsored hackers. The same month, he joined a technical advisory group for the Freedom of the Press Foundation, which counts Glenn Greenwald, Laura Poitras and Edward Snowden as members of its board. “If you can’t protect your privacy and that of your sources, it’s debatable whether you can actually practice journalism in the traditional sense,” he says. That notion represents a shift from the cypherpunk views of Marquis-Boire’s youth. Once, cypherpunks were mainly interested in seizing privacy for themselves. Now, he says, that’s no longer enough. “When we discovered that we could create private and anonymous communications with math, that was super cool,” he says. “But then after a while I think it dawned on us as a movement that the only conversations you could have with those tools were with other cypherpunks.” “Now it’s been thrust into our faces that the people practicing adversarial journalism and exposing human right abuses are the real-world targets of precisely the kind of thing that the cypherpunk movement was trying to protect against,” says Marquis-Boire. “It’s become apparent we need to provide privacy to those who need it, not just to ourselves.” Tags: Edward Snowden, First Look Media, NSA, Security

1 0