9 ms·

And what were GCHQ, MI6 and NCSC doing to protect our prime-minister at this time? We have a problem in democratic nations. I've written about it here [1]. Br

And what were GCHQ, MI6 and NCSC doing to protect our prime-minister at this time? We have a problem in democratic nations. I've written about it here [1]. Bruce Schneier has also addressed it in his own way. Our lack of any framework for civic cybersecurity is a disgrace. People in future ages will look back on our time as a wild-west. A solution can only come from a ground-up awareness through education. [1] http://www.icicte.org/assets/icicte2019_5.4_farnell.pdf http://www.icicte.org/assets/icicte2019_5.4_farnell.pdf

jll29 5y ago
> And what were GCHQ, MI6 and NCSC doing to protect our prime-minister at this time? Nobody is perfect - but there are people who blatantly ignore ITSEC best practices and are therefore almost unprotectable.
- wyldfire 5y ago
  Could these agencies enumerate some phone models / sw versions that are vulnerable to Pegasus and just blast email the govt folks "if you got one of these it's vulnerable, upgrade to new hardware or software { list of phones without known vulnerabilities here }"?
  - e12e 5y ago
    Well, what if the lists got leaked, and the secret services no longer can spy on the electorate with these tools? /s
- nonrandomstring 5y ago
  > Nobody is perfect - but there are people who blatantly ignore ITSEC best practices and are therefore almost unprotectable. I hear you, but I would contest that they're not at liberty to ignore them. If pizza delivery drivers consent to obligations to carry issued and configured devices while on duty by what exceptionalism is Downing Street excused? Secondly, I'd say that they may make themselves unprotectable, but that is not where their duty of care ends. Boris Johnson is not only responsible for his own security, but that of a nation. Insofar as the spooks are responsible for Boris (god help them) their pants are round their ankles again.
  - pjc50 5y ago
    I don't think you really want a world where the security services can overrule the elected government, rather than the other way round. However, I'm not one to defend either MI5 or Johnson here. MI5 routinely surveil anyone to the left of the Tory party as being some kind of dissident. The Johnson government is notorious for ignoring any kind of rules, restraint, or best practice. If they had something to say about it, they should have done so in public like the rest of us, once privately recommending had failed.
    - nonrandomstring 5y ago
      > I don't think you really want a world where the security services can overrule the elected government, rather than the other way round. Well said, and excellent point. But I would like to live in a world where security services could professionally, and in good faith, advise other public servants, who would professionally, and in good faith heed that advice. As I understand it that fits the actual job description for all parties. A world in which public servants are adversaries, in which intra- and inter-institutional trust has totally broken down seems to be the fruits of the misadventure, over-reach and disrespect for the Rule of Law in all quarters.
      - pjc50 5y ago
        Well, yes. But we're not dealing with public servants in the Cabinet, we're dealing with inept looters who are being propped up by the conservative press.
- alasdair_ 5y ago
  > Nobody is perfect - but there are people who blatantly ignore ITSEC best practices and are therefore almost unprotectable This is tangential to this story however. Even people who follow best practices can get owned when ex-Mossad/8200 agents armed with dozens of zero days and millions of dollars come after them.
  - haker9 5y ago
forum_ghost 5y ago
>Bruce Schneier has also addressed it in his own way. very interesting, can you link to it? tia!
- nonrandomstring 5y ago
  Sure I guess this one [1] is fairly typical of Bruce's psoition. He identifes as (coined the phrase?) working as a "public interest technologist". He mentions this throughout his writing. I took to using the term "civic cybersecurity" and "digital self defence" after about 2014. I think we're on the same page, loosely. [1] https://www.schneier.com/essays/archives/2019/02/public-interest_tech.html https://www.schneier.com/essays/archives/2019/02/public-inte...
dundarious 5y ago
The Johnson government has been widely but toothlessly criticized for using WhatsApp on personal devices to conduct affairs of state (and deleting messages, failing to hand over messages to investigations, etc.). My personal opinion is that they don't care too much about this type of thing (being hacked by UAE, etc.), and are preoccupied with more selfish matters. It can be quite profitable to be the butler to Gulf, Russian, and UK billionaires.
pydry 5y ago
>And what were GCHQ, MI6 and NCSC doing to protect our prime-minister at this time? Preparing an advertising campaign against E2E encryption: https://www.engadget.com/the-uk-government-is-reportedly-planning-ad-campaign-attacking-end-to-end-encryption-101610703.html https://www.engadget.com/the-uk-government-is-reportedly-pla...
haltingproblem 5y ago
- Veen 5y ago
  There's so much that's factually wrong with this comment I don't know where to start. 1. The UK does have a Bill of Rights (It's different in England and Scotland). The English one pre-dates the US Bill of rights by a century[0]. 2. It does have a constitution, but not a written constitution in the American sense[1]. 3. The Queen doesn't nominate Bishops; she rubber stamps nominations by a committee who are approved by the PM. 4. The Queen does not vote in elections. [0]: https://en.wikipedia.org/wiki/Bill_of_Rights_1689 https://en.wikipedia.org/wiki/Bill_of_Rights_1689 [1]: https://en.wikipedia.org/wiki/Constitution_of_the_United_Kingdom https://en.wikipedia.org/wiki/Constitution_of_the_United_Kin...
  - comprev 5y ago
    Fun fact: In addition to the Queen, the Speaker of the House of Commons also cannot vote due to their role in keeping order between all parties.
  - haltingproblem 5y ago
    I stopped reading around: "Protestants may have arms for their defence suitable to their conditions and as allowed by law;" and something about (only) Ireland repealed it in [1]. In [2] it says, quite straight faced, that "The Constitution of the United Kingdom or British constitution comprises the written and unwritten arrangements that establish the United Kingdom of Great Britain and Northern Ireland as a political body. Unlike in most countries, no attempt has been made to codify such arrangements into a single document. Thus, it is known as an uncodified constitution. This enables the constitution to be easily changed as no provisions are formally entrenched.[2] However, the Supreme Court of the United Kingdom recognises that there are constitutional principles, including parliamentary sovereignty, the rule of law, democracy and upholding international law". There is no codified constitution but there are constitutional principles. Because it is not "entrenched" it can be easily changed. How can someone even say this without an Orwellian sneer? If a North Korean said that we would laugh them out of the room. Edit: North Korea does have a constitution. Written. Just not followed. Britain does not have a written constitution but it is followed (how?), except when it is not as in the wag that it just takes a minister's signature to violate an unwritten (but somehow codified) constitutional principle.
ClumsyPilot 5y ago
'solution can only come from a ground-up awareness through education' Average consumer cannot be responsible for security. Not because they are uneducated but becauae corporations have physicall talen away control from us. You have no control over software running on your router supplied by the internet company, wifi printer, smart toaster, tesla or what crapware is preinstalled on your phone (often you can't even update it) So since they took away control, they shoupd be held financially accountable
- nonrandomstring 5y ago
  > because corporations have physically taken away control from us. The solution of ground-up awareness and education I am suggesting involves making sure people understand they must take that back. The tag-line for the final chapter of my book is "Taking back tech" [1] > You have no control over software.... Well, actually you do, but it is insufficient, and moreover others have control over it which they should not. Legislation can fix this, but legislation requires an educated user base first. Many folks don't know how they are being abused, or even that they are being abused. This is the project of a new digital literacy. Digital literacy 1.0 was about "the amazing things computers can do" Digital literacy 2.0 is about "the dangerous things computers shouldn't do" > So since they took away control, they should be held financially accountable I don't think money is a factor in this. The questions revolve around fundamental rights, responsibilities, ownership and control, One cannot buy or sell such obligations. [1] https://digitalvegan.net https://digitalvegan.net
raxxorraxor 5y ago
I do think secret services did more damage than good with their forward surveillance of citizens, which basically was wild west surveillance initiated by states. The lost trust cannot be repaid for decades, maybe even centuries. It basically voided the significance of huge parts of constitutions of many countries that explicitly forbid such actions. This is beyond political realities of realpolitik where the justification was an alleged immediate threat of terrorism. And that is an overall problem. The fears decide the action. So improving security is becoming dangerous, because parents or teachers just putting their children into a cage of complete surveillance is the most probable outcome. Because the ambition is to get more control. But that doesn't provide much security at all and creates even far greater threats than the "wild west" free open net ever posed in the past.
InCityDreams 5y ago
>And what were GCHQ, MI6 and NCSC doing to protect our prime-minister at this time? Laughing their tits off?

jll29 5y ago

> And what were GCHQ, MI6 and NCSC doing to protect our prime-minister at this time? Nobody is perfect - but there are people who blatantly ignore ITSEC best practices and are therefore almost unprotectable.

wyldfire 5y ago
Could these agencies enumerate some phone models / sw versions that are vulnerable to Pegasus and just blast email the govt folks "if you got one of these it's vulnerable, upgrade to new hardware or software { list of phones without known vulnerabilities here }"?
- e12e 5y ago
  Well, what if the lists got leaked, and the secret services no longer can spy on the electorate with these tools? /s
nonrandomstring 5y ago
> Nobody is perfect - but there are people who blatantly ignore ITSEC best practices and are therefore almost unprotectable. I hear you, but I would contest that they're not at liberty to ignore them. If pizza delivery drivers consent to obligations to carry issued and configured devices while on duty by what exceptionalism is Downing Street excused? Secondly, I'd say that they may make themselves unprotectable, but that is not where their duty of care ends. Boris Johnson is not only responsible for his own security, but that of a nation. Insofar as the spooks are responsible for Boris (god help them) their pants are round their ankles again.
- pjc50 5y ago
  I don't think you really want a world where the security services can overrule the elected government, rather than the other way round. However, I'm not one to defend either MI5 or Johnson here. MI5 routinely surveil anyone to the left of the Tory party as being some kind of dissident. The Johnson government is notorious for ignoring any kind of rules, restraint, or best practice. If they had something to say about it, they should have done so in public like the rest of us, once privately recommending had failed.
  - nonrandomstring 5y ago
    > I don't think you really want a world where the security services can overrule the elected government, rather than the other way round. Well said, and excellent point. But I would like to live in a world where security services could professionally, and in good faith, advise other public servants, who would professionally, and in good faith heed that advice. As I understand it that fits the actual job description for all parties. A world in which public servants are adversaries, in which intra- and inter-institutional trust has totally broken down seems to be the fruits of the misadventure, over-reach and disrespect for the Rule of Law in all quarters.
    - pjc50 5y ago
      Well, yes. But we're not dealing with public servants in the Cabinet, we're dealing with inept looters who are being propped up by the conservative press.
alasdair_ 5y ago
> Nobody is perfect - but there are people who blatantly ignore ITSEC best practices and are therefore almost unprotectable This is tangential to this story however. Even people who follow best practices can get owned when ex-Mossad/8200 agents armed with dozens of zero days and millions of dollars come after them.
- haker9 5y ago

forum_ghost 5y ago

>Bruce Schneier has also addressed it in his own way. very interesting, can you link to it? tia!

nonrandomstring 5y ago
Sure I guess this one [1] is fairly typical of Bruce's psoition. He identifes as (coined the phrase?) working as a "public interest technologist". He mentions this throughout his writing. I took to using the term "civic cybersecurity" and "digital self defence" after about 2014. I think we're on the same page, loosely. [1] https://www.schneier.com/essays/archives/2019/02/public-interest_tech.html https://www.schneier.com/essays/archives/2019/02/public-inte...

dundarious 5y ago

The Johnson government has been widely but toothlessly criticized for using WhatsApp on personal devices to conduct affairs of state (and deleting messages, failing to hand over messages to investigations, etc.). My personal opinion is that they don't care too much about this type of thing (being hacked by UAE, etc.), and are preoccupied with more selfish matters. It can be quite profitable to be the butler to Gulf, Russian, and UK billionaires.

pydry 5y ago

>And what were GCHQ, MI6 and NCSC doing to protect our prime-minister at this time? Preparing an advertising campaign against E2E encryption: https://www.engadget.com/the-uk-government-is-reportedly-planning-ad-campaign-attacking-end-to-end-encryption-101610703.html https://www.engadget.com/the-uk-government-is-reportedly-pla...

haltingproblem 5y ago

Veen 5y ago
There's so much that's factually wrong with this comment I don't know where to start. 1. The UK does have a Bill of Rights (It's different in England and Scotland). The English one pre-dates the US Bill of rights by a century[0]. 2. It does have a constitution, but not a written constitution in the American sense[1]. 3. The Queen doesn't nominate Bishops; she rubber stamps nominations by a committee who are approved by the PM. 4. The Queen does not vote in elections. [0]: https://en.wikipedia.org/wiki/Bill_of_Rights_1689 https://en.wikipedia.org/wiki/Bill_of_Rights_1689 [1]: https://en.wikipedia.org/wiki/Constitution_of_the_United_Kingdom https://en.wikipedia.org/wiki/Constitution_of_the_United_Kin...
- comprev 5y ago
  Fun fact: In addition to the Queen, the Speaker of the House of Commons also cannot vote due to their role in keeping order between all parties.
- haltingproblem 5y ago
  I stopped reading around: "Protestants may have arms for their defence suitable to their conditions and as allowed by law;" and something about (only) Ireland repealed it in [1]. In [2] it says, quite straight faced, that "The Constitution of the United Kingdom or British constitution comprises the written and unwritten arrangements that establish the United Kingdom of Great Britain and Northern Ireland as a political body. Unlike in most countries, no attempt has been made to codify such arrangements into a single document. Thus, it is known as an uncodified constitution. This enables the constitution to be easily changed as no provisions are formally entrenched.[2] However, the Supreme Court of the United Kingdom recognises that there are constitutional principles, including parliamentary sovereignty, the rule of law, democracy and upholding international law". There is no codified constitution but there are constitutional principles. Because it is not "entrenched" it can be easily changed. How can someone even say this without an Orwellian sneer? If a North Korean said that we would laugh them out of the room. Edit: North Korea does have a constitution. Written. Just not followed. Britain does not have a written constitution but it is followed (how?), except when it is not as in the wag that it just takes a minister's signature to violate an unwritten (but somehow codified) constitutional principle.

ClumsyPilot 5y ago

'solution can only come from a ground-up awareness through education' Average consumer cannot be responsible for security. Not because they are uneducated but becauae corporations have physicall talen away control from us. You have no control over software running on your router supplied by the internet company, wifi printer, smart toaster, tesla or what crapware is preinstalled on your phone (often you can't even update it) So since they took away control, they shoupd be held financially accountable

nonrandomstring 5y ago
> because corporations have physically taken away control from us. The solution of ground-up awareness and education I am suggesting involves making sure people understand they must take that back. The tag-line for the final chapter of my book is "Taking back tech" [1] > You have no control over software.... Well, actually you do, but it is insufficient, and moreover others have control over it which they should not. Legislation can fix this, but legislation requires an educated user base first. Many folks don't know how they are being abused, or even that they are being abused. This is the project of a new digital literacy. Digital literacy 1.0 was about "the amazing things computers can do" Digital literacy 2.0 is about "the dangerous things computers shouldn't do" > So since they took away control, they should be held financially accountable I don't think money is a factor in this. The questions revolve around fundamental rights, responsibilities, ownership and control, One cannot buy or sell such obligations. [1] https://digitalvegan.net https://digitalvegan.net

raxxorraxor 5y ago

I do think secret services did more damage than good with their forward surveillance of citizens, which basically was wild west surveillance initiated by states. The lost trust cannot be repaid for decades, maybe even centuries. It basically voided the significance of huge parts of constitutions of many countries that explicitly forbid such actions. This is beyond political realities of realpolitik where the justification was an alleged immediate threat of terrorism. And that is an overall problem. The fears decide the action. So improving security is becoming dangerous, because parents or teachers just putting their children into a cage of complete surveillance is the most probable outcome. Because the ambition is to get more control. But that doesn't provide much security at all and creates even far greater threats than the "wild west" free open net ever posed in the past.

InCityDreams 5y ago

>And what were GCHQ, MI6 and NCSC doing to protect our prime-minister at this time? Laughing their tits off?