So how do we protect our privacy from the advance of technology? It doesn't seem possible. Just going after NSO is useless.
Like we do with anything else:
These are crimes, but we are stuck in the mindset of the nascent Internet, when it was a growing experiment, a subculture in our society, harmless, and we wanted to nurture it and give it maximum freedom.
Those days are long gone. The Internet is completely integral to our society, like a major city (an extraordinarily large one) - in fact, anything not integrated into the Internet is on the fringe, like a business without a website. The idea of a harmless Internet has been antiquated for a long time; it is a serious place of serious money, serious criminals, and serious political actors.
Yet we still don't have serious law or law enforcement, not as an oppressive force but in the tradition of free, open societies. It would be like New York or Tokyo without law or law enforcement. We should create in the federal government (not state governments, given the Internet's borderless nature) a major domestic law enforcement agency, on the scale of the FBI, to protect people and enforce laws; I suspect we need a major addition to or revision of our legal code to go with it. That is how we deal with crime in other parts of society; the Internet is no different. We need divisions dealing with theft, fraud, destruction or property, invasions (hacking), etc. It's long past time to stop applying the antiquated notions to the current reality. Why do you accept this Wild West chaos; it no long fuels creativity and growth, it greatly hampers it.
Bringing justice to international actors opposing democratic ethics is regrettably less of a priority today than enforcing highly publicized and politicized criminal cases.
But to answer your question more fully, you can't solve this problem without supranational cooperation. A "police force" working to safeguard the Internet would have to work under authority of the UN, not any single nation.
It's an association of governments, where they get together and organize things. All the power is in the individual governments. There are some grey areas and exceptions, but overwhelmingly the above is the case.
The UN could coordinate cybercrime law and national agencies.
Based on an estimate of the design of organizations: Sometimes you expand an existing function within an organization, sometimes you add a sub-organzation (e.g., a division), sometimes you create a new organization. Which, when, and why? Standard CEO fare. A couple basic considerations off the top of my head:
Organizations have priorities. As one example, the story (I can't promise perfect details here) is that the US Air Force has always had the priority of pilots - it's run by pilots, they are glorified - strategic bombers and air superiority (air-to-air) fighter planes. Tasked also with providing close air support for ground soldiers, drones for surveillance, and orbital operations, they don't quite get around to those needs: They want bombers and air superiority fighters, flown by pilots, so that's what gets attention, that's what they invest in researching, developing, and buying - F-35's, B-21's, etc. (name a high-price uber-tech platform they've built for close air support, surveillance, or space). For close air support, they insist the F-35 will do it well enough as a secondary function, and want to cut other options - 'well enough' is not the language of priority. It's a constant battle to get them to deliver on these other needs. Partly for that reason, the Marines provide their own air support and the Army has helicopters - they have different priorities than the Air Force - and the US created a separate Space Force.
Organizations also have competencies, which affects the expertise of leaders, the acquired deep organizational knowledge, the asset investments, the organizational structure, and the culture - systems engineers have a different culture than movie actors. If the people in the executive meeting know storage but not networking, you can imagine the results for the networking function. Consider recruiting, training, mentoring, and promotion for networking personnel. Just consider office locations, which will be near the storage talent and facilities, but not near the Internet exchange and networking talent hotbed.
The FBI's priority has been terrorism. Catching domestic terrorists seems much different than investigating cybercrime. The FBI leaders have little expertise in the latter; the entire organization is built around the former. The agent training and skills needed for cybercrime and terrorism seem completely different, the assets needed seem completely different (field offices versus high-performance, highly secure computing centers). I would guess the culture would be very different, with cybercrime placing a very high priority on intellectual ability seated in a room, not interpersonal skill (interviews, etc.), tactical decisions, and physical action around the world. My impression is that a different agency, or at least a major FBI division that reports directly to the top, is needed.
Sure, not everything is always their fault, but usually it is and comes with yoloing from the first line of code, shipping alph… proof of concept software, or outsourcing their network’s security to MS Word. If a breach could ruin a company beyond reputation, people may stop storing cleartext credentials or testing merely their app’s UI at best; if a hacker could stop your show, companies may take bug bounty programs serious, and be grateful for disclosures instead of filing reports, when someone edit-and-resend’ed on a web API and accidentally got a copy of their database.
Today, a breach has zero consequences. Why would you spend a shitton of money on security, when marketing’s budget isn’t downright ridiculous yet?
And of course it would be super helpful, if governments would stop encouraging insecurity by buying e.g. NSO’s products for what they do. Always awkward persecuting someone you depend on… The NSO’s business should be straight illegal, including export/import. Since hacking someone without their consent usually comes with the ability to tamper with evidence, it’s really questionable for law enforcement and straight unethical for anyone else. Just kill the whole sector IMO.
If your threat model includes targeted attack by a major intelligence agency, just accept that you are likely screwed.
I was driving home today and the satnav warned us about driving over speed limit (74 mph on UK motorway). Ok. But the solution to that is technology - and organisation. There are speed cameras on this road. But most of the time they don't take images or don't trigger an action. If every road camera triggered a warning / fine on every violation then speeding would stop in a few months.
Is that something socially beneficial ? Probably. Would it be disruptive and cause great anger and political resentment? Yes.
That is one tiny example but I think that pretty much every criminal act can be detected with technology - it's going to become which one we care enough about to prosecute and which we give up and decriminialise?
Or governments will continue to have those laws on the books and prosecute them with discretion (which is what happens today). It is very convenient for those in power when every person is already guilty of something.
If society is not free or fair, that's the problem to fix first.
Location can be determine with sufficient accuracy for this purpose from cell-tower connections. More so as 5G, with its greater tower density and shorter range, is rolled out.
(An actual 5G threat you can get behind.)
If you add a VPN to the stack, the VOIP service doesn't know your IP (though I wonder if a VOIP service would work well through a VPN, due to added latency).
If you're making VOIP calls over a device that is itself connected to mobile networks ... you've still got the connectivity of the device itself to track. Presumably that's a long-lived relationship. At this point the information is limited to location data, but that, at the postal-code level is again sufficient to identify 90% of individuals within the US, based largely on residential and workplace locations.
The notion of having short-lived individually-attributable 5G connection history, perhaps through a dongle- or tether-swapping system, in which many individuals utilise devices for a short period of time, might work. With a sufficient budget, disposable devices might also be an option. (As the cost of SBCs / SOCs falls through $0.10/device, the disposable option might be tractable, leaving SIM card provisioning as the bottleneck.)
The tether is connected over WiFi (the MAC address space is already repetitive, and MAC addresses can be arbitrarily changed at the OS kernel level), giving a two-stage connection to the actual mobile network itself. Frequently-relocating (via a swap) or short-lived / previously unknon tethers, as identified through IMEI is required for mobile connections to work, would still be possible, but at a much greater workload. (I'm very sketch on how 5G identifies specific devices, take what I'm saying here with a few kilos of salt.)
I'd still have concerns with a VOIP device that itself has access to information and computing capabilities, but at least the degree of tracking that's possible over a PSTN direct-dialed mobile handset on a 4G/5G network would be sharply reduced. Other threat vectors remain.
Burner phones on a one-use / short-use cycle would probably be preferable.
If by "two problems" you mean that VOIP adds an additional problem, I don't quite grok it. It isn't a panacea, as you point out, but seems like a clear improvement.
Another advantage of VOIP is that you can easily obtain throwaway phone numbers.
> If you're making VOIP calls over a device that is itself connected to mobile networks ... you've still got the connectivity of the device itself to track. Presumably that's a long-lived relationship. At this point the information is limited to location data, but that, at the postal-code level is again sufficient to identify 90% of individuals within the US, based largely on residential and workplace locations.
Good point. They still don't know who I talk to and when, but they certainly can figure out who I am. I wonder how expensive the latter is, which I'd guess it depends on whether that analysis and the sharing of it is done automatically or takes a special request.
> The tether is connected over WiFi
I'm not sure that helps privacy: Wifi networks are likely shorter range than 5G cells, and the networks are well mapped. I suppose it does require involvement of someone with the map, but that might be easy to obtain.
> the MAC address space is already repetitive, and MAC addresses can be arbitrarily changed at the OS kernel level
I think iOS and Android randomize MAC addresses these days ?
> Burner phones on a one-use / short-use cycle would probably be preferable.
Yes, but a single burner phone, between the hardware and a one month plan, can cost $75-100. Using lots of them is out of reach for many people.
On connecting to the tether over WiFi, the advantages over cellular data or Bluetooth is that a WiFi identity (MAC address, SSID) can be arbitrarily changed, and in fact are in consumer-grade hardware (yes, iOS uses a distinct MAC per connected network AFAIU, not positive of Android). This could be modified on every network connection, or even within a single session (requiring periodic reconnects). Other means of specific host identification via TCP/IP and 802.11 protocols are fairly limited.
On increasing workload, much surveillance is done via mass-produced hardware and software, and targets frequently-encountered devices (e.g., stock mobile phones, iOS, and Android systems). Adopting measures and methods other than these ... leaves a signature, but also means that specific new surveillance methods need to be devised for a specific target.
Also: in case anyone mistakes me for an expert on this area, I'm not. I've general familiarity with methods, techniques, protocols, devices, and operating systems.
I was recently asked how to make an anonymous post to a local news organization where all they wanted to do was hide their IP. I said if their only worry is the news organization then a VPN would be enough... Now that I'm reading your comment I'm having second thoughts whether it was right.
Varies by country I’m sure, but I was surprised how difficult it was to buy a SIM in Indonesia and Malaysia without an ID. Even little shops wanted an ID or passport number to type in to activate it.
This is near impossible now. I tried a few years ago to get an anonymous phone to activate an anonymous twitter account and you have to provide too much information to activate the sim card across the major providers and other companies that use their infrastructure.
There's no escape really, your only option is to embrace the paranoia and learn to love the cat-and-mouse game, or (what most people choose) give up. Remember, this is the future you voted for when you signed up for Google Drive and bought your iPhone. This is the future you willingly supported with each ad that YouTube showed you on movie night, and the one you opted-into when you noticed you were low on popcorn and got 2-day delivery on kernels from Amazon.
To illustrate this point, Apple gives up users' data for about 150,000 users/accounts in the US[1] a year in response to government data requests.
Yes, Apple is no different than any other tech company in that regard. The difference is that Apple's PR tells you otherwise. The whole San Bernardino shooting case had many people on HN saying that it meant that Apple would refuse to work with law enforcement when law enforcement would ask for users' data, even to the point of challenging subpeonas and warrants in court. That is clearly not the case.
One of the issues I have is that those warrants are rubber-stamped out. We should change how the judiciary approaches that, raise the bar law enforcement has to meet to be able to request that data, while also encouraging the use of encryption at every level.
Until we make those changes (which I'm of the opinion the wider society does not have an appetite for the legal and usability trade-offs that come with the even if I personally do), I guess I'm confused by what we're demanding when we point out that a company based in the US cooperates with valid legal requests from the US government.
The sentiment towards Apple is just disappointment today. Their 'ecosystem' approach has had detrimental effects on the consumer electronics market, and has given them a frightening amount of power over the flow of information. Apple's treatment has been generally irresponsible, though: they do nothing to assuage the general public of what's running in their OSes, rather choosing to occasionally throw out unverifiable whitepapers of how these systems might work, but we've got no way to verify that. For a company that claims 'privacy is a human right', I was really hoping to dig into something more profound.
The biggest issue is that we're taking Apple at face-value. They're documented liars, and their insistence on being right contrasts with their tacit rejection of transparency. They operate without accountability, and the only people keeping them in check have a mutual interest in creating a monopoly. Their factories are staffed by political prisoners, and they're the only FAANG company who's comfortable operating in China's homeland. It's crazy how people forget this with nothing more than a little marketing and some diversity in their iPhone commercial.
I expect better from a company with more money in the world than anyone else. But maybe this is yet another reminder that shareholders don't care about your security, privacy or peace-of-mind.
Seriously, if you are a journalist investigating anything that might upset the powers that be in a nation-state, don't use any online technology and for gods sake not a mobile phone.
Very unlikely give that the US does this as much as anyone. We are all potential victims in this new form of warfare.
Really not much you can do with zero-clicks.
Don't be rich or famous I guess? Or don't use smartphones.
E.g. https://news.ycombinator.com/item?id=28469193 and https://news.ycombinator.com/item?id=27564236
https://blog.cryptographyengineering.com/2021/07/20/a-case-a...
I think the original landlines, which were/are a few switches connected to a write on one side and some microphones on the other, were close to inherently insecure. Phones haven't ever been "your device" whereas a laptop might, maybe be rendered trustworthy.
One of my banks has been closing branches left and right, and if I want to use my accounts for anything other than debit purchases, I need to use the app. Some banks even charge you when you go to a branch location in person and use a teller to access your accounts.
Some jobs require you to install and use apps on your phone. Last time I was a big box retailer, the floor staff had the company's app installed on their phones so they could do instant price look ups and confirm discounts on their store's inventory.
Even just applying for a job requires an internet browser, and many people's only access to the internet is through their phone.
I don't think the smartphone is inescapable at all, and I don't think any of the conveniences it offers is worth surrendering one's privacy. But there is a tendency in businesses to ignore the fact that some potential customers do not have smartphones. I wonder if legislation against this might be possible.
There is one smartphone with those: https://puri.sm/products/librem-5. The alternative one, Pinephone, has quite inconvenient kill switches.
Is this really true where you are? No menus?
You're not wrong that this fundamentally excludes those who don't have (powered-up) smartphones. But it's not like restaurants and bars had the luxury of thinking through and choosing to have these effective new smartphone requirements: they adapted to Covid for their survival, and the odd case who got unlucky with a dead phone is just collateral damage.
I'm in Canada, and we use QR codes, signed by the government, to show and validate status.
Mine is printed out, and in my pocket. No phone is required.
Thus, no one needs to avoid anything, phone or not.
Also, in your case, is this a federal system or a state by state one? If the latter, this sounds way worse than what NY is doing; with my CA vaccination I couldn't get in anywhere.
The QR code is provincial, but it only requires minor changes to have one provincial app, look at other validation sources.
I agree that sadly, restaurants may find some metrics too high/annoying to deal with, and opt for a lost sale.
I was also at a play where a QR code was the only way to get the program.
Using your device to read the menu puts your device in the loop where formerly it was not.
It's not comparing websites accessed via QR against every other already tracked thing in society, it's comparing it with laminated pieces of paper.
I didn't mean they generate QR codes dynamically. It wouldn't be hard at all to encode the table number, for example, and then of course they have the time and know your reservation, and thus can identify their customer's phone.