News for hackers. Stuff that matters.
Re:Hacking Team, Computer Vulnerabilities, and the NSA by tptacek on Tuesday September 15, 2015 @06:33PM (#10223576)
There's a fourth reason NSA wouldn't have tipped off every vendor impacted by HT exploits: because they have no business breaking into commercial vulnerability research teams networks, grabbing their exploits, and burning them. It is in fact probably unlawful for them to do so (those actions having as they do an impact on US F-500 companies that use --- for better or worse --- tools from companies like HT to evaluate their own security).

This is a positive comment, not a normative one. I don't know how I feel about entities busting up companies like HT, but I do think I know that the world would be better off without companies like HT.

Re:Hacking Team, Computer Vulnerabilities, and the NSA by bediger4000 on Tuesday September 15, 2015 @06:46PM (#10223620)
I salute your sentiment: the world would be better off without companies like HT.

It is in fact probably unlawful for them to do so

I realize that the patriotic employees of the NSA work within a legal framework, and seemingly pride themselves on doing so. But they haven't bothered to share that framework with the rest of us. So my first response was to snicker to myself, and that's unfair to you.

Also, Hacking Team was Italian, not US, so would it really be illegal to slurp up all of HT's exploits? That is, if you want to stay within the bounds of the law, if not the bounds of ethical behavior.

Re:Hacking Team, Computer Vulnerabilities, and the NSA by tptacek on Tuesday September 15, 2015 @06:50PM (#10223631)
I tried to acknowledge that HT is jurisdictionally complex; they are probably allowed, under the same charter that allows CIA to conduct HUMINT missions, to attack Italian security companies (modulo treaties, I guess). The issue though is that those attacks have direct impact on US companies, who (again) may rely on HT products for "zero day pentesting" (among other things).
Re:Hacking Team, Computer Vulnerabilities, and the NSA by HiYaBarbie on Wednesday September 16, 2015 @12:31AM (#10224691)
> they are probably allowed, under the same charter that allows CIA to conduct HUMINT missions, to attack Italian security companies

They are definitely not allowed, under the Constitution, to monitor everyone, but they do it anyway. You know this too.

So why do you discuss legislation as if it mattered to the NSA, when their actions show it clearly doesn't?

Re:Hacking Team, Computer Vulnerabilities, and the NSA by ikeboy on Wednesday September 16, 2015 @12:48AM (#10224741)
The NSA consists of many parts. Some people within it breaking the law does not mean that laws don't matter there.
Re:Hacking Team, Computer Vulnerabilities, and the NSA by HiYaBarbie on Wednesday September 16, 2015 @06:01AM (#10225589)
Look, the NSA as an organization, as a whole, is blatantly violating the Constitution, which is supposedly the most sacrosanct law of the nation.

The fact that they don't care about what laws say doesn't get any clearer than that.

The fact that no one from NSA has gone to jail for the NSA violating the Constitution shows.. well, pretty much that the government doesn't bother punishing itself for violating its own laws.

To be fair, that would be kind of silly, after all.

Re:Hacking Team, Computer Vulnerabilities, and the NSA by ikeboy on Wednesday September 16, 2015 @06:54PM (#10230532)
Also, even if someone at the NSA carried out a program that violated the Constitution, there still wouldn't be jail time. That's not how the Constitution works.

The Constitution is strictly a metric by which courts decide what laws are allowed to say. It binds Congress, not other government workers. And there's generally a presumption that a law is legal until decided to be unconstitutional in court, otherwise people would be afraid to do their jobs.

Re:Hacking Team, Computer Vulnerabilities, and the NSA by dragonwriter on Wednesday September 16, 2015 @07:05PM (#10230576)
> Also, even if someone at the NSA carried out a program that violated the Constitution, there still wouldn't be jail time.

It is true that such would be unlikely to be prosecuted, especially if it was authorized from above (and, depending on how it was authorized, there might even be a legal defense -- while ignorance of the law is not a defense, reasonable reliance on legal representations of those responsible for enforcing the law can be), but there is a specific criminal statute that applies to government employees acting deliberately contrary to Constitutional rights (deprivation of rights under color of law, 18 USC Sec. 242.) And an unconstitutional program might also violate the criminal provisions of FISA.

So its not impossible for them to end up in jail, just unlikely for them to prosecuted.

> That's not how the Constitution works.

Sure, the Constitution itself doesn't provide criminal penalties, but there (as noted above) are statutory provisions creating criminal liability for government officers that use their position to deny people Constitutionally-protected rights.

> The Constitution is strictly a metric by which courts decide what laws are allowed to say. It binds Congress, not other government workers.

This is not, in fact, true. Government actions by actors other than Congress, and not justified by appeals to statute, can be decided on Constitutional grounds, both negative (Constitutional limitations) and positive (questions of whether positive authority is granted.)

Some parts of the Constitution, by their own terms, bind Congress directly (but even these have often been construed as more general restrictions on government power even when not exercised through Congress.)

Re:Hacking Team, Computer Vulnerabilities, and the NSA by ikeboy on Wednesday September 16, 2015 @08:56PM (#10230960)
> but there is a specific criminal statute that applies to government employees acting deliberately contrary to Constitutional rights (deprivation of rights under color of law, 18 USC Sec. 242.)

Thank you for that. I think this would come under the "reasonable reliance on legal representations of those responsible for enforcing the law". Is the fact that a (later-to-be-declared-unconstitutional) law allows something itself a defense? I would strongly expect that to be the case, so to the extent that NSA programs were authorized by the Patriot act, even if said act is unconstitutional, workers would be immune.

In any event, following a later-declared-unconstitutional law does not seem to qualify as "deliberately contrary to Constitutional".

>Sure, the Constitution itself doesn't provide criminal penalties, but there (as noted above) are statutory provisions creating criminal liability for government officers that use their position to deny people Constitutionally-protected rights.

Fair enough.

>Government actions by actors other than Congress, and not justified by appeals to statute, can be decided on Constitutional grounds, both negative (Constitutional limitations) and positive (questions of whether positive authority is granted.)

If an action isn't warranted by statute, why would a court consider Constitutional issues at all? What about https://en.wikipedia.org/wiki/Constitutional_avoidance

Could you give an example?

(It can also bind other legislators, not just Congress, and can bind anyone after a court ruling, but that shouldn't get to criminal liability except insofar as that statute you mentioned above).

Re:Hacking Team, Computer Vulnerabilities, and the NSA by ikeboy on Wednesday September 16, 2015 @06:26AM (#10225656)
Has any court ruled NSA actions to be against the Constitution?
Re:Hacking Team, Computer Vulnerabilities, and the NSA by ikeboy on Wednesday September 16, 2015 @12:08PM (#10227619)
The first one doesn't say anything about constitutional issues.

The appeals court did not rule on whether the surveillance violated the U.S. Constitution.

The second link has a ton of links. The first one is only referring to a preliminary injunction; i.e., it found that "there's a good chance the plaintiff will win", but did not find in favor of the plaintiff. As far as I can tell, all the other links there are about the same ruling.

The third link is talking about that same ruling, again:

A federal judge said Monday that he believes the government's once-secret collection of domestic phone records is unconstitutional

Emphasis on believes; that was not a judicial finding that the government violated the constitution.

He didn't even order the government to stop:

However, he put off enforcing his order barring the government from collecting the information, pending an appeal by the government.

What happened on appeal? http://www.cadc.uscourts.gov/internet/opinions.nsf/ED64DC482..., or a more readable summary here http://www.bloomberg.com/news/articles/2015-08-28/u-s-appeal... and http://www.ibtimes.com/nsa-phone-surveillance-ruling-reverse...

Re:Hacking Team, Computer Vulnerabilities, and the NSA by HiYaBarbie on Wednesday September 16, 2015 @07:57AM (#10225926)
How does it matter?
Re:Hacking Team, Computer Vulnerabilities, and the NSA by ikeboy on Wednesday September 16, 2015 @08:42AM (#10226093)
If years after the Snowden revelation, no one has gotten a court to rule that blatant widespread constitutional violations took place at the NSA, you might want to reconsider your claim that there were blatant violations.
[dead]
Re:Hacking Team, Computer Vulnerabilities, and the NSA by flyryan on Wednesday September 16, 2015 @12:49PM (#10227968)
You're stating that the organization "as a whole" is "blatantly" violating the Constitution. Don't you see why your statement is being challenged? It's largely baseless. At most, a small number of programs that the NSA has used have been shown to maybe be unconstitutional.
Re:Hacking Team, Computer Vulnerabilities, and the NSA by dang on Thursday September 17, 2015 @12:57AM (#10231654)
> You're disingenuous so I'll just not bother anymore.

We've banned this account for repeatedly violating the HN guidelines.

Re:Hacking Team, Computer Vulnerabilities, and the NSA by tedunangst on Tuesday September 15, 2015 @09:27PM (#10224176)
Burning exploits is more or less directly industrial espionage/sabotage. The NSA seems to avoid engaging in economic battles unless it's a direct policy goal (stuxnet) or furthers their mission of gathering secrets.
Re:Hacking Team, Computer Vulnerabilities, and the NSA by harry8 on Tuesday September 15, 2015 @07:30PM (#10223770)
Is it still a reason when the NSA clearly don't care whether they break the law?
Re:Hacking Team, Computer Vulnerabilities, and the NSA by tptacek on Tuesday September 15, 2015 @09:23PM (#10224161)
You're missing the point. Behind the scenes? Sure. But Schneier is asking why NSA didn't break into HT and then burn all their exploits with the vendors. That's not a behind- the- scenes hack.
Re:Hacking Team, Computer Vulnerabilities, and the NSA by harry8 on Tuesday September 15, 2015 @11:48PM (#10224563)
I'm pretty sure you're completely missing the point. Any time somebody suggests something is "against the law" in a discussion about the NSA practises we need to remind ourselves that they really don't care whether they break the law. They do it nakedly, in public, with live television coverage and there are no consequences.

The NSA is a criminal organisation. I don't say everything they do is crime or that is there sole raison d'etre just that they don't care about the rule of law. The law is something that they don't need to worry about at all.

Does anyone really dispute that? "I gave the least untruthful answer I could..." Lying under oath. No consequences for that crime or any other.

No respect for the rule of law.

Please don't miss that point, the rule of law is the point, it is a necessary condition for a civilized society and MOST ESPECIALLY the government needs to be bound by it.

Re:Hacking Team, Computer Vulnerabilities, and the NSA by HiYaBarbie on Wednesday September 16, 2015 @12:43AM (#10224732)
You're right to point out that the NSA doesn't give a fuck about the law, but..

> the rule of law is the point, it is a necessary condition for a civilized society and MOST ESPECIALLY the government needs to be bound by it

You seem to be overlooking the fact that the organization that makes the laws is, by definition, above them. The government is not bound by its own laws any more than a King or Emperor by his, back in the day.

The reason why you see crimes go unpunished is that people with political power and/or connections are effectively above the law.

Re:Hacking Team, Computer Vulnerabilities, and the NSA by harry8 on Wednesday September 16, 2015 @01:45AM (#10224885)
One thousand times NO. The rule of law applies to all equally. This the ideal insofar as it is agreed that our current implementation does not achieve that it is an agreed deficiency. The president murders their spouse, expect them to be charged. By definition the rule of law applies to all. The End. Period. The price of freedom is eternal... etc.
Re:Hacking Team, Computer Vulnerabilities, and the NSA by HiYaBarbie on Wednesday September 16, 2015 @07:50AM (#10225905)
> One thousand times NO. The rule of law applies to all equally.

This is just your cognitive dissonance talking.

You can say "NO" a million times, but Bradley Manning was just imprisoned without trial (and tortured for months.. years?), even though Habeas Corpus was supposed to apply.

> The president murders their spouse, expect them to be charged.

Why would you expect that? If the president murders his spouse, he's probably reasonably sure he'll get away with it. Otherwise he probably wouldn't.

> By definition the rule of law applies to all.

That's what we're trained to believe.. so many TV shows and movies show police officers risking their lives in fighting crime and courts being fair and just and all, but have you ever dealt with the court system? Did you get justice?

You've probably heard of "plea-bargaining", right? http://www.truth-out.org/news/item/12556-overwhelming-use-of...

People are blackmailed into accepting a punishment for something they haven't done, to avoid the potential life-ruining punishment for whatever outrageous bullshit they're charged with (that they haven't done either).

And you insist that everything is fine?

Maybe this will clarify things: https://www.youtube.com/watch?v=BNIgztvyU2U

Re:Hacking Team, Computer Vulnerabilities, and the NSA by SEJeff on Monday September 21, 2015 @11:13AM (#10252831)
No not really. As a US Soldier, you sign away 100% of your constitutional rights when you voluntarily sign the contract.

So many civilians get this wrong it isn't funny, but the only code that applies to US military members is the UCMJ (uniformed code of military justice), of which Bradley (now Chelsea) Manning was a member of.

Source: I'm a US Army veteran and learned all about this.

Re:Hacking Team, Computer Vulnerabilities, and the NSA by harry8 on Wednesday September 16, 2015 @02:45PM (#10228824)
You have to accept the rule of law is a worthy ideal to find any real or imagined example of its infringement a problem. To give up on it, to give up on the ideal, to stop raging against the violation of that ideal is to give up on Freedom.

I won't.