In this case, it might be better to assume malice rather than incompetence. In the 1950's it was s/terrorist/communist/, but it was a remarkably effective political tool. We might be in the same situation.
But this time, our fates are all linked. Once shipping backdoors becomes mainstream, it might be impossible to go back.
We should try to think of some concrete steps to resist this. It feels like we have to try, since there's so much at stake.
Could we reverse engineer the political forces at play? We could try to think of the most effective thing we could do, and then focus on that.
> In this case, it might be better to assume malice rather than incompetence.
I really want to consider you paranoid, but sadly I strongly agree. This is hardly the first time engineered paranoia has gripped the country, but living through it is horrible.
I was a kid during the mid-to-late Cold War (post "duck and cover") and somehow I was never able to take it seriously. Even when I took classes on strategic deterrence and the like in college I considered them light entertainment I was paying for to give me a break from the serious classes.
Now we have the emperor's new suicide vest.
Unfortunately, the threat was (and still very much is) real:
Stanislav Petrov: The man who may have saved the world http://www.bbc.com/news/world-europe-24280831
Thank you Vasili Arkhipov, the man who stopped nuclear war https://www.theguardian.com/commentisfree/2012/oct/27/vasili...
Not that paranoia is a particularly useful response, but it did not require much engineering.
Engineered paranoia is still very real and a danger to our societies because of its reality-distorting effects that can result in violent overreactions.
Did I get that right?
Great point. One idea I had recently is to start an organization in the same spirit as Open AI called OpenSurveillance that builds and releases all sorts of useful tools for thwarting surveillance efforts or acting as an adversary to an entity with pervasive surveillance power (generally speaking, corrupt regimes around the world).
I think it would entail a combination of social/operational and technological tools, and would be useful for defensive and offensive efforts.
When OpenAI releases a state of the art facial recognition algorithm, it becomes obvious how the technology might be used for good or for evil. The same goal would apply.
Perhaps one utility conducts an analysis of public social media data to determine the best strategy for bribing or compromising an adversary. Another could explain how to use a HackRF YARDStick One to track the movement of an adversary via tire air pressure sensors. Another might utilize an infra-red camera to determine which entrances and exits of a building are slow to close and could offer time to sneak in.
Still other tools might be a user-friendly rootkit installer for easy installation on a spouse or boss's device, etc., or maybe a program that trains a fleet of drones to follow a person all day, causes vehicle engine failure, etc.
The basic idea would be to highlight enough about reality so that the security (and privacy) implications of the policies can be weighed accurately by the public. By putting all the tools in one place and releasing polished, thoughtful products, the organization would help the public understand the privacy/security tradeoffs much better.
Basically a modern Anarchist's Cookbook for the surveillance age.
Disclaimer: It is not the intent of this post to discourage people to break laws, simply to use their vote and influence to peacefully change laws.
I've been considering a comparable project, but more focussed on opsec/infosec in a file sharing context. However, I've felt chilled by the possible legal consequences to me and my family if I enter this arena.
Bootstrapping myself to have great opsec seems like a really tough task. I feel like I'd have to repeatedly burn hardware, houses and identities if I want to stand a chance to reach "opsec heaven" where I can freely persue projects such as the Spook's Cookbook or the Pirate's Cookbook.
I think it could but it would need good legal support and PR support to prevent its actions from being mischaracterized.
> Bootstrapping myself to have great opsec seems like a really tough task
I think it would be incredibly difficult if not impossible in today's world. So I think that an "in the light" approach is much less vulnerable.
>a user-friendly rootkit installer for easy installation >a program that trains a fleet of drones to follow a person all day, causes vehicle engine failure, etc.
I'm afraid corrupt regimes would be the ones who benefit the most from such tools.
They already do. But since the tools are under the radar there is not all that much pressure on technology firms to follow best practices.
For example, why don't we have fully auditable filesystems?
While I think (and hope) this is correct, I'm not sure it matters.
For example, it would not be necessary for most of the engineers to be aware of a backdoor or other known vulnerability. There have been examples from open source crypto where malicious code has weakened it significantly and still nobody noticed.
There's also the very real possibility of baking the backdoor/vulnerability into a custom ASIC design. Chances are the government has a lot of expertise in this area and could simply tell Apple that it would provide one of the parts for all iPhones and the part would behave to spec (but would contain other undocumented behavior).
I think it's also realistic that other governments do this. Unless a chip is manufactured using the latest microprocessor-level miniaturization, it could contain all sorts of undocumented circuitry. I'm not sure about the economics of this sort of attack, but surely it makes sense once in a while.
There's this weird denial that takes place. I see it in all professions.
Eh, communism was way more of a threat. People in extremely high positions were communist traitors (eg Harry Dexter White who negotiated Bretton Woods/the creation of IMF for the US, or Alger Hiss who was involved in the creation of the UN, or a gazillion people in the British intelligence services).
If the government today was filled with people loyal to ISIS or AQ, then you could draw such a parallel.
The flu is Feinstein. From the ridiculous controls that treat cold medicine like contraband, the Patriot act, and bullshit like this, the Senator is a wellspring of bad law and disrespect for the American people.
Why do Californians keep electing this person?
However, a senior politician of marginal quality can be better for your state than a junior politician of superior quality. In theory they are able to score you all kinds of handouts and preferential treatment where the junior politician would just get ignored.
I don't know if that's the case for Feinstein, but my point is there's some utility there from the perspective of a Californian that does not exist for (say) a Utahn given the option to vote in CA elections.
You are looking at the problem wrong. It has nothing to do with government indoctrination but an issue with incentives. The FBI's whole job is to investigate potentially illegal acts and as human beings they are incentivized to do their job as well as they can. When the opportunity comes up to give them more tools to do their job no one in the FBI is going to say "no I want to continue with one hand behind my back".
The exact same thing happens at companies. Companies with poorly aligned incentives will quickly see employees act against the will of the company as a whole to make sure they look and come across as best as possible, and any chance a decision comes up to help them do their job better they will fight for it, because not doing so is pretty dumb.
Well run companies work around these incentive issues by trying to get everyone aligned with checks and balances. We don't have that in the government because the people who are supposed to be doing the checks and balances (congress) have incentives to follow the FBI's requests because of the political suicide of coming out against solving crimes and defeating terrorists. It can (and will) be used against them at election time and their checks and balances (us as voters) fall for it all the time because we (as a collective whole) are short sighted and scared that something might happen and don't want to be someone who voted for someone soft on security.
The only way to realign the incentives back for societal good is to get the common voter to understand the bigger implications of issues and hold our elected officals accountable. Until that happens the incentiives are always going to be aligned for the government to gain power.
Everyone's vote is secret, so no one will come to your house and bust your balls over voting for someone who comes out against defeating terrorists. The problem is that there are no incentives to become well-read in the issues behind each election. Maybe we can find a way to incentivize learning the facts and becoming well-read on issues before elections [1]
[1] http://www.pewresearch.org/fact-tank/2013/06/17/political-vi...
Not Comey. In this committee session he bluntly said torture is not effective and that his personal standard for what constitutes torture is more stringent than that in the statutes.
> if extreme techniques were viewed as likely to result in useful information
He's not arguing that torture is wrong, he's arguing that torture doesn't work.
Maybe listen/read to his full response first?
But that just calls into question a person's character and it's going to be impossible to dig down and find a satisfying answer for everyone. So I'm not sure how fruitful this is.
Right, he wouldn't use it because he doesn't believe it's effective. The GP is suggesting that if it were effective and legal, do you really believe he would refrain from doing it on moral grounds? It's the prerogative of the FBI to pursue cases using essentially all effective legal means, and it's no surprise to hear they are lobbying for more tools to become legal.
Paraphrasing here but I think his definition was along the lines of "anything that purposefully causes physical harm or injury to a person", and when asked whether bad prison food counts, he said that in his eyes for his team that is not something he would condone. This was a pretty straightforward response; the man at least talks the good talk on torture.
We hear about it all the time. It's just so pervasive we no longer see how extreme is the intrusion!
Civil asset forfeiture, stop & frisk, the near endless litany of TSA/Homeland Security abuses, "VIPER" teams hassling Greyhound bus riders, states such as Hawaii where the 2nd Amendment is ignored, the SWAT teams that have taken over every small-town police department, the banking secrecy acts that report you if you move more than $4000 at a time or in an undefined "suspicious" way (also see "structuring"), the aggressive+confrontational transformation of law enforcement into domestic military, the involvement of military at WACO... need I continue?
The fear, of course, is such restrictions would be next. You start by going after the boogeymen, terrorists and pedophiles, then expand to gangs, then drug dealers, then political enemies, then....
[1] https://ucr.fbi.gov/crime-in-the-u.s/2013/crime-in-the-u.s.-...
[2] https://ucr.fbi.gov/crime-in-the-u.s/2013/crime-in-the-u.s.-...
[3] http://edition.cnn.com/2016/10/03/us/terrorism-gun-violence/
Anecdote: I live in one of the lowest crime neighborhoods in Chicago. Every now and again though someone is shot in the area. The first thing I always wonder: was it random or was it gang/drug related? Nine of ten times it's the latter and I feel better because I don't associate with gangs or regularly participate in drug deals in a McDonald's parking lot at 4AM. It's scary when it's random because it's easy to think, "that could have been me, it could have been anyone."
That's why terrorism is scary (and that's why the terrorists do what they do). Of course protections should be in place, but there's simply only so much you can do before you're policing every aspect of everyone's life to prevent the tiniest chance that something happens to a tiny percentage of people. But, damn, is it scary.
It was always just a ruse to snatch power. Parading a potential existential threat to consolidate authority goes back to antiquity and is a common theme in historical narratives, fiction, allegorical literature, popular political writings of the founding fathers...
It's like the political version of a 419 scam. I'm continually dumbfounded that people fall for these things.
In the modern era, there's accessible easy-to-read references at our finger-tips to learn about all the classic shams that are constructed to manipulate and seize power, but it doesn't seem to matter. It's really something.
Wiretapping and search warrants are long standing and well support ways for law enforcement to investigate among other things organized crime. Just because you know have encryption doesn't mean that has changed. Similar to how the NSA didn't suddenly stop doing signal intelligence just because they allegedly "lost the crypto wars".
> Nobody would reasonably argue that extreme surveillance measures, patriot act, etc., is necessary to stop the vast majority of crimes from occurring, so why is it so easy for seemingly serious/intelligent people to think this nonsense is reasonable?
It's a presumably a "better safe than sorry" and "nobody got fired for choosing more surveillance" kind of a thing.
> Terrorism is a political word to describe political enemies of the state, yet the patriot act and surveillance machinery has been used in enforcement of many other kinds of (less serious) crime.
Terrorism is just the ultimate argument of people in the establishment. Just like encryption enthusiast might have some story about how they are helping dissidents, but are mostly encrypting their warez and mundane e-mails.
True, but there is a big difference between presenting evidence to a judge to obtain a search warrant and subsequently manually wiretapping a phone line or two and the sort of massive-scale surveillance/capture we have today.
It's like the difference between a doctor examining an awake patient who has complained about a specific symptom... vs to a doctor sneaking into the bedroom of thousands of sleeping non-patients and performing a secret physical exam on their genitals just in case anything about their genitals seems alarming.
The crime (building the illegal infrastructure to do that surveillance) is now justified after the fact by a fairly quaint comparison to traditional police work.
As much as I'd like to, I don't believe that surveillance is about police work. It's about political intimidation which is identical to the kind of political intimidation that seems obvious when talking about other police states from history.
The effects of intimidation are not obvious as everyone expects them to be. I'll make an analogy with the North Korean regime to illustrate my point.
How is it possible that the leader of N. Korea is able to make statements to the public that are obviously absurd. Are people in N. Korea less rational than elsewhere? Less intelligent? No, but over time the range of ideas considered acceptable has adapted to include some of the most ludicrous (and contradicted by fact) claims imaginable.
How does this happen? I think it happens gradually. How likely are we to loudly criticize our government when we know all our devices contain a hot mic and all the audio might be getting recorded? Maybe we still offer a criticism but we couch it a bit or we follow it with some praise. Small things like this mean that we all hear less criticism, less scrutiny, less dissent. All because we are not sure who is listening or who will be reported to authorities for holding a controversial view.
Over the course of decades, perfectly intelligent, rational people in N. Korea are easily able to believe some fairly outlandish claims simply because of a few decades of secret police presence and fear of being reported.
What does this have to do with the US? By definition, terrorism is a political crime. It causes intimidation and fear. It is designed to be asymmetrical and sporadic, and is impossible to stop. The only way to fight it is with extreme social control... a more compliant society where holders of nonstandard beliefs are more easily identified.
If the surveillance data had not been used to fight non-terrorism crimes, or if the systems were designed with a cryptographically provable audit trail, I'd consider the possibility that this was just a more modern way of doing law enforcement. But sadly I think all of the evidence points in the other direction.
The goal of terrorists is inflicting terror and reactions following from the terror. Terror suppresses reason, so the reactions become less reasonable and thus detrimental to the attacked side.
By this measure, terrorists have unquestionably won. The Western societies under attack suppress their core values after the attacks, such as openness, free speech, tolerance to a variety of views, and primacy of reason and right over force. Voluntarily crippling your own encryption is like voluntarily making holes in your armor, all out of fear.
It's like an auto-immune reaction that kills the patient instead of the germ.
""" surprised anyone can still use the word "terrorism" with a straight face anymore """
Is quickest way to shut down conversation. Especially given horrific events in France, Ohio, Florida. Your argument is not only ridiculous its counter productive to anyone offering a balanced saner approach.
In 10 years time the death stats for lightning bolts will be similar and for road accidents will probably have declined. Which way do you think the terrorists stats will go?
The comparisons given are accidents and happen through negligence or plain bad luck.
Even so, terrorism may have cumulative political and social effects. People don't like to know there are others out there who wish them harm. Once a certain threshold of resentment is reached within an affected society then suddenly massive unrest could erupt.
Some politicians are trying to mitigate this by suggesting we should just get used to the occasional terrorist attack and treat it like a lightning strike or a piece of heavy furniture falling over.
Rather than thinking in terms of mortality rate over a period, its more accurate to think in terms of events. A single lightning bolt strike can at most affect 0 ~ 10 people with a gaussian distribution. A terrorist attack on the other hand has a long tail distribution and can cause 10^0 ~ 10^4 deaths.
There is no organized cult going around making lightening bolts with explicit intention of causing large scale harm. On the other hand there are several organized terrorist groups which are intentionally trying to do that. As far as being overweight or bad driving habits, billions of dollars are poured into health care system, automated driving and regulations with goal of reducing deaths due to them.
What?? What does legal driving age has to do with DHS budget? You are simply rambling, different mortality causes have different risk models.
Or to explain simply you are comparing "Apples to Oranges".
If your goal as a government is to minimise the number of lives lost that were preventable, then the argument is that there are many more effective ways of doing it other than spending huge amounts on security services.
I presume there's some stat somewhere that says that young drivers are more likely to be involved in fatal traffic accidents. No-one would claim that dying in these accidents is not tragic.
So if you were to raise the legal driving age by a year, you may end up saving lots of lives, and that would be a lot cheaper way of saving lives.
It's not a flawless argument, as one has to balance freedoms with restrictions and the fact that any historic analysis of attacks has to try and unpick the fact that security apparatus was in place in the past. Spending 0 money on security could have unforeseen consequences, and most people would accept that preparing and executing an attack would be easier.
Since "Terrorism" is a political problem, how about a political solution? Stop going into Muslim countries and murdering women/children and tearing down governments with no plan for rebuilding? Be more cautious about what you do on the world stage. Stop bombing brown people just because they don't support 'American interests' and such.
I don't see any reason to compromise against a fake enemy.
I bet the number of blacks killed by cops outnumbers the people killed by terrorists here in the U.S. Let's spend a trillion dollars fighting THAT problem!
edit: clarify
I don't buy in that this problem is large enough not that this solution would be acceptable if it was
Unchecked Terrorism has non stationary distribution and can lead to deadlier events that are orders of magnitude larger. Further why pick a year and not a day? At any given day the number of deaths due to Terrorism are close to zero, except you know on a tragic day a decade ago in september.
So stop the underlying process? Terrorist organizations aren't quiet about their problems, that tragic day in September was in opposition to US interference in their lives. If our goal was combatting terrorism, we picked a terrible way of addressing the problem.
To you these attacks are a valid grievance redressal mechanisms??? Is that the path every disenfranchised group should take?? If you are okay with such approach, no point in having a discussion.
No, but neither is the "War on Terror."
http://www.washingtonpost.com/wp-dyn/content/article/2007/05...
The gist of it is that Comey went to great lengths to make sure warrantless wiretapping wouldn't be considered legal. And when he failed to do so, he resigned.
What happened to him since then?
On a more serious note though: it strikes me that in our time of 'total information awareness' the ability to blackmail people in powerful positions is a significant flaw in our system, much more so compared to the past.
Has any research been or anything worthwhile been written about this (potential) problem? I mean, we know people have been blackmailed or that attempts have been made, so the question is how common this actually is.
Despite my internal knee-jerk 'this sounds tinfoil-hatty', I can't think of anything keeping intelligence agencies from wielding massive hidden power in this way. Or would it just have come to light much more often if that were the case?
If the AG had signed for it, then we'd have probably seen the supreme court weigh in on it. But since he didn't, the program continued behind closed doors and grew massively. I believe now there is a rolling 60 day archive of nearly all worldwide communications and metadata (and longer rolling archives for select subsets). It's incredibly impressive tech but quite scary.
It's not at all natural that he should argue for hollowing out the constitution, or favour the needs of own organisation over the rest of the state or over the entire society.
Very true. But I think it's safe to assume that no good, just individual would end up in the role of Director of an intelligence service. Who really aspires to be the leader of a team of secret police?
There are some professions that are not strictly speaking unethical, but that tend to attract an ilk of people who are unconcerned with ethics. Used car salespeople, brothel owners, chiefs of secret police forces, people hired to do telephone cold calls to sell shady investments to the elderly, etc.
If Comey is viewed in this light, we can see that he is acting predictably. Sadly, many people have the mistaken idea that people who dress in nice suits and wear medals and get appointed by presidents somehow deserve the benefit of the doubt. They do not.
“We’ve had very good open and productive conversations with the private sector over the last 18 months about this issue, because everybody realizes we care about the same things. We all love privacy, we all care about public safety and none of us want backdoors — we don’t want access to devices built in in some way. What we want to work with the manufacturers on is to figure out how can we accommodate both interests in a sensible way”
If you are curious about how you might incorporate what people say into your reasoning about reality and outcomes, this is a good book: https://www.amazon.com/How-Know-What-Isnt-Fallibility/dp/002...
You can't; this is an either or situation. There is literally no system that could be put in place that wouldn't be exploited by people who were not the intended users.
That's the worst thing about Comey. He is totally comfortable and unabashed about going in front of the American people and playing a word game.
I am an Indian citizen living in USA and I think American society must take the blame here and not the politicians. The way society thinks and votes I think only a total narcissist moron can succeed in US administration.
The fastest way to rise to top (as we saw in case of Obama and Trump) is to find some target group and blame that group for the failure of other larger society. The larger society is far too quick to raise pitchforks and burn the other group at stake.
It is depressing to see that large % of Americans have seen inside of jail. A lot of people labeled as "suspected terrorist" or "sex offenders" are no where close to the common sense definition of those words. But once you have that label rest of the society treats you like utter shit. You cant find a job, state can put any arbitrary restrictions on all your freedoms etc.
Unless US society learns to be compassionate and stand up for the rights of even those "deplorable" people purely as matter of principle I don't think there is any scope for optimism.
I remember Ron Paul's words "Once you give up some liberty, you are not going to get it back, ever!"
This is a really excellent point that you make.
Yes, we are very much a blame society. It is the Republicans fault. It is the Democrats fault. It is my neighbor's fault. It is my parents' fault. Blame blame.
This depends on what kind of crime you talk about. And is "the vast majority of crimes" actually prevented from occurring? How do you get numbers for this?
Calling people who don't agree with you stupid is not going to advance your cause. At all.
> I am surprised anyone can still use the word "terrorism" with a straight face anymore after it's become so clear that there is no large existential threat (merely the occasional zealot who acts out due to his/her own mental health issues).
Two points:
1. The occasional zealot is all it takes to make people feel unsafe, affect their behaviour towards other people and just generally ruin a lot of peoples days.
2. Blaming all terrorist attacks on mental issues alone without taking into account viral ideologies is dishonest.
edit: i forgot this:
> And in spite of a historically unprecedented global surveillance system there have been no attacks thwarted.
Provably wrong.
How did we get to this point? Nobody would reasonably argue that extreme surveillance measures, patriot act, etc., is necessary to stop the vast majority of crimes from occurring, so why is it so easy for seemingly serious/intelligent people to think this nonsense is reasonable?
Members of our government are so indoctrinated about stopping "terrorism" that they have lost all sense of perspective. Terrorism is a political word to describe political enemies of the state, yet the patriot act and surveillance machinery has been used in enforcement of many other kinds of (less serious) crime.
I am surprised anyone can still use the word "terrorism" with a straight face anymore after it's become so clear that there is no large existential threat (merely the occasional zealot who acts out due to his/her own mental health issues). And in spite of a historically unprecedented global surveillance system there have been no attacks thwarted.
Comey is a symptom of the kind of cowardly, authority-respecting society we've become. I look forward to the day when our FBI director is not someone whose gaffes and judgment calls we read about in the newspaper on a regular basis.