5 ms·

I'm going to go out on a limb here. I think he's right. It's a red flag, not the only red flag. Like, if you use strong encryption, have associated with know

I'm going to go out on a limb here. I think he's right. It's a red flag, not the only red flag. Like, if you use strong encryption, have associated with known drug traffickers, and served time in prison on a felony charge, someone might want to keep an eye on you. It's one of many factors that may or may not be worth considering. The use of strong encryption alone should not be considered bad.

ChuckMcM 10y ago
I think that is a more accurate characterization. There are lots of things which can indicate you're trouble. One or even two of them is probably not an issue, once you get to three or four it starts to be harder to explain away.
Miner49er 10y ago
This argument is similar to the "nothing to hide" argument. People shouldn't be flagged just for wanting privacy.
- chrissnell 10y ago
  Not really. I'm saying that it's one of many factors, some typically benign (like "gun owner"), and some not benign ("has a brother fighting for IS in Syria"). To do a better job at intelligence, our government needs to look at these holistically. My argument also extends to things like the TSA. We all like to complain about having to wait in line for security at the airport. Why can't they do better threat assessment? Well, it needs a holistic approach. Why should I, chrissnell, an officer in the Army Reserve, with no criminal record whatsoever, be subjected anything more than a magnetometer at the airport? If the TSA would look at my profile holistically, they would see that I am not a significant threat and that should mean that I would be able to go on my way without interference.
  - maxerickson 10y ago
    Why should anybody be subject to anything more than a magnetometer? Locked doors stop boxcutters.
  - digler999 10y ago
    > chrissnell, an officer in the Army Reserve, thats a red flag. you've got specialized training in weapons and tactics. maybe they should "keep an eye on you" ?
    - TeMPOraL 10y ago
      That depends entirely on their estimate of whether "specialized training in weapons and tactics" is a signal for or against being a potential person of interest. This is a domain of probability, there are rigorous ways to deal with that. Bringing up "nothing to hide" isn't a rational response. Whether or not something constitutes a good signal does not depend on rhetorics! Math doesn't care about what some celebrity said at some point.
    - squozzer 10y ago
      Especially in light of the fact that George Washington was a colonel in the VA Militia before renouncing his allegiance to the king and joining the Continental Army.
  - ska 10y ago
    This program exists, it's called "Trusted Traveler". The most important thing is that it is opt in. If you want to trade some of your privacy for a more efficient time at the airport, you are free to apply. The elephant in this particular room is that if the government has enough information about you to make these sort of decisions holistically, it also has enough information to effect many, many abuses. History teaches us that trusting an organization like this to "do the right thing" is a fools game.
digler999 10y ago
> someone might want to keep an eye on you what good will that do if the suspect is using encryption. thats the whole point!
maxerickson 10y ago
"red flag" has a pretty strong connotation of "worth consideration all on its own". Like in your example, I bet recent association with known drug traffickers is so much of a stronger signal that looking at encryption or felony history is basically worthless. Associating with known criminals is worthy of the label 'red flag'.
yup123 10y ago
I imagine that if criminals know that a product has a backdoor they'll start meeting in person, then what?
JshWright 10y ago
Is locking your door a red flag?
- buckbova 10y ago
  Probably not, but hand delivering/receiving packages in secret probably is.
- venomsnake 10y ago
  Locking my door no. But building 4 meter concrete fence with barbed wire and armed guards around my house probably is. Is encryption door lock(which in the real world are trivial to bypass in case of valid warrant) or Bond villain's lair? Encryption is red flag because so few people are using it.
  - digler999 10y ago
    "so few" people are using online banking ? Or are most of them just connecting via unencrypted telnet sessions ?
    - venomsnake 10y ago
      Any encryption that relies on CA certificates whose issuers can be coerced by the government is not secure by default if you want to protect yourself from said government.
  - jrs235 10y ago
    Is not speeding a red flag if the flow of traffic is going faster than the speed limit?
  - yup123 10y ago
    How about surfing in incognito/private mode? is that a red flag?
    - venomsnake 10y ago
      And how about using outgoing VPN from your office? If you are and IT security chief and see somebody doing it - what will you think?
TeMPOraL 10y ago
Indeed. People are forgetting we have a whole piece of math - called probability theory - for dealing exactly with that stuff. It can tell you whether or not doing X is an evidence for you being Y (or evidence against it). The important thing is - probability theory doesn't depend on rhetorics. Someone speaking the "nothing to hide" argument, or someone else finding arguments against it convincing, doesn't suddenly invalidate Bayes' theorem! Trying to argue from principle is a mistake because reality doesn't listen to principles. The only relevant question is whether encryption/Tor/whatever is or is not currently an evidence for/against being an evildoer, and how strong that evidence is. Those considerations do include things like loss of utility because of false positives / false negatives, too. So for instance, it may be so that evildoers are more likely to use encryption than general population, but there's so much normal people using encryption that you can't get evidence for being evil out of just noticing that a person uses encryption (the same considerations explain why so much of what TSA is doing is security theater).
- _qbxp 10y ago
  I agree with you in general. My issue with this line of thinking for policy decisions, is that I personally believe relying solely on objective probability theory to associate people with _______, without looking at the larger picture, and then building policies from that, could exacerbate the reason the association is being payed attention to in the first place. Let's say theoretically, that people who wear red shirts are objectively more likely to commit a crime. Policies are made such that people with red shirts are targeted for extra policing. People with red shirts who are not criminals feel discriminated and overly watched, and because of that, generate a resentment against society and (I admit this is a jump), ultimately end up with a higher disposition towards committing crimes. And then it just goes on ad infinitum. So in some situations, I would argue that society benefits from ignoring these objective probabilities entirely, if there's evidence that taking action based on them could cause downstream negative consequences.
  - TeMPOraL 10y ago
    I've seen this argument brought up in discussions about racial profiling, and... I think this may be a real - and in some situations significant - phenomenon. I currently have no idea how to model it in a way that could plug into the probability calculations. I need to think about this some more. I say in some situations, because the typical case is that if something (e.g. wearing red shirts) is likely to attract attention you don't want, you'll tend to avoid doing that thing (you'll stop wearing red shirts in order for the police to leave you alone). So there's a negative feedback loop. But I can see how this loop can fail in case of things one can't (easily) change - like skin color, cultural background, religion, etc. This leads me to believe that just looking for probability-based signals may be a good thing in case of guns and encryption, but a bad thing in case of race and religion.
pnathan 10y ago
There's certainly a valid argument for, "smells like a duck, walks like a duck, sounds like a duck.... maybe it's a duck, ok?" It's super clear that we're on the cusp of a total informational transformation in the West in terms of how life is lived, and a consequence is that there are deluges of personal data.... and a lawful, diligent and trustworthy law enforcement or spy officer will want to use that to do their jobs better. Unlike many in the tech world, I don't buy into either left or right anarchism: I think the office of the State is a valid one. So we have to start looking to the future and how to properly safeguard rights in the Information Age.

ChuckMcM 10y ago

I think that is a more accurate characterization. There are lots of things which can indicate you're trouble. One or even two of them is probably not an issue, once you get to three or four it starts to be harder to explain away.

Miner49er 10y ago

This argument is similar to the "nothing to hide" argument. People shouldn't be flagged just for wanting privacy.

chrissnell 10y ago
Not really. I'm saying that it's one of many factors, some typically benign (like "gun owner"), and some not benign ("has a brother fighting for IS in Syria"). To do a better job at intelligence, our government needs to look at these holistically. My argument also extends to things like the TSA. We all like to complain about having to wait in line for security at the airport. Why can't they do better threat assessment? Well, it needs a holistic approach. Why should I, chrissnell, an officer in the Army Reserve, with no criminal record whatsoever, be subjected anything more than a magnetometer at the airport? If the TSA would look at my profile holistically, they would see that I am not a significant threat and that should mean that I would be able to go on my way without interference.
- maxerickson 10y ago
  Why should anybody be subject to anything more than a magnetometer? Locked doors stop boxcutters.
- digler999 10y ago
  > chrissnell, an officer in the Army Reserve, thats a red flag. you've got specialized training in weapons and tactics. maybe they should "keep an eye on you" ?
  - TeMPOraL 10y ago
    That depends entirely on their estimate of whether "specialized training in weapons and tactics" is a signal for or against being a potential person of interest. This is a domain of probability, there are rigorous ways to deal with that. Bringing up "nothing to hide" isn't a rational response. Whether or not something constitutes a good signal does not depend on rhetorics! Math doesn't care about what some celebrity said at some point.
  - squozzer 10y ago
    Especially in light of the fact that George Washington was a colonel in the VA Militia before renouncing his allegiance to the king and joining the Continental Army.
- ska 10y ago
  This program exists, it's called "Trusted Traveler". The most important thing is that it is opt in. If you want to trade some of your privacy for a more efficient time at the airport, you are free to apply. The elephant in this particular room is that if the government has enough information about you to make these sort of decisions holistically, it also has enough information to effect many, many abuses. History teaches us that trusting an organization like this to "do the right thing" is a fools game.

digler999 10y ago

> someone might want to keep an eye on you what good will that do if the suspect is using encryption. thats the whole point!

maxerickson 10y ago

"red flag" has a pretty strong connotation of "worth consideration all on its own". Like in your example, I bet recent association with known drug traffickers is so much of a stronger signal that looking at encryption or felony history is basically worthless. Associating with known criminals is worthy of the label 'red flag'.

yup123 10y ago

I imagine that if criminals know that a product has a backdoor they'll start meeting in person, then what?

JshWright 10y ago

Is locking your door a red flag?

buckbova 10y ago
Probably not, but hand delivering/receiving packages in secret probably is.
venomsnake 10y ago
Locking my door no. But building 4 meter concrete fence with barbed wire and armed guards around my house probably is. Is encryption door lock(which in the real world are trivial to bypass in case of valid warrant) or Bond villain's lair? Encryption is red flag because so few people are using it.
- digler999 10y ago
  "so few" people are using online banking ? Or are most of them just connecting via unencrypted telnet sessions ?
  - venomsnake 10y ago
    Any encryption that relies on CA certificates whose issuers can be coerced by the government is not secure by default if you want to protect yourself from said government.
- jrs235 10y ago
  Is not speeding a red flag if the flow of traffic is going faster than the speed limit?
- yup123 10y ago
  How about surfing in incognito/private mode? is that a red flag?
  - venomsnake 10y ago
    And how about using outgoing VPN from your office? If you are and IT security chief and see somebody doing it - what will you think?

TeMPOraL 10y ago

Indeed. People are forgetting we have a whole piece of math - called probability theory - for dealing exactly with that stuff. It can tell you whether or not doing X is an evidence for you being Y (or evidence against it). The important thing is - probability theory doesn't depend on rhetorics. Someone speaking the "nothing to hide" argument, or someone else finding arguments against it convincing, doesn't suddenly invalidate Bayes' theorem! Trying to argue from principle is a mistake because reality doesn't listen to principles. The only relevant question is whether encryption/Tor/whatever is or is not currently an evidence for/against being an evildoer, and how strong that evidence is. Those considerations do include things like loss of utility because of false positives / false negatives, too. So for instance, it may be so that evildoers are more likely to use encryption than general population, but there's so much normal people using encryption that you can't get evidence for being evil out of just noticing that a person uses encryption (the same considerations explain why so much of what TSA is doing is security theater).

_qbxp 10y ago
I agree with you in general. My issue with this line of thinking for policy decisions, is that I personally believe relying solely on objective probability theory to associate people with _______, without looking at the larger picture, and then building policies from that, could exacerbate the reason the association is being payed attention to in the first place. Let's say theoretically, that people who wear red shirts are objectively more likely to commit a crime. Policies are made such that people with red shirts are targeted for extra policing. People with red shirts who are not criminals feel discriminated and overly watched, and because of that, generate a resentment against society and (I admit this is a jump), ultimately end up with a higher disposition towards committing crimes. And then it just goes on ad infinitum. So in some situations, I would argue that society benefits from ignoring these objective probabilities entirely, if there's evidence that taking action based on them could cause downstream negative consequences.
- TeMPOraL 10y ago
  I've seen this argument brought up in discussions about racial profiling, and... I think this may be a real - and in some situations significant - phenomenon. I currently have no idea how to model it in a way that could plug into the probability calculations. I need to think about this some more. I say in some situations, because the typical case is that if something (e.g. wearing red shirts) is likely to attract attention you don't want, you'll tend to avoid doing that thing (you'll stop wearing red shirts in order for the police to leave you alone). So there's a negative feedback loop. But I can see how this loop can fail in case of things one can't (easily) change - like skin color, cultural background, religion, etc. This leads me to believe that just looking for probability-based signals may be a good thing in case of guns and encryption, but a bad thing in case of race and religion.

pnathan 10y ago

There's certainly a valid argument for, "smells like a duck, walks like a duck, sounds like a duck.... maybe it's a duck, ok?" It's super clear that we're on the cusp of a total informational transformation in the West in terms of how life is lived, and a consequence is that there are deluges of personal data.... and a lawful, diligent and trustworthy law enforcement or spy officer will want to use that to do their jobs better. Unlike many in the tech world, I don't buy into either left or right anarchism: I think the office of the State is a valid one. So we have to start looking to the future and how to properly safeguard rights in the Information Age.