You're presenting a red herring here, tptacek. Any third grader who played played Splinter Cell would say, "No duh!" But the news isn't that the NSA is breaking into computers. The news is the scope of the intrusions (installing malware on 50k computers), and of the motivations for the behavior. We've been told it's to protect us from the extremist muslims attempting to establish a caliphate here in America [1]. That was a lie. 50k computers with US-planted malware on them is not a defensive maneuver. It's an offensive one. It's not about protecting America. It's about global information dominance.
Now, whether we want that or not is a different question; there are advantages and disadvantages to the issue depending to a large degree on whether or not you believe in American exceptionalism. But this is about an executive power grab, not about "spies spy, let's all go home now," and you're deluding yourself if you believe otherwise.
[1] http://www.nsa.gov/public_info/_files/speeches_testimonies/T...
It it is illegal for an individual to murder someone, then it should be illegal for the government to do so. If it is illegal for a programmer to infect thousands of computers of innocent people with malware, then it should be illegal for the government to do so.
I have no doubt in my mind that among those 50k are many innocent people (foreign and domestic), and that among the domestic infections, I doubt the NSA could produce a warrant or other legal instrument that permits them to have caused that infection.
Under what wacky laws do we actually permit such malware. And are there any provisions in those laws proscribing corrections for any offensive malware programs that cause collateral damage.
And this isn't about "American Exceptionalism". China didn't hack Google because they were upset about NSA hacking; they did it because Google had information they wanted, so they took it.
[1] http://www.theguardian.com/world/2013/sep/09/nsa-spying-braz...
GCHQ have said for at least 15 years that their mission is to monitor all communications, world wide, at frequencies from DC to light. They've said that they provide intelligence for their customers, who are the Ministry of Defence and other parts of government. (MI5, MI6, etc).
> It's about global information dominance.
GCHQ / NSA have never ever said anything different.
> But this is about an executive power grab,
It's a grab that happened a decade or more ago.
That's a truly appalling aspiration. If that is indeed their aspiration, which apparently it is (total information awareness, master the internet etc), we'd be safer with them shut down completely. Otherwise as more and more data becomes available online, they'd be in a position of absolute power over the populace (including those who are supposed to control their activities).
That's not keeping us safe, that is endangering the things they purport to defend.
Don't you find this aspiration frightening?
It's a grab that happened a decade or more ago.
Oh, that's ok then. Business as usual. Would you prefer people just didn't bother to discuss this topic, or do you have something to say about where the limits on this behaviour should be?
I would prefer that people stop saying that it's a modern development, or that there was no sign of it until Snowden leaked, or that it's some weird new thing. GCHQ at least has been open about their behaviour for years and years. ECHELON was discussed in EU parliament.
> do you have something to say about where the limits on this behaviour should be?
My view is tricky for me to explain, but I'll try.
1) GCHQ need to be allowed to do stuff. The limits should be clear, and defined by law.
2) GCHQ is a secret organisation, thus their oversight must be by people who keep secrets, but who are accountable to the public. GCHQ oversight failed, hard. I'm not sure what should happen. I hope that, in secret, someone is getting a kicking.
3) I don't care what GCHQ does to people who are not subjects of the UK (or whatever the hell England plus others is called now)
4) For UK subjects I would prefer that GCHQ does not collect meta data. I could be persuaded that they can collect targeted meta data, if they have suitable oversight. EG: They know that Bob is a terrorist-sympathiser. (Beyond just looking at a few YouTube videos - this would be things like sending money, fly-posting, fund raising, associating with other terrorists, etc.) GCHQ would apply for, and get, a warrant, and be allowed to collect meta data for that person. Warrants would require oversight, not just by the courts but by the oversight body.
5) For UK subjects I strongly prefer that GCHQ does not collect content data unless they get a warrant.
6) GCHQ claim to obey the law. I want oversight to be stronger, and I want some of the GCHQ choices to be challenged. I don't want weird interpretations of words to guide their behaviours. (EG: Clinton's "I did not have sexual relations" - well, a blow job is sexual to most people.)
Having said all that, I am a lot less bothered by GCHQ data slurping than I am by other potential privacy invasions.
GCHQ has a many petabyte dump of data but there's no impact on me unless they grep my name. (I'm aware that this is like me saying I'm not so bothered by police stop and search powers; me being white and rarely leaving the house means that I'm never stopped and searched.) Plenty of other organisations have my data, and we have many examples of them breaching confidentiality through corruption, incompetence, maliciousness, and so on. I said a bit more about that in this post. https://news.ycombinator.com/item?id=6767612
GCHQ has a many petabyte dump of data but there's no impact on me unless they grep my name.
I'd disagree there - if GCHQ is collecting huge dumps of data, it doesn't have to be your data to affect you directly. For example if your MP or prime minister is deposed because of selective leaks of their data, that could easily affect your life in dramatic ways.
Which is why you should be angry at your government for failing to protect you.
I seriously doubt that. Russia, for example, could not care less about 99.9% of western citizens (whereas for western spying agencies, those are potential dissidents to be kept on check).
And even if they cared, what exactly would they do with that information? It's not like they are particularly powerful, imperialist or try to play global cop (post USSR). It's also not like they arrange puppet politicians and governments in foreign countries, as western powers are known to do.
So I thank tptacek for sharing what he knows that I don't know. That is, after all, why I come here.
We could close down all news sites and stop reporting on all crimes - because, hey, the cop, the robber and the victim knew already hours ago that somebody had been robbed.
The argument that something should be a no-story, just because I personally suspected/knew about it already for some time screams of delusional self-importance worldview to me.
But it is intellectually dishonest to pretend that
people are just now discovering that NSA was breaking
into computers around the world.
Perhaps somewhat, but not really. I read the word 'people' in the sense of 'some group' instead of 'any single person.' In other words, 'people now know that eggs aren't bad for you' doesn't mean that every single person has learned this, just that the knowledge is in the generally accepted body of knowledge and those with business or interest in nutrition know it. At least that's how I read it.
I think that leveling a claim of intellectual dishonesty at someone who thinks that everyone else was as ignorant as they were is a bit harsh, and sort of inflammatory.
I think that most people would reasonably believe that if there were such strong signals that the NSA was doing this it would be closer to public knowledge than it was.
Explain them as "business as usual" to take away the outrage.
Might as well have been explaining the actions of the KKK.
I didn't take it that way. In fact, you could argue for more outrage: "There are certain groups who knew about this behavior all along and for them to pretend that this is news to them is bullshit" is how I read it.
So if you are going to be outraged, you should be outraged at the groups "in the know" as well.
It was unexpected for me, but I think it is important for us to understand that it wasn't unexpected for everybody. It's kind of like if we found out that Gitmo really wasn't exceptional. That would be important.
It would imply that this something is a standard practice, many groups are aware of it and for some reason, over time and through many events, they've decided it's the best policy that they can hope for (or else they would have blown the whistle earlier).
It means you should consider changing policy carefully, because the policy was put in place (and stayed there) not on a whim but rather after some consideration and re-consideration. Unless you think that all of these groups are filled with horrible people whose only aim is power and control you might have to allow that some of them have different insights into the problem from their experiences.
Please understand that I'm not defending anything- just showing how it could be important to learn this type of information.
A somewhat similar example that always comes to mind in these cases (and for some reason happens relatively often among my 'geekier' friends) is when someone says 'I don't dream'. There's always a smart-ass around to point out that everybody dreams, but they just don't always remember it. I don't know if that's true, but that's irrelevant..
It might be technically true, but it's pedantic and misses the point of the statement. And it cuts off a potentially interesting conversation for the sole purpose of making this person sound smart.
I've noticed myself doing this too (I privately call it 'snoping' someone), and have been trying to avoid it as much as possible since I became aware of it.
Unfortunately for whatever innuendo you're trying to evoke here, I'm on pretty firm ground when I say that NSA sponsoring computer hacking is normal and expected. I say that because you can find it on people's fucking resumes.
Can you point to some HN threads that discussed this in detail before Snowden? For example, when China was hacking Google, some people may off-handedly said, "well we do it too", but nobody gave specifics as Snowden did. His revelations were extremely useful.
If you have articles with publish dates pre-Snowden with lots of examples like the revelations in the posted story, please share. I want to figure out how I missed this.
Just 1 year before, people would deny such thing occured and treat you like a conspiracy theorist, including here on HN.
>But it is intellectually dishonest to pretend that people are just now discovering that
A, the "we knew it all along so it's ok" defense -- with the "and furthermore, you should be ashamed for pretending to have learned about it just now" extension...
You are wrong.
People have been saying for as long as email has existed that it is not private and that anyone can read it. People have been warning that if you have something secret you must not put it online, or that you must use sensible encryption carefully if you do so.
Risk assessment has always been part of online security considerations.
Online privacy is not a new thing. Knowing that governments have access to everything is not a new thing. Being annoyed that governments do it is a new thing.
What did you think they were doing with the huge secret budget and more computing power than anywhere else?
2001, in mainstream UK newspaper http://www.theguardian.com/world/2001/may/30/eu.politics4
> the European Parliament warned EU citizens of the threat to their privacy from Echelon, a global eavesdropping network run by the US National Security Agency in cooperation with Britain, Canada, Australia and New Zealand. As we reported on Saturday, it concluded that the primary purpose of the system is to "intercept private and commercial communications". It urged individuals and businesses to use codes to protect their communications.
> Half of the UK and US government are saying it's news to them
1999, from the website of this secret agency https://web.archive.org/web/19990428012157/http://www.gchq.g...
> GCHQ employs one of the largest long term bulk near line storage systems in the world. Data is stored in a number of locations on a variety of media, including magnetic tape, cartridges, recordable Compact Disc and optical storage technologies.
What did they think was being done with the largest long term storage system in the world?
> GCHQ has an interest in all aspects of modern telecommunications and uses a variety of systems designed to operate on all frequencies over which data can be transmitted.
I'll admit that the GCHQ FAQ got a bit slimier later on. See this page from 2004 https://web.archive.org/web/20040604234303/http://www.gchq.g...
> People sometimes think that we cannot be accountable because we do not disclose much about GCHQ's operations and methods.
> Nothing could be further from the truth.
> In fact, GCHQ is subject to very rigorous oversight both by Parliament and senior members of the judiciary, and works entirely within a legal framework which complies with the European Convention on Human Rights.
> Activities at GCHQ are underpinned by the Intelligence Services Act 1994 (amended most recently by the Anti-Terrorism, Crime and Security Act 2001) and the Regulation of Investigatory Powers Act 2000. The purposes for which interception may be permitted are set out explicitly in these Acts: national security, safeguarding economic wellbeing, and the prevention and detection of serious crime. Interception for other purposes is not lawful, and we do not do it.
But I've already condemned this kind of wording used to justify unjustifiable privacy violation.
EDIT: It's mildly interesting reading through the technology pages to see it iterating. They list Win3.1 in the early versions!
More to the point, the fact that it is a huge story in the news across the world proves that most people were simply unaware. So it doesn't mean much to say that this was already known when to most it wasn't. That could be taken to imply that there is nothing to see here and that people who are bringing it up are a little slow - which is simply disingenuous. The fact that my mother doesn't read every page of every newspaper doesn't mean she should be disenfranchised. And it also doesn't change the fact that many businesses are only now changing their behaviour and moving away from US companies and reconsidering architecture for IT projects and business operations.
I should say that I'm glad it's now being taken seriously by many people. I'm a bit worried about the number of toy crypto systems popping up. I'm frustrated that people still release apps that have over-broad privacy intrusions.
I do appreciate you sharing the fact that among computer security circles it was a well-known fact, and it's sad that you get so much hate for your informative comments.
But I've been telling people to encrypt everything, and to assume the government can read everything, for very many years.
Sure, I lack gravitas, but still. We were telling people about it.
A Google web search for Echelon before 1999 reveals many hits for the secret codename (as well as many not relevant hits)
https://www.google.co.uk/search?q=echelon&sa=X&ei=IXWRUpCGE8...
We successfully fought against idiotic ideas from government to control use of encryption (EG Clipper chip). We told you to use encryption. We told you they could listen. We told you they were listening.
What more could people have done?
What more could people have done? Good question. Maybe try and contact investigative journalists, although I have had no luck doing that for an unrelated issue I feel strongly about (NBA game fixing).
Do I like it? No. We don't work with the USG, and that's one of many reasons why.
The whole situation is uncomfortably asymmetric. Economies of scale I guess. Winner takes it all.
Opposition to the tactics of the NSA/GCHQ does not require you to be opposed to the existence of spies. That's an old, tired argument, which we didn't need to go into the first time. Of course spies spy, but should they do so without boundaries, without proper supervision, and above the law? Should they do so outside wartime and on allies? Should they be given the very real capacity to subvert our democracies and networks worldwide? Who then will keep them in check if the head of the NSA decides he wants regime change at home? How will we know if this has happened?
Personally I don't think this world-weary acceptance of lawbreaking is an appropriate response, and I'm outraged that spies in my country (GCHQ) have been collaborating with collection of data worldwide and handing it over to the NSA, without any respect for international law or the interests of their own country.
The important discussion to be had is on where the boundaries to NSA surveillance lie, and how to perform adequate supervision of them, and just what laws they are not allowed to break. At the very least I think we need a proper inquiry into those topics, which we have not been offered thus far. Spies could (and have) assassinate, kidnap, subvert the political process, and break into networks worldwide but should they do those things to allies and domestically? Should we fund them to keep doing it? Should we accept the perpetual state of war which has been engendered by wars on terrorism and drugs, and the use of that to justify tyranny, assassination and subversion of the democratic process? If we say they can and will do all these things, because it's just what they do, we might as well given up on the pretence of a democracy we currently enjoy.
There are very good reasons the NSA is not supposed to be used domestically, and I'd argue those reasons should also extend to allies, if only because not doing so means your country will no longer have any real allies at all. Why should anyone trust the US or UK in trade negotiations when they've been shown to cheat and steal at every opportunity? Why should Sri Lanka say not just laugh in the face of the UK when Cameron talks of human rights, and China laugh in the face of the US when it complains about intrusive industrial espionage? The blowback on this topic is very real and deep and is only going to be reinforced by reactions like yours above which come down to 'spies will be spies'. The defensive capabilities of the NSA should be far more important than the offensive ones in my opinion, particularly in times of peace. Acting as if you are in a perpetual state of war with other nations, including your closest allies and even domestic population, will lead them to treat you the same way.
The spies have become a supranational organisation which apparently doesn't feel it is answerable to anyone; even the politicians who are ostensibly in charge of them. I think that's dangerous and worthy of note.
Be outraged that we're spying on your country if that makes you feel better, I guess. I'd rather nobody spied on each other either. But it is intellectually dishonest to pretend that people are just now discovering that NSA was breaking into computers around the world. That is literally the charter of the NSA. It's why they exist at all. There isn't even a pretense of a different purpose for the organization.