Hacker News Reader

Comment by superuser2 | Hacker News Reader

Open source does not do anything about surveillance of specific individuals the government is interested in. If they can't ask Google for your data, they'll come into your house (or datacenter) and read it off your hard drive.

View on HN

I think part of the point is that if it was in your house it would be more difficult, and require more steps for the government. You've got:

1. Government can just go to one of 3 top email providers (Yahoo / Google / Hotmail) to get access to surveil most people.

2. Government can do surveillance, but must deal with hundreds or thousands of email providers.

3. Government must get a warrant (or at least have someone physically infiltrate your house) to start surveillance on you.

The point here is ramping up the cost / difficulty, so that the government adopts a more conservative approach to using these tools.

1,000 physical searches is not exactly unreasonable for the federal government, given that it's responsible for more than 300 million citizens. The New York Police Department in one year alone served almost 3,000 warrants to actually invade people's homes and search for narcotics. And that was 1997[1].

I would also point out that GMail has more than 400 million users. Investigation of 2,000 of them does not constitute mass surveillance or evidence that it's too easy to get people's data. Is it really outrageous for 0.0006% of the population to be persons of legitimate interest in investigations?

[1]http://www.nytimes.com/1998/05/26/nyregion/raids-and-complai...

There are technical solutions to this [1]. They just run counter to Google's business model. Why do you think they have not rolled out integrated PGP support, even in Labs?

[1] http://en.wikipedia.org/wiki/Deniable_encryption

How could gmail support PGP? The whole point of PGP is that the infrastructure can't read your mail. Even of Gmail wanted to, they couldn't, except maybe in the android/iphone app. But even then, you would be insane to trust them to do it right, even if they tried.

That is exactly my point.

Your point doesn't really make sense, though. As is often brought up in this discussion: see the example of Hushmail[1]. If you don't provide your own encryption mechanism, you cannot trust it, which is what Evbn is saying, I think. That's why it makes no sense as a Lab offering (and I'm not sure which is the worst option: encrypting the email in a browser via javascript or encrypting it after it's on the mail server and out of your control).

And of course you can use PGP with almost any email system right now. Just download thunderbird and enigmail (or whatever is the good one these days) and use gmail through IMAP.

[1] http://en.wikipedia.org/wiki/Hushmail#Compromises_to_email_p...

Order your residential ISP to set up port mirroring, receive all your encrypted email, then go into your house and plant a keystroke logger to get the key. Or just put you in jail until you provide it. Good luck convincing a judge that you download random noise from your IMAP server for fun.

PGP could make it very difficult to surveil the whole population, but that's not what's going on here. There's not really a way to stop a sovereign government from getting data on individuals of interest.

> "but that's not what's going on here."

Not with the NSLs, no. But when you consider the not-so-secret rooms at all the ISPs: that is what's going on there.

Not without a warrant, which is presumably useless against good encryption. Moreover, the dominant view is that a judge can't compel you to disclose the encryption key unless the authorities have already seen what was encrypted.

They can get a warrant to pick your lock and install a keystroke logger, or bust in while you're using your computer, forcibly separate you from it, and download the encryption key from memory.

Right, I'm not arguing that. My point is that it's considerably more difficult for them to go this route; they need to convince a judge to affix his signature (and his credibility) to a warrant by demonstrating the existence of probable cause.

Reply on news.ycombinator.com