Hacker News Reader

Comment by r00fus | Hacker News Reader

I don't have to sympathize with what I see as unconstitutional overreach. Who funds these agencies anyway?

5Eyes includes nations other than the USA (4 of them), so the constitution need not apply.

I know the usage of other nations spy agencies has long been used to bypass US laws protecting it's citizenry from our own agencies.

That doesn't make it right.

I often see this claim made without any supporting evidence. The Five Eyes agreement explicitly forbids its members from spying on each other. It facilitates sharing of information gained from spying in countries outside of the group.

https://www.pbs.org/newshour/world/an-exclusive-club-the-fiv...

>forbids its members from spying on each other

It isn't spying if they willingly exchange the information they have intercepted. Straight from the link you posted:

Yet there have been reports in the British press — amplified most recently by former NSA contractor and leaker Edward Snowden — that that’s not the case, that the Five Eyes spy on one another’s citizens and share the information to get around laws preventing agencies from spying on their own citizens.

That would be a good story if Snowden provided any documents to back it up. He didn't.

I trust the BRUSA documents over the word of a high school dropout who failed his analyst exam for misunderstanding the course materials and misdescribed PRISM for misunderstanding the documents he leaked.

They're not spying on each other, they're spying on us.

MUSCULAR, revealed by the Snowden leaks, is a program in which the UK's GCHQ broke into Google datacenters and exfiltrated information, which it handed over to the US's NSA. Because the NSA received the data from a foreign partner, they treated it as foreign data and did not scrub it for US citizen data.

For those who remember, this is the program with the famous "smiley face" drawing of where Google decrypted data at their network edge.

> MUSCULAR, revealed by the Snowden leaks, is a program in which the UK's GCHQ broke into Google datacenters and exfiltrated information, which it handed over to the US's NSA. Because the NSA received the data from a foreign partner, they treated it as foreign data and did not scrub it for US citizen data.

You misunderstood Snowden's documents. The UK tapped undersea cables entering their country. They did not break into Google's datacenters. According to Snowden's documents, the NSA is not allowed to collect and store US citizen data, no matter the source. There was at one time email metadata collection (from/to/when) from that source that was ended prior to Snowden's leaks according to his documents.

> Intercepting communications overseas has clear advantages for the NSA, with looser restrictions and less oversight. NSA documents about the effort refer directly to “full take,” “bulk access” and “high volume” operations on Yahoo and Google networks. Such large-scale collection of Internet content would be illegal in the United States, but the operations take place overseas, where the NSA is allowed to presume that anyone using a foreign data link is a foreigner.

https://www.washingtonpost.com/world/national-security/nsa-i...

That article's author is very confused. "Full take" is in reference to other interception programs in war zones. The documents about MUSCULAR itself show that it filtered to particular data types sent to international regions and filtered that data to just the information on selected individuals. The same source previously also provided email metadata collection on everybody, but that program ended in 2011. https://www.theguardian.com/world/2013/jun/27/nsa-data-minin...

Refer to the primary documents when you see articles like the one you posted with contradictory information like "full take" vs. "100,000 selectors" with a mere "millions of records every day."

The author is Barton Gellman, one of the reporters to whom Snowden leaked documents, and the lead at the Post for the team that shared the 2014 Pulitzer with the Guardian for the Snowden coverage.

The article you posted is not about MUSCULAR. MUSCULAR did not require FISA authorization; that was kind of the point of structuring it the way they did.

It doesn't matter who wrote the article. What matters is that it contradicts itself on what MUSCULAR is.

My article is about a data collection program that used MUSCULAR as a source.

When you tell me to "refer to the primary documents when you see articles like the one you posted", it's relevant that Barton Gellman is one of a few people who have reviewed Snowden documents directly, including documents that the Post chose not to publish.

I'm done with this conversation; it's clear you're not acting in good faith.

> it's clear you're not acting in good faith.

I pointed out that the article you posted said the exact opposite of what you claimed it said (in addition to saying what you claimed it said). How is that not acting in good faith? If the article is contradictory, you need to go to the primary documents, which were available from The Guardian.

In the US, telecom companies are required to provide wiretap capabilities to law enforcement. Do you think that's unconstitutional overreach?

A wiretap doesnt interfere with my ability to use the phone. Breaking security definitely interferes with my ability to use the internet.

What’s the difference? They’re both forms of eavesdropping.

Phones shouldn't have an expectation of privacy if they're over analog lines as you have no control over the content once it leaves you. I, personally, think that they're both overreach but, legally, I think it's the difference between someone listening to a conversation you're having in a public park vs. one that you're having in your bedroom at home. If someone can hear me in a public park, that's on me as I clearly didn't put thought into how accessible I was. If someone can hear me in my bedroom, though, then I have to question the integrity of my home.

Encryption was specifically created to guarantee the integrity of an A->B interaction. If we're compelled to break that, then the whole system is no longer able to be trusted and its integrity is shot.

Would it be naive to suggest that perhaps we should never have trusted it?

Isn't this why spies always meet in person and go to great lengths to set up dead drops etc.

Of course not phones! I mean, "The President's Analyst" ;)

But from a professional, and WWII hero:

> 17. The greatest material curse to the profession, despite all its advantages, is undoubtedly the telephone. It is a constant source of temptation to slackness. And even if you do not use it carelessly yourself, the other fellow, very often will, so in any case, warn him. Always act on the principle that every conversation is listened to, that a call may always give the enemy a line. Naturally, always unplug during confidential conversations. Even better is it to have no phone in your room, or else have it in a box or cupboard.

https://blog.cyberwar.nl/2016/02/some-elements-of-intelligen...

Maybe not naive but I think never trusting your own home is just a recipe for paranoia. You have no reason not to trust your home unless some actor had reason to do so from the onset. It's not a trivial matter to bug someone's home or bedroom without their detection unless you have free and clear access.

Edit: Just now realizing that you meant we shouldn't trust encryption and phones, not our home. Whoops. Leaving my response for posterity and lulz.

Spies meet in person because they're people of interest. They take the job knowing that nothing they do is ever really done in secret.

Why shouldn't we have trusted it? It's solid math.

Resting on a massive assumption.. so really the opposite of solid math.

One only exposes you to the spy, the other exposes you to every other malicious actor on the internet.

If Apple includes an additional public key in the list of keys that can decrypt an iMessage, how are you now exposed to every other malicious actor on the internet?

There are things handset makers could do that would allow law enforcement access to a device without compromising the security of every person using that device. For example, they could add a connector to the logic board that grants access to the keys after a fuse is blown. It would only work on devices that law enforcement have in their possession and once they blow the fuse, the device is otherwise useless so you don't have to worry about using a device that's been compromised. It could even be designed so that the extracted key is encrypted and can only be decrypted by Apple after they receive physical possession of the phone and a court order.

A scheme like this would individual phones that law enforcement have in their possession to be accessed. It wouldn't allow mass decryption and so normal users are still protected. That seems like a reasonable compromise to me.

This would ruin the physical security of lost devices wherein the attacker is willing to ruin the device. This is worse than key escrow because it ruins the physical security all all devices everywhere.

At least with key escrow we could laughably pretend that the government would keep their master keys secure. You are suggesting that all portable devices ship with security that can be defeated with a screw driver and hoping nefarious people don't react by installing actual security in software.

> This would ruin the physical security of lost devices wherein the attacker is willing to ruin the device.

Only if they could also secure Apple's cooperation. That's what I was addressing when I said "the extracted key is encrypted and can only be decrypted by Apple".

Ok you are right I missed that. However

Once apple has the keys to the kingdom what is stopping the government making apple give the government such keys ensuring that no warrant is required.

What is stopping users from using software that is ACTUALLY secure.

> what is stopping the government making apple give the government such keys ensuring that no warrant is required

The same thing that's stopping them from silently requiring Apple to include backdoors into every device today.

> What is stopping users from using software that is ACTUALLY secure.

It's the same as with a regular phone line. Users are free to speak in code or use an analog scrambler. Just because a particular interception technique isn't perfect doesn't mean it wouldn't be valuable to law enforcement.

No, both depend on how careful the eavesdropper is about safeguarding their special access. Both could be secure (as secure as planned, anyway) but both add some extra risk.

There are practical differences, sure, but it’s all the same principle.

One cannot automate physical wiretaps on hundreds of millions of people from Nigeria and steal their data or sabotage their infrastructure via access to their phone lines.

It's been a while since wiretaps were a physical thing.

They don't require access to your phone companies premises?

No, not anymore.

The difference is that we can secure Internet traffic. So we should. Just in case.

Reply on news.ycombinator.com