7 ms·

Is there really any way to hide from a motivated state actor? Asking about it on HN is definitely not one. Relevant xkcd: 538 [1] [1] https://xkcd.com/538/ h

Is there really any way to hide from a motivated state actor? Asking about it on HN is definitely not one. Relevant xkcd: 538 [1] [1] https://xkcd.com/538/ https://xkcd.com/538/

Jerrrry 4y ago
No. Which is why Agora marketplace, digital lawyers, and a slew of others have simply said: "we no longer operate under any assumption of privacy regardless of measures taken, and have simple refused to operate on the internet any longer." Which is what the 3 letters want, a chilling-effect to reduce their Herculean-effort to just an Athenian one.
- danuker 4y ago
  Physical measures might make yourself much more expensive to surveil, to the point of not being worth it. You can avoid being the "easy picking".
  - r3trohack3r 4y ago
    Bingo. Tor is just a layer. You still have to take measures to separate your identity from the device, the behavior, and the location. When tor falls, the next question is "what do they see?" You have control over that.
deleted 4y ago
[deleted]
vorpalhex 4y ago
Just as there is no perfect boat or perfect date, there is no perfect security or privacy. You can make things more and more difficult for your adversary (and usually for yourself too) but if they are dedicated enough they can basically outspend you. Therefore you need to minimize the apparent cost of your actions and their duration. You can afford to be a passing pain in their butt but you can't afford to be the focus of their eye.
hinata08 4y ago
it depends on what you're doing (as far as I understand as a criminal news nerd) the police-justice system is usually broke for commoners. So yeah, if you're not doing a serious offense, they will never catch you. Where I live, you can buy weed. Even if the government says they're motivated to stop it, they don't have the resources to plant police everywhere. If your home was 'visited' by burglars, they would just take fingerprints. They wear gloves, and that's enough to avoid the state actor. if you're doing a real serious crime, you can kind-ish avoid attention, if you know retention laws and stuff. if the (mostly digital) traces you generated are too old, they would have disappeared or would not be usable in court. if you appeared on mall CCTV months before you did the crime, have been browsing sites over a year before, ... these data should technically have been deleted.- Just don't create new data in the meantime. In a similar fashion, some white collar criminals host data in their lawyers office. it is so hard to have a warrant for a lawyers office that you can be safe. A law teacher at our engineering college said it was convenient to hang out with a lawyer - just drop your phone in their purse if cops show up. then, you can avoid some digital communications. Putin and friends are well known for being mostly offline, unlike some ministers at western governments, for example. Send letters, and you will have that perfect forward secrecy. there has also been some stories about plausible deniability ( https://en.wikipedia.org/wiki/Plausible_deniability https://en.wikipedia.org/wiki/Plausible_deniability ), especially among rogue corporations and corrupt politicians. ie when you create data, you can do it in a way where it says what it says, but it's not meaningful in court. don't drag attention on you. cops shows teach you how so many criminals are found out after a traffic stop, when they were speeding or ran a red light. The government can't check everyone, so they check those who stand out. Lastly, I remember watching a youtuber who got out of prison, and who said that three people could only keep a secret if 2 are dead. it's a bit pessimistic and dark, but maybe don't just involve everyone in your crimes. I would like to know if series like Breaking Bad are (or were) realistic. I know some criminals learned a lot from movies. Edit : or just befriend politicians, you would be above any law in most places. Someone in France once stole 2.5 billions $ in one shot from the government. It what became known as the uramin scandal, and nobody was caught. So everything is possible.
- AlbertCory 4y ago
  > three people could only keep a secret if 2 are dead Exactly. Which is why, not to start a JFK war, I think the Mafia killed JFK. If it were the CIA, or LBJ, someone would have talked. Anyone who knew what happened got whacked.
bumby 4y ago
Possibly with the help of another motivated state actor. I believe one of the theories about the proliferation of the current organization of political entities is that the only organization that can reliably compete with one nation-state is another nation-state.
kerpotgh 4y ago
Probably. If you use a laptop once, on a public Wi-Fi hundreds of miles from where you live, while not being caught on surveillance, while using a stripped down privacy based OS, and then route yourself through Tor, you might be okay.
- magnat 4y ago
  Not if you brought your cellphone on the trip. Or used a car that has a built-in SIM card and cellular modem. Or you bought that laptop from a supplier that registers all MAC addresses of sold devices. Or that laptop had Computrace or some other firmware-based anti-theft mechanism.
  - kerpotgh 4y ago
    Okay so in addition to the above, use a burner and change your MAC address. “Lojacks” on laptops is still mostly pretty unheard of.
    - generalizations 4y ago
      > mostly pretty unheard of Yeah, but if there is an exception to that, it'd be the scenario we're talking about.
  - heavyset_go 4y ago
    Even if you had a car without a cell connection, license plate readers and cameras make it easy for anyone with access to replay and reverse any traveling you do with any car.
    - at-fates-hands 4y ago
      This is basically how the prosecutor in the Idaho case is putting Kohberger at the scene. They've also used where his cell phone was pinging during the night of the murders as additional evidence he was there. Meanwhile, detectives scoured video footage from cameras in the area and picked out a white Hyundai Elantra driving past the house three times before stopping on the fourth pass shortly after 4am. The car left 16 minutes later “at a high rate of speed”, according to Payne Meanwhile, FBI investigators trawled through Kohberger’s cellphone records and discovered that he turned it off shortly before the attack, perhaps thinking it would help him to avoid detection. The phone springs to life again at 4.48am on a road out of Moscow. The records also showed that Kohberger was in the area near the house at least a dozen times in the months before the attack, usually in the early morning or late evenings. Investigators said they were examining whether he “conducted surveillance on the King Road residents and was in contact with any of the victim’s associates before or after the alleged offense”.
timwaagh 4y ago
Hole in the ground far away? Not on the internet presumably. In any case any would be terrorists should take note: don't use grannies computer.
dmux 4y ago
One of my favorite HN comments of all time [0] suggested that MMO's provide plentiful means of covertly communicating: >MMO's are packed with possible communication channels in addition to chat. Ever wonder if that annoying gnome in the auction hall is jumping in morse code? Could signals be sent with bids? Could a character's inventory contents be arranged to leave a message to someone else who shares the login info? Is that nonsense coming from what you presume to be a bot-controlled gold-farming crew really nonsense? When a game goes to great lengths to simulate a world, the possibilities for covert communication are nearly limitless! [0] https://news.ycombinator.com/item?id=6874143 https://news.ycombinator.com/item?id=6874143
- bmn__ 4y ago
  > MMO's provide plentiful means of covertly communicating This is a plot device in <http://enwp.org/Little_Brother_%28Doctorow_novel%29 http://enwp.org/Little_Brother_%28Doctorow_novel%29>.
  - skippyboxedhero 4y ago
    Also in the film Four Lions where terrorists use an online game to communicate (basically an unbranded Club Penguin). Wouldn't particularly recommend watching the film (it isn't bad, it is just depressing...which is the aim) but the media coverage of this does suggest it is occurring.
    - plugin-baby 4y ago
      > Wouldn't particularly recommend watching the film (it isn't bad, it is just depressing...which is the aim) It’s a comedy, I don’t think it aims to depress.
    - spott 4y ago
      Also in the first season of the Jack Ryan show (which only bears a very passing resemblance to Tom Clancy’s Jack Ryan, but has good action)
- PartiallyTyped 4y ago
oceanplexian 4y ago
If I were hiding from a state actor I'd use a high-bandwidth communications medium like video. In another life I worked for a large live streaming service, the infrastructure required to process terabits of video is mind-boggling in size, extremely technically challenging, and usually involves custom built ASICs and hardware that's expensive and in short supply. Even with the NSA's budget and infrastructure, I don't think it's technologically feasible for them to decrypt and then semantically process or store that much content. Video is also the vast majority of traffic on the Internet so it would be trivial to hide in plain sight with some creativity (Using stenography to hide content in the video) With 4k you can pack a ridiculous amount of information into even a single frame, and that's one frame among hundreds of thousands, among billions of videos.
- autoexec 4y ago
  > Even with the NSA's budget and infrastructure, I don't think it's technologically feasible for them to decrypt and then semantically process or store that much content. I have little doubt that they can store terabits of video content. They let us know about their utah data center (https://en.wikipedia.org/wiki/Utah_Data_Center https://en.wikipedia.org/wiki/Utah_Data_Center) which was estimated to have as much as 12 exabytes in 2013 and who knows what data centers they have they aren't mentioning. Back in 2003 they had no problems capturing every bit of data that moved over AT&Ts network. Storage is dirt cheap and they can just hang onto everything until they see a reason to dig into it. No need to process everything right away. You'd think your video would be blending in with all the other video on the internet, but it really wouldn't. Streaming video put out by netflix is going to look very different than streaming video served via youtube vs streaming video over P2P etc.
  - derangedHorse 4y ago
    OP said he doesn't "think it's technologically feasible for them to decrypt and then semantically process or store that much content" meaning it's more about just storing the raw data. Assuming they could store it perfectly fine (which is a big 'if' considering Cisco estimated 7.7 Exabytes of data would be generated per day by 2021), they'd still have to decrypt all the videos, semantically analyze each video (subtitles, object detection, face recognition, etc), find a way to index that information to make it queryable, and run analytics on that data regularly. Ideally they wouldn't have to search everything when needed and could keep a running file on everyone (because lazily parsing data could be expensive and probably a waste on their existing current resources). That's not to say they can't do it, given that they probably have a huge budget, but it's also not a sure thing they can do it effectively for those who are trying to stay hidden.
joshlemer 4y ago
What about www.bitmessage.org ?

Is there really any way to hide from a motivated state actor? Asking about it on HN is definitely not one. Relevant xkcd: 538 [1] [1] https://xkcd.com/538/ https://xkcd.com/538/

Jerrrry 4y ago

No. Which is why Agora marketplace, digital lawyers, and a slew of others have simply said: "we no longer operate under any assumption of privacy regardless of measures taken, and have simple refused to operate on the internet any longer." Which is what the 3 letters want, a chilling-effect to reduce their Herculean-effort to just an Athenian one.

danuker 4y ago
Physical measures might make yourself much more expensive to surveil, to the point of not being worth it. You can avoid being the "easy picking".
- r3trohack3r 4y ago
  Bingo. Tor is just a layer. You still have to take measures to separate your identity from the device, the behavior, and the location. When tor falls, the next question is "what do they see?" You have control over that.

deleted 4y ago

[deleted]

vorpalhex 4y ago

Just as there is no perfect boat or perfect date, there is no perfect security or privacy. You can make things more and more difficult for your adversary (and usually for yourself too) but if they are dedicated enough they can basically outspend you. Therefore you need to minimize the apparent cost of your actions and their duration. You can afford to be a passing pain in their butt but you can't afford to be the focus of their eye.

hinata08 4y ago

it depends on what you're doing (as far as I understand as a criminal news nerd) the police-justice system is usually broke for commoners. So yeah, if you're not doing a serious offense, they will never catch you. Where I live, you can buy weed. Even if the government says they're motivated to stop it, they don't have the resources to plant police everywhere. If your home was 'visited' by burglars, they would just take fingerprints. They wear gloves, and that's enough to avoid the state actor. if you're doing a real serious crime, you can kind-ish avoid attention, if you know retention laws and stuff. if the (mostly digital) traces you generated are too old, they would have disappeared or would not be usable in court. if you appeared on mall CCTV months before you did the crime, have been browsing sites over a year before, ... these data should technically have been deleted.- Just don't create new data in the meantime. In a similar fashion, some white collar criminals host data in their lawyers office. it is so hard to have a warrant for a lawyers office that you can be safe. A law teacher at our engineering college said it was convenient to hang out with a lawyer - just drop your phone in their purse if cops show up. then, you can avoid some digital communications. Putin and friends are well known for being mostly offline, unlike some ministers at western governments, for example. Send letters, and you will have that perfect forward secrecy. there has also been some stories about plausible deniability ( https://en.wikipedia.org/wiki/Plausible_deniability https://en.wikipedia.org/wiki/Plausible_deniability ), especially among rogue corporations and corrupt politicians. ie when you create data, you can do it in a way where it says what it says, but it's not meaningful in court. don't drag attention on you. cops shows teach you how so many criminals are found out after a traffic stop, when they were speeding or ran a red light. The government can't check everyone, so they check those who stand out. Lastly, I remember watching a youtuber who got out of prison, and who said that three people could only keep a secret if 2 are dead. it's a bit pessimistic and dark, but maybe don't just involve everyone in your crimes. I would like to know if series like Breaking Bad are (or were) realistic. I know some criminals learned a lot from movies. Edit : or just befriend politicians, you would be above any law in most places. Someone in France once stole 2.5 billions $ in one shot from the government. It what became known as the uramin scandal, and nobody was caught. So everything is possible.

AlbertCory 4y ago
> three people could only keep a secret if 2 are dead Exactly. Which is why, not to start a JFK war, I think the Mafia killed JFK. If it were the CIA, or LBJ, someone would have talked. Anyone who knew what happened got whacked.

bumby 4y ago

Possibly with the help of another motivated state actor. I believe one of the theories about the proliferation of the current organization of political entities is that the only organization that can reliably compete with one nation-state is another nation-state.

kerpotgh 4y ago

Probably. If you use a laptop once, on a public Wi-Fi hundreds of miles from where you live, while not being caught on surveillance, while using a stripped down privacy based OS, and then route yourself through Tor, you might be okay.

magnat 4y ago
Not if you brought your cellphone on the trip. Or used a car that has a built-in SIM card and cellular modem. Or you bought that laptop from a supplier that registers all MAC addresses of sold devices. Or that laptop had Computrace or some other firmware-based anti-theft mechanism.
- kerpotgh 4y ago
  Okay so in addition to the above, use a burner and change your MAC address. “Lojacks” on laptops is still mostly pretty unheard of.
  - generalizations 4y ago
    > mostly pretty unheard of Yeah, but if there is an exception to that, it'd be the scenario we're talking about.
- heavyset_go 4y ago
  Even if you had a car without a cell connection, license plate readers and cameras make it easy for anyone with access to replay and reverse any traveling you do with any car.
  - at-fates-hands 4y ago
    This is basically how the prosecutor in the Idaho case is putting Kohberger at the scene. They've also used where his cell phone was pinging during the night of the murders as additional evidence he was there. Meanwhile, detectives scoured video footage from cameras in the area and picked out a white Hyundai Elantra driving past the house three times before stopping on the fourth pass shortly after 4am. The car left 16 minutes later “at a high rate of speed”, according to Payne Meanwhile, FBI investigators trawled through Kohberger’s cellphone records and discovered that he turned it off shortly before the attack, perhaps thinking it would help him to avoid detection. The phone springs to life again at 4.48am on a road out of Moscow. The records also showed that Kohberger was in the area near the house at least a dozen times in the months before the attack, usually in the early morning or late evenings. Investigators said they were examining whether he “conducted surveillance on the King Road residents and was in contact with any of the victim’s associates before or after the alleged offense”.

timwaagh 4y ago

Hole in the ground far away? Not on the internet presumably. In any case any would be terrorists should take note: don't use grannies computer.

dmux 4y ago

One of my favorite HN comments of all time [0] suggested that MMO's provide plentiful means of covertly communicating: >MMO's are packed with possible communication channels in addition to chat. Ever wonder if that annoying gnome in the auction hall is jumping in morse code? Could signals be sent with bids? Could a character's inventory contents be arranged to leave a message to someone else who shares the login info? Is that nonsense coming from what you presume to be a bot-controlled gold-farming crew really nonsense? When a game goes to great lengths to simulate a world, the possibilities for covert communication are nearly limitless! [0] https://news.ycombinator.com/item?id=6874143 https://news.ycombinator.com/item?id=6874143

bmn__ 4y ago
> MMO's provide plentiful means of covertly communicating This is a plot device in <http://enwp.org/Little_Brother_%28Doctorow_novel%29 http://enwp.org/Little_Brother_%28Doctorow_novel%29>.
- skippyboxedhero 4y ago
  Also in the film Four Lions where terrorists use an online game to communicate (basically an unbranded Club Penguin). Wouldn't particularly recommend watching the film (it isn't bad, it is just depressing...which is the aim) but the media coverage of this does suggest it is occurring.
  - plugin-baby 4y ago
    > Wouldn't particularly recommend watching the film (it isn't bad, it is just depressing...which is the aim) It’s a comedy, I don’t think it aims to depress.
  - spott 4y ago
    Also in the first season of the Jack Ryan show (which only bears a very passing resemblance to Tom Clancy’s Jack Ryan, but has good action)
PartiallyTyped 4y ago

oceanplexian 4y ago

If I were hiding from a state actor I'd use a high-bandwidth communications medium like video. In another life I worked for a large live streaming service, the infrastructure required to process terabits of video is mind-boggling in size, extremely technically challenging, and usually involves custom built ASICs and hardware that's expensive and in short supply. Even with the NSA's budget and infrastructure, I don't think it's technologically feasible for them to decrypt and then semantically process or store that much content. Video is also the vast majority of traffic on the Internet so it would be trivial to hide in plain sight with some creativity (Using stenography to hide content in the video) With 4k you can pack a ridiculous amount of information into even a single frame, and that's one frame among hundreds of thousands, among billions of videos.

autoexec 4y ago
> Even with the NSA's budget and infrastructure, I don't think it's technologically feasible for them to decrypt and then semantically process or store that much content. I have little doubt that they can store terabits of video content. They let us know about their utah data center (https://en.wikipedia.org/wiki/Utah_Data_Center https://en.wikipedia.org/wiki/Utah_Data_Center) which was estimated to have as much as 12 exabytes in 2013 and who knows what data centers they have they aren't mentioning. Back in 2003 they had no problems capturing every bit of data that moved over AT&Ts network. Storage is dirt cheap and they can just hang onto everything until they see a reason to dig into it. No need to process everything right away. You'd think your video would be blending in with all the other video on the internet, but it really wouldn't. Streaming video put out by netflix is going to look very different than streaming video served via youtube vs streaming video over P2P etc.
- derangedHorse 4y ago
  OP said he doesn't "think it's technologically feasible for them to decrypt and then semantically process or store that much content" meaning it's more about just storing the raw data. Assuming they could store it perfectly fine (which is a big 'if' considering Cisco estimated 7.7 Exabytes of data would be generated per day by 2021), they'd still have to decrypt all the videos, semantically analyze each video (subtitles, object detection, face recognition, etc), find a way to index that information to make it queryable, and run analytics on that data regularly. Ideally they wouldn't have to search everything when needed and could keep a running file on everyone (because lazily parsing data could be expensive and probably a waste on their existing current resources). That's not to say they can't do it, given that they probably have a huge budget, but it's also not a sure thing they can do it effectively for those who are trying to stay hidden.

joshlemer 4y ago

What about www.bitmessage.org ?