5 ms·

Facebook and Instagram have guaranteed that spies can be identified before they even decide to become spies. There will be decades of facial recognition data an

Facebook and Instagram have guaranteed that spies can be identified before they even decide to become spies. There will be decades of facial recognition data and social media presence as adolescents and adults before the thought of becoming a spy crosses their minds. If you don’t think that governments have already mined this data or have agents in all of the major companies and extracting data that would be extremely naive.

jorblumesea 7y ago
Unless foregin governments continuously poll and save data from FB and IG apis (which is possible) all of that can be faked or deleted. The US intelligence community has deep pockets and relationships to tech companies. You scan a face, and up pops a legit looking FB account. I think the article makes it clear that data from many sources is being used and that there's no one "source of truth". It also points out that there's an increasing sophistication to the creation of online presences.
- mr__y 7y ago
  >Unless foregin governments continuously poll and save data from FB and IG apis (which is possible) all of that can be faked or deleted. Given how simple and relatively cheap that is I would be very suprised if they don't. This is a kind of operation that a few people with their private budgets could pull off (I mean just scraping the contents and storing a single copy , not the analysis part) so don't expect powerful and not-so-powerful organizations or goverments restraining themselves from doing so. This is neither expensive nor difficult while being extremely valuable
  - jorblumesea 7y ago
    It would be interesting to see if the NSA/CIA whomever would hack into external DBs of data and insert fake people into them, so when they check against polled api data, everything checks out. Cyber is an offensive world, after all. I wonder if, thinking in a post truth manner, ambiguous or grey is enough for the intel world.
    - mr__y 7y ago
      Assuming that the average adult citizen is nowadays using social networks for more than a decade you could cross-reference the persons photo with many snapshots of your scraped data expecting the person to show in most of them, not just one. With such approach, the fake profiles would have to be created with many years advance to succeed. Now given that using cryptography it is relatively easy to verify if our reference data was not tampered with this insertion of fake profiles would be kind of hard. Hacking such systems in one way or another could be a "solution" depending on how such systems operate (and if they actually exist or are just a theoretical possibility imagined by hn community)
      - caseysoftware 7y ago
        > With such approach, the fake profiles would have to be created with many years advance to succeed. That's called building a legend and YES, the intelligence agencies have been doing it for years. But more importantly, in professional networks (mostly LinkedIn) generally you wouldn't have to. Most people don't use it the same way as Facebook or Twitter with regular updates and it doesn't show others when you connected so if you create a profile and fill in details, the system takes care of most of the rest. The most likely place that would leak the age of the profile is whatever internal profile id that might be embedded in the urls or the page itself. If it's too high, it would be more recent than claimed. Here are some of the details you can explore: https://caseysoftware.com/blog/open-source-intelligence-linkedin https://caseysoftware.com/blog/open-source-intelligence-link...
        deleted 7y ago
        [deleted]
        mr__y 7y ago
        >and it doesn't show others when you connected if I actually scraped all the profiles in 2009, then in 2014 and then in 2019 I could tell whether an account is a 10+-year old account by simply checking if it is available in my 2009 snapshot. Does not matter if the social network displays or leaks profile age in one way or another. If it's not in my 2009 and not in 2014 snapshots then that profile is 5- years old. With frequent enough snapshots I would get even better timing resolotion. Now given that it's neither that hard nor that expensive to scrape or store that amounts of data, such an approach would actually be feasible.
- Gustomaximus 7y ago
  But how can it be faked? You can upload a fake FB account but it's new. Country X can say 'that account wasn't there 2 years ago'. Nor can agencies set up fake accounts over time as they need to know the faces of future spies to create their fake front over time and that's not possible unless you choose spies from birth.
  - deleted 7y ago
    [deleted]
stef25 7y ago
The scene from Minority Report comes to mind where he takes some kind of pill that painfully distorts his face so as to not be detected by FR cameras. Is the technology currently good enough to detect the same person if they have different color eyes, different sized lips & eyebrows, abundance of lack of facial hair etc, downturned mouth vs smile etc? If you take someone who hasn't slept for 3 days + hangover + flue their face will look substantially different than when fresh as a daisy.

jorblumesea 7y ago

Unless foregin governments continuously poll and save data from FB and IG apis (which is possible) all of that can be faked or deleted. The US intelligence community has deep pockets and relationships to tech companies. You scan a face, and up pops a legit looking FB account. I think the article makes it clear that data from many sources is being used and that there's no one "source of truth". It also points out that there's an increasing sophistication to the creation of online presences.

mr__y 7y ago
>Unless foregin governments continuously poll and save data from FB and IG apis (which is possible) all of that can be faked or deleted. Given how simple and relatively cheap that is I would be very suprised if they don't. This is a kind of operation that a few people with their private budgets could pull off (I mean just scraping the contents and storing a single copy , not the analysis part) so don't expect powerful and not-so-powerful organizations or goverments restraining themselves from doing so. This is neither expensive nor difficult while being extremely valuable
- jorblumesea 7y ago
  It would be interesting to see if the NSA/CIA whomever would hack into external DBs of data and insert fake people into them, so when they check against polled api data, everything checks out. Cyber is an offensive world, after all. I wonder if, thinking in a post truth manner, ambiguous or grey is enough for the intel world.
  - mr__y 7y ago
    Assuming that the average adult citizen is nowadays using social networks for more than a decade you could cross-reference the persons photo with many snapshots of your scraped data expecting the person to show in most of them, not just one. With such approach, the fake profiles would have to be created with many years advance to succeed. Now given that using cryptography it is relatively easy to verify if our reference data was not tampered with this insertion of fake profiles would be kind of hard. Hacking such systems in one way or another could be a "solution" depending on how such systems operate (and if they actually exist or are just a theoretical possibility imagined by hn community)
    - caseysoftware 7y ago
      > With such approach, the fake profiles would have to be created with many years advance to succeed. That's called building a legend and YES, the intelligence agencies have been doing it for years. But more importantly, in professional networks (mostly LinkedIn) generally you wouldn't have to. Most people don't use it the same way as Facebook or Twitter with regular updates and it doesn't show others when you connected so if you create a profile and fill in details, the system takes care of most of the rest. The most likely place that would leak the age of the profile is whatever internal profile id that might be embedded in the urls or the page itself. If it's too high, it would be more recent than claimed. Here are some of the details you can explore: https://caseysoftware.com/blog/open-source-intelligence-linkedin https://caseysoftware.com/blog/open-source-intelligence-link...
      - deleted 7y ago
        [deleted]
      - mr__y 7y ago
        >and it doesn't show others when you connected if I actually scraped all the profiles in 2009, then in 2014 and then in 2019 I could tell whether an account is a 10+-year old account by simply checking if it is available in my 2009 snapshot. Does not matter if the social network displays or leaks profile age in one way or another. If it's not in my 2009 and not in 2014 snapshots then that profile is 5- years old. With frequent enough snapshots I would get even better timing resolotion. Now given that it's neither that hard nor that expensive to scrape or store that amounts of data, such an approach would actually be feasible.
Gustomaximus 7y ago
But how can it be faked? You can upload a fake FB account but it's new. Country X can say 'that account wasn't there 2 years ago'. Nor can agencies set up fake accounts over time as they need to know the faces of future spies to create their fake front over time and that's not possible unless you choose spies from birth.
- deleted 7y ago
  [deleted]

stef25 7y ago

The scene from Minority Report comes to mind where he takes some kind of pill that painfully distorts his face so as to not be detected by FR cameras. Is the technology currently good enough to detect the same person if they have different color eyes, different sized lips & eyebrows, abundance of lack of facial hair etc, downturned mouth vs smile etc? If you take someone who hasn't slept for 3 days + hangover + flue their face will look substantially different than when fresh as a daisy.