Also, there's a big difference between letting NSA protect US against Real Threats - real national security people-are-going-to-die threats, and spying not just on every single citizen on the planet (which includes corporate espionage), but on American citizens and companies, too.
Just like everyone has a little "evil" in them, without all of us being Hitler, the NSA can do a little bit of spying on important targets, without going 10/10 on the scale of evil spying.
So no, I really don't think "this is their job" or that "everyone knew they were doing this". I think the vast majority of people thought NSA would be reasonable with their spying.
I also hate it when people say, "didn't you see when they passed the Patriot Act? You should've expected this." Perhaps, but if you go back to when they passed it, they did it in literally hours, and if you watch Bush speak about it [1], he makes it sound as if they are only going to use it to spy on the terrorists' communications - not everyone's. Going by how fast they passed the bill, and how few details were offered, you can't really blame most people for "not knowing".
Heck, it was even called the "anti-terrorism bill" on TV, so I don't think people imagined that meant all of their communications are going to be swept up, because they were now thinking everyone is a potential terrorist (which is what "collecting it all" means) until proven otherwise by their systems.
There are enough prominent technology and finance people reading this who back controversial and truly disruptive technologies like bitcoin, biotech hacker spaces, open source crypto, etc. that they may have a reasonable concern about being a target.
I first encountered speculation that this was the case in a textbook from 1986, in a chapter discussing encryption algorithms in wide use that were contributed to by the NSA.
"Who really thought they'd go to US service and hardware companies and ask them to implement backdoors"
The fascinating book The Puzzle Palace, from 1982, describes the precursors to the NSA setting up shop in telegraph offices and copying all traffic with the collusion of the new industry.
None of this is new, and none of it is in the least bit surprising.
Since not everyone who reads this site meets those criteria, I suspect that it is even a not-insignificant subset on hacker news as well.
To see the effect, let's try it with some headlines I've just cherry-picked from a Google search results page for purposes of demonstration:
"Black Chamber team spies, hacks to gather intelligence on targets, report says"
"Appelbaum: 'Scary' Black Chamber will spy on you – every which way they can ..."
"Black Chamber Secret Toolbox: ANT Unit Offers Spy Gadgets for Every Need ..."
"Black Chamber 'spying on Europe-Asia undersea telecom cables' - Yahoo News"
"The Black Chamber Is Building the Country's Biggest Spy Center"
"Black Chamber can spy on offline computers wirelessly, says security expert"
"A Peek Inside the Black Chamber's Spy Gear Catalog"
"Report: Black Chamber intercepts computer deliveries"
"Black Chamber targets foreigners, catches Americans: Column"
I mean, how can you not love a name like that? You can't even say it in an ordinary tone of voice. See for yourself! No matter how you try, you'll find yourself saying not merely "the Black Chamber," but...the Black Chamber.
I think an official change of name is long overdue.
True, but perhaps someday we can learn to not advocate the passage of bills in such a short amount of time that representatives themselves do not have a chance to read or digest them, much less have debate about the specific contents. I say perhaps because I suspect we'll continue to see much more of this until there's some sort of mechanical change requiring a X day waiting period on any legislation introduced, and/or something requiring reps to sign a document with real penalties for perjury that they've read the damn things before voting on them.
Many bills today (perhaps most) are not written by legislators and their staff, but rather by lobbyists. That might have been the case since forever (if the movie "The Aviator" is not too dramatized, this has been true in the 1930's as well)
To this point has there been any evidence that a company has add in a "backdoor" at the request of the NSA?
The media keeps using the term "backdoor" when they talk about covert access but that doesn't mean that some company added a "NSA Access" feature to their product. It is possible (I would even say probable) that the NSA has exploited unknown vulnerabilities rather than used built in backdoors.
Covert access is only effective if it remains covert. If companies are building in these features then a lot more people know about it and it reduces the likely hood of staying covert.
I disagree, the article implies that Apple might (probably?) is helping them with their spying. This is not a minor point for me. I think it's very important to expose which tech companies are betraying their customers, and conversely which are not.
But no evidence was presented that any of the hardware companies were coordinating with the NSA. Given that jail breaking continues to exist, it is entirely possible that Apple and other companies are victims of security exploits identified by the NSA.
That being said, it would be good to get some companies on record on this.
He based this assertion on an NSA slide that said 100% of iPhones could be tapped. In the rest of the talk there was frequent mention (in bulletpoints or even more interestingly graphs) of efficacy rates, and as I recall most were between 50-80 percent. Apple was the only slide cited with 100% which is why this was noteworthy.
It's a resources/efficacy decision on the part of the NSA for targeting.
It's the same reason there were "no" mac viruses for many years: there were far more windows users to target.
Charlie Miller (that apple 0day guy) is ex NSA. In 2009 or so, he made huge waves with his iphone hacks.
I also find it appaling how widely revered charlie is. In this context, he is clearly an example of the kind of hacker we should be fucking shaming.
No more free bugs finds its logical conclusion. 0xcharlie: NSA stooge.
If you start your company today and put all your stuff on newly bought Apple machines (or Windows boxen), in case your stuff is stolen by the NSA or GCHQ or whoever in five years time, you will recieve (and deserve?) little compassion: When you complain, people will tell you that you should have known. After all, you started after the Snowden affair caused "all of us" to lose trust in these companies.
I'm starting to arrange myself with the "new" situation to maintain my sanity. If there is some life-or-death info, that should go into a crypto-container on an airgap linux box. For everything else, I'll have to become accustomed to the thought that there is someone out there who can get at it if they want and that all my efforts can make it only marginally more difficult for them.
"Here’s a problem: I don’t really believe that Apple didn’t help them."
That is a bullshit statement. It is pure speculation without a SHRED of facts to back it up.
There's a whole paragraph about that. You quoted part of it. It's not a minor point of the article. There's no smoking gun but that doesn't mean it shouldn't be discussed.
i'm guessing most people thought that spying of US agencies was an activity that was carried out abroad, and aimed at real threats.
that's true of course. but i'm afraid that the revelations of the past months have almost turned "jumping to conclusions" into a legitimate response to this kind of information.
I guess they'd still be hoovering up everything they could, just in case, if it weren't for the threat of terrorism. Public opinion is strategically important (if a foreign power starts a war, how will their people react?), but it wouldn't be so important.
Next on the NSA revelations list: A backdoor software "implant" capable of exploiting holes in everything from Froyo to KitKat, and which subverts the device's power management circuitry, such that a remote command can short-circuit and overheat the battery. Results, and especially the likelihood of explosion, depend strongly on battery capacity and charge state, but in-house testing suggests probability of fire should be ca. 95%+ across all device models susceptible to the implant.
(Speaking of which: "Implant", I like that choice of term, it's got just the cyberpunk flavor today's world needs.)
And yet today we find ourselves in a situation where bit by bit those limitations have been eroded so severely that they might as well not exist. We have organizations, such as the NSA, who have multi-billion dollar budgets with limited oversight and little public transparency. Who similarly operate with limited oversight in conditions of near utter secrecy. Who, through those conditions, have essentially unfettered ability to undertake any conceivable surveillance effort imaginable and much else besides.
It is simply untenable to have so many people with such power and no accountability and also maintain democratic institutions and preserve individual liberty. We should be thankful that, so far as I am aware, there has not been an individual with an excess of competence and ambition combined with a scarcity of morals or we would be in a much worse place today. But realistically it is only a matter of time before this power falls into the wrong hands. We have already been dangerously close in relatively recent history, such as with J. Edgar Hoover, we should not be courting fate again.
It would not be an exaggeration to say that how we handle this crisis will greatly affect the near-future history of the United States and significantly affect the future of all mankind in the 21st century and beyond. This is potentially a defining moment for this generation.
Increasing income disparity. Exposure to versus shelter from the legal system and justice -- as stated in the U.S. in published, public laws and mounted through public, accountable law enforcement activities. Freedom of movement, or constraint of same (e.g. the secret, unaudit-able, un-appealable, unaccountable no-fly list). Etc.
I'd argue that, in the large, a democratic society is based upon the willing participation of its members. Who share in responsibility for its security.
What is being created seems already to be, and regardless of ones opinion of current circumstances, capable of being made into and becoming, rather something else.
In other words, "equality before the law" already seems to be going out the window. (Well, that has always been somewhat of a myth, but, in many opinions, it seems to be getting worse.) Our democratic societies deserve and need to know about this, for the sake of remaining democratic.
And it's time to pull out a potent word in description of what has been and is going on: Hypocrisy.
Our leaders actions and their words -- platitudes -- do not align.
And it's time for us to think hard about whether our own do.