Surveillance countermeasures

[Greg Broiles]

On Tue, May 20, 2003 at 10:18:53AM -0500, Kevin S. Van Horn wrote:
> barabbus at hushmail.com wrote:
> 
> >[If you're not making a serious attempt at limiting access to information about your on-line activities you're pissing into the wind.]
> >
> 
> Do you know of any  effective means of concealing one's web-surfing 
> habits?  I know there are things like Anonymizer.com, but with all of 
> these you have to trust the service providers.  I've looked into JAP, 
> but they don't have a real network -- just one path between two links, 
> both controlled by the same people.

To get a good answer, you should refine the question to include details
about your threat model, e.g. :

"I don't want my spouse to look at the history file in Internet Explorer
and see that I was shopping for their birthday present online."

or 

"I don't want my employer to look at their proxy logs and figure out that
I'm looking for a new job in a different state." 

or 

"I don't want John Ashcroft to figure out that I'm a pot-smoking Al Qaida
member who's ordering a case of boxcutters from officemax.com."

(which is functionally indistinguishable from "I don't want John Ashcroft
to figure out that I'm a free-thinking ACLU member who's ordering an
unlicensed printing press from officemax.ru.")

If your life really is so dramatic and exciting that your realistic threat
model is the third choice, you're fucked. You're in never-lose-sight-of-your
laptop trust-nobody the-walls-have-ears X-files land.

A web proxy is not going to save you from a police state.

Tricky probability hacks like letting other people connect to your 802.11
hotspot are only "reasonable doubt" in a hypothetical perfect fair 
courtroom with a jury full of engineers and statisticians. It's really
hard to get your trial assigned to one of those hypothetical perfect
fair courtrooms with fully rational juries - you're much more likely
to get assigned to one of the standard ones, with juries full of people
whose best grasp of probability tells them it's best to fill out Lotto
tickets with the dates of their kids' birthdays because that's lucky.

Torturers and despots don't want to hear about "plausible deniability" -
ask John Walker Lindh about that. ("No, really, I was just studying radical
Islam .. ")

The best use of surveillance data may not be trial evidence - it's 
intelligence, which is used to lead to arrests and the subsequent 
seizure of admissible evidence. 

A web proxy (like Anonymizer, or one of John Kozubik's virtual colo
boxes) will save you from prying spouses and employers, which are more
realistic threats for most of the world's population; they're also enough
to make it really expensive to spy on you, which means that you're
unlikely to be the target of opportunistic or systematic surveillance.
They're not nearly enough to save you if you're really in hot water
with The Man; which you almost certainly aren't, so count your blessings
and keep your head down. 

--
Greg Broiles
gbroiles at parrhesia.com