From a systems security standpoint, no. This is the same kind of idealistic naivety that causes the FBI to advocate for weak encryption, or senators to call for "security only breakable by us, because we're the good guys".
The same security flaw that lets “baddies” pwn us, also lets us pwn baddies. The same indefatigable crypto that keeps us safe and makes online anything possible, also lets people conspire in secret to overthrow governments — heck, I remember reading the idea of onion routing that led to TOR was a U.S. military project to help anti-government activists in China, and even if that was just an urban legend, one team’s goodies are another team’s baddies.
I don’t have any good solutions here.
This is security vs security, and my weak fleshy hardware is vulnerable to exploding things owing to a lack of backup solutions, therefore if my options were perfect security for my body or for my data, right now I would choose my body, even though loss of data has the potential to be catastrophic.
That said, if it were up to me, police investigations would involve a lot more remote sensing tech instead of hacking… but I say that knowing even that isn’t a no-downside option, and I know that I am unaware of the full implications of police having the budget and power to spy on targets of their choice.
(I’m also in favour of radical decriminalisation of just about everything that can be decriminalised, because I think omniscient surveillance is unavoidable and I don’t want criminals using it to automate blackmail).
A lot of them were democracies.
It is rather unfair to describe me as cherry-picking, however: every comment I've made firmly notes that posting an extremely broad Wikipedia article was flippant and dismissive of _actual_ atrocities. Asking for examples of the article being overly broad, then dismissing the examples as cherry-picking, is blinkered.
The solution is for state actors to move their resources from offense to defense. Imagine half of the NSA budget going into auditing software, both closed source and open source. (They already do that, but AFAIK nowhere near half.)
There is a quite clear and simple line here: the people breaking security for any purpose other than fixing security problems are the "baddies", and the people defending systems are the "goodies".
If some intelligence service decides they want to covertly exploit security issues, they have made their choice to be "baddies" and should be treated as such.
(Coincidentally, this narrative of "XYZ got hacked by ABC hackers, bad ABC!" needs to change to "XYZ got hacked, bad IT sec at XYZ!" - it's your choice to plug your shit into the internet, and your responsibility to make sure you don't get 0wned.)
In this particular case I can't follow this part of the reasoning. It was a counterterrorism operation using sophisticated exploit chains.
Would you clarify what's the bad IT sec? "nobody should use a browser"? https://1.bp.blogspot.com/-37hyk7hERGk/YFDuISGgCNI/AAAAAAAAa...
This naturally leads to a chronic gap between the state of reality and belief about the state of reality.
Also, I'm not sure the clear line is that clear. There will almost always be a tipping point for people for this type of scenario. If the hacking operation that was exposed would have prevented an attack that kills 1 person, was it still OK to expose? 100 people? 10,000? It's almost impossible to know what the exposure cost will be but if people die due to it and it becomes known, some people will rethink what the "right" thing to do was.
This type of stuff seems like it should be decided by elected representatives and not by some team of coders that work for some for profit company. It seems possible to me that the decision they made was based purely on what was best for Google.
I think we as tech workers need to acknowledge and understand the viewpoints contrary to ours and try to compromise with those on the other side. This type of issue is complex and I think we really need to acknowledge that there is no easy "right" solution to something like this. Blind idealism on both sides of the issue won't be good for either side or for society in general. We as tech workers are not infallible and we don't deserve to dictate rules to society just because we know how to write code.
In these discussions we should also distinguish between attacks by nation states and those by non state actors. It seems the argument for weakening encryption is mostly to catch or prevent illegal activities by non state actors who likely lack the sophistication to understand weak encryption fully. State actors would almost certainly know and avoid using weak encryption.
But it gets more interesting. Law enforcement is a perennial cat and mouse game. You catch today’s criminals harnessing weak encryption, the next generation of baddies will get smarter. The end result is weak encryption for everyone, without really helping society except to maybe catch the “current generation of baddies”. Advocates for strong encryption point out that this is an extremely short term and stupid thinking that destroys the protection offered by cryptography without really giving us all that much anyway.
On the completely secure systems end of the spectrum, bad people will take advantage of that complete security. You wouldn't have to worry about having your identity stolen, but I don't know how we would prevent bad actors like organized criminals or terrorists from taking advantage of those completely anonymous and secure tools. I'm also not too sure what living in an authoritarian regime with complete security would look like. Maybe dissidents would still have tools to fight the regime or maybe the regime would be better at controlling the population and squashing dissent.
I personally don't want government to do everything. Security is a trade-off and I wish more people understood this.
But that's exactly what this is not. Every big and scary gun the enemy might have is also a big and scary vulnerability that you could fix. While it's infeasible to have "perfect" security, you can absolutely make the enemy's offensive tools useless.
It's especially bad since when working offensively, you're incentivized to not fix issues. That might be OK for black hats & nations with "questionable" ethics, but how is this a thing in any democratic country? When state agencies are sitting on exploits and purposely not working to get them fixed, that's IMHO a kind of treason on your own country. It's leaving entry points open for others to find. And anything you can find, they can find too.
> Also, I'm not sure the clear line is that clear. [...] prevented an attack that kills 1 person, was it still OK to expose? 100 people? 10,000? [...]
The line is clear, because that attack that the "goodie" western hackers couldn't execute, and possibly resulted in deaths, might as well be an attack that the "baddie" hackers couldn't execute, resulting in people surviving.
Systems are generally designed such that working correctly is the intended best state (even for weapons support systems.) More work going towards keeping systems within their design parameters (i.e. not hacked) should be the best way to save lives. Even if we're talking about some terrorist building a computerized IED, there are likely systems whose correct functioning can help save lives - maybe some chemical detectors at an airport, or first responder management systems, etc.
It's also the only line that can be drawn on an objective standard. Regardless of whether you're the USA, EU, China, or North Korea - "systems functioning correctly to their design" is an universal standard. Do you think North Korea cares about any life that isn't their bonzo supreme leader?
This seems contradictory. If its not possible to have perfect security, how are you supposed to make your enemy's offensive tools useless?
> It's especially bad since when working offensively, you're incentivized to not fix issues. That might be OK for black hats & nations with "questionable" ethics, but how is this a thing in any democratic country? When state agencies are sitting on exploits and purposely not working to get them fixed, that's IMHO a kind of treason on your own country. It's leaving entry points open for others to find. And anything you can find, they can find too.
Yes, it is an extremely gray area that is tough to find an easy answer to. Whatever ideals you want to stick to, the fact is the other side more likely than not will not play by your ideal/"right" rules. It seems like China and Russia have no plans on slowing down pilfering intellectual property and causing chaos in the US. Is it really a good idea for the US to throw down all offensive cyber weapons for some ideal? That would only encourage China and Russia to act worse knowing that they don't have to worry about repercussions from their actions.
> The line is clear, because that attack that the "goodie" western hackers couldn't execute, and possibly resulted in deaths, might as well be an attack that the "baddie" hackers couldn't execute, resulting in people surviving.
In this case, the article was about google exposing a hacking operation of a government that was trying to prevent terrorism. If the terrorists are able to kill people due to this government operation being shutdown are you saying that it was better for google to have exposed it just because security flaws are bad and should be fixed? It isn't possible to know for sure which side is "right" in this situation. If the operation would have prevented deaths with no collateral deaths on the other side, how can anyone say that preventing some bits on computers being moved in unexpected ways is better than having people die?
> Even if we're talking about some terrorist building a computerized IED, there are likely systems whose correct functioning can help save lives - maybe some chemical detectors at an airport, or first responder management systems, etc.
> It's also the only line that can be drawn on an objective standard. Regardless of whether you're the USA, EU, China, or North Korea - "systems functioning correctly to their design" is an universal standard.
Clean, well designed and secure systems are nice and all but I don't a large majority of non-tech workers will agree that this standard trumps every other consideration when it comes to a functioning society. It doesn't seem fair that some tech workers like clean design and they deserve to dictate what is right and wrong in society.
> Clean, well designed and secure systems are nice and all but I don't a large majority of non-tech workers will agree that this standard trumps every other consideration when it comes to a functioning society. It doesn't seem fair that some tech workers like clean design and they deserve to dictate what is right and wrong in society.
I didn't say "clean". I said "functioning correctly to their design". I'm willing to wager a "large majority of non-tech workers" would agree that things are preferably working rather than broken.
Twisting a statement like that is very much in the domain of Eristic Dialectic. Please try to reduce your usage of such tools.
It's funny that it's being used as an argument for why 702 is good, because considering the scale of the operation it's almost laughable. Even more, how many of those points would have been exposed by old fashioned spying.
[1] https://www.nsa.gov/News-Features/Feature-Stories/Article-Vi...
In that context (chess) the final evaluation reveals a well executed attack is superior to a defensive stance. I suspect the same is true of espionage and war. In other words, stop them before they have the opportunity to get to your king.
Another hypothetical: Imagine a future event when, for whatever reason, a band of twenty criminals is intent on breaking into one hundred homes in your neighborhood. The twist is: You can’t call the police for help. Which decision would lead to securing these homes: Each family stays in their home to defend it or one hundred neighbors join forces to repel them?
On a more personal scale, think about jailbreaks/rooting, DRM, "trusted" computing, and all that other user-hostile stuff. The same crypto is also being used to enslave users and enforce monopolies, in which case the security flaws are a way to regain freedom and control. Leaked information is invaluable for the third-party repair industry. Who's the authoritarian one now...?
The world is definitely not black and white. IMHO, governments being afraid of strong crypto and viewing it as a (defensive) weapon are prescient. Why this fact isn't realised by more of the general population is indeed a real issue.
In principle a government can just demand businesses provide users with a “liberty” button that changes the root of all trust in the system. Even if technical reasons mean that button has to be pressed in the factory and its state is read-only forevermore, it is an option. Still secure, more liberal; if it is rootable regardless of this, I’d say it isn’t secure, because if a user can break in a hacker probably can too.
The USA was founded on this principle, and the framers felt it important enough to enshrine in the 1st and 4th amendment. Some could argue the possibility of citizen overthrow helped keep corruption in check for the first 200 years (but probably no longer).
I don't think this property is an absolute (in all cases) bad property.
We restrict law enforcement from using tools like Clearview for many legitimate reasons but there is no such restriction on crime that often involves the same reasons. Even something innocuous such as being in the vicinity of a certain area at a certain time coupled with better deep fakes will create headlines or fabricate evidence to sideline business deals.
I suspect we will be forced to move towards a world where people increasingly get a free pass for past behaviour and many crimes will simply have to be decriminalized for society to function. We are beginning to see push back for many whose careers have been ruined by so little as an errant comment and I expect change to spread from that.
There shouldn't be any. There is no good or moral way to perfectly control a human population. Anything of the sort inherently degrades the human condition because it requires complete submission to authority. Since humans are corruptible, authorities are also corruptible. Therefore, it is vital that crime and insurrection never become impossible even if only to preserve the threat against authority.
You're an American; that makes you the baddies. Whether it's Syria, Libya, Yemen, Iraq, Afghanistan ... Laos, Cambodia, Vietnam..., American troops have run roughshod over the rest of the world for generations.
America is not in charge of the world. It would be a better world if Americans remembered this.
> also lets people conspire in secret to overthrow governments
About that:
http://content.time.com/time/covers/0,16641,19960715,00.html
https://en.wikipedia.org/wiki/1973_Chilean_coup_d%27%C3%A9ta...
Not so, but like I said: one team’s goodies are another team’s baddies.
But after reading the article i can infer that was not the intent here. Based on the article, it seems like the exploits were found because they (exploits) :
"caught the attention of cybersecurity experts thanks to their scale, sophistication, and speed. "
Notice the word 'scale' in there.
This ops seemed to not be targeting a bunch of guys in a mudhut putting together IEDs.
This was something scalable. With the potential to ensnare hundreds maybe even thousands of people...
Also who says a lawfully elected representative government might not:
- act unlawfully, to undermine democracy to make sure they will stay in power.
- act unlawfully for other reasons, there are many such examples in history
- the CCP is also a lawfully elected representative government, because they make the laws so that they are. So you probably mean not "lawfully" but something like "properly"? Also I for example would say a lawfully/properly elected representative government requires that all people can vote and there is real choice about who to vote for. Guess which country has neither? (USA,it removes voting rights from citizens under certain situations and as a winner-takes-all de-facto 2 party system has no real, i.e. no democratic choice when voting. And that is ignoring the fact that the citizens votes can be overuled by a small group of propel, even if they normally don't do so).
So as we take the idealistic approach, any hacking campaign lead by Western intelligence agencies or any initiative to weaken encryption are for most people "pure" in intentions, they're anti-terrorism, they're fighting pedophiles. But any enemy doing the same, China, Russia, NK, Iran, etc. are engaging in terrorism, authoritarianism. It's always very black and white because that's how people are educated.
The absolutely overwhelming majority of people are able to go about their lives every day never questioning how they can hold such dissonant opinions in their head simply because they were told "it's ok when we do it, it's bad when they do it".
And as you can see even the "democratic" approach has a chilling effect. The suggestion most people take away from a cursory parsing of the title or article is that Google acted irresponsibly. Imagine the day this point of view becomes prevalent fueled by the typical political campaign populism. Imagine people and companies being put off from touching the topic out of fear that they're branded irresponsible and unwittingly hindering anti-terrorism efforts because they're disclosing problems of general interest.
Even still, Clapper felt compelled to lie to their faces. How many others have done the same?
Which is great in theory, but raises the question of how you identify friend or foe. Since they do it indirectly by "hallmarks" of the organization, all a skilled adversary has to do is camouflage their code to look like it's from a friendly, and then enjoy flying under the radar.
>"with potentially life and death consequences that go beyond day-to-day internet security."
So this is setting up "counter-terrorism" as some sort of special thing far beyond "day-to-day internet security". But the whole problem is that day-to-day internet security absolutely can involve life-safety issues. Lots of vital infrastructure SCADA is on the internet and ludicrously exploitable. Internet monitoring is now used for all sorts of medical scenarios as well. Even in business settings like hospitals we've seen ransomware and the like cause major damage, but lots of individuals make use of internet devices to empower their ability to have the elderly stay at home longer for example, monitoring for falls or other issues. And even with "just" finance, if someone's small business is destroyed and everyone laid off, that can cause plenty of dangerous ripples.
If anything, I'd say terrorism is near the bottom of my list of threats to my own life and those close to me, right along lightning strikes. Sure, they do happen, and taking some basic transparent precautions is reasonable. But it gets lots of attention precisely because it's rare. Like, the entire point of it is right there in the name, to terrorize people into doing damage to themselves that the attacker could never manage alone. Terrorism is an expression of weakness, not strength.
Am I the only one who doesn’t see anything here that tells you why he should be working for MIT Review writing about cyber security?
People are often all to quick to jump on "democratic country" as if its a simple definition of a country that is beyond reproach. The trouble is that modern politicians spoil that rose-tinted view.
Google should thread carefully here.
But Google? Our intelligence agencies are already relatively unpopular (if you can trust the polls) [1]. I'm not sure that the US government could attack Google like that without serious consequences from the public.
[1]: https://www.pewresearch.org/politics/2018/02/14/majorities-e...