4 ms·

I've helped architect the LI/Lawful Interception solution/integration aspect on a product that's not listed. I don't feel bad about this. Should I? It's what's

by tpmx 7y ago

I've helped architect the LI/Lawful Interception solution/integration aspect on a product that's not listed. I don't feel bad about this. Should I? It's what's being used to catch murderers, kidnappers and terrorists. Its use is being controlled by very serious judges/courts.

rendx 7y ago
What's your argument against adding it then?
- tpmx 7y ago
  (I see what you're doing.) This was about a decade ago. Not sure if it's still being used, but I think it may be, at least in one country. Obviously, what I worried about was: The same technical solution could then be sold by less scrupulous sales people to less democratic countries and then misused badly. I made sure there were a number of undocumented steps involved in setting up LI that couldn't be done without involving me or one trusted developer directly. It was also purposefully architected to handle a scale of wiretapping of about 1 in 10000 people nationwide. That 1:10000 ratio was the the ratio I got "off-the-record" from someone in the first western customer country. I was okay with that ratio, given that the country was democratic. To clarify: I took pains to make sure that the mechanism could only be used to extract a fraction of the traffic flowing through our hardware, and that the selectors had to be preselected in a pretty meticulous way. Basically I spent a bunch of time to make sure to deliver the exact minimum of that what the country's government requested. There was never any pushback. I think our counterpart in this case was legimitely just trying to solve crime, as opposed to performing passive mass surveillance/recording. My main point here is that LI can make sense, if it is done done at small scale. Manual work needs to be involved. It needs to be a little cumbersome.
  - nicehat 7y ago
    >I made sure there were a number of undocumented steps involved in setting up LI that couldn't be done without involving me or one trusted developer directly. So, countries need to bribe a single developer. >It was also purposefully architected to handle a scale of wiretapping of about 1 in 10000 people That's more than enough to target political opponents. By these numbers, you would be able to target 33,000 Americans. In a small country like Ireland, (4.9 mil) you would be able to target 490 people; lawyers, heads of political parties, journalists... >That was the the ratio I got off-the-record from someone in the first western customer country Sounds super legit, I can see why you are so confident it won't be abused /s.
  - novok 7y ago
    Western democratic countries use this for unscrupulous purposes too, just look at the many documented instances in the USA for example. Anyway the end result is everything will be encrypted. The real battle is forcing ISPs and governments to not log device locations and giving real teeth to it. Something that is fairly doubtful.
    - tpmx 7y ago
      I think the US is really a special case here. Also: We never deployed this LI solution in the US. You're right - because of Google's efforts nowadays everything is going to be encrypted when it comes to web traffic. That's both good and bad.
deogeo 7y ago
> Its use is being controlled by very serious judges/courts. 'Controlled' is an overstatement: https://www.popehat.com/2014/07/15/warrants-bulwark-of-liberty-or-paper-shield/ https://www.popehat.com/2014/07/15/warrants-bulwark-of-liber...
- tpmx 7y ago
  Not every country in the west is like the US.
  - deogeo 7y ago
    Do we know how much tougher the warrant requirement is in other countries? Australia is expanding anti-protest laws [1,2], the UK police is helping blacklist union organizers [3], and sharing information on disabled people and activist with private companies [4,5]. And as China's influence on Australia and New Zealand expands, there's a very real risk surveillance abuse will get even worse. And of course if you dare turn surveillance around on those with power, you can expect consequences [6]. There are precious few countries where surveillance is only used to catch murderers and kidnappers. And even in those, you're helping set up suppression infrastructure that a malicious government can use if they ever gain power in the future. [1] https://www.theguardian.com/australia-news/2019/aug/20/queensland-police-to-get-new-powers-to-search-climate-change-protesters https://www.theguardian.com/australia-news/2019/aug/20/queen... [2] https://www.smh.com.au/opinion/nsw-antiprotest-laws-are-part-of-a-corrosive-national-trend-20160322-gno10h.html https://www.smh.com.au/opinion/nsw-antiprotest-laws-are-part... [3] https://www.bbc.com/news/uk-43507728 https://www.bbc.com/news/uk-43507728 [4] https://www.themeteor.org/2019/07/27/gmp-shares-disabled-protesters-info-with-dwp/ https://www.themeteor.org/2019/07/27/gmp-shares-disabled-pro... [5] https://www.theguardian.com/uk/2009/apr/20/police-intelligence-e-on-berr https://www.theguardian.com/uk/2009/apr/20/police-intelligen... [6] https://www.businessinsider.com/tweets-that-got-people-arrested-2013-7?op=1#9-tweeting-your-frustration-about-a-flight-delay-9 https://www.businessinsider.com/tweets-that-got-people-arres... - 10th tweet
    - tpmx 7y ago
      > There are precious few countries where surveillance is only used to catch murderers and kidnappers. I think that number is down to ~0 after 9/11. The more relevant distiction nowadays is between countries that are performing mass surveillance and those that are not.
ganzuul 7y ago
Are you able to advise privacy advocate organizations about how systems like yours work?
- tpmx 7y ago
  I think they're probably aware of the general technical issues/limitations/possibilities these days.
  - avs733 7y ago
    That isnt what the parent comment asked though.
  - ganzuul 7y ago
    It's more political than technical. It matters a lot who is telling the same truth, e.g. for the minutiae of a formal meeting.
    - tpmx 7y ago
      To clarify: No, I'm not willing to become a "whistleblower" for simply following a long-time law in a stable western-european country. I chose to trust the existing legal systems in this case. And to clarify: I actually do trust the legal systems, in this unnamed country.
      - ganzuul 7y ago
        Whistleblowing implies something is wrong... Let me change the angle: Do you believe it is important for democracy to have solid information to base votes on? Would you be legally able to share this information if you wanted to?

by tpmx 7y ago

rendx 7y ago

What's your argument against adding it then?

tpmx 7y ago
(I see what you're doing.) This was about a decade ago. Not sure if it's still being used, but I think it may be, at least in one country. Obviously, what I worried about was: The same technical solution could then be sold by less scrupulous sales people to less democratic countries and then misused badly. I made sure there were a number of undocumented steps involved in setting up LI that couldn't be done without involving me or one trusted developer directly. It was also purposefully architected to handle a scale of wiretapping of about 1 in 10000 people nationwide. That 1:10000 ratio was the the ratio I got "off-the-record" from someone in the first western customer country. I was okay with that ratio, given that the country was democratic. To clarify: I took pains to make sure that the mechanism could only be used to extract a fraction of the traffic flowing through our hardware, and that the selectors had to be preselected in a pretty meticulous way. Basically I spent a bunch of time to make sure to deliver the exact minimum of that what the country's government requested. There was never any pushback. I think our counterpart in this case was legimitely just trying to solve crime, as opposed to performing passive mass surveillance/recording. My main point here is that LI can make sense, if it is done done at small scale. Manual work needs to be involved. It needs to be a little cumbersome.
- nicehat 7y ago
  >I made sure there were a number of undocumented steps involved in setting up LI that couldn't be done without involving me or one trusted developer directly. So, countries need to bribe a single developer. >It was also purposefully architected to handle a scale of wiretapping of about 1 in 10000 people That's more than enough to target political opponents. By these numbers, you would be able to target 33,000 Americans. In a small country like Ireland, (4.9 mil) you would be able to target 490 people; lawyers, heads of political parties, journalists... >That was the the ratio I got off-the-record from someone in the first western customer country Sounds super legit, I can see why you are so confident it won't be abused /s.
- novok 7y ago
  Western democratic countries use this for unscrupulous purposes too, just look at the many documented instances in the USA for example. Anyway the end result is everything will be encrypted. The real battle is forcing ISPs and governments to not log device locations and giving real teeth to it. Something that is fairly doubtful.
  - tpmx 7y ago
    I think the US is really a special case here. Also: We never deployed this LI solution in the US. You're right - because of Google's efforts nowadays everything is going to be encrypted when it comes to web traffic. That's both good and bad.

deogeo 7y ago

> Its use is being controlled by very serious judges/courts. 'Controlled' is an overstatement: https://www.popehat.com/2014/07/15/warrants-bulwark-of-liberty-or-paper-shield/ https://www.popehat.com/2014/07/15/warrants-bulwark-of-liber...

tpmx 7y ago
Not every country in the west is like the US.
- deogeo 7y ago
  Do we know how much tougher the warrant requirement is in other countries? Australia is expanding anti-protest laws [1,2], the UK police is helping blacklist union organizers [3], and sharing information on disabled people and activist with private companies [4,5]. And as China's influence on Australia and New Zealand expands, there's a very real risk surveillance abuse will get even worse. And of course if you dare turn surveillance around on those with power, you can expect consequences [6]. There are precious few countries where surveillance is only used to catch murderers and kidnappers. And even in those, you're helping set up suppression infrastructure that a malicious government can use if they ever gain power in the future. [1] https://www.theguardian.com/australia-news/2019/aug/20/queensland-police-to-get-new-powers-to-search-climate-change-protesters https://www.theguardian.com/australia-news/2019/aug/20/queen... [2] https://www.smh.com.au/opinion/nsw-antiprotest-laws-are-part-of-a-corrosive-national-trend-20160322-gno10h.html https://www.smh.com.au/opinion/nsw-antiprotest-laws-are-part... [3] https://www.bbc.com/news/uk-43507728 https://www.bbc.com/news/uk-43507728 [4] https://www.themeteor.org/2019/07/27/gmp-shares-disabled-protesters-info-with-dwp/ https://www.themeteor.org/2019/07/27/gmp-shares-disabled-pro... [5] https://www.theguardian.com/uk/2009/apr/20/police-intelligence-e-on-berr https://www.theguardian.com/uk/2009/apr/20/police-intelligen... [6] https://www.businessinsider.com/tweets-that-got-people-arrested-2013-7?op=1#9-tweeting-your-frustration-about-a-flight-delay-9 https://www.businessinsider.com/tweets-that-got-people-arres... - 10th tweet
  - tpmx 7y ago
    > There are precious few countries where surveillance is only used to catch murderers and kidnappers. I think that number is down to ~0 after 9/11. The more relevant distiction nowadays is between countries that are performing mass surveillance and those that are not.

ganzuul 7y ago

Are you able to advise privacy advocate organizations about how systems like yours work?

tpmx 7y ago
I think they're probably aware of the general technical issues/limitations/possibilities these days.
- avs733 7y ago
  That isnt what the parent comment asked though.
- ganzuul 7y ago
  It's more political than technical. It matters a lot who is telling the same truth, e.g. for the minutiae of a formal meeting.
  - tpmx 7y ago
    To clarify: No, I'm not willing to become a "whistleblower" for simply following a long-time law in a stable western-european country. I chose to trust the existing legal systems in this case. And to clarify: I actually do trust the legal systems, in this unnamed country.
    - ganzuul 7y ago
      Whistleblowing implies something is wrong... Let me change the angle: Do you believe it is important for democracy to have solid information to base votes on? Would you be legally able to share this information if you wanted to?