3 ms·

What's your argument against adding it then?

by rendx 7y ago

tpmx 7y ago
(I see what you're doing.) This was about a decade ago. Not sure if it's still being used, but I think it may be, at least in one country. Obviously, what I worried about was: The same technical solution could then be sold by less scrupulous sales people to less democratic countries and then misused badly. I made sure there were a number of undocumented steps involved in setting up LI that couldn't be done without involving me or one trusted developer directly. It was also purposefully architected to handle a scale of wiretapping of about 1 in 10000 people nationwide. That 1:10000 ratio was the the ratio I got "off-the-record" from someone in the first western customer country. I was okay with that ratio, given that the country was democratic. To clarify: I took pains to make sure that the mechanism could only be used to extract a fraction of the traffic flowing through our hardware, and that the selectors had to be preselected in a pretty meticulous way. Basically I spent a bunch of time to make sure to deliver the exact minimum of that what the country's government requested. There was never any pushback. I think our counterpart in this case was legimitely just trying to solve crime, as opposed to performing passive mass surveillance/recording. My main point here is that LI can make sense, if it is done done at small scale. Manual work needs to be involved. It needs to be a little cumbersome.
- nicehat 7y ago
  >I made sure there were a number of undocumented steps involved in setting up LI that couldn't be done without involving me or one trusted developer directly. So, countries need to bribe a single developer. >It was also purposefully architected to handle a scale of wiretapping of about 1 in 10000 people That's more than enough to target political opponents. By these numbers, you would be able to target 33,000 Americans. In a small country like Ireland, (4.9 mil) you would be able to target 490 people; lawyers, heads of political parties, journalists... >That was the the ratio I got off-the-record from someone in the first western customer country Sounds super legit, I can see why you are so confident it won't be abused /s.
- novok 7y ago
  Western democratic countries use this for unscrupulous purposes too, just look at the many documented instances in the USA for example. Anyway the end result is everything will be encrypted. The real battle is forcing ISPs and governments to not log device locations and giving real teeth to it. Something that is fairly doubtful.
  - tpmx 7y ago
    I think the US is really a special case here. Also: We never deployed this LI solution in the US. You're right - because of Google's efforts nowadays everything is going to be encrypted when it comes to web traffic. That's both good and bad.

What's your argument against adding it then?

by rendx 7y ago

What's your argument against adding it then?

tpmx 7y ago

(I see what you're doing.) This was about a decade ago. Not sure if it's still being used, but I think it may be, at least in one country. Obviously, what I worried about was: The same technical solution could then be sold by less scrupulous sales people to less democratic countries and then misused badly. I made sure there were a number of undocumented steps involved in setting up LI that couldn't be done without involving me or one trusted developer directly. It was also purposefully architected to handle a scale of wiretapping of about 1 in 10000 people nationwide. That 1:10000 ratio was the the ratio I got "off-the-record" from someone in the first western customer country. I was okay with that ratio, given that the country was democratic. To clarify: I took pains to make sure that the mechanism could only be used to extract a fraction of the traffic flowing through our hardware, and that the selectors had to be preselected in a pretty meticulous way. Basically I spent a bunch of time to make sure to deliver the exact minimum of that what the country's government requested. There was never any pushback. I think our counterpart in this case was legimitely just trying to solve crime, as opposed to performing passive mass surveillance/recording. My main point here is that LI can make sense, if it is done done at small scale. Manual work needs to be involved. It needs to be a little cumbersome.

nicehat 7y ago
>I made sure there were a number of undocumented steps involved in setting up LI that couldn't be done without involving me or one trusted developer directly. So, countries need to bribe a single developer. >It was also purposefully architected to handle a scale of wiretapping of about 1 in 10000 people That's more than enough to target political opponents. By these numbers, you would be able to target 33,000 Americans. In a small country like Ireland, (4.9 mil) you would be able to target 490 people; lawyers, heads of political parties, journalists... >That was the the ratio I got off-the-record from someone in the first western customer country Sounds super legit, I can see why you are so confident it won't be abused /s.
novok 7y ago
Western democratic countries use this for unscrupulous purposes too, just look at the many documented instances in the USA for example. Anyway the end result is everything will be encrypted. The real battle is forcing ISPs and governments to not log device locations and giving real teeth to it. Something that is fairly doubtful.
- tpmx 7y ago
  I think the US is really a special case here. Also: We never deployed this LI solution in the US. You're right - because of Google's efforts nowadays everything is going to be encrypted when it comes to web traffic. That's both good and bad.