6 ms·

We Shouldn’t Wait Another 15 Years for a Conversation About Government Hacking

165 points by ex_amazon_sde 10y ago

wyldfire 10y ago
> We are calling for a conversation around how the government uses that technology. ... > If the Snowden revelations taught us anything, it’s that the government is in little danger of letting law hamstring its opportunistic use of technology. Nor is the executive branch shy about asking Congress for more leeway when hard-pressed. That’s how we got the Patriot Act and the FISA Amendments Act, not to mention the impending changes to Federal Rule of Criminal Procedure 41 and the endless encryption “debate.” I'd be worried that this would be mean that the conversation would be fruitless. The constituencies just won't hold Congress accountable because they don't understand or they don't care. Even though these events generate major headlines, I think most individuals think that it doesn't impact them, or that the only villains to be found are the ones in foreign states, but not ours. I kinda wish that Ars story about the corrupt DEA agents [1] were more publicized. It clearly illustrates the kind of damage that corrupt law enforcement can do. These are the same individuals who are able to summon the power of the Stingrays and similar technology. [1] http://arstechnica.com/tech-policy/2016/08/stealing-bitcoins-with-badges-how-silk-roads-dirty-cops-got-caught/ http://arstechnica.com/tech-policy/2016/08/stealing-bitcoins...
- tedunangst 10y ago
  A story about DEA agents stealing from a drug dealer probably doesn't scare a lot of people who aren't drug dealers.
  - lettergram 10y ago
    I'm not a drug dealer, yet find that horrifying...
    - wfunction 10y ago
      You're also not a lot of people...
  - majormajor 10y ago
    Here's an exchange I had a couple of years ago: Person in late 20s-early-30s in coastal California city (demo info given in anticipation of "out of touch old people"-type blaming followups): "What do you do?" Me: "Computer software, internet stuff." Them: "Oh, is that like that Snowden stuff? How are we going to prevent more people like him from leaking stuff?" The EFF and such are generally awful at presenting their arguments in ways that are convincing to a general audience.
    - swalsh 10y ago
      One of the effects of the generational differences in how we obtain our information about the world also impacts how we view current events in the world. The internet offers a much less filtered version. Unfortunately that means it also requires a higher degree of critical thinking.
      - majormajor 10y ago
        Unfortunately, though, I think if your strategy is "hope people adjust their behavior on your own" then your sales pitch isn't going to be effective. So if we want to change the status quo, how do we make it over that preaching-to-the-choir hump? (This sounds rhetorical, but it's more cynical/frustrated, actually - I don't have the answer.)
        tedunangst 10y ago
        Stop saying "You disagree? You must be an idiot." to start. It's not always so explicit, of course, but it's pretty easy for a solid dose of scorn to slip into an argument that the true believers won't notice. Another exercise is to try presenting (to yourself) the very best argument for the opposing side that you can. Now compare, is this the argument that you are refuting?
- swalsh 10y ago
  > I'd be worried that this would be mean that the conversation would be fruitless. The constituencies just won't hold Congress accountable because they don't understand or they don't care. In my opinion, this is the biggest issue. I'm more concerned that our democracy isn't functioning properly. Trust in the media is at an all-time low, conspiracy theories are flying left and right about everything, and now that some of them have been proven... the existing systems we have in place to change things... are not changing things. I don't get where we go from here.
  - bootload 10y ago
    "In my opinion, this is the biggest issue. I'm more concerned that our democracy isn't functioning properly." @swalsh, the US democracy hasn't functioned properly since '63 ~ https://news.ycombinator.com/item?id=12324273 https://news.ycombinator.com/item?id=12324273
deleted 10y ago
[deleted]
tptacek 10y ago
A better submission for discussion would be Dave Aitel's piece at Lawfare, which is making the rounds in the industry right now, and is linked from this EFF advocacy piece. Nobody at EFF is as close to this issue as Aitel is.
- mordocai 10y ago
  Being close to the issue is often a disadvantage. I don't know enough to say whether that is the case here, but I trust the opinion of a non-profit organization established to defend my rights over an ex-NSA security firm CTO whom I admittedly know nothing about except what I just looked up.
  - 794CD01 10y ago
    Yes, as a wise man once said, people in this country have had enough of experts.
  - tedunangst 10y ago
    This sounds like "I prefer feels to facts."
    - CaptSpify 10y ago
      Or the opposite. People closer to the situation tend to have more "feels"
      - tedunangst 10y ago
        Is the EFF too close? They're pretty one track minded. Either way, there's probably more persuasive arguments that either Aitel or the EFF are correct than "too close".
- jessaustin 10y ago
  Yes by all means read Aitel's piece before reading TFA's point-by-point critique. I do think EFF is worried about too much here, which helps to distract from the main issues. I don't really care about vulns that the State finds or purchases from researchers. I do care about vulns that the State creates, abusing its position to weaken standards or infrastructure. More broadly, I definitely care about unlawful actions the State uses its vulns to commit. Granted, it's difficult to sort one category from the other, from the outside. If we've learned anything, however, it's that we can't simply trust the insiders. EFF wants to know more, and so do I.
paulsutter 10y ago
Does anyone know what provisions CFAA has to allow government hacking? Generally speaking, what are the laws relating to government investigative entities' compliance with law generally? (asking with real curiosity and not taking any position) Found this quote in an article[1] about the FBI's hacking to identify Ross Ulbricht, which made me curious to understand the underlying principles: > “Even if the FBI had somehow ‘hacked’ into the [Silk Road] Server in order to identify its IP address, such an investigative measure would not have run afoul of the Fourth Amendment,” the prosecutors’ new memo reads. “Given that the SR Server was hosting a blatantly criminal website, it would have been reasonable for the FBI to ‘hack’ into it in order to search it, as any such ‘hack’ would simply have constituted a search of foreign property known to contain criminal evidence, for which a warrant was not necessary.” [1] https://www.wired.com/2014/10/feds-silk-road-hack-legal/ https://www.wired.com/2014/10/feds-silk-road-hack-legal/
- tedunangst 10y ago
  Do breaking and entering statutes have specific exceptions for police? That's a real question, because now that I think about it, I don't know the answer. In any case, you'll have a hard time convincing a prosecutor to file charges.
  - lmm 10y ago
    A warrant grants the holder specific exceptions. In the case of not having a warrant I'm not aware of any police-specific exceptions - there are general exceptions ("lawful excuse"), and qualified immunity would also apply provided they didn't violate clearly established law. IANAL.
uola 10y ago
I'm not sure there is a productive conversation to be had. Even in the very unlikely case of the US changing their policy, there's nothing stopping anyone else. Even in the very unlikely event that hackers can agree to how the Internet in its implementation should protect basic humans rights, it will be hindered by business interests. At this point we more or less have wait until robustness rather than growth becomes a competitive advantage and with the shift to Asia this could be many centuries.

165 points by ex_amazon_sde 10y ago

> We are calling for a conversation around how the government uses that technology. ... > If the Snowden revelations taught us anything, it’s that the government is in little danger of letting law hamstring its opportunistic use of technology. Nor is the executive branch shy about asking Congress for more leeway when hard-pressed. That’s how we got the Patriot Act and the FISA Amendments Act, not to mention the impending changes to Federal Rule of Criminal Procedure 41 and the endless encryption “debate.” I'd be worried that this would be mean that the conversation would be fruitless. The constituencies just won't hold Congress accountable because they don't understand or they don't care. Even though these events generate major headlines, I think most individuals think that it doesn't impact them, or that the only villains to be found are the ones in foreign states, but not ours. I kinda wish that Ars story about the corrupt DEA agents [1] were more publicized. It clearly illustrates the kind of damage that corrupt law enforcement can do. These are the same individuals who are able to summon the power of the Stingrays and similar technology. [1] http://arstechnica.com/tech-policy/2016/08/stealing-bitcoins-with-badges-how-silk-roads-dirty-cops-got-caught/ http://arstechnica.com/tech-policy/2016/08/stealing-bitcoins...

tedunangst 10y ago
A story about DEA agents stealing from a drug dealer probably doesn't scare a lot of people who aren't drug dealers.
- lettergram 10y ago
  I'm not a drug dealer, yet find that horrifying...
  - wfunction 10y ago
    You're also not a lot of people...
- majormajor 10y ago
  Here's an exchange I had a couple of years ago: Person in late 20s-early-30s in coastal California city (demo info given in anticipation of "out of touch old people"-type blaming followups): "What do you do?" Me: "Computer software, internet stuff." Them: "Oh, is that like that Snowden stuff? How are we going to prevent more people like him from leaking stuff?" The EFF and such are generally awful at presenting their arguments in ways that are convincing to a general audience.
  - swalsh 10y ago
    One of the effects of the generational differences in how we obtain our information about the world also impacts how we view current events in the world. The internet offers a much less filtered version. Unfortunately that means it also requires a higher degree of critical thinking.
    - majormajor 10y ago
      Unfortunately, though, I think if your strategy is "hope people adjust their behavior on your own" then your sales pitch isn't going to be effective. So if we want to change the status quo, how do we make it over that preaching-to-the-choir hump? (This sounds rhetorical, but it's more cynical/frustrated, actually - I don't have the answer.)
      - tedunangst 10y ago
        Stop saying "You disagree? You must be an idiot." to start. It's not always so explicit, of course, but it's pretty easy for a solid dose of scorn to slip into an argument that the true believers won't notice. Another exercise is to try presenting (to yourself) the very best argument for the opposing side that you can. Now compare, is this the argument that you are refuting?
swalsh 10y ago
> I'd be worried that this would be mean that the conversation would be fruitless. The constituencies just won't hold Congress accountable because they don't understand or they don't care. In my opinion, this is the biggest issue. I'm more concerned that our democracy isn't functioning properly. Trust in the media is at an all-time low, conspiracy theories are flying left and right about everything, and now that some of them have been proven... the existing systems we have in place to change things... are not changing things. I don't get where we go from here.
- bootload 10y ago
  "In my opinion, this is the biggest issue. I'm more concerned that our democracy isn't functioning properly." @swalsh, the US democracy hasn't functioned properly since '63 ~ https://news.ycombinator.com/item?id=12324273 https://news.ycombinator.com/item?id=12324273

deleted 10y ago

[deleted]

tptacek 10y ago

A better submission for discussion would be Dave Aitel's piece at Lawfare, which is making the rounds in the industry right now, and is linked from this EFF advocacy piece. Nobody at EFF is as close to this issue as Aitel is.

mordocai 10y ago
Being close to the issue is often a disadvantage. I don't know enough to say whether that is the case here, but I trust the opinion of a non-profit organization established to defend my rights over an ex-NSA security firm CTO whom I admittedly know nothing about except what I just looked up.
- 794CD01 10y ago
  Yes, as a wise man once said, people in this country have had enough of experts.
- tedunangst 10y ago
  This sounds like "I prefer feels to facts."
  - CaptSpify 10y ago
    Or the opposite. People closer to the situation tend to have more "feels"
    - tedunangst 10y ago
      Is the EFF too close? They're pretty one track minded. Either way, there's probably more persuasive arguments that either Aitel or the EFF are correct than "too close".
jessaustin 10y ago
Yes by all means read Aitel's piece before reading TFA's point-by-point critique. I do think EFF is worried about too much here, which helps to distract from the main issues. I don't really care about vulns that the State finds or purchases from researchers. I do care about vulns that the State creates, abusing its position to weaken standards or infrastructure. More broadly, I definitely care about unlawful actions the State uses its vulns to commit. Granted, it's difficult to sort one category from the other, from the outside. If we've learned anything, however, it's that we can't simply trust the insiders. EFF wants to know more, and so do I.

paulsutter 10y ago

Does anyone know what provisions CFAA has to allow government hacking? Generally speaking, what are the laws relating to government investigative entities' compliance with law generally? (asking with real curiosity and not taking any position) Found this quote in an article[1] about the FBI's hacking to identify Ross Ulbricht, which made me curious to understand the underlying principles: > “Even if the FBI had somehow ‘hacked’ into the [Silk Road] Server in order to identify its IP address, such an investigative measure would not have run afoul of the Fourth Amendment,” the prosecutors’ new memo reads. “Given that the SR Server was hosting a blatantly criminal website, it would have been reasonable for the FBI to ‘hack’ into it in order to search it, as any such ‘hack’ would simply have constituted a search of foreign property known to contain criminal evidence, for which a warrant was not necessary.” [1] https://www.wired.com/2014/10/feds-silk-road-hack-legal/ https://www.wired.com/2014/10/feds-silk-road-hack-legal/

tedunangst 10y ago
Do breaking and entering statutes have specific exceptions for police? That's a real question, because now that I think about it, I don't know the answer. In any case, you'll have a hard time convincing a prosecutor to file charges.
- lmm 10y ago
  A warrant grants the holder specific exceptions. In the case of not having a warrant I'm not aware of any police-specific exceptions - there are general exceptions ("lawful excuse"), and qualified immunity would also apply provided they didn't violate clearly established law. IANAL.

uola 10y ago

I'm not sure there is a productive conversation to be had. Even in the very unlikely case of the US changing their policy, there's nothing stopping anyone else. Even in the very unlikely event that hackers can agree to how the Internet in its implementation should protect basic humans rights, it will be hindered by business interests. At this point we more or less have wait until robustness rather than growth becomes a competitive advantage and with the shift to Asia this could be many centuries.