12 ms·

Dutch secret service tries to recruit Tor-admin

267 points by Liriel 10y ago

Freak_NL 10y ago
That student's account of meeting those AIVD suits reads like a spy-thriller fanfic, but if it's true then he's pretty brave publishing it like this. I'm sure the AIVD's cyber division has some talent, but the AIVD leadership is pretty naive about the internet. Last year the director publicly criticized WhatsApp for providing end-to-end encryption because it makes his job harder. Sure. It's not as if any half-decent terrorist wouldn't use advanced cryptography or simply use burner phones to plan and coordinate their attacks.
- pricechild 10y ago
  Naive or pushing a narrative to people who are naive themselves.
  - StavrosK 10y ago
    Pushing a narrative to people who are naive themselves or pushing a narrative about pushing a narrative to people who are naive themselves to people who are naive themselves.
- treflow 10y ago
  You'd be surpised: https://www.techdirt.com/articles/20151118/08474732854/after-endless-demonization-encryption-police-find-paris-attackers-coordinated-via-unencrypted-sms.shtml https://www.techdirt.com/articles/20151118/08474732854/after...
- roel_v 10y ago
  Maybe, but remember that people used to laugh about the capacities of the FBI (and to some extent the NSA) before the Snowden leaks... Besides, high level statements like that (that make the main stream media) aren't meant to be factually correct or framed considering all nuances. It's political maneuvering. People don't always mean literally what they say; part of social intelligence is understanding this, and being able to read between the lines. I wish I had learned about this 2 decades ago. I guess us computer types aren't predisposed to have this come natural to us.
- quincunx 10y ago
  Re: brave publishing it like this I wonder if he could (potentially) be prosecuted for it; the exchange includes "information reasonably assumed confidential." Artikel 85 Wet op de inlichtingen- en veiligheidsdiensten 2002 http://wetten.overheid.nl/BWBR0013409/2017-01-01#Hoofdstuk7 http://wetten.overheid.nl/BWBR0013409/2017-01-01#Hoofdstuk7
  - Freak_NL 10y ago
    I doubt a judge would find that this article of law applies here; for relaying what a private citizen was told by two strangers who approached him for a job offer without any prior contact, without engaging his professional services or hearing him formally as part of an ongoing investigation, and without formally requesting his cooperation in keeping certain information private. If someone from an agency such as the AIVD tells you something in public, you can reasonably assume (one of the definitions of that article) that it is not subject to secrecy.
- pmoriarty 10y ago
  Having more encrypted traffic definitely makes spying harder. It's a lot easier to track, store, and attempt to crack one single terrorist's encrypted traffic in a sea of non-encrypted traffic, than try to pick out the terrorist's encrypted traffic in a sea of other encrypted traffic. If terrorists are the only ones using encryption, then their traffic will stick out like a sore thumb. While if everyone uses encryption, their traffic will simply blend in.
neoeldex 10y ago
I'm surprised they're interested in infiltrating hackerspaces. Is this where they spend our tax money on? Our surveillance state is going in the wrong way.
- throwaway7767 10y ago
  If your goal is to collect everything like the western intelligence services, infiltrating hackerspaces and the CCC seems like a very efficient use of resources. Especially if they're focusing on Tor and related projects, which they seem to be.
- dracht 10y ago
  I assume they're interested in acquiring information and techniques from these hacker gatherings, rather than hoping to find a terrorist there. The attendees are probably/hopefully not the target.
rahkiin 10y ago
I am really not sure how I feel about this, being dutch myself. Isn't this how any country would recruit new people? I don't see what is so wrong about it. Isn't it logical for secret agencies to monitor possible recruits? Isn't that what other companies do as well, to an extent? (Using linkedIn, buying data from Facebook/Twitter/whoever sells). I am not really patriotic, but this is about 'protecting' your country, right? And if we will have some WWIII I think it will be mostly 'cyber'. Regarding the threat: well duh, you are doing something that might make you an accomplice of a crime (with whatever law they make) so yeah, they could arrest you then. How is that even surprising? But eh, I am not an (ethical) hacker, I just build software...
- Grangar 10y ago
  Running a Tor node doesn't make you an accomplice of a crime. That's like saying a taxi driver is an accomplice because he (unwittingly) drove a terrorist around.
  - akjainaj 10y ago
    What % of taxi fares are made by terrorists? What % of Tor traffic is for illegal/immoral/subversive activities?
    - jnbiche 10y ago
      Can you describe what you view as "subversive" activities? Subversive to whom?
      - akjainaj 10y ago
        Subversive against the current order. I'm talking from a secret services perspective, of course.
    - ekidd 10y ago
      Define "subversive." Does politically organizing against Putin count as "subversive"? Does not wanting everything you read online to be tracked and recorded by the NSA/Obama/Trump count as "subversive"? Does not wanting a large fraction of your browsing habits to be added to marketing databases count as "subversive"? Honestly, I would suggest that more people ought to consider encrypting more of their communications just for day to day use.
Grangar 10y ago
This is pretty worrying, I've shared the story around.
- danieldk 10y ago
  I would be more worried if secret services were not trying to acquire assets and keep tabs on potential threats. If others do it, you have to do it too.
  - werid 10y ago
    You were okay with them making a threat to him in order to get him to cooperate too?
  - eeZah7Ux 10y ago
    > If others do it, you have to do it too. And this is why war exists.
- deleted 10y ago
  [deleted]
throw2016 10y ago
It's their job to secure 'assets' and they have a near endless amount of resources, influence and leverage to do so. It's anyone's guess how many 'assets' secret service around the world have on their rolls. While its easy to give in to paranoia or a witchhunt it would be equally amiss to pretend these things don't happen regularly. Things positioned as privacy centric would especially have a lot of attention on them from services around the world. Few would be able to resist, the money, power, purpose and if they have leverage less so. Which makes privacy that much more important, its easy to get leverage if everyone is on file. Trust is a huge premium. For those who need privacy or secrecy better to trust yourself. You don't need any specific technology or project to get those things.
anondon 10y ago
Something very similar happens in the movie The Recruit. Must watch for hackers. I hope the authorities don't go after him for making this public though. I don't know what it would take for Governments around the world to acknowledge the importance of encryption and anonymity tools. Access to private data cuts both ways, if the Government can do it so can the black hats. Maybe a large scale hack of Government networks devastating the economy will bring them to their senses. Given the allegations of Russia's involvement in the recent election, whether true or not, I was expecting Governments around the world to think deeply about cyber security issues. Looks like that won't happen anytime soon.
whazor 10y ago
This is a new strategy of AIVD and MIVD, they are desperately trying to hire skilled hackers. He thinks that AIVD wants him to infiltrate hacker scenes. Reality is probably that they want him to recruit more hackers. Same story about the tor nodes, AIVD knows that hackers want to have tor nodes. They obviously do not care about Tor, thus want to look like they are cool.
- phicoh 10y ago
  Note this interview: http://www.trouw.nl/tr/nl/4324/Nieuws/article/detail/4452683/2017/01/24/Veiligheidsdienst-zoekt-jonge-hackers-tegen-Russische-dreiging.dhtml http://www.trouw.nl/tr/nl/4324/Nieuws/article/detail/4452683... Note they did offer him a position to manage young hackers. I guess the sad part is the threat. Hackers have to decide for themselves if they want to work for the government or not. But is bad if part of recruitment is making threats (and demanding that those threats kept secret).
102381203103 10y ago
Having fun trolling/astroturfing? This type of pseudo-calm innocent style is usually a giveaway. EDIT: "You want to know what others know." is bound to be a troll (or worse).
- rahkiin 10y ago
  Euhm no... not trolling (at least, not aware of it). I just assume that country governments just want to know what other governments are capable of... I mean, it would be great if such a thing was not necessary and there would not be any nation states acting against other nation states. And no, I have not been recruited or work for any other company than my own (which is not in the security business) EDIT: can't reply anymore. But I seem to be wrong indeed. hackerspaces are probably not the best place to look what other gov. can do. Maybe it is for recruiting instead?
  - hueving 10y ago
    >I just assume that country governments just want to know what other governments are capable of... How does sniffing around hackerspaces tell them what other governments are capable of?
- sctb 10y ago
  We detached this subthread from https://news.ycombinator.com/item?id=13490607 https://news.ycombinator.com/item?id=13490607 and marked it off-topic.
digitalengineer 10y ago
We (the Dutch) have one of the most watched societies and it's never enough. All phone/internet data is saved for years with almost dragnet like strength, even though it was deemed excessive by judges. The police buy their traffic information from TomTom, the highways are littered with camera's with licence plate-scanning abilities, cities have permanent bluetooth capable scanners around them (to monitor traffic it is said) and there are there is talk to add a RIFD chip to the official licence plates... And still it's not enough...
- secfirstmd 10y ago
  It's nothing new. It has gone on amongst the NGO and activist community for many years. Especially the aid worker (in places like Pakistan) and environmental defender community (all over the world). We have investigated a number of instances of pitches by both government and corporate intelligence human penetration over the years in many different countries. In fact we cover it quite extensively in our security training programs that we teach. I think people are often surprised to know that we've seen nearly as many human penetration attempts as digital. The activist space is full of (mostly) good hearted humans who are as vulnerable as any normal person to flattery, money, ego etc (the common and preferred pitching point of a service) and weaknesses like crime, blackmail, revenge etc (the lesser preferred pitching point). On a side note, it's always worth pointing out, especially in Europe, that direct attitribution to a service making a pitch is never so sure. Many countries make pitches pretending to be other (usually local) services. For example the US and Israelis are often aware that Europeans often take personal political stances against their government policies so they will impersonate a local service like AVID. People have spent years not realising what service or country they are really working for.
  - digitalengineer 10y ago
    > People have spent years not realising what service or country they are really working for. Imagine someone's surprise when they get arrested. They thought they were doing their country a service and it turns out they were actually aiding the enemy...
101930199012 10y ago
Could the moderators please investigate why this deliberately naive comment "And if we will have some WWIII I think it will be mostly 'cyber'." is repeatedly upvoted to the top? I've rarely read such garbage as the top comment here.
- thecatspaw 10y ago
  it is upvoted to the top because lots of people agree
  - gvwijk 10y ago
    Could you use capitalization and interpunction? Have you ever heard of the concept of a voting ring? FYI, the moderators have.
    - thecatspaw 10y ago
      Im sorry if the lack of interpunction caused you to not understand my comment. I do have heard of voting rings, yes, of course. However, just because an idea which you dont like is upvoted, doesnt mean its a voting ring. edit: I also find it kinda interesting that an account which is 25minutes old talks about voting rings
- sctb 10y ago
  Please don't comment uncivilly like this. You've gone way too far in assuming malice on behalf of both the parent commenter and the voting community members. In addition, please don't create throwaway accounts for every comment like this—we ban them. Hacker News is a community site and, while pseudonymity is fine, users should be able to expect a mostly continuous identity in their fellow community members. We detached this subthread from https://news.ycombinator.com/item?id=13490564 https://news.ycombinator.com/item?id=13490564 and marked it off-topic.
unixhero 10y ago
Better the Dutch than some other agency.
tinus_hn 10y ago
So they have looked at publicly available information and asked them to work for them. What's the surprise? That the intelligence agencies have people working for them that go to security conferences? That they will say that if you hack a system under their responsibility they will shield you and otherwise they won't? I don't really see the problem here.
- JumpCrisscross 10y ago
  > That they will say that if you hack a system under their responsibility they will shield you Promises are cheaper than deeds. You don't need to actually protect anyone. It's actually better, from the agency's perspective, if they can convert an asset from an honest law-abiding man to someone who has "crash[ed] a system in a public place". They have leverage over the latter. This is how criminals work. Given the secrecy involved, you could never be sure you weren't working for one.
  - tinus_hn 10y ago
    Except recently a widely-publicized law was introduced that actually allows the intelligence agencies to break into computers. So the offer is legitimate and the rest is paranoid superstition.
    - JumpCrisscross 10y ago
      > the offer is legitimate and the rest is paranoid superstition How do you know it's the Dutch intelligence agency recruiting him and not a foreign agency or criminal group? It's unlikely AIVD would put him on their official payroll. From an asset's perspective it will always be difficult to tell--that's how the handler maintains deniability.
besselheim 10y ago
Sounds like he just turned down a rather nice job offer, and burned his bridges by being publicly disgruntled about it.
- phicoh 10y ago
  Many in the Dutch hacker scene would never work for the Dutch government (at least, the more sensitive parts such as intelligence agencies, police, etc.). So mostly likely he didn't want to work for them anyway and was very unhappy about the implicit threats related to his tor exit-nodes.
  - besselheim 10y ago
    Still, he'd have been better off staying quiet about it, in case he changed his outlook in years to come.
    - phicoh 10y ago
      For IT professionals the risk doesn't seem very high. Just running tor exit-nodes is not illegal. There are enough jobs in IT where you don't have to worry about any kind of government approval. There are lots of stories about people who in one way or another got in contact with the intelligence agencies and nothing really bad happened to them. Of course, agreeing to secrecy and then spilling the beans is not recommended. But in this case the agents decided to tell him stuff without any kind of agreement.
    - nyolfen 10y ago
      i think it's commendable that he told this story at risk and cost to himself for the benefit of providing intelligence to the hacker community
fixxer 10y ago
Tor is a huge inconvenience to a government that wants to suppress the exchange of controversial ideas within the civilian population. It is also a huge problem to a government struggling to halt, for instance, Islamic terrorists that are well established within that population and potentially use Tor for communication. I think this is a case of the latter and I don't disagree with the sentiment 100%. The region faces some substantial challenges and we're going to see civil liberties erode.
StavrosK 10y ago
Hah, this is rich: > If you work with us there are benefits, for example if we ask you to crash a system in a public place and you would be arrested for that, we make sure you don’t get arrested and nobody will know about it, not even the police "If you do us a favor, there's the amazing perk that you might not even go to jail for it!"
- secfirstmd 10y ago
  Yeah but that sort of thing is also a hook...once you do it once they begin to own and have greater control over you. Similar to how even when the individual might not want to take anything in return for information, they will want to get the individual to take money or something else in return (free trips to stuff, ego stroking, sex, drugs etc). Especially on a regular basis. This means the individual has a) compromised themselves and now cannot feel "clean" in this previous environment and b) are starting to get used to/spend the new perk/cash so pretty soon they can't live without it. The power relationship then swings more towards a needs based one. Suddenly the handler(s) are the only people who really know the truth about how the informant truly is. Also the handler(s) are the only people how can meet the new need that the person has got hooked on.
- fennecfoxen 10y ago
  Will you do me a favor and send me €2000 or so first, so I can put a lawyer on retainer and run this by him? :)
- apecat 10y ago
  My basic understanding of this matter is this: never co-operate with the intelligence community. Shit on these people and burn their identities whenever you can because they're not your friends. You might even be able to limit the future career opportunities of a younger intelligence officer who's approached you by not only telling your friends, but informing the entire internet. These people may be a necessary extension of diplomacy, but history shows that it's likely toxic for any individual to be ensnared as an asset in any kind work for this sector of the government, foreign or domestic. There are enough 'useful idiots' who will fall for this, you don't need to be one of them. Unless you're an actual employee of an intelligence agency or a contractor, these people will fuck you over in a heartbeat. Anyone unfamiliar with this line of business could do worse than to read any old basic textbook on intelligence and counter-intelligence work (such as 'Thwarting Enemies at Home and Abroad', linked below. There's a good audiobook version on Audible). Training in this business is based on cultivating anti-social behavior in susceptible individuals. Just as you don't want any garden variety sociopaths in your life, you don't want to deal with people who've been trained to fuck with you. http://press.georgetown.edu/book/georgetown/thwarting-enemies-home-and-abroad http://press.georgetown.edu/book/georgetown/thwarting-enemie...
coretx 10y ago
Dutch Pirateparty founder and sometimes information broker here. During my 10+ years of both national and international activism, politics and intelligence trade I came to realize that approximately 2 out of 3 people, NGO's, etc. is compromised. Furthermore, the report is matching what I encountered in reality.
- secfirstmd 10y ago
  Been working on security for NGOs and activist groups all over the world and in every part of the space for a long time. I think your figure is on the high side and overly alarmist. Perhaps with Pirateparty-style groups it is higher than most but not across the whole sector. It's certainly not the case that two-thirds of all groups and activists have been compromised. People forgot that human intelligence operations are actually pretty cost intensive and fairly difficult to pull off well. Some parts of the community make the problem worse once a genuine compromise is found by then creating biases and accusations where none can be confirmed. It really depends on many factors - location, group activities, training, personal, the threats they pose to the actors with the will/desire etc to target them, also how you define compromised (a cleaner keeping tabs? a phishing email opened? a disgruntled volunteer? a paid staff member who walks out the door with data? a leader who has been turned?)
  - donkeyd 10y ago
    >I think your figure is on the high side and overly alarmist. This is actually my gripe with the Dutch pirate party. They are often very alarmist and exaggerate problems in the same way the parties they oppose do. I wish there was a party that's focuses on major issues in stead of exaggerating a small number of issues in order to get popular with a specific market.
    - coretx 10y ago
      You are right when it comes to the alarmism and exaggeration, it's a populist policy choice, detrimental to the roots of the party and something I totally disagree with.
    - 10y ago
lawless123 10y ago
5k a month max seems a a bit low.. for that.. Is it after tax?
franzpeterstein 10y ago
hm, what's wrong ycombinator? Is that a technically/database problem? I don't no it's possible to post double content, with same headline and same link. I mean, that's (in my personal opinion) bad database design. > https://news.ycombinator.com/item?id=13484071 https://news.ycombinator.com/item?id=13484071
- DanBC 10y ago
  The duplicate detector is weak to allow good stories get a second chance. https://news.ycombinator.com/item?id=11273241#11273580 https://news.ycombinator.com/item?id=11273241#11273580
  - franzpeterstein 10y ago
    Ah! Ok, thanks for the info thread link.
- pc86 10y ago
  Don't worry, the points don't get you anything.
sjbase 10y ago
It's always hard to believe a second-hand story on the Internet, but suspending skepticism for a moment: kudos to the guy for telling this. There's easily enough information in there to be identified by the agents he spoke to. He's taking a huge risk. Or maybe he included some false info for noise injection... if so, how do we know which parts to believe? Skepticism suspension lifted, I suppose.
- secfirstmd 10y ago
  >He's taking a huge risk I understand how it can be viewed that way and it's certainly a bit of a risk but realistically it's not a huge risk. If this is AVID, at the end of the day, despite what many may think due to outlying examples, they are an intelligence organisation working in a democracy and their agents aren't normally going to be in the business of retribution for someone turning down a pitch. Plus, if they became known for unnecessary retribution for minor things like someone saying no to a pitch, it would damage their long-term efforts in other areas. They will expect that probably the majority of the pitches they make will be rejected. It's not something new to them. Similarly they will have risk assessed and planned for the eventuality of it being made public. Yes, it will annoy them but they will still just keep on moving through the social network analysis diagrams until they find and pitch the right people they are looking for. Plus, while it will make some people more weary in future, occasionally exposure of efforts like this often leads to a softening up of others who might be interested in doing this sort of thing for them in future. Maybe a few months down the line someone in the community gets pissed off with others and remembers this article and drops AVID a mail........
sjbase 10y ago
It's always hard to believe a second-hand story on the Internet, but suspending skepticism for a moment: kudos to the guy for telling this. There's easily enough information in there to be identified by the agents he spoke to. He's taking a huge risk. Or maybe he included some false info for noise injection... if so, how do we know which parts to believe? Skepticism suspension lifted, I suppose.
DavidWanjiru 10y ago
I may be wondering because I'm standing on an atoll of ignorance in a sea of knowledge, but I wonder why the intelligence themselves can't became Tor admins and do away with needing to recruit anyone.
- Neliquat 10y ago
  I can imagine the red tape for training, then buying and running a node would be a bigger hassle than the usual MO of bribery.
t0mas88 10y ago
This isn't that strange. The police (more public than secret service) and national cyber crime team (also public) are very open in hiring IT and especially infosec talent from the industry, universities and at conferences. They even commercially sponsor IT related news outlets and communities and organise hacker challenges to recruit talent in that space. By far the biggest part of what those teams do isn't secret and fits within the law. The "problem" is that Dutch law is very liberal on wire tapping, decryption etc as long as there is a reasonable suspicion and/or court order. Actually not far behind the rubber stamping in the US, but without the limitation that they can't target our own citizens (so: much worse than the US for locals, but similar for foreigners) Obviously the military and domestic secret service hire the same people and have even wider abilities within the law and quite a wide grey area. Most of the public doesn't care enough to make it a political topic, so nobody stops them.
deleted 10y ago
[deleted]
deleted 10y ago
[deleted]

267 points by Liriel 10y ago

That student's account of meeting those AIVD suits reads like a spy-thriller fanfic, but if it's true then he's pretty brave publishing it like this. I'm sure the AIVD's cyber division has some talent, but the AIVD leadership is pretty naive about the internet. Last year the director publicly criticized WhatsApp for providing end-to-end encryption because it makes his job harder. Sure. It's not as if any half-decent terrorist wouldn't use advanced cryptography or simply use burner phones to plan and coordinate their attacks.

pricechild 10y ago
Naive or pushing a narrative to people who are naive themselves.
- StavrosK 10y ago
  Pushing a narrative to people who are naive themselves or pushing a narrative about pushing a narrative to people who are naive themselves to people who are naive themselves.
treflow 10y ago
You'd be surpised: https://www.techdirt.com/articles/20151118/08474732854/after-endless-demonization-encryption-police-find-paris-attackers-coordinated-via-unencrypted-sms.shtml https://www.techdirt.com/articles/20151118/08474732854/after...
roel_v 10y ago
Maybe, but remember that people used to laugh about the capacities of the FBI (and to some extent the NSA) before the Snowden leaks... Besides, high level statements like that (that make the main stream media) aren't meant to be factually correct or framed considering all nuances. It's political maneuvering. People don't always mean literally what they say; part of social intelligence is understanding this, and being able to read between the lines. I wish I had learned about this 2 decades ago. I guess us computer types aren't predisposed to have this come natural to us.
quincunx 10y ago
Re: brave publishing it like this I wonder if he could (potentially) be prosecuted for it; the exchange includes "information reasonably assumed confidential." Artikel 85 Wet op de inlichtingen- en veiligheidsdiensten 2002 http://wetten.overheid.nl/BWBR0013409/2017-01-01#Hoofdstuk7 http://wetten.overheid.nl/BWBR0013409/2017-01-01#Hoofdstuk7
- Freak_NL 10y ago
  I doubt a judge would find that this article of law applies here; for relaying what a private citizen was told by two strangers who approached him for a job offer without any prior contact, without engaging his professional services or hearing him formally as part of an ongoing investigation, and without formally requesting his cooperation in keeping certain information private. If someone from an agency such as the AIVD tells you something in public, you can reasonably assume (one of the definitions of that article) that it is not subject to secrecy.
pmoriarty 10y ago
Having more encrypted traffic definitely makes spying harder. It's a lot easier to track, store, and attempt to crack one single terrorist's encrypted traffic in a sea of non-encrypted traffic, than try to pick out the terrorist's encrypted traffic in a sea of other encrypted traffic. If terrorists are the only ones using encryption, then their traffic will stick out like a sore thumb. While if everyone uses encryption, their traffic will simply blend in.

neoeldex 10y ago

I'm surprised they're interested in infiltrating hackerspaces. Is this where they spend our tax money on? Our surveillance state is going in the wrong way.

throwaway7767 10y ago
If your goal is to collect everything like the western intelligence services, infiltrating hackerspaces and the CCC seems like a very efficient use of resources. Especially if they're focusing on Tor and related projects, which they seem to be.
dracht 10y ago
I assume they're interested in acquiring information and techniques from these hacker gatherings, rather than hoping to find a terrorist there. The attendees are probably/hopefully not the target.

rahkiin 10y ago

I am really not sure how I feel about this, being dutch myself. Isn't this how any country would recruit new people? I don't see what is so wrong about it. Isn't it logical for secret agencies to monitor possible recruits? Isn't that what other companies do as well, to an extent? (Using linkedIn, buying data from Facebook/Twitter/whoever sells). I am not really patriotic, but this is about 'protecting' your country, right? And if we will have some WWIII I think it will be mostly 'cyber'. Regarding the threat: well duh, you are doing something that might make you an accomplice of a crime (with whatever law they make) so yeah, they could arrest you then. How is that even surprising? But eh, I am not an (ethical) hacker, I just build software...

Grangar 10y ago
Running a Tor node doesn't make you an accomplice of a crime. That's like saying a taxi driver is an accomplice because he (unwittingly) drove a terrorist around.
- akjainaj 10y ago
  What % of taxi fares are made by terrorists? What % of Tor traffic is for illegal/immoral/subversive activities?
  - jnbiche 10y ago
    Can you describe what you view as "subversive" activities? Subversive to whom?
    - akjainaj 10y ago
      Subversive against the current order. I'm talking from a secret services perspective, of course.
  - ekidd 10y ago
    Define "subversive." Does politically organizing against Putin count as "subversive"? Does not wanting everything you read online to be tracked and recorded by the NSA/Obama/Trump count as "subversive"? Does not wanting a large fraction of your browsing habits to be added to marketing databases count as "subversive"? Honestly, I would suggest that more people ought to consider encrypting more of their communications just for day to day use.

Grangar 10y ago

This is pretty worrying, I've shared the story around.

danieldk 10y ago
I would be more worried if secret services were not trying to acquire assets and keep tabs on potential threats. If others do it, you have to do it too.
- werid 10y ago
  You were okay with them making a threat to him in order to get him to cooperate too?
- eeZah7Ux 10y ago
  > If others do it, you have to do it too. And this is why war exists.
deleted 10y ago
[deleted]

throw2016 10y ago

It's their job to secure 'assets' and they have a near endless amount of resources, influence and leverage to do so. It's anyone's guess how many 'assets' secret service around the world have on their rolls. While its easy to give in to paranoia or a witchhunt it would be equally amiss to pretend these things don't happen regularly. Things positioned as privacy centric would especially have a lot of attention on them from services around the world. Few would be able to resist, the money, power, purpose and if they have leverage less so. Which makes privacy that much more important, its easy to get leverage if everyone is on file. Trust is a huge premium. For those who need privacy or secrecy better to trust yourself. You don't need any specific technology or project to get those things.

anondon 10y ago

Something very similar happens in the movie The Recruit. Must watch for hackers. I hope the authorities don't go after him for making this public though. I don't know what it would take for Governments around the world to acknowledge the importance of encryption and anonymity tools. Access to private data cuts both ways, if the Government can do it so can the black hats. Maybe a large scale hack of Government networks devastating the economy will bring them to their senses. Given the allegations of Russia's involvement in the recent election, whether true or not, I was expecting Governments around the world to think deeply about cyber security issues. Looks like that won't happen anytime soon.

whazor 10y ago

This is a new strategy of AIVD and MIVD, they are desperately trying to hire skilled hackers. He thinks that AIVD wants him to infiltrate hacker scenes. Reality is probably that they want him to recruit more hackers. Same story about the tor nodes, AIVD knows that hackers want to have tor nodes. They obviously do not care about Tor, thus want to look like they are cool.

phicoh 10y ago
Note this interview: http://www.trouw.nl/tr/nl/4324/Nieuws/article/detail/4452683/2017/01/24/Veiligheidsdienst-zoekt-jonge-hackers-tegen-Russische-dreiging.dhtml http://www.trouw.nl/tr/nl/4324/Nieuws/article/detail/4452683... Note they did offer him a position to manage young hackers. I guess the sad part is the threat. Hackers have to decide for themselves if they want to work for the government or not. But is bad if part of recruitment is making threats (and demanding that those threats kept secret).

102381203103 10y ago

Having fun trolling/astroturfing? This type of pseudo-calm innocent style is usually a giveaway. EDIT: "You want to know what others know." is bound to be a troll (or worse).

rahkiin 10y ago
Euhm no... not trolling (at least, not aware of it). I just assume that country governments just want to know what other governments are capable of... I mean, it would be great if such a thing was not necessary and there would not be any nation states acting against other nation states. And no, I have not been recruited or work for any other company than my own (which is not in the security business) EDIT: can't reply anymore. But I seem to be wrong indeed. hackerspaces are probably not the best place to look what other gov. can do. Maybe it is for recruiting instead?
- hueving 10y ago
  >I just assume that country governments just want to know what other governments are capable of... How does sniffing around hackerspaces tell them what other governments are capable of?
sctb 10y ago
We detached this subthread from https://news.ycombinator.com/item?id=13490607 https://news.ycombinator.com/item?id=13490607 and marked it off-topic.

digitalengineer 10y ago

We (the Dutch) have one of the most watched societies and it's never enough. All phone/internet data is saved for years with almost dragnet like strength, even though it was deemed excessive by judges. The police buy their traffic information from TomTom, the highways are littered with camera's with licence plate-scanning abilities, cities have permanent bluetooth capable scanners around them (to monitor traffic it is said) and there are there is talk to add a RIFD chip to the official licence plates... And still it's not enough...

secfirstmd 10y ago
It's nothing new. It has gone on amongst the NGO and activist community for many years. Especially the aid worker (in places like Pakistan) and environmental defender community (all over the world). We have investigated a number of instances of pitches by both government and corporate intelligence human penetration over the years in many different countries. In fact we cover it quite extensively in our security training programs that we teach. I think people are often surprised to know that we've seen nearly as many human penetration attempts as digital. The activist space is full of (mostly) good hearted humans who are as vulnerable as any normal person to flattery, money, ego etc (the common and preferred pitching point of a service) and weaknesses like crime, blackmail, revenge etc (the lesser preferred pitching point). On a side note, it's always worth pointing out, especially in Europe, that direct attitribution to a service making a pitch is never so sure. Many countries make pitches pretending to be other (usually local) services. For example the US and Israelis are often aware that Europeans often take personal political stances against their government policies so they will impersonate a local service like AVID. People have spent years not realising what service or country they are really working for.
- digitalengineer 10y ago
  > People have spent years not realising what service or country they are really working for. Imagine someone's surprise when they get arrested. They thought they were doing their country a service and it turns out they were actually aiding the enemy...

101930199012 10y ago

Could the moderators please investigate why this deliberately naive comment "And if we will have some WWIII I think it will be mostly 'cyber'." is repeatedly upvoted to the top? I've rarely read such garbage as the top comment here.

thecatspaw 10y ago
it is upvoted to the top because lots of people agree
- gvwijk 10y ago
  Could you use capitalization and interpunction? Have you ever heard of the concept of a voting ring? FYI, the moderators have.
  - thecatspaw 10y ago
    Im sorry if the lack of interpunction caused you to not understand my comment. I do have heard of voting rings, yes, of course. However, just because an idea which you dont like is upvoted, doesnt mean its a voting ring. edit: I also find it kinda interesting that an account which is 25minutes old talks about voting rings
sctb 10y ago
Please don't comment uncivilly like this. You've gone way too far in assuming malice on behalf of both the parent commenter and the voting community members. In addition, please don't create throwaway accounts for every comment like this—we ban them. Hacker News is a community site and, while pseudonymity is fine, users should be able to expect a mostly continuous identity in their fellow community members. We detached this subthread from https://news.ycombinator.com/item?id=13490564 https://news.ycombinator.com/item?id=13490564 and marked it off-topic.

unixhero 10y ago

Better the Dutch than some other agency.

tinus_hn 10y ago

So they have looked at publicly available information and asked them to work for them. What's the surprise? That the intelligence agencies have people working for them that go to security conferences? That they will say that if you hack a system under their responsibility they will shield you and otherwise they won't? I don't really see the problem here.

JumpCrisscross 10y ago
> That they will say that if you hack a system under their responsibility they will shield you Promises are cheaper than deeds. You don't need to actually protect anyone. It's actually better, from the agency's perspective, if they can convert an asset from an honest law-abiding man to someone who has "crash[ed] a system in a public place". They have leverage over the latter. This is how criminals work. Given the secrecy involved, you could never be sure you weren't working for one.
- tinus_hn 10y ago
  Except recently a widely-publicized law was introduced that actually allows the intelligence agencies to break into computers. So the offer is legitimate and the rest is paranoid superstition.
  - JumpCrisscross 10y ago
    > the offer is legitimate and the rest is paranoid superstition How do you know it's the Dutch intelligence agency recruiting him and not a foreign agency or criminal group? It's unlikely AIVD would put him on their official payroll. From an asset's perspective it will always be difficult to tell--that's how the handler maintains deniability.

besselheim 10y ago

Sounds like he just turned down a rather nice job offer, and burned his bridges by being publicly disgruntled about it.

phicoh 10y ago
Many in the Dutch hacker scene would never work for the Dutch government (at least, the more sensitive parts such as intelligence agencies, police, etc.). So mostly likely he didn't want to work for them anyway and was very unhappy about the implicit threats related to his tor exit-nodes.
- besselheim 10y ago
  Still, he'd have been better off staying quiet about it, in case he changed his outlook in years to come.
  - phicoh 10y ago
    For IT professionals the risk doesn't seem very high. Just running tor exit-nodes is not illegal. There are enough jobs in IT where you don't have to worry about any kind of government approval. There are lots of stories about people who in one way or another got in contact with the intelligence agencies and nothing really bad happened to them. Of course, agreeing to secrecy and then spilling the beans is not recommended. But in this case the agents decided to tell him stuff without any kind of agreement.
  - nyolfen 10y ago
    i think it's commendable that he told this story at risk and cost to himself for the benefit of providing intelligence to the hacker community

fixxer 10y ago

Tor is a huge inconvenience to a government that wants to suppress the exchange of controversial ideas within the civilian population. It is also a huge problem to a government struggling to halt, for instance, Islamic terrorists that are well established within that population and potentially use Tor for communication. I think this is a case of the latter and I don't disagree with the sentiment 100%. The region faces some substantial challenges and we're going to see civil liberties erode.

StavrosK 10y ago

Hah, this is rich: > If you work with us there are benefits, for example if we ask you to crash a system in a public place and you would be arrested for that, we make sure you don’t get arrested and nobody will know about it, not even the police "If you do us a favor, there's the amazing perk that you might not even go to jail for it!"

secfirstmd 10y ago
Yeah but that sort of thing is also a hook...once you do it once they begin to own and have greater control over you. Similar to how even when the individual might not want to take anything in return for information, they will want to get the individual to take money or something else in return (free trips to stuff, ego stroking, sex, drugs etc). Especially on a regular basis. This means the individual has a) compromised themselves and now cannot feel "clean" in this previous environment and b) are starting to get used to/spend the new perk/cash so pretty soon they can't live without it. The power relationship then swings more towards a needs based one. Suddenly the handler(s) are the only people who really know the truth about how the informant truly is. Also the handler(s) are the only people how can meet the new need that the person has got hooked on.
fennecfoxen 10y ago
Will you do me a favor and send me €2000 or so first, so I can put a lawyer on retainer and run this by him? :)
apecat 10y ago
My basic understanding of this matter is this: never co-operate with the intelligence community. Shit on these people and burn their identities whenever you can because they're not your friends. You might even be able to limit the future career opportunities of a younger intelligence officer who's approached you by not only telling your friends, but informing the entire internet. These people may be a necessary extension of diplomacy, but history shows that it's likely toxic for any individual to be ensnared as an asset in any kind work for this sector of the government, foreign or domestic. There are enough 'useful idiots' who will fall for this, you don't need to be one of them. Unless you're an actual employee of an intelligence agency or a contractor, these people will fuck you over in a heartbeat. Anyone unfamiliar with this line of business could do worse than to read any old basic textbook on intelligence and counter-intelligence work (such as 'Thwarting Enemies at Home and Abroad', linked below. There's a good audiobook version on Audible). Training in this business is based on cultivating anti-social behavior in susceptible individuals. Just as you don't want any garden variety sociopaths in your life, you don't want to deal with people who've been trained to fuck with you. http://press.georgetown.edu/book/georgetown/thwarting-enemies-home-and-abroad http://press.georgetown.edu/book/georgetown/thwarting-enemie...

coretx 10y ago

Dutch Pirateparty founder and sometimes information broker here. During my 10+ years of both national and international activism, politics and intelligence trade I came to realize that approximately 2 out of 3 people, NGO's, etc. is compromised. Furthermore, the report is matching what I encountered in reality.

secfirstmd 10y ago
Been working on security for NGOs and activist groups all over the world and in every part of the space for a long time. I think your figure is on the high side and overly alarmist. Perhaps with Pirateparty-style groups it is higher than most but not across the whole sector. It's certainly not the case that two-thirds of all groups and activists have been compromised. People forgot that human intelligence operations are actually pretty cost intensive and fairly difficult to pull off well. Some parts of the community make the problem worse once a genuine compromise is found by then creating biases and accusations where none can be confirmed. It really depends on many factors - location, group activities, training, personal, the threats they pose to the actors with the will/desire etc to target them, also how you define compromised (a cleaner keeping tabs? a phishing email opened? a disgruntled volunteer? a paid staff member who walks out the door with data? a leader who has been turned?)
- donkeyd 10y ago
  >I think your figure is on the high side and overly alarmist. This is actually my gripe with the Dutch pirate party. They are often very alarmist and exaggerate problems in the same way the parties they oppose do. I wish there was a party that's focuses on major issues in stead of exaggerating a small number of issues in order to get popular with a specific market.
  - coretx 10y ago
    You are right when it comes to the alarmism and exaggeration, it's a populist policy choice, detrimental to the roots of the party and something I totally disagree with.
  - 10y ago

lawless123 10y ago

5k a month max seems a a bit low.. for that.. Is it after tax?

franzpeterstein 10y ago

hm, what's wrong ycombinator? Is that a technically/database problem? I don't no it's possible to post double content, with same headline and same link. I mean, that's (in my personal opinion) bad database design. > https://news.ycombinator.com/item?id=13484071 https://news.ycombinator.com/item?id=13484071

DanBC 10y ago
The duplicate detector is weak to allow good stories get a second chance. https://news.ycombinator.com/item?id=11273241#11273580 https://news.ycombinator.com/item?id=11273241#11273580
- franzpeterstein 10y ago
  Ah! Ok, thanks for the info thread link.
pc86 10y ago
Don't worry, the points don't get you anything.

sjbase 10y ago

It's always hard to believe a second-hand story on the Internet, but suspending skepticism for a moment: kudos to the guy for telling this. There's easily enough information in there to be identified by the agents he spoke to. He's taking a huge risk. Or maybe he included some false info for noise injection... if so, how do we know which parts to believe? Skepticism suspension lifted, I suppose.

secfirstmd 10y ago
>He's taking a huge risk I understand how it can be viewed that way and it's certainly a bit of a risk but realistically it's not a huge risk. If this is AVID, at the end of the day, despite what many may think due to outlying examples, they are an intelligence organisation working in a democracy and their agents aren't normally going to be in the business of retribution for someone turning down a pitch. Plus, if they became known for unnecessary retribution for minor things like someone saying no to a pitch, it would damage their long-term efforts in other areas. They will expect that probably the majority of the pitches they make will be rejected. It's not something new to them. Similarly they will have risk assessed and planned for the eventuality of it being made public. Yes, it will annoy them but they will still just keep on moving through the social network analysis diagrams until they find and pitch the right people they are looking for. Plus, while it will make some people more weary in future, occasionally exposure of efforts like this often leads to a softening up of others who might be interested in doing this sort of thing for them in future. Maybe a few months down the line someone in the community gets pissed off with others and remembers this article and drops AVID a mail........

sjbase 10y ago

DavidWanjiru 10y ago

I may be wondering because I'm standing on an atoll of ignorance in a sea of knowledge, but I wonder why the intelligence themselves can't became Tor admins and do away with needing to recruit anyone.

Neliquat 10y ago
I can imagine the red tape for training, then buying and running a node would be a bigger hassle than the usual MO of bribery.

t0mas88 10y ago

This isn't that strange. The police (more public than secret service) and national cyber crime team (also public) are very open in hiring IT and especially infosec talent from the industry, universities and at conferences. They even commercially sponsor IT related news outlets and communities and organise hacker challenges to recruit talent in that space. By far the biggest part of what those teams do isn't secret and fits within the law. The "problem" is that Dutch law is very liberal on wire tapping, decryption etc as long as there is a reasonable suspicion and/or court order. Actually not far behind the rubber stamping in the US, but without the limitation that they can't target our own citizens (so: much worse than the US for locals, but similar for foreigners) Obviously the military and domestic secret service hire the same people and have even wider abilities within the law and quite a wide grey area. Most of the public doesn't care enough to make it a political topic, so nobody stops them.

deleted 10y ago

[deleted]

deleted 10y ago

[deleted]