3 ms·
I see this take a lot. Serious question: doesn't the U.S. government surveillance program focus on collecting communication metadata for U.S. citizens? While it
by r3trohack3r 6y ago
I see this take a lot. Serious question: doesn't the U.S. government surveillance program focus on collecting communication metadata for U.S. citizens? While it isn't clear what that metadata includes, we do have examples of past programs that have leaked (and the legal theory used to justify them) to guide us.
Given what we publicly know about these surveillance programs I could see FISC approving bulk metadata collection for the IPv4 header content, insecure HTTP header content, and DNS queries.
Wouldn't using a VPN, DNS over HTTPS, and HTTPS everywhere shield you from these bulk metadata collection programs? I run https://everytwoyears.org https://everytwoyears.org, a political non-profit focused on ending these programs, and I view VPNs as a key technical piece of preventing these metadata collection programs from functioning; if the security community doesn't believe they are effective, I would really like to know!
Another way of saying this: collecting _content_ of a communication requires a warrant (and our mass surveillance programs respect that from what we publicly know). Most people that I know aren't trying to avoid active (we have a warrant to search you) monitoring with a VPN, but trying to avoid passive warrantless monitoring. Obscuring communication metadata through encryption and tunneling seems to be an effective way of doing this.
- surround 6y agoThis is a good question and I would like to discuss it. If the government is able to passively collect metadata from your ISP, couldn’t they do the same thing with a VPN company?
- r3trohack3r 6y agoThe original form of the Presidential Surveillance Program didn't compel service providers to share this metadata. The providers willingly shared it. There is a reference to a service provider backing out of the agreement several years after it started stating they would feel more comfortable continuing to share their data if the government compelled them. This may have changed since 2013.
- PureParadigm 6y agoIf I were a government trying to gather metadata about web usage, the first thing I'd do is set up or acquire my own VPN company (and make it look convincing, of course).
- deleted 6y ago[deleted]
- notriddle 6y agoI wouldn't. What percent of the public do you think uses a VPN? And do you think VPN users are a representative sample of the general public?
- PureParadigm 6y agoVPN (and tor) users are the ones you'd be most interested in as a government. So it doesn't matter how much of the general population uses your VPN as long as you convince the ones you're interested in to use one. And for all of those not using a VPN, just ask the ISPs.