News for hackers. Stuff that matters.
Re:Terrorist watchlist exposed via misconfigured Elasticsear... by vkou on Wednesday August 18, 2021 @02:08PM (#28224952)
> You mean being put on a restricted rights/law enforcement attention list with no due process?

What novel 'due process' do you believe is necessary for the police to unintrusively start investigating someone?

We already require judge-issued warrants for intrusive investigations (Searching your things, tapping your phone lines, arresting you, etc).

I don't believe there's any country in the world that requires a judge to review the police putting you on a list as a person of interest. I am no legal scholar, so I should probably cut myself off right here - but do you not think that perhaps, there is a valid reason for this? You're inventing novel legal practices without precedent, here.

Re:Terrorist watchlist exposed via misconfigured Elasticsear... by pessimizer on Wednesday August 18, 2021 @02:37PM (#28225376)
If I, as a police department, put you on a secret list of possible pedophiles based on the fact that we saw you speaking to another person on that list, noticed you in a board game store patronized by many local young Magic: The Gathering fans, you were single with no children, and you were the brother of someone who once dated the sister of the cop who put you on the list, would you have a problem with that?

What if we weren't allowed to confirm or deny you were on the list, except to a prospective landlord or employer who filled out a form?

What if there were no way to find out those were the reasons I put you on the list, and no appeals process to be removed from the list?

What if you couldn't prove standing in court because there was no legal way to prove you were on the list at all without a friendly judge?

> You're inventing novel legal practices without precedent

Which is why people are forced to rely on the racial makeup of these horrifying lists in order to challenge them. The problem becomes a lot clearer if your local police force makes up a list of all Jews in the neighborhood (whatever criteria they decide to use, i.e. "valid reason") for special treatment.

edit: and, of course, what if the list leaks, and is used as an automated first step for disqualification by employers and landlords for the rest of your life?

Re:Terrorist watchlist exposed via misconfigured Elasticsear... by vkou on Wednesday August 18, 2021 @02:53PM (#28225597)
Would I have a problem with being on a list that, from my perspective, I can't tell the difference between being on it, and not on it?

I don't know, I wouldn't be able to tell. If a tree falls in the forest, and nobody's there to hear it, does it matter to anyone whether it makes a sound?

> What if we weren't allowed to confirm or deny you were on the list, except to a prospective landlord or employer who filled out a form?

You're swinging at strawmen. Nobody in this thread is defending intrusive lists.

For some reason, though, you are conflating unintrusive lists (Which don't require oversight anywhere in the world) with intrusive lists (Which do require oversight in... well-governed parts of the world).

Do you have arguments against the former? I'm not interested in being convinced that the latter are bad, I'm already convinced that they are bad.

> edit: and, of course, what if the list leaks, and is used as an automated first step for disqualification by employers and landlords for the rest of your life?

If there's an unholy decades-long alliance between the FBI, the background check bureaus, and millions of employers and landlords, that neither my federal, state, or municipal government is interested in doing anything about, I think my main problem is not 'the FBI has a list'. I think my main problem is 'My society, on every imaginable level, is broken.'

Re:Terrorist watchlist exposed via misconfigured Elasticsear... by salawat on Wednesday August 18, 2021 @03:41PM (#28226140)
>Would I have a problem with being on a list that, from my perspective, I can't tell the difference between being on it, and not on it?

>I don't know, I wouldn't be able to tell. If a tree falls in the forest, and nobody's there to hear it, does it matter to anyone whether it makes a sound?

Spoken like someone who hasn't had the long arm of the law drop in on them before, or a person who "doesn't care about that liberty anyway, so why not vote it away?"

Just because you don't see the problem doesn't mean it isn't there. Just because you didn't see the tree fall, doesn't mean the world is uneffected. These are concepts 3-4 year olds manage to divest themselves of once they grap the permanence of objects. Just because you don't get much out of a liberty doesn't mean that it's cool to force the loss of it on somebody else. Liberty is to be treasured and protected. The selective relinquishment, revocation, or limiting of one for anyone should be a Big. Frigging. Deal.

The fact people are so cavalier with wisking away the freedoms that underpin American Civil Life on mere suspicion of something that the State is not even required to be transparent about should disturb everybody.

Re:Terrorist watchlist exposed via misconfigured Elasticsear... by isoskeles on Wednesday August 18, 2021 @05:41PM (#28227552)
I don't understand this response. He was told it was a "secret list." Why would you take such a tone in response to him saying he might not have a problem since he doesn't know about the list? It's a hypothetical about a secret list, and since he doesn't immediately agree with the conclusion, you browbeat him about not having the long arm of the law drop down on him, etc.

More importantly, this:

> Spoken like someone who hasn't had the long arm of the law drop in on them before, or a person who "doesn't care about that liberty anyway, so why not vote it away?"

Who are you quoting here? No one said this at all.

I'm actually disgusted by your comment and the logic you present in it.

Re:Terrorist watchlist exposed via misconfigured Elasticsear... by octaonalocto on Wednesday August 18, 2021 @04:31PM (#28226692)
Your tone is inappropriate, please try to make your point without implying GP is dumber than a third grader. It implies malicious intent and is bad for discussion.
Re:Terrorist watchlist exposed via misconfigured Elasticsear... by RHSeeger on Wednesday August 18, 2021 @02:12PM (#28225020)
The problem is when that list is used to prevent you from accessing common services, like fly on planes.

Edit: Because people assumed I was talking about the no-fly list specifically; I'm not. The terror watch list also winds up being used to cause problems for people.

From: THE PROGRESS AND PITFALLS OF THE TERRORIST WATCH LIST By: COMMITTEE ON HOMELAND SECURITY https://www.govinfo.gov/content/pkg/CHRG-110hhrg48979/html/C...

> Inaccurate watch list information also increases the chances of innocent persons being stopped or detained because of misidentification.

A page by the ACLU goes into some detail. https://www.aclu.org/other/us-government-watchlisting-unfair...

That list, and others, are not innocent "we're just keeping an eye on these people" lists. Their use causes serious harm.

Re:Terrorist watchlist exposed via misconfigured Elasticsear... by AnimalMuppet on Wednesday August 18, 2021 @02:20PM (#28225134)
Except that, if I understand correctly, this is not the no-fly list. So...
Re:Terrorist watchlist exposed via misconfigured Elasticsear... by vkou on Wednesday August 18, 2021 @02:24PM (#28225213)
Yes, that is a problem. But that's not what the parent poster is talking about. It's absolutely irrelevant to this conversation.

The parent poster takes issue with the fact that an unintrusive person of interest list exists, and wants oversight on it. This is an absolutely unprecedented legal take.

It doesn't help that they are conflating the two (one of which is, at a first glance reasonable, and the other is not), when they are not the same thing. All that does is muddy the waters.

Re:Terrorist watchlist exposed via misconfigured Elasticsear... by __blockcipher__ on Wednesday August 18, 2021 @03:40PM (#28226125)
There’s no such thing as an “unintrusive” list. They make the lists for a reason.
Re:Terrorist watchlist exposed via misconfigured Elasticsear... by vkou on Wednesday August 18, 2021 @04:28PM (#28226664)
If that's the case, you should have no trouble answering two simple questions:

1. What do you think happens to people on it?

2. Which of those actions should require judicial oversight, but currently don't?

So far, the only answers to those questions in this thread have been 'imagine if...' tangents. I don't need to imagine strawmen, I'd like to know what is currently wrong.

Imagining disasters is how we're in this mess, I'd like to know what the actionable problem is.

Re:Terrorist watchlist exposed via misconfigured Elasticsear... by RHSeeger on Wednesday August 18, 2021 @05:22PM (#28227344)
> Imagining disasters is how we're in this mess

I posted some links in my original comment that talk about specific problems. That being said, "allowing those in authority to do things that could be used inappropriately... and then it turning out that they did exactly that" doesn't require ANY imagination. The US government engages in such behavior on a daily basis.

Re:Terrorist watchlist exposed via misconfigured Elasticsear... by vkou on Wednesday August 18, 2021 @06:12PM (#28227802)
Please note the four demands the ACLU makes in the publication you linked.

None of them demand that police lists should not exist, or that judicial oversight should be necessary to put a person on one.

Instead, they demand that:

1. The lists be accurate.

2. The lists be accurate.

3. Allowing people to contest them on a case-by-case basis.

4. To not blacklist people from employment based on them.

The ACLU seems to be in agreement with me.

Re:Terrorist watchlist exposed via misconfigured Elasticsear... by RHSeeger on Wednesday August 18, 2021 @08:10PM (#28228827)
I don't see them agreeing with you at all. I see you saying "the lists are fine", whereas they are saying "the lists are not fine, but would be ok if these things were true (but they're not atm)". Personally, I don't think it's enough. I think someone being known to be on the terror watch list is likely to cause them all sorts of problems; and anyone can be put on the list for pretty much any reason.
Re:Terrorist watchlist exposed via misconfigured Elasticsear... by harimau777 on Thursday August 19, 2021 @10:26AM (#28234222)
We can't answer that because the lists are secret. That's part of the problem.
Re:Terrorist watchlist exposed via misconfigured Elasticsear... by mikem170 on Wednesday August 18, 2021 @07:15PM (#28228374)
This is how the KGB, Stasi, and other secret police organizations work. It's a way to extra-judicially monitor and control the population. This should give you pause for thought. Law enforcement that the public can trust is a big deal. Our government already bends the laws quite a bit to suppress dissent, we shouldn't enable them to do more of this.

It's a lot more straight-forward if the police investigate crimes reported to them by citizens. That's what they are supposedly there for, right?