3 ms·
You're "reality" doesn't match the historical record how FVEY agencies work. Programs like the NSA's BULLRUN[1] or GCHQ's EDGEHILL are well funded ($B/yr) targe
by pdkl95 8y ago
You're "reality" doesn't match the historical record how FVEY agencies work. Programs like the NSA's BULLRUN[1] or GCHQ's EDGEHILL are well funded ($B/yr) target individuals, companies, standards committees[2], and anything else that serves the purpose of preventing or compromising encryption.
One well documented[2] example where individuals were "tasked" (spy on) directly is the compromise of satellite ISP Stellar:
> The document lists "key staff" at the company. The document states they should be identified and "tasked." "Tasking" somebody in signals intelligence jargon means that they are to be targeted for surveillance. In addition to CEO Christian Steffen, nine other employees are named in the document.
The shock on the IT chief's face[4] when he saw his name in an NSA document...
[1] https://en.wikipedia.org/wiki/Bullrun_%28decryption_program%29 https://en.wikipedia.org/wiki/Bullrun_%28decryption_program%...
[2] https://www.mail-archive.com/cryptography@metzdowd.com/msg12325.html https://www.mail-archive.com/cryptography@metzdowd.com/msg12...
[3] http://www.spiegel.de/international/world/snowden-documents-indicate-nsa-has-breached-deutsche-telekom-a-991503.html http://www.spiegel.de/international/world/snowden-documents-...
[4] http://www.spiegel.de/video/chokepoint-the-moment-stellar-learns-it-has-been-hacked-video-1521333.html http://www.spiegel.de/video/chokepoint-the-moment-stellar-le...
- vermilingua 8y agoI may have phrased it badly, but my point wasn't that they would/could not target individuals, but more that they don't really care about their capacity as developers; more that these people are simply government implants in the target org, and that whether they are unable to provide the capability through ordinary channels is simply irrelevant. If the Govt strongarms a developer into implanting a backdoor, they won't care that they can't do it without breaking company policy or QA or workflow or even the law, because they cease to be primarily an employee, and become an asset of ASIO.
- alfiedotwtf 8y agoThis is why I'm choosing to stick to the term commandeering