4 ms·

> That assumes the man did not first violate... My point exactly - your brain skips right over reckless or accidental and goes straight to malice. > ...doesn'

by woodman 11y ago

> That assumes the man did not first violate... My point exactly - your brain skips right over reckless or accidental and goes straight to malice. > ...doesn't absolve Snowden of responsibility. Not my intent, just pointing out the use of the phrase betrayed a thinly veiled hope for some federal pound me in the ass prison time. > ...foreign high-level leadership targets... If you are referring to NATO allies, then I think the lack of actual response beyond grandstanding indicates that they were aware already. > ...clandestine hardware implantation in transit... This was already well known, supply chain security isn't a new concept. The consumers were the only ones surprised by this revelation. > ...co-traveler inference as a method... Funny you should mention this. Check drudge, where you'll find "Ex-CIA officer faces 'unprecedented' extradition..." [0] The Italian police used this technique to identify 22 individuals alleged to be part of a CIA snatch team, in 2005. [1] So not a big hit to lose a secret surveillance method that had been widely used by foreign governments for at least a decade prior to the leak. [0] https://www.washingtonpost.com/local/ex-cia-officer-faces-extradition-from-portugal-to-italy-for-her-alleged-role-in-clerics-rendition/2016/04/21/b8b08b22-0727-11e6-bdcb-0133da18418d_story.html https://www.washingtonpost.com/local/ex-cia-officer-faces-ex... [1] https://en.wikipedia.org/wiki/Abu_Omar_case https://en.wikipedia.org/wiki/Abu_Omar_case

rl3 11y ago
>My point exactly - your brain skips right over reckless or accidental and goes straight to malice. No, I was just trying to illustrate that the analogy is absurd given the context. Snowden was not unwitting and made explicit choices that had consequences, regardless of underlying motivation. >Not my intent, just pointing out the use of the phrase betrayed a thinly veiled hope for some federal pound me in the ass prison time. Agreed. Though, on the bright side the incidence of rape is probably nonexistent in a place like ADX Florence. You unfortunately just go crazy from solitary instead. >This was already well known, supply chain security isn't a new concept. The consumers were the only ones surprised by this revelation. Yeah, but it's still solid confirmation that a specific actor is doing a very specific thing—one which involved extremely sneaky custom hardware modifications with very fast turnaround times. >The Italian police used this technique to identify 22 individuals alleged to be part of a CIA snatch team, in 2005. This is actually apples and oranges. Cell phone surveillance has been around forever, and the Italians were leveraging the cellular networks in their own country at that. What I'm referring to is automated co-traveler inference in foreign countries to protect friendly personnel. In other words, analyzing massive amounts of data in real-time to detect previously unknown persons based on movement alone. A prerequisite for doing that is first compromising the entire telecommunications network of whatever country you're operating in.
- woodman 11y ago
  > This is actually apples and oranges. You are making a distinction without a difference here. The ss7 network has been known to be broken forever, and all the carriers sell their customer's historical data - so the Italians could have applied the same technique anywhere in the world. > ...automated co-traveler inference... That is exactly what they did, only instead of protecting in real time they ran models after the fact. Real time would actual be easier, because instead of dealing with the carrier - you just poll the ss7 network. There is nothing novel about the tracking methods, the inference, or the combination of the two.
  - rl3 11y ago
    NSA's setup isn't simply SS7 though, and it's probably entirely passive at that.[0] They operate on an industrial scale and have every facet down to a science. Granted, field operatives who carry active cellphones with them while conducting a tail are probably bad at their job to begin with, so you're probably right in that the damage isn't much. [0] https://www.washingtonpost.com/news/the-switch/wp/2013/12/10/new-documents-show-how-the-nsa-infers-relationships-based-on-mobile-location-data/ https://www.washingtonpost.com/news/the-switch/wp/2013/12/10...
    - woodman 11y ago
      Well it can't be entirely passive for time-sensitive/comprehensive monitoring, because telemetric data won't cross one of their numerous tap points unless the target is roaming or the target's carrier is being queried by a roaming partner (or partner of a partner of a...). I'm sure they've got taps inside of major carriers, but I doubt they're inside every network. Considering how regularly ss7 is abused for criminal/commercial activity, they may not have to do much active probing for intra-network monitoring - but the barrier to entry is so low that it would be silly for them not to front a carrier with direct access. I can accept the excuse that ss7 was designed for a world with a few trusted carriers, but the latest stuff (that isn't even backwards compatible) has the exact same class of security flaws. The only rational explanation for the obviously insecure standard defining LTE RRC connection setup (base station control, no mutual auth, no crypto, identifying info in the clear - often with lat/lon) is intentional design. So the argument that the leak had any operational impact sounds pretty silly to me, but I won't deny that it caused serious embarrassment to people who really don't take criticism well.

by woodman 11y ago

rl3 11y ago

>My point exactly - your brain skips right over reckless or accidental and goes straight to malice. No, I was just trying to illustrate that the analogy is absurd given the context. Snowden was not unwitting and made explicit choices that had consequences, regardless of underlying motivation. >Not my intent, just pointing out the use of the phrase betrayed a thinly veiled hope for some federal pound me in the ass prison time. Agreed. Though, on the bright side the incidence of rape is probably nonexistent in a place like ADX Florence. You unfortunately just go crazy from solitary instead. >This was already well known, supply chain security isn't a new concept. The consumers were the only ones surprised by this revelation. Yeah, but it's still solid confirmation that a specific actor is doing a very specific thing—one which involved extremely sneaky custom hardware modifications with very fast turnaround times. >The Italian police used this technique to identify 22 individuals alleged to be part of a CIA snatch team, in 2005. This is actually apples and oranges. Cell phone surveillance has been around forever, and the Italians were leveraging the cellular networks in their own country at that. What I'm referring to is automated co-traveler inference in foreign countries to protect friendly personnel. In other words, analyzing massive amounts of data in real-time to detect previously unknown persons based on movement alone. A prerequisite for doing that is first compromising the entire telecommunications network of whatever country you're operating in.

woodman 11y ago
> This is actually apples and oranges. You are making a distinction without a difference here. The ss7 network has been known to be broken forever, and all the carriers sell their customer's historical data - so the Italians could have applied the same technique anywhere in the world. > ...automated co-traveler inference... That is exactly what they did, only instead of protecting in real time they ran models after the fact. Real time would actual be easier, because instead of dealing with the carrier - you just poll the ss7 network. There is nothing novel about the tracking methods, the inference, or the combination of the two.
- rl3 11y ago
  NSA's setup isn't simply SS7 though, and it's probably entirely passive at that.[0] They operate on an industrial scale and have every facet down to a science. Granted, field operatives who carry active cellphones with them while conducting a tail are probably bad at their job to begin with, so you're probably right in that the damage isn't much. [0] https://www.washingtonpost.com/news/the-switch/wp/2013/12/10/new-documents-show-how-the-nsa-infers-relationships-based-on-mobile-location-data/ https://www.washingtonpost.com/news/the-switch/wp/2013/12/10...
  - woodman 11y ago
    Well it can't be entirely passive for time-sensitive/comprehensive monitoring, because telemetric data won't cross one of their numerous tap points unless the target is roaming or the target's carrier is being queried by a roaming partner (or partner of a partner of a...). I'm sure they've got taps inside of major carriers, but I doubt they're inside every network. Considering how regularly ss7 is abused for criminal/commercial activity, they may not have to do much active probing for intra-network monitoring - but the barrier to entry is so low that it would be silly for them not to front a carrier with direct access. I can accept the excuse that ss7 was designed for a world with a few trusted carriers, but the latest stuff (that isn't even backwards compatible) has the exact same class of security flaws. The only rational explanation for the obviously insecure standard defining LTE RRC connection setup (base station control, no mutual auth, no crypto, identifying info in the clear - often with lat/lon) is intentional design. So the argument that the leak had any operational impact sounds pretty silly to me, but I won't deny that it caused serious embarrassment to people who really don't take criticism well.