9 ms·
Based on the overview alone (of course I can't read the entire report that fast!), this is exactly what I expect a spy agency would be doing -- if they were not
by dvcc 10y ago
Based on the overview alone (of course I can't read the entire report that fast!), this is exactly what I expect a spy agency would be doing -- if they were not then I would be disappointed.
What exactly in the admittedly shortened list am I supposed to be upset about? It makes no distinction between US citizens and overseas parties. If these actions are being done domestically against US citizens, with no just cause sure I will get upset, but that has yet to be seen.
As usual it seems Wikileaks publishes a sensationalist story around one of their leaks, claiming dozens of zero-day releases where most were already patched. Hell, they included the i0nic jailbreak as one of the 0-day exploits (https://wikileaks.org/ciav7p1/cms/page_13205587.html https://wikileaks.org/ciav7p1/cms/page_13205587.html).
I'll let journalists parse through the full report before coming to any conclusion as of yet. I just find it hard to get excited about any Wikileaks release that has yet to be vetted.
- colinbartlett 10y agoThe "with no just cause" part of the argument is what scares me because the government's idea of a just cause for domestic spying and my own, are often very, very different.
- tyingq 10y agoOne cause for concern is that the CIA appears to not only have lost control of the documentation, but of the tools themselves: "Recently, the CIA lost control of the majority of its hacking arsenal...and associated documentation. This extraordinary collection...gives its possessor the entire hacking capacity of the CIA." So, now, you get to worry about anybody else that might have this toolset. (Not withstanding your note that some of it might have already been available)
- at-fates-hands 10y ago>> So, now, you get to worry about anybody else that might have this toolset. You also have to consider who has the capability to actually use these tools - its not like they come with a user manual. Could Joe Schmo download these and start using them tomorrow? Probably not. Also, I'm pretty sure this isn't "the entire hacking capacity of the CIA". If you consider all the stuff that came out with the Snowden leaks, you'd think this is more likely the tip of the iceberg in terms of tools they're currently using. I would think they're developing new tools and techniques daily.
- tyingq 10y ago>its not like they come with a user manual "including malware, viruses, trojans, weaponized "zero day" exploits, malware remote control systems and associated documentation" Sounds like they do potentially come with a manual. >Also, I'm pretty sure this isn't "the entire hacking capacity of the CIA" Well, yeah. Wikileaks does like to put their spin on things.
- alva 10y agoThey have stated this is part 1 of a long series of Vault7 releases, so it might be possible.
- freeone3000 10y agoReading the leak, these are very clearly tool manuals. Some of the technical documentation is better than the official stuff!
- erikbye 10y agoThese tools, whether from NSA or CIA, are made to be easy to use, and they come with detailed instructions and user guides.
- imron 10y ago> this is exactly what I expect a spy agency would be doing From Wikileaks' overview: "In the wake of Edward Snowden's leaks about the NSA, the U.S. technology industry secured a commitment from the Obama administration that the executive would disclose on an ongoing basis — rather than hoard — serious vulnerabilities, exploits, bugs or "zero days" to Apple, Google, Microsoft, and other US-based manufacturers. ... "Year Zero" documents show that the CIA breached the Obama administration's commitments. Many of the vulnerabilities used in the CIA's cyber arsenal are pervasive and some may already have been found by rival intelligence agencies or cyber criminals." By not releasing this information to technology companies affected, they are increasing the risk of the same exploits being used against high profile US targets.
- waifufucker 10y agoby definition a zero day is unknown, if they detect that it's being used in the wild then they can easily trigger the software vendor to issue emergency patches or plant the story somewhere - hell, they can even release counter malware that can mitigate they have absolutely no reason to reveal their inventory of zero daze; that's not to say they're not morally obligated to do so, but when have morals driven their actions?
- dvcc 10y agoAgain, I think there is a difference between the desired and realistic roles of an intelligence agency in disclosing exploits. Sure, I would hope they disclose them. But at the same time if they are actively using an exploit, I have pretty much no expectation of them disclosing it. I think this has way more to do with our reference-point than anything else. My expectations were never quite as high!
- _jal 10y agoIn other words, you feel attempting to constrain the operations of intelligence agencies is equivalent of asking nicely, and that's the way is should be?
- 10y ago
- tehwalrus 10y ago> If these actions are being done domestically against US citizens, with no just cause sure I will get upset, but that has yet to be seen. May I just ask, why does this distinction matter? Why do you believe the world should be divided into "people who were issued bits of paper by my overlords" and "people who weren't"? I never understood this division in other people's heads. It leads to all sorts of philosophical problems, like for example people believing that war is ethical.
- FullMtlAlcoholc 10y agoI believe that in my heart as well. However, we don't currently live in a world with a federated global government. The recent election in the US highlighted that people do divide the world into imaginary lines on maps and it had a slogan: AMERICA FIRST. It's not just the political class that sees these divisions, it's a majority of the citizens. How would you spark a revolution in people's thinking?
- tehwalrus 10y agoI have written about this in the past. I believe I proposed something like a "no executive" world government, where you had international laws, defined by treaties, and a commitment by some treaty signatories to "arrest" any state actor which broke them. If this coalition of "world police" (which are, of course, armies) were powerful enough, I believe this could lead to less lawbreaking by governments (from the USA to Zimbabwe). Note, the commitment is not to start wars/invade, but specifically to arrest e.g. presidents or generals. You can't do this without an army, but the objective is considerably different from invading, neutralising any opposing forces, and securing a place. Of course, persuading people something like this is a good idea, your actual question, is just about the hardest problem I've ever thought about solving. I still don't really know where to begin, but I'm interested in teaching people epistemology before other things, as a means to halt the "post truth" stuff (which has been going on for years, not only recently!) By the way, if anyone wants to work on these idea with me - I'm calling the concept "World Peace, Inc" in my head - please get in touch with me (clues in profile). I'd love for this to be my job rather than the hobby I don't have time for.
- revelation 10y agoSo you didn't read any of it nor wait for anyone else to but have already come to a number of overarching conclusions and dismiss the release as whole? I guess we can go ahead and close this particular thread then. If you don't want to read any of the source materials, you could possibly at least make the effort to respond to the various philosophical or policy questions this poses, that takes only an opinion.
- dvcc 10y agoThey provided an overview which I read through, but I find it a bit silly to expect any single person to read through the entire report and fact-check it as well. That is what journalists are for.
- topwer 10y ago>What exactly in the admittedly shortened list am I supposed to be upset about? It makes no distinction between US citizens and overseas parties. If these actions are being done domestically against US citizens, with no just cause sure I will get upset, but that has yet to be seen. From the Reppublica article: "Three years ago the news that the Agency had spied on the US Senate intelligence committee's years-long effort to investigate CIA's tortures by penetrating the computers of the committee staff members sparked public outrage and political fury."
- dvcc 10y agoThis is a past revelation that was already investigated, no? Without any direct connection to the current release it muddies the waters.
- RodericDay 10y agoHow does it muddle the waters? People are saying "no big deal I expect my agency to defend me from foreign threats", and it turns out they have been used against domestic do-gooders. It seems incredibly relevant.
- dvcc 10y agoI think it makes an unwarranted (ha!) connection between the current released documents that do not indicate they were used against US citizens, and a previous probed and documented illegal act by the CIA. Not a justification for their previous behavior, more of drawing solid lines between two ideas, where maybe a dash is better fitted.
- tobltobs 10y ago> this is exactly what I expect a spy agency would be doing Loosing their "cyber" equivalents of atomic bombs after they deemed it unnecessary to improve the protection of the US against such those weapons is what you expect?
- Godel_unicode 10y agoThat type of hyperbole isn't helpful. 0-days are hardly equivalent to atomic bombs, much known and patched vulnerabilities.
- omouse 10y agoI'm sorry but I didn't realize it was a requirement for spies to exist to have a free society.
- jessaustin 10y agoDidn't you know, the best way to ensure the citizenry is informed, is to keep lots of secrets?!?
- NoGravitas 10y agoI would also expect a spy agency to be hoarding exploits. I don't think that's the concerning part of the reveal. Here's what I gather are the main issues the analysis discusses. 1. Poor control of the resources means a proliferation concern. Hacking tools are not classified, because it would then be illegal to deploy them if they were. But leaving them unclassified makes it easier for them to spread outside of the agency. 2. The CIA is duplicating the NSA's capabilities for no real reason other than institutional rivalries. One of the lesser issues I thought was particularly interesting is that the CIA works to make attribution more difficult, and in particular, to pin things on the Russians. That's got to be relevant in the current political climate.
- coldpie 10y agoYou don't have to be upset to find something interesting and worthy of discussion.
- 1897234235 10y agoI believe the revelation here is the the CIA has built a duplicate version of the NSA, but with much further reach and less accountability.
- nyolfen 10y ago'further reach' is stretching it to put it lightly. all of the cia tools appear to be individually targeted, whereas the nsa's programs are broadly based on mass surveillance.
- draw_down 10y agoI don't understand making this point unless it's to give yourself permission not to think about this. Feel free not to.
- deleted 10y ago[deleted]
- jMyles 10y ago> What exactly in the admittedly shortened list am I supposed to be upset about? That, with taxpayer dollars, the government of the United States is undermining the security of consumer devices around the world. Part of the difference between your worldview and the view of those of us who find this behavior childish and unacceptable is that you "expect a spy agency would be doing [this;] if they were not then [you] would be disappointed." Whereas for many of us, the legitimacy of the state is already on thin ice and is subject to descent below the x-axis as the internet comes to supplant it. Listening to my neighbor through their TV set is just one thing I want the state to stop doing as our species moves into the internet age; other things I want it to stop include all the other things it does.
- sushisource 10y agoYou don't actually say why they shouldn't be doing this, though. Everyone with this opinion seems to base it on moral grounds around privacy, but in practical terms, is this really harming citizens? So far there's zero evidence these things being used illegally domestically. IE: Without a warrant. There is some evidence that they've prevented some wrongdoing with it, though. I get the theoretical moral argument. I just don't understand why it matters in practical terms. If the government wants to blackmail me, or discriminate against me, or whatever, they're going to do it with or without these tools. To not build them is to willfully give up an important competitive edge on the global stage.
- craftkiller 10y agoConsidering the government is letting pedophiles walk[1] because they don't want to release their exploits, do you really think we would know if they were abusing their power? [1]: https://news.ycombinator.com/item?id=13798924 https://news.ycombinator.com/item?id=13798924
- sushisource 10y agoOk, so we didn't prevent the maximum amount of wrongdoing? No program is perfect. Those pedophiles would've been just as free had they not developed the programs in the first place. You're comparing reality against a theoretical world where we can both prevent crimes and never need to develop the tools necessary to do so. As to the second point, sure, we don't know. That's tangential to my point. Let's assume the government is abusing their power. What does that have to do with these tools? Nothing, besides it maybe makes it a little bit easier for them. But, like I said, they'd do it anyways with sufficient motivation. I still optimistically believe that an important tenet of liberalism is that you put some trust in your government, but recently it seems for many liberals that trust only extends to cushy (not to say I don't want them) domestic programs like healthcare, equality programs, or whatever the program du jour is. I'm willing to trust that our intelligence agencies aren't some nightmare Orwellian monster hellbent on subjugating the populace. Abuse of power could happen just as easily through other agencies, it just doesn't sounds as scary as when you slap a three letter acronym on it.
- njharman 10y ago> am I supposed to be upset about? Who do you imagine is asking you to be upset about anything. A strawman? This is knowledge. Wikileaks is about spreading knowledge. How you react to that knowledge is entirely up to you.
- AgentME 10y agoI'm just disappointed with the phone industry for the current state of rampant insecurity.
- ExactoKnight 10y agoIs it really that bad?! The FBI took Apple to court because it couldn't crack its iPhones...
- ExactoKnight 10y agoIs it really that bad?! The FBI took Apple to court because it couldn't crack its iPhones...
- mtgx 10y agoNo, spy agencies aren't supposed to spy on every single person in the country.
- whereisthegun 10y agoThe internet and all electronics have just become one big spying and manipulation device and this is further evidence of that. No person who values freedom wants anything like that. I don't want to sit at home knowing that someone can listen in and see and record every thing I do! I am so close to throwing all of these electronics devices in the bin. You are right that a spy agency should be expected to try to find ways into all of these devices. You are of course wrong in trusting that the spy agency is acting in your best interests. They don't have any accountability as we cannot see what they are doing. Wikileaks is the only organisation trying to bring accountability to the unaccountable.
- crucialfelix 10y agoWhat I find most interesting is that Trump tweets about Obama tapping his phone and then a few days later this leak happens. In the minds of his supporters this makes him credible. But it also shows that he or Bannon might have known this leak was coming and the "wiretapp" rant was the set up. Which makes things very messy indeed.
- losvedir 10y ago> What exactly in the admittedly shortened list am I supposed to be upset about? This part concerns me: > The archive appears to have been circulated among former U.S. government hackers and contractors in an unauthorized manner, one of whom has provided WikiLeaks with portions of the archive. So, not so much the contents of the leak, but that it happened at all, and that Wikileaks is just one of many who have access. If the total cyber arsenal of the CIA were floating around on the web somehow, I'm glad that Wikileaks made that public. Could potentially see a big spike in viruses, and maybe make plans to avoid products with known exploits and stuff.