5 ms·

Soldiers were already sharing videos of aircraft carriers on Rednote which hasn't gone through the whole shenanigans of paying Larry Ellison to host it on Oracl

by vasco 2y ago

Soldiers were already sharing videos of aircraft carriers on Rednote which hasn't gone through the whole shenanigans of paying Larry Ellison to host it on Oracle Cloud and so on. The national security risk is the US military apparently not being able to convince its own soldiers to be thoughtful about cybersecurity.

whatshisface 2y ago
How does it matter where those videos were shared? Material is either classified or unclassified, it doesn't matter if the WarThunder forums (for example) are moderated by US nationals or not.
- vasco 2y ago
  It's not about where the videos are posted, it's about having apps that collect exact GPS position of smartphones that soldiers carry while the position of the ships they are on is classified. The fact that there's videos is just the "proof" that they have installed such apps that exfiltrate things like their location, for example. Famously, soldiers wanted to use strava in secret military bases: https://www.theguardian.com/world/2018/jan/28/fitness-tracking-app-gives-away-location-of-secret-us-army-bases https://www.theguardian.com/world/2018/jan/28/fitness-tracki...
  - whatshisface 2y ago
    If you want to secure sailors' phones you are going to have to do a lot more, and at the same time much less, than ban or transfer the ownership of one single app that happens to be used by over a hundred million civilians.
    - redwall_hp 2y ago
      GasBuddy (and Life360) just sold that same location data to brokers, which Allstate bought and used to adjust premiums. Practically every app that is given access to location info is selling it, and it's widely available to anyone with the money to buy. Maybe we should have some sort of General Data Protection Regulation law instead of hand-wringing about social media.
      - ssl-3 2y ago
        GasBuddy, at least, said that they could (read: would) sell the location data that they collected after opt-in. It was part of the agreement. I can't imagine a world where it would be illegal for two parties to agree to sell the location data that one of them generates.
        woodson 2y ago
        That’s the world we live in today. Under many countries’ privacy laws, it’s not legal to sell PII to a third party that you collected for a specific other purpose (e.g., fulfilling the primary purpose of the app). The problem is that they do it anyways.
        ssl-3 2y ago
        What problem? If I agree to let FantasyCorp sell my location data, and then they follow through with our agreement and actually sell it, then there's no problem here that I can see.
  - Kye 2y ago
    Are ship locations classified? I doubt China has difficulty keeping track. They have satellites too.
    - pjc50 2y ago
      They almost certainly are while on deployment, despite it being really obvious where a ship is.
      - Atotalnoob 2y ago
        Oceans are vast, sometimes there are clouds and storms.
        echoangle 2y ago
        Clouds and storms don’t really help you with a SAR satellite.
    - wcunning 2y ago
      The Onion Router was invented by the Navy to make ship location tracking hard with visibility of some of the network, so it's classified at times. More importantly, just because you have satellites doesn't mean that it's easy to pick all of that out all the time or to be entirely certain of which ship/which mission, etc. Making it harder is better even if it can't be made impossible outside of subs.
    - catlifeonmars 2y ago
      App usage not only leaks location, but number of troops; something which is not readily detectable by satellite.
      - echoangle 2y ago
        Wouldn’t the crew of a ship be pretty constant though, for this example?
        2y ago
  - Gormo 2y ago
    Why are soldiers allowed to bring GPS-enable consumer smartphones along with them on top-secret deployments in the first place?
    - catlifeonmars 2y ago
      It’s not top secret deployments, it’s any deployments. All deployments need to maintain a level of operational security. Also if you expect a bunch of people in the 18-29 age range to go without internet for 9 months to 2 years, you’re kidding yourself. The tradeoff is between operational security and morale and if you’re in military leadership, you really don’t want unhappy troops on your hands.
      - Gormo 2y ago
        I mean, I do completely expect deployed military personnel to adhere to rules and limitations that are much more rigorous than those they'd experience in civilian life. I'd be astonished if I learned that soldiers on duty were totally free to do as they please the expense of operational security simply because that's what people in their broad demographic category are accustomed to. I'd be equally astonished if I found that military recruitment was based on enlisting cross-sectional samples of demographic categories, without regard for the capacities and attitudes of the specific individuals seeking to join. I know for a fact that people are rejected for enlistment for all sorts of reasons. And I'm sure that the military can find ways of enabling deployed personnel to use the internet without sacrificing security or oversight -- for example by requiring them to use secured military-issue computers and smartphones, or by having an inspection or vetting process for hardware and software when soldiers want to use their own devices. I hope you also acknowledge the absurdity of suggesting that the government should apply essentially the same restrictions to the whole of society that the military couldn't apply within its own sphere of control.
        ethbr1 2y ago
        You're constructing a straw man without being curious about the things you yourself are missing. Or in HNism, you're "Why don't they just..." without considering the reasons those solutions might be more challenging than they first appear. I suggest you read parent comment about balance and tradeoffs inherent in forward deployment again.
RobotToaster 2y ago
By that measure they should ban the war thunder forum before tiktok
gscott 2y ago
Plus these apps track you everywhere so the Chinese have your GPS and you're on the aircraft carrier. No need for fancy satellites they can just have that data and track the military and other government employees 24/7. I guarantee you no American company can track Chinese military or Chinese employees 24/7 wherever they're at this is a one-way deal it's not good for the US.
gazchop 2y ago
This isn’t the only risk. There is also the problem of radicalising people. This has been a big problem in Europe.
david_allison 2y ago
It's hopeless to expect every member of the military to be thoughtful about cybersecurity. If they'll openly share nuclear secrets & base protocols publicly, anything is fair game. https://www.bellingcat.com/news/2021/05/28/us-soldiers-expose-nuclear-weapons-secrets-via-flashcard-apps/ https://www.bellingcat.com/news/2021/05/28/us-soldiers-expos...
rchaud 2y ago
This is why Blackberry used to sell phones without cameras and microphone switches, and enterprise-centric OS images. Crazy that regular iOS/Android phones leaking data 24/7 to a million 'partners' are freely allowed at military locations. Pictures and video uploaded to social media include EXIF data with geolocation!
oooyay 2y ago
> The national security risk is the US military apparently not being able to convince its own soldiers to be thoughtful about cybersecurity. That's not really a new problem. The problem is as old as time, even before the internet: https://en.wikipedia.org/wiki/Loose_lips_sink_ships https://en.wikipedia.org/wiki/Loose_lips_sink_ships When I was deployed in 2011 we didn't carry cell phones because: 1. Jammers will render your antenna unusable or potentially damage your device. 2. The country that controls the infrastructure now has the inside scoop on who you are, what you're doing, and where you are. Even if they country is an ally, it only takes a few individuals to start mass exfiltration. TikTok was turning into infrastructure for social dialogue except that it had a new capability compared to the cell phones of 2011: it could be manipulated at scale, and quickly with the combination of algorithms and outrage culture.

by vasco 2y ago

whatshisface 2y ago

How does it matter where those videos were shared? Material is either classified or unclassified, it doesn't matter if the WarThunder forums (for example) are moderated by US nationals or not.

vasco 2y ago
It's not about where the videos are posted, it's about having apps that collect exact GPS position of smartphones that soldiers carry while the position of the ships they are on is classified. The fact that there's videos is just the "proof" that they have installed such apps that exfiltrate things like their location, for example. Famously, soldiers wanted to use strava in secret military bases: https://www.theguardian.com/world/2018/jan/28/fitness-tracking-app-gives-away-location-of-secret-us-army-bases https://www.theguardian.com/world/2018/jan/28/fitness-tracki...
- whatshisface 2y ago
  If you want to secure sailors' phones you are going to have to do a lot more, and at the same time much less, than ban or transfer the ownership of one single app that happens to be used by over a hundred million civilians.
  - redwall_hp 2y ago
    GasBuddy (and Life360) just sold that same location data to brokers, which Allstate bought and used to adjust premiums. Practically every app that is given access to location info is selling it, and it's widely available to anyone with the money to buy. Maybe we should have some sort of General Data Protection Regulation law instead of hand-wringing about social media.
    - ssl-3 2y ago
      GasBuddy, at least, said that they could (read: would) sell the location data that they collected after opt-in. It was part of the agreement. I can't imagine a world where it would be illegal for two parties to agree to sell the location data that one of them generates.
      - woodson 2y ago
        That’s the world we live in today. Under many countries’ privacy laws, it’s not legal to sell PII to a third party that you collected for a specific other purpose (e.g., fulfilling the primary purpose of the app). The problem is that they do it anyways.
        ssl-3 2y ago
        What problem? If I agree to let FantasyCorp sell my location data, and then they follow through with our agreement and actually sell it, then there's no problem here that I can see.
- Kye 2y ago
  Are ship locations classified? I doubt China has difficulty keeping track. They have satellites too.
  - pjc50 2y ago
    They almost certainly are while on deployment, despite it being really obvious where a ship is.
    - Atotalnoob 2y ago
      Oceans are vast, sometimes there are clouds and storms.
      - echoangle 2y ago
        Clouds and storms don’t really help you with a SAR satellite.
  - wcunning 2y ago
    The Onion Router was invented by the Navy to make ship location tracking hard with visibility of some of the network, so it's classified at times. More importantly, just because you have satellites doesn't mean that it's easy to pick all of that out all the time or to be entirely certain of which ship/which mission, etc. Making it harder is better even if it can't be made impossible outside of subs.
  - catlifeonmars 2y ago
    App usage not only leaks location, but number of troops; something which is not readily detectable by satellite.
    - echoangle 2y ago
      Wouldn’t the crew of a ship be pretty constant though, for this example?
      - 2y ago
- Gormo 2y ago
  Why are soldiers allowed to bring GPS-enable consumer smartphones along with them on top-secret deployments in the first place?
  - catlifeonmars 2y ago
    It’s not top secret deployments, it’s any deployments. All deployments need to maintain a level of operational security. Also if you expect a bunch of people in the 18-29 age range to go without internet for 9 months to 2 years, you’re kidding yourself. The tradeoff is between operational security and morale and if you’re in military leadership, you really don’t want unhappy troops on your hands.
    - Gormo 2y ago
      I mean, I do completely expect deployed military personnel to adhere to rules and limitations that are much more rigorous than those they'd experience in civilian life. I'd be astonished if I learned that soldiers on duty were totally free to do as they please the expense of operational security simply because that's what people in their broad demographic category are accustomed to. I'd be equally astonished if I found that military recruitment was based on enlisting cross-sectional samples of demographic categories, without regard for the capacities and attitudes of the specific individuals seeking to join. I know for a fact that people are rejected for enlistment for all sorts of reasons. And I'm sure that the military can find ways of enabling deployed personnel to use the internet without sacrificing security or oversight -- for example by requiring them to use secured military-issue computers and smartphones, or by having an inspection or vetting process for hardware and software when soldiers want to use their own devices. I hope you also acknowledge the absurdity of suggesting that the government should apply essentially the same restrictions to the whole of society that the military couldn't apply within its own sphere of control.
      - ethbr1 2y ago
        You're constructing a straw man without being curious about the things you yourself are missing. Or in HNism, you're "Why don't they just..." without considering the reasons those solutions might be more challenging than they first appear. I suggest you read parent comment about balance and tradeoffs inherent in forward deployment again.

RobotToaster 2y ago

By that measure they should ban the war thunder forum before tiktok

gscott 2y ago

Plus these apps track you everywhere so the Chinese have your GPS and you're on the aircraft carrier. No need for fancy satellites they can just have that data and track the military and other government employees 24/7. I guarantee you no American company can track Chinese military or Chinese employees 24/7 wherever they're at this is a one-way deal it's not good for the US.

gazchop 2y ago

This isn’t the only risk. There is also the problem of radicalising people. This has been a big problem in Europe.

david_allison 2y ago

It's hopeless to expect every member of the military to be thoughtful about cybersecurity. If they'll openly share nuclear secrets & base protocols publicly, anything is fair game. https://www.bellingcat.com/news/2021/05/28/us-soldiers-expose-nuclear-weapons-secrets-via-flashcard-apps/ https://www.bellingcat.com/news/2021/05/28/us-soldiers-expos...

rchaud 2y ago

This is why Blackberry used to sell phones without cameras and microphone switches, and enterprise-centric OS images. Crazy that regular iOS/Android phones leaking data 24/7 to a million 'partners' are freely allowed at military locations. Pictures and video uploaded to social media include EXIF data with geolocation!

oooyay 2y ago

> The national security risk is the US military apparently not being able to convince its own soldiers to be thoughtful about cybersecurity. That's not really a new problem. The problem is as old as time, even before the internet: https://en.wikipedia.org/wiki/Loose_lips_sink_ships https://en.wikipedia.org/wiki/Loose_lips_sink_ships When I was deployed in 2011 we didn't carry cell phones because: 1. Jammers will render your antenna unusable or potentially damage your device. 2. The country that controls the infrastructure now has the inside scoop on who you are, what you're doing, and where you are. Even if they country is an ally, it only takes a few individuals to start mass exfiltration. TikTok was turning into infrastructure for social dialogue except that it had a new capability compared to the cell phones of 2011: it could be manipulated at scale, and quickly with the combination of algorithms and outrage culture.