US Military Bought Mass Monitoring Tool Including Internet Browsing, Email Data | Hacker News Reader

US Military Bought Mass Monitoring Tool Including Internet Browsing, Email Data

vice.com

35 pointsNN8812 comments

So...the CEO of Cymru is also on the board of TOR?

That sounds...problematic?

>Beyond his day job as CEO of Team Cymru, Rabbi Rob Thomas also sits on the board of the Tor Project, a privacy focused non-profit that maintains the Tor software. That software is what underpins the Tor anonymity network, a collection of thousands of volunteer-run servers that allow anyone to anonymously browse the internet.

>“Just like Tor users, the developers, researchers, and founders who've made Tor possible are a diverse group of people. But all of the people who have been involved in Tor are united by a common belief: internet users should have private access to an uncensored web,” the Tor Project’s website reads.

>When asked by Motherboard in April about Thomas’ position on the Tor Project board while also being the CEO of a company that sells a capability for attributing activity on the internet, Isabela Bagueros, executive director for the Tor Project, said in an email that “Rabbi Rob's potential conflicts of interest have been vetted according to the standard conflicts disclosure process required of all board members. Based on the board's understanding of Rabbi Rob's work with Team Cymru, the board has not identified any conflicts of interest.”

> Do you work at a company that handles netflow data? Do you work at an ISP distributing that data? Or do you know anything else about the trade or use of netflow data? We'd love to hear from you. Using a non-work phone or computer, you can contact Joseph Cox securely on Signal on +44 20 8133 5190, Wickr on josephcox, or email joseph.cox@vice.com.

Say you do. A new article is published, containing information you leaked. Your company makes a list of lets be extremely generous and say 10,000 employees with access to the leaked data. Then they look at the reporter's social graph, and make a list of everyone 1-2x removed. Then a list of websites where all of these people's contact information or articles have appeared. Then a list of their employees who have seen these articles/contacts on their non-anonymous browsing, sorted by recency and proximity to the author.

How many names does that leave?

Now they look at VPN purchases or downloads of Signal or Tor. Or if you were stupid enough to buy an "anonymous" phone/laptop with a credit card, they can now compare its browsing fingerprint to web searches for Tor/Signal/Vice/etc. originating from your area. Or they buy phone or license-plate reader location data and see if their employees visited any computer stores, but left without making a credit-card purchase.

How many names are left now?

You have nothing to hide, until you want to share something of substance with a journalist. Then you see the cage all around you.

Too complicated. Just send a usps mail: cheap and completely anonymous.

There’s a reason Assange is in Belmarsh and James Dolan is dead.

How hard is it to dodge that surveillance?

As difficult as driving towards a population center and connecting to open or weak WiFi from afar.

I'm a little confused about what's actually going on here.

>The tool, called Augury, is developed by cybersecurity firm Team Cymru and bundles a massive amount of data together and makes it available to government and corporate customers as a paid service.

So they just bought the data? Why couldn't they just ... ask for it from NSA, for free? Is there some legal distinction here that prevents them from getting it from already-running government snooping activities? I suspect that's the case, and is probably the real story here ... DoD circumventing the spirit of some rule or regulation and buying the data direct from brokers.

Side note: it bugs me when articles about the military feature a stock photo of someone in uniform and the uniform is all sorts of wrong. Makes me skeptical of the accuracy in the rest of the reporting.

I remember this being discussed somewhere on HN or Metafilter before. There was this bit where someone was explaining how surveillance efforts are extremely bureaucratized and disjointed across countless departments and entities. So, depending on the objective, it can be much more difficult to get something from someone else in a different government organization through official channels than it would be to just spend money on buying the info through the private sector.

And this makes sense when you think about it. Like yeah, the NSA has everything locked away somewhere but the limitations on giving access to that are probably very serious. When you’re a smaller guy in some other government or corporate organization and you’re on a fishing expedition for some lower level routine investigation, you’re probably not going to be asking your boss or higher ups for the most expensive solution to your problem.

And yeah - the stock photo is just lazy.

Totally. A mapping of this bureaucracy to see how e.g. the Department of the Navy is being blocked was what I was hoping for in this article. We so often hear about the terrible controls that exist within USG for surveillance, and in parallel how the vast bureaucracy makes USG horribly inefficient and wasteful and so on. Bureaucracy as a feature to prevent (literally) unwarranted state surveillance, circumvented by the accessibility provided by surveillance capitalism. That’s a story, would read.

Interservice rivalry, probably.

Possibly, yes. Hadn’t considered that.

How easily can this be used to reconstruct browsing history? How easily can another firm replicate it?

Reply on news.ycombinator.com