11 ms·
UK spies: You know how we said bulk device hacking would be used sparingly?
- setquk 8y agoI’m not overly bothered about this. Their access vectors are more likely to get noticed in bulk and patched so the entire idea is self defeating in the long run. Which is beneficial for all of us.
- Xylakant 8y agoGiven that many many many devices are not patched despite known vulnerabilities, I'd not be overly optimistic about this. Vendors do not provide patches for devices, Vendors go out of business, Users don't patch even when patches are available. This affects everything, routers, phones, IP cameras, you name it. I'd rather expect that the access vectors get noticed and applied by criminals en masse.
- mirimir 8y agoSure, but the key point is that the access vectors will get noticed, and publicized. And people who pay attention and care (including many criminals) will protect themselves.
- anilakar 8y agoAh, the horrors of lifecycle management of consumer devices. Every networked product should come with a legally binding A4/letter-sized sheet that clearly shows the last date the product is guaranteed to receive security patches. Not fulfilling the requirements would have to result in a buyback with the sum directly proportional to whatever time of the promised lifetime is left unused. EU countries already have rather strict consumer protection laws but they really haven't been designed for situations where a hardware product can be rendered unusable by insecure software.
- TomMarius 8y ago> EU countries already have rather strict consumer protection laws but they really haven't been designed for situations where a hardware product can be rendered unusable by insecure software. That is definitely covered by the standard 2 year warranty as insecurity (when security is expected) is seen as defect. If they don't fix it you get your money back. I successfully got my money back for several phones after 1 to 1.5 years.
- andai 8y agoFirst time I've heard of this, this is really interesting. Don't most phones release updates for the first ~2 years? Maybe this law is the reason?
- TomMarius 8y agoIndeed most phones do. This law however applies to resellers of cheap chinese phones of small brands as well, which was my case.
- TomMarius 8y agoEh, how does that make it OK in any way?
- setquk 8y agoIt doesn’t make it ok but it makes it self defeating. We can’t win the ok battle any more as no one up top gives a shit clearly.
- TomMarius 8y agoI'm absolutely sure it's self defeating only temporarily and/or when it doesn't matter. Governments can use literally any amount of money and other resources if they care, and there are many people who wouldn't even require extraordinary sums (being in army is not exactly well paid). We're going full speed into totality. It was absolutely the same when the communist regime started in my home country: People were saying they would not use their new powers against ordinary people and that seizing all farmland would be impractical and then after few years of silence KGB and gulags and executions happened (our local alternatives of course).
- setquk 8y agoThey can but they don’t pay people much and you have to be morally bankrupt to work there. Very few people fit that niche. After paying £27k+ in tuition fees grad priority is earning so the government chased them off too.
- TomMarius 8y agoNot at all. Most people see working for their country as a good thing. They can start paying people literally any sum of money literally any minute they want. And even if UK people wouldn't work for them, mercenaries are common.
- setquk 8y agoNot here in the UK. Once you’ve taken a public sector position you are tainted.
- floatingatoll 8y ago“GCHQ’s planned use of the Investigatory Powers Act 2016 Bulk Equipment Interference Regime” https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/761147/Letter_from_the_Security_Minister_to_Dominic_Grieve_QC_MP_December_2018.pdf https://assets.publishing.service.gov.uk/government/uploads/... (PDF)
- sbhn 8y agoYour data, someone elses money; and in this case, the money for those who can convince you the most that you are in imminent danger and thats why they need so much more money and media attention and fear mongering government support
- kmlx 8y agofear mongering "government is out to get us" vs fear mongering "the terrorists are out to get us". none are true, but fear sells nonetheless.
- retrogradeorbit 8y agoStatistically speaking (tally up the dead for example) the biggest threat people face in their lives is not from any terrorist or criminal, but from their own government.
- PavlovsCat 8y agoKinda terroristic and criminal governments, often enough. And when you consider the lives saved by having hospitals or food safety regulations or whatever, criminals and terrorists are doing nothing positive at all, so these "statistics" seem kinda off. The threat is in not dealing with politics before it deals with you, and a good way to do that is seeing "the government" of a democratic nation as something totally separate from a citizen in that nation... instead of getting engaged because it's so messed up, to disengage further because it's so messed up.
- retrogradeorbit 8y agoEven a stopped clock is right twice a day. That's it. Never stop believing!
- isostatic 8y agoHeart disease rang and wants its statistics back
- 8y ago
- baybal2 8y agoInteresting dilemma there: gazillions of routers with worst possible security vulnerabilities are laying in the open for everybody to exploit. Either you have them flopped yourself, or leave it to the enemy. But in any way, the West has more urgent issues than Chinese popping their routers, namely the issue of their own spy agencies running rampant.
- SmellyGeekBoy 8y agoI'm not so sure, I think I'd rather be spied on by my own country.
- leibwiht 8y agoThat's very silly. Between all of the people capable of spying on you, it's exactly your own country that has the most ability to harm you. The Chinese government can't arrest you if you're not in China, but your government can.
- na85 8y agoChina can assassinate you on foreign soil - as Russia has demonstrated, the consequences for this are essentially nil.
- Nasrudith 8y agoFor a nuclear power petrostate with minimal economic ties. China would get the shit boycotted out of them at least and Iran would get the shit bombed out of them as many politicians have been caught openly drooling at the prospect.
- na85 8y agoSays you, a random internet commentor. Meanwhile international diplomacy's track record is clear.
- mirimir 8y ago
- hkt 8y agoIt'd be lovely if the security services acted to make the general population morr secure instead of less.
- kmlx 8y ago"Police foil seven terror attacks in London in just six months" https://www.standard.co.uk/news/london/police-foil-seven-terror-attacks-in-london-in-just-six-months-a3642371.html https://www.standard.co.uk/news/london/police-foil-seven-ter...
- fromthestart 8y agoI'd be extremely wary of such reports coming from the government. I don't know about other sources but that article provides absolutely no additional information beyond the claim. And I imagine this kind of information is nearly impossible to verify, which they may be betting on. In short, given the current state of media and government, it wouldn't surprise me if this were just propaganda.
- gambiting 8y agoWe are now finding out that during the cold war, the government has released several reports of "arresting communist spies" when in fact, no one was ever found or arrested - it was just a propaganda piece. I would not be surprised if we were seeing the same thing now to support the "war on terror" narrative.
- vahji 8y agoIf they talk evil about something I don't like, that's cool and genuine. If they talk good things about something I don't like, now let me be a cynic here
- mike_hearn 8y agoMaybe but not necessarily. The flip side of your view is that there are absolutely cases that are real, which don't even make it to the press at all. I was an expert witness for a terrorism case in the UK - the guy was convicted - and nothing about it ever surfaced in the media. The reality is that there are a stream of people in the UK who try to carry out terrorist attacks, and who are stopped by the police. Attempting to argue against a bad policy by claiming terrorists are establishment propaganda is likely to be a bad strategy as a result. A much better approach is to ask how many of these terrorists are really using sophisticated cryptography, and how many successful attacks would have been stopped if not for encryption? And there we find the answer is "not many" and "essentially none". There is a great article on that very topic, written by a British journalist who also has acted as an expert witness in many terrorism trials: http://privacy-pc.com/articles/how-terrorists-encrypt-threatscape-overview.html http://privacy-pc.com/articles/how-terrorists-encrypt-threat... It looks at many cases of busted terrorist attacks over many years, and examines the involvement of cryptography. The conclusion is that the intersection of terrorists and sophisticated users of encryption is the empty set. The closest you get is a groupie who worked on things like propaganda and funding, but who wasn't involved in any attacks themselves. Now that article was written quite a few years ago and I suspect the new attitude of companies like Facebook towards encryption has changed the game somewhat, WhatsApp end to end encryption (assuming it's really on for everyone) makes it much easier to protect conversations than before so, it would stand to reason that cryptography does foil terrorism investigations more often than it used to. However, we don't know that, and the IC was yelling about the danger of cryptography for decades already - certainly in the time frame that Duncan Campbell's analysis was written in. In conclusion, I'd focus more on whether real terrorist plots are happening successfully because GCHQ couldn't hack things fast enough, than on whether terrorists exist at all.
- cs02rm0 8y agoThis is presumably a response to the increase in encryption post-Snowden. In which case, it's a good thing from one angle at least - it suggests that moves to encrypt everywhere are frustrating bulk intercept.
- candiodari 8y agoNo, it states the reason in the article: > UK spies are planning to increase their use of bulk equipment interference, as the range of encrypted hardware and software applications they can't tap into increases. So past communication methods came with built-in backdoors for UK spies (and, as it turns out, around 32 other EU agencies). These backdoors are becoming useless for them, and so they seek to force everyone else into providing backdoors for them again.
- mike_hearn 8y agoI'm not sure why you interpret it that way. Nobody has found built-in backdoors for UK spies, and where did you get the "32 other agencies" from? This shift was predicted long in advance and is clearly a response to the increasingly saturation-level usage of SSL. GCHQ and NSA have for decades been oriented primarily around bulk interception of unencrypted radio and fibre traffic, see: http://www.lamont.me.uk/capenhurst/original.html http://www.lamont.me.uk/capenhurst/original.html But what happens when nearly all traffic becomes encrypted? Then they must become ever more reliant on hacking the endpoints, to get at data before the encryption is applied. What's happening is easily explainable without needing to refer to apparently non-existent back doors. The closest thing to that was the EC-DRB algorithm, but nobody ever used that except RSA Inc who got paid to use it, because their back doored algorithm sucked and the back door was spotted very quickly. I doubt it ever had much operational impact.
- mmjaa 8y ago>Nobody has found built-in backdoors for UK spies I think GCHQ's intercept capabilities are pretty well documented in the ANT catalog: https://en.wikipedia.org/wiki/NSA_ANT_catalog https://en.wikipedia.org/wiki/NSA_ANT_catalog I know for a fact that GCHQ are customers of JUNIORMINT. (Check for fingerprints and other sloppy cleaning on the wrappers of those "brand new laptops", folks.. the ones that spent a couple of days in limbo at a 'shipping hub' somewhere around Heathrow/Stanstead, etc.) This is the issue with the duplicity inherent in the 5-eyes agreement - what we think only 'the other guys' can do, our guys can do when they work with the 'other guys'.
- Quarrelsome 8y agoIsn't this the thing that was added that lets police and intelligence agencies hack other machines legally? I thought that was the only decent part of the bill as most of those attacks become narrow and direct in contrast to the problematic broad information gathering the legislation also authorised.
- vectorEQ 8y agoits maybe interesting to read up on what these kind of intelligence services amounted to before the internet and what they generally did. then you can translate these activities to the digital age and see very easily what they do and don't do. even in the first episode of cryptolog (nsa) they state that collectors 'might chose or not chose what rules to adhere to to complete their collection job'. so theres rules not to do things and people with choices (like everywhere in life) and these choices aren't aligning to these rules. like always, a channel for plausible deniability and if the shit hits the fan a scapegoat is chosen to mitigate any damages if public eye caught something suspicious. plain and simple how the intelligence agencies work in whatever context.