4 ms·

Tor users and Linux Journal readers are classified as extremists by NSA

38 points by RatherFunky 10y ago

Lordarminius 10y ago
While we are already witnessing the effects of unrestrained government interference and surveillance in our lives I shudder to consider the world the next generation will inherit from us and grow up in. That said, F..k the NSA. I just opened all the listed links in the article.I am on at least eight more lists now.
- dajohnson89 10y ago
  >Countries like Canada, the UK, New Zealand, Australia, and the US, also known as the "Five Eyes", are exempt from surveillance, however. If you're in one of those countries, you should be in the clear?
  - Lordarminius 10y ago
    > Countries like Canada, the UK, New Zealand, Australia... are exempt from surveillance Anyone with a rudimentary knowledge of spy-craft knows that's not how it works. Everyone will spy on everyone else when they can get away with it.
  - torkable 10y ago
    lol? sure pal
  - nxzero 10y ago
    Given the FBI's interest in Tor, pretty obvious Tor users are targets.
  - toomanybeersies 10y ago
    From the rules file: > fingerprint('anonymizer/tor/torpoject_visit')=http_host('www.torproject.org') and not(xff_cc('US' OR 'GB' OR 'CA' OR 'AU' OR 'NZ')); So yes, it would appear that you would be in the clear. At least for looking at the TOR project website.
nxzero 10y ago
(2014) publication date.
- teh_klev 10y ago
  And from the last time around: https://news.ycombinator.com/item?id=7991696 https://news.ycombinator.com/item?id=7991696
toomanybeersies 10y ago
It does seem to make sense logistically in terms of why they'd do it. Linux Journal isn't a large website, so it's not hard to just bulk add everyone to a list or whatever. It seems they're just trying to bulk sweep up anyone that might be using TAILS.
ittekimasu 10y ago
Is "fingerprint" here referring to the Javascript fingerprint ? (https://panopticlick.eff.org/ https://panopticlick.eff.org/) This is much more potent than IP address, but there don't seem to be much defense against this.
- goodplay 10y ago
  There is. You can either randomize the fingerprint (per-session fresh vm configured from a pool of possibilities) or unify it (tor/tails), provided that enough people do the same.
  - ittekimasu 10y ago
    Is there a (recommended) add-on that does this ?
grkvlt 10y ago
Not this again, I expect better from HN readers. Please do not treat the claims in this poorly researched article as correct information. NO, Tor and Linux users are NOT classified as extremists by the Intelligence Community. Yes, there are mentions of 'Linux Journal', 'TAILs' and 'Tor' in a file with filter definitions. But why? If we look at the actual rules in the file (http://daserste.ndr.de/panorama/xkeyscorerules100.txt http://daserste.ndr.de/panorama/xkeyscorerules100.txt) we see it contains the following definition: // START_DEFINITION /* These variables define terms and websites relating to the TAILs (The Amnesic Incognito Live System) software program, a comsec mechanism advocated by extremists on extremist forums. */ $TAILS_terms=word('tails' or 'Amnesiac Incognito Live System') and word('linux' or ' USB ' or ' CD ' or 'secure desktop' or ' IRC ' or 'truecrypt' or ' tor '); $TAILS_websites=('tails.boum.org/') or ('linuxjournal.com/content/linux*'); // END_DEFINITION This does NOT say that anyone using TAILs or reading the Linux Journal is classed as an extremist. Notice that they describe TAILs is a 'comsec mechanism advocated by extremists' and then go on to define a filter that selects users searching for it. However it would be used in conjunction with filters that also select traffic from browsing those extremist forums. This usefully gives a list of addresses that frequent extremist forums and then seek out and implement the communications security advice given in those forums, thereby indicating they are more than just casual browsers, they have something they wish to hide or secure in their communications. So, once again, the XKeyScore definitions do NOT automatically classify Linux, Tor and TAILs users as 'extremists', they merely give examples of filters that can be used to select traffic mentioning these keywords or connecting to related sites, in order to further filter traffic from known extremist or terrorist groups that also advocate using these tools for communications security. This allows analysts to determine whether an address belongs to a casual browser of these forums, or someone who wishes to keep their extremist or terrorist related browsing secret, and is therefore worthy of further surveillance of their internet traffic.

38 points by RatherFunky 10y ago

While we are already witnessing the effects of unrestrained government interference and surveillance in our lives I shudder to consider the world the next generation will inherit from us and grow up in. That said, F..k the NSA. I just opened all the listed links in the article.I am on at least eight more lists now.

dajohnson89 10y ago
>Countries like Canada, the UK, New Zealand, Australia, and the US, also known as the "Five Eyes", are exempt from surveillance, however. If you're in one of those countries, you should be in the clear?
- Lordarminius 10y ago
  > Countries like Canada, the UK, New Zealand, Australia... are exempt from surveillance Anyone with a rudimentary knowledge of spy-craft knows that's not how it works. Everyone will spy on everyone else when they can get away with it.
- torkable 10y ago
  lol? sure pal
- nxzero 10y ago
  Given the FBI's interest in Tor, pretty obvious Tor users are targets.
- toomanybeersies 10y ago
  From the rules file: > fingerprint('anonymizer/tor/torpoject_visit')=http_host('www.torproject.org') and not(xff_cc('US' OR 'GB' OR 'CA' OR 'AU' OR 'NZ')); So yes, it would appear that you would be in the clear. At least for looking at the TOR project website.

nxzero 10y ago

(2014) publication date.

teh_klev 10y ago
And from the last time around: https://news.ycombinator.com/item?id=7991696 https://news.ycombinator.com/item?id=7991696

toomanybeersies 10y ago

It does seem to make sense logistically in terms of why they'd do it. Linux Journal isn't a large website, so it's not hard to just bulk add everyone to a list or whatever. It seems they're just trying to bulk sweep up anyone that might be using TAILS.

ittekimasu 10y ago

Is "fingerprint" here referring to the Javascript fingerprint ? (https://panopticlick.eff.org/ https://panopticlick.eff.org/) This is much more potent than IP address, but there don't seem to be much defense against this.

goodplay 10y ago
There is. You can either randomize the fingerprint (per-session fresh vm configured from a pool of possibilities) or unify it (tor/tails), provided that enough people do the same.
- ittekimasu 10y ago
  Is there a (recommended) add-on that does this ?

grkvlt 10y ago

Not this again, I expect better from HN readers. Please do not treat the claims in this poorly researched article as correct information. NO, Tor and Linux users are NOT classified as extremists by the Intelligence Community. Yes, there are mentions of 'Linux Journal', 'TAILs' and 'Tor' in a file with filter definitions. But why? If we look at the actual rules in the file (http://daserste.ndr.de/panorama/xkeyscorerules100.txt http://daserste.ndr.de/panorama/xkeyscorerules100.txt) we see it contains the following definition: // START_DEFINITION /* These variables define terms and websites relating to the TAILs (The Amnesic Incognito Live System) software program, a comsec mechanism advocated by extremists on extremist forums. */ $TAILS_terms=word('tails' or 'Amnesiac Incognito Live System') and word('linux' or ' USB ' or ' CD ' or 'secure desktop' or ' IRC ' or 'truecrypt' or ' tor '); $TAILS_websites=('tails.boum.org/') or ('linuxjournal.com/content/linux*'); // END_DEFINITION This does NOT say that anyone using TAILs or reading the Linux Journal is classed as an extremist. Notice that they describe TAILs is a 'comsec mechanism advocated by extremists' and then go on to define a filter that selects users searching for it. However it would be used in conjunction with filters that also select traffic from browsing those extremist forums. This usefully gives a list of addresses that frequent extremist forums and then seek out and implement the communications security advice given in those forums, thereby indicating they are more than just casual browsers, they have something they wish to hide or secure in their communications. So, once again, the XKeyScore definitions do NOT automatically classify Linux, Tor and TAILs users as 'extremists', they merely give examples of filters that can be used to select traffic mentioning these keywords or connecting to related sites, in order to further filter traffic from known extremist or terrorist groups that also advocate using these tools for communications security. This allows analysts to determine whether an address belongs to a casual browser of these forums, or someone who wishes to keep their extremist or terrorist related browsing secret, and is therefore worthy of further surveillance of their internet traffic.