10 ms·

"How one treats intelligence activity or law enforcement activity driven under democratic oversight within a lawfully elected representative government is very

by tremon 6y ago

"How one treats intelligence activity or law enforcement activity driven under democratic oversight within a lawfully elected representative government is very different from that of an authoritarian regime.” From a systems security standpoint, no. This is the same kind of idealistic naivety that causes the FBI to advocate for weak encryption, or senators to call for "security only breakable by us, because we're the good guys".

lenkite 6y ago
Obeying the law is not naivety. Protecting your customers is not naivety. Pass legislation through both houses of the US enforcing such privileged "Government Right to Hack" first before claiming any morality. Of-course that will likely lead to economic collapse as no-one (allies or enemies) will trust US software or services.
- indymike 6y ago
  This is one of the best comments I've read in a long time on HN.
adamcstephens 6y ago
From my viewpoint the oversight given to the intelligence agencies is handled by intelligence friendly members of Congress. They don’t seem to let critical people into the committees and if they do they are minor players. Even still, Clapper felt compelled to lie to their faces. How many others have done the same?
ben_w 6y ago
While this is absolutely correct, it is also true that the world we live in is not the clean world of Boolean algebra. The same security flaw that lets “baddies” pwn us, also lets us pwn baddies. The same indefatigable crypto that keeps us safe and makes online anything possible, also lets people conspire in secret to overthrow governments — heck, I remember reading the idea of onion routing that led to TOR was a U.S. military project to help anti-government activists in China, and even if that was just an urban legend, one team’s goodies are another team’s baddies. I don’t have any good solutions here. This is security vs security, and my weak fleshy hardware is vulnerable to exploding things owing to a lack of backup solutions, therefore if my options were perfect security for my body or for my data, right now I would choose my body, even though loss of data has the potential to be catastrophic. That said, if it were up to me, police investigations would involve a lot more remote sensing tech instead of hacking… but I say that knowing even that isn’t a no-downside option, and I know that I am unaware of the full implications of police having the budget and power to spy on targets of their choice. (I’m also in favour of radical decriminalisation of just about everything that can be decriminalised, because I think omniscient surveillance is unavoidable and I don’t want criminals using it to automate blackmail).
- eqvinox 6y ago
  > I don’t have any good solutions here. The solution is for state actors to move their resources from offense to defense. Imagine half of the NSA budget going into auditing software, both closed source and open source. (They already do that, but AFAIK nowhere near half.) There is a quite clear and simple line here: the people breaking security for any purpose other than fixing security problems are the "baddies", and the people defending systems are the "goodies". If some intelligence service decides they want to covertly exploit security issues, they have made their choice to be "baddies" and should be treated as such. (Coincidentally, this narrative of "XYZ got hacked by ABC hackers, bad ABC!" needs to change to "XYZ got hacked, bad IT sec at XYZ!" - it's your choice to plug your shit into the internet, and your responsibility to make sure you don't get 0wned.)
  - tgragnato 6y ago
    > XYZ got hacked, bad IT sec at XYZ In this particular case I can't follow this part of the reasoning. It was a counterterrorism operation using sophisticated exploit chains. Would you clarify what's the bad IT sec? "nobody should use a browser"? https://1.bp.blogspot.com/-37hyk7hERGk/YFDuISGgCNI/AAAAAAAAaww/xcrVLfY_ZUQVozcte09NaqafWbL8ukvDgCNcBGAsYHQ/s1660/image1%2B%25282%2529.png https://1.bp.blogspot.com/-37hyk7hERGk/YFDuISGgCNI/AAAAAAAAa...
    - eqvinox 6y ago
      I was trying to make an independent point with that "coincidentally ...", sorry if that was a bit unclear. In this case, the takeaway would be "we still don't know how to make secure browsers even though we're trying our darndest." But also, that exploit chain is limited to a single machine; there's still some opportunity to limit damages on a larger scale.
    - iforgotpassword 6y ago
      That's a bit extreme, but I find it worrying how the general public seems to have accepted that software just has bugs. Like it's this self conscious thing and nobody is at fault. Prisoners don't get released although they served their sentence? Software fault. People pay more tax thab they should? Software bug! Let's just shrug im confusion about that silly software problems that nobody os possibly responsible for.
baybal2 6y ago
So, what exploit did they find, and who was spying on whom?
kstenerud 6y ago
Also: "But while protecting customers from attack is important, some argue that counter-terrorism operations are different, with potentially life and death consequences that go beyond day-to-day internet security." Which is great in theory, but raises the question of how you identify friend or foe. Since they do it indirectly by "hallmarks" of the organization, all a skilled adversary has to do is camouflage their code to look like it's from a friendly, and then enjoy flying under the radar.
- xoa 6y ago
  I think that line was actually a lot worse than that, in particular: >"with potentially life and death consequences that go beyond day-to-day internet security." So this is setting up "counter-terrorism" as some sort of special thing far beyond "day-to-day internet security". But the whole problem is that day-to-day internet security absolutely can involve life-safety issues. Lots of vital infrastructure SCADA is on the internet and ludicrously exploitable. Internet monitoring is now used for all sorts of medical scenarios as well. Even in business settings like hospitals we've seen ransomware and the like cause major damage, but lots of individuals make use of internet devices to empower their ability to have the elderly stay at home longer for example, monitoring for falls or other issues. And even with "just" finance, if someone's small business is destroyed and everyone laid off, that can cause plenty of dangerous ripples. If anything, I'd say terrorism is near the bottom of my list of threats to my own life and those close to me, right along lightning strikes. Sure, they do happen, and taking some basic transparent precautions is reasonable. But it gets lots of attention precisely because it's rare. Like, the entire point of it is right there in the name, to terrorize people into doing damage to themselves that the attacker could never manage alone. Terrorism is an expression of weakness, not strength.
  - 1337shadow 6y ago
    Makes sense, even though not easy to ear for everyone, especially the last part: is it "an expression of weakness" that took my son from me? Terrorism is an expression of mercilessness, aggressiveness, bloodlustness, anything but "weakness", please, there is no place for weakness in terrorism.
salimmadjd 6y ago
FYI, the author’s LinkedIn profile [0] in case you’re curious how qualified he is. Am I the only one who doesn’t see anything here that tells you why he should be working for MIT Review writing about cyber security? [0] https://www.linkedin.com/in/howelloneill https://www.linkedin.com/in/howelloneill
- jessaustin 6y ago
  Good catch. He's been a journalist for a few years, but surely the most important year was spent at "Aspen Institute". Nobody can figure out whether it's a pro-war think tank or a PPP loan scam, but they get lots of money from dictatorial "Western allies" (i.e., MbS). It must have been there that he learned to write a whole article littered with "western operations" without once writing "Israel" or "8200".
HenryKissinger 6y ago
The US government would not hesitate to shut down Google inc., take over the company, or throw the entire executive team into prison if the company actively interfered with counterterrorist operations. Google should thread carefully here.
- nickysielicki 6y ago
  The US wouldn't hesitate to come after and make an example of individual developers or small companies. But Google? Our intelligence agencies are already relatively unpopular (if you can trust the polls) [1]. I'm not sure that the US government could attack Google like that without serious consequences from the public. [1]: https://www.pewresearch.org/politics/2018/02/14/majorities-express-favorable-opinions-of-several-federal-agencies-including-the-fbi/ https://www.pewresearch.org/politics/2018/02/14/majorities-e...
traceroute66 6y ago
@tremon, not only that but the definition of "democracy" is being increasingly stretched by modern politicians. For example many will have something to say about the Trump definition of "democracy" that we saw only just recently in the US. Others might have something to say about the Johnson definition of "democracy" in the UK. Others might not exactly consider Israel a democracy given the way they treat the Palestinians on their doorstep. People are often all to quick to jump on "democratic country" as if its a simple definition of a country that is beyond reproach. The trouble is that modern politicians spoil that rose-tinted view.
- Tostino 6y ago
  Historic politicians spoiled it as well. Modern ones are by no means short of company.
dathinab 6y ago
Yes, especially how do you differentiate? Also who says a lawfully elected representative government might not: - act unlawfully, to undermine democracy to make sure they will stay in power. - act unlawfully for other reasons, there are many such examples in history - the CCP is also a lawfully elected representative government, because they make the laws so that they are. So you probably mean not "lawfully" but something like "properly"? Also I for example would say a lawfully/properly elected representative government requires that all people can vote and there is real choice about who to vote for. Guess which country has neither? (USA,it removes voting rights from citizens under certain situations and as a winner-takes-all de-facto 2 party system has no real, i.e. no democratic choice when voting. And that is ignoring the fact that the citizens votes can be overuled by a small group of propel, even if they normally don't do so).
- buran77 6y ago
  Any perspective is usually purely idealistic and strongly influenced by the environment you were educated in. We tend to consider the theoretical aspects of democracy as the golden standard but ignore the practicalities of the implementation. So as we take the idealistic approach, any hacking campaign lead by Western intelligence agencies or any initiative to weaken encryption are for most people "pure" in intentions, they're anti-terrorism, they're fighting pedophiles. But any enemy doing the same, China, Russia, NK, Iran, etc. are engaging in terrorism, authoritarianism. It's always very black and white because that's how people are educated. The absolutely overwhelming majority of people are able to go about their lives every day never questioning how they can hold such dissonant opinions in their head simply because they were told "it's ok when we do it, it's bad when they do it". And as you can see even the "democratic" approach has a chilling effect. The suggestion most people take away from a cursory parsing of the title or article is that Google acted irresponsibly. Imagine the day this point of view becomes prevalent fueled by the typical political campaign populism. Imagine people and companies being put off from touching the topic out of fear that they're branded irresponsible and unwittingly hindering anti-terrorism efforts because they're disclosing problems of general interest.
jonplackett 6y ago
Also, with the revelations of Snowden you have to question the 'democratic oversight' part. We have no idea what our governments are up to and whether this is also being used to spy on us.
nickysielicki 6y ago
I'd also like to add that the whole notion of there existing "telltale signs" and fingerprinting to discern between good-guy Western governments and bad-guy Ze Russianz!11! is total BS. Unless Google is in the loop, it's completely unreasonable to expect them to know who is who -- and no, it's not reasonable to expect them to ask before they act.
- shadowgovt 6y ago
  I believe there are a lot of details we in the public won't get to know here, but in general Google isn't in the business of choosing to eff up police activity or allied espionage. The whole thing smells to me like either miscommunication or a situation where Google had additional data that made them decide to override the interests of the task force.

by tremon 6y ago

lenkite 6y ago

Obeying the law is not naivety. Protecting your customers is not naivety. Pass legislation through both houses of the US enforcing such privileged "Government Right to Hack" first before claiming any morality. Of-course that will likely lead to economic collapse as no-one (allies or enemies) will trust US software or services.

indymike 6y ago
This is one of the best comments I've read in a long time on HN.

adamcstephens 6y ago

From my viewpoint the oversight given to the intelligence agencies is handled by intelligence friendly members of Congress. They don’t seem to let critical people into the committees and if they do they are minor players. Even still, Clapper felt compelled to lie to their faces. How many others have done the same?

ben_w 6y ago

While this is absolutely correct, it is also true that the world we live in is not the clean world of Boolean algebra. The same security flaw that lets “baddies” pwn us, also lets us pwn baddies. The same indefatigable crypto that keeps us safe and makes online anything possible, also lets people conspire in secret to overthrow governments — heck, I remember reading the idea of onion routing that led to TOR was a U.S. military project to help anti-government activists in China, and even if that was just an urban legend, one team’s goodies are another team’s baddies. I don’t have any good solutions here. This is security vs security, and my weak fleshy hardware is vulnerable to exploding things owing to a lack of backup solutions, therefore if my options were perfect security for my body or for my data, right now I would choose my body, even though loss of data has the potential to be catastrophic. That said, if it were up to me, police investigations would involve a lot more remote sensing tech instead of hacking… but I say that knowing even that isn’t a no-downside option, and I know that I am unaware of the full implications of police having the budget and power to spy on targets of their choice. (I’m also in favour of radical decriminalisation of just about everything that can be decriminalised, because I think omniscient surveillance is unavoidable and I don’t want criminals using it to automate blackmail).

eqvinox 6y ago
> I don’t have any good solutions here. The solution is for state actors to move their resources from offense to defense. Imagine half of the NSA budget going into auditing software, both closed source and open source. (They already do that, but AFAIK nowhere near half.) There is a quite clear and simple line here: the people breaking security for any purpose other than fixing security problems are the "baddies", and the people defending systems are the "goodies". If some intelligence service decides they want to covertly exploit security issues, they have made their choice to be "baddies" and should be treated as such. (Coincidentally, this narrative of "XYZ got hacked by ABC hackers, bad ABC!" needs to change to "XYZ got hacked, bad IT sec at XYZ!" - it's your choice to plug your shit into the internet, and your responsibility to make sure you don't get 0wned.)
- tgragnato 6y ago
  > XYZ got hacked, bad IT sec at XYZ In this particular case I can't follow this part of the reasoning. It was a counterterrorism operation using sophisticated exploit chains. Would you clarify what's the bad IT sec? "nobody should use a browser"? https://1.bp.blogspot.com/-37hyk7hERGk/YFDuISGgCNI/AAAAAAAAaww/xcrVLfY_ZUQVozcte09NaqafWbL8ukvDgCNcBGAsYHQ/s1660/image1%2B%25282%2529.png https://1.bp.blogspot.com/-37hyk7hERGk/YFDuISGgCNI/AAAAAAAAa...
  - eqvinox 6y ago
    I was trying to make an independent point with that "coincidentally ...", sorry if that was a bit unclear. In this case, the takeaway would be "we still don't know how to make secure browsers even though we're trying our darndest." But also, that exploit chain is limited to a single machine; there's still some opportunity to limit damages on a larger scale.
  - iforgotpassword 6y ago
    That's a bit extreme, but I find it worrying how the general public seems to have accepted that software just has bugs. Like it's this self conscious thing and nobody is at fault. Prisoners don't get released although they served their sentence? Software fault. People pay more tax thab they should? Software bug! Let's just shrug im confusion about that silly software problems that nobody os possibly responsible for.

baybal2 6y ago

So, what exploit did they find, and who was spying on whom?

kstenerud 6y ago

Also: "But while protecting customers from attack is important, some argue that counter-terrorism operations are different, with potentially life and death consequences that go beyond day-to-day internet security." Which is great in theory, but raises the question of how you identify friend or foe. Since they do it indirectly by "hallmarks" of the organization, all a skilled adversary has to do is camouflage their code to look like it's from a friendly, and then enjoy flying under the radar.

xoa 6y ago
I think that line was actually a lot worse than that, in particular: >"with potentially life and death consequences that go beyond day-to-day internet security." So this is setting up "counter-terrorism" as some sort of special thing far beyond "day-to-day internet security". But the whole problem is that day-to-day internet security absolutely can involve life-safety issues. Lots of vital infrastructure SCADA is on the internet and ludicrously exploitable. Internet monitoring is now used for all sorts of medical scenarios as well. Even in business settings like hospitals we've seen ransomware and the like cause major damage, but lots of individuals make use of internet devices to empower their ability to have the elderly stay at home longer for example, monitoring for falls or other issues. And even with "just" finance, if someone's small business is destroyed and everyone laid off, that can cause plenty of dangerous ripples. If anything, I'd say terrorism is near the bottom of my list of threats to my own life and those close to me, right along lightning strikes. Sure, they do happen, and taking some basic transparent precautions is reasonable. But it gets lots of attention precisely because it's rare. Like, the entire point of it is right there in the name, to terrorize people into doing damage to themselves that the attacker could never manage alone. Terrorism is an expression of weakness, not strength.
- 1337shadow 6y ago
  Makes sense, even though not easy to ear for everyone, especially the last part: is it "an expression of weakness" that took my son from me? Terrorism is an expression of mercilessness, aggressiveness, bloodlustness, anything but "weakness", please, there is no place for weakness in terrorism.

salimmadjd 6y ago

FYI, the author’s LinkedIn profile [0] in case you’re curious how qualified he is. Am I the only one who doesn’t see anything here that tells you why he should be working for MIT Review writing about cyber security? [0] https://www.linkedin.com/in/howelloneill https://www.linkedin.com/in/howelloneill

jessaustin 6y ago
Good catch. He's been a journalist for a few years, but surely the most important year was spent at "Aspen Institute". Nobody can figure out whether it's a pro-war think tank or a PPP loan scam, but they get lots of money from dictatorial "Western allies" (i.e., MbS). It must have been there that he learned to write a whole article littered with "western operations" without once writing "Israel" or "8200".

HenryKissinger 6y ago

The US government would not hesitate to shut down Google inc., take over the company, or throw the entire executive team into prison if the company actively interfered with counterterrorist operations. Google should thread carefully here.

nickysielicki 6y ago
The US wouldn't hesitate to come after and make an example of individual developers or small companies. But Google? Our intelligence agencies are already relatively unpopular (if you can trust the polls) [1]. I'm not sure that the US government could attack Google like that without serious consequences from the public. [1]: https://www.pewresearch.org/politics/2018/02/14/majorities-express-favorable-opinions-of-several-federal-agencies-including-the-fbi/ https://www.pewresearch.org/politics/2018/02/14/majorities-e...

traceroute66 6y ago

@tremon, not only that but the definition of "democracy" is being increasingly stretched by modern politicians. For example many will have something to say about the Trump definition of "democracy" that we saw only just recently in the US. Others might have something to say about the Johnson definition of "democracy" in the UK. Others might not exactly consider Israel a democracy given the way they treat the Palestinians on their doorstep. People are often all to quick to jump on "democratic country" as if its a simple definition of a country that is beyond reproach. The trouble is that modern politicians spoil that rose-tinted view.

Tostino 6y ago
Historic politicians spoiled it as well. Modern ones are by no means short of company.

dathinab 6y ago

Yes, especially how do you differentiate? Also who says a lawfully elected representative government might not: - act unlawfully, to undermine democracy to make sure they will stay in power. - act unlawfully for other reasons, there are many such examples in history - the CCP is also a lawfully elected representative government, because they make the laws so that they are. So you probably mean not "lawfully" but something like "properly"? Also I for example would say a lawfully/properly elected representative government requires that all people can vote and there is real choice about who to vote for. Guess which country has neither? (USA,it removes voting rights from citizens under certain situations and as a winner-takes-all de-facto 2 party system has no real, i.e. no democratic choice when voting. And that is ignoring the fact that the citizens votes can be overuled by a small group of propel, even if they normally don't do so).

buran77 6y ago
Any perspective is usually purely idealistic and strongly influenced by the environment you were educated in. We tend to consider the theoretical aspects of democracy as the golden standard but ignore the practicalities of the implementation. So as we take the idealistic approach, any hacking campaign lead by Western intelligence agencies or any initiative to weaken encryption are for most people "pure" in intentions, they're anti-terrorism, they're fighting pedophiles. But any enemy doing the same, China, Russia, NK, Iran, etc. are engaging in terrorism, authoritarianism. It's always very black and white because that's how people are educated. The absolutely overwhelming majority of people are able to go about their lives every day never questioning how they can hold such dissonant opinions in their head simply because they were told "it's ok when we do it, it's bad when they do it". And as you can see even the "democratic" approach has a chilling effect. The suggestion most people take away from a cursory parsing of the title or article is that Google acted irresponsibly. Imagine the day this point of view becomes prevalent fueled by the typical political campaign populism. Imagine people and companies being put off from touching the topic out of fear that they're branded irresponsible and unwittingly hindering anti-terrorism efforts because they're disclosing problems of general interest.

jonplackett 6y ago

Also, with the revelations of Snowden you have to question the 'democratic oversight' part. We have no idea what our governments are up to and whether this is also being used to spy on us.

nickysielicki 6y ago

I'd also like to add that the whole notion of there existing "telltale signs" and fingerprinting to discern between good-guy Western governments and bad-guy Ze Russianz!11! is total BS. Unless Google is in the loop, it's completely unreasonable to expect them to know who is who -- and no, it's not reasonable to expect them to ask before they act.

shadowgovt 6y ago
I believe there are a lot of details we in the public won't get to know here, but in general Google isn't in the business of choosing to eff up police activity or allied espionage. The whole thing smells to me like either miscommunication or a situation where Google had additional data that made them decide to override the interests of the task force.