14 ms·

E-Mail Security in the Wake of Petraeus

78 points by neeee 14y ago

killermonkeys 14y ago
I don't personally buy that the solution to this is to "rein in the FBI" if we're talking about the security of the CIA chief vis-a-vis the FBI. The point is that a motivated attacker could do all these things to a high value target. It might sound far-fetched but having damaging personal information about a CIA chief is very valuable. I don't condone judging people by their worst actions, but I think that the government would rather the FBI found out this information than someone else.
- deleted 14y ago
  [deleted]
mtgx 14y ago
The issue is not whether or not FBI should be able to do something like this, but they should be following more strict procedures, and they should always need a warrant and "probably cause". It's pretty scary that the FBI can get all this information about someone just because there's a 10th degree relationship between someone they were following and you. But this case was pretty horrible to begin with. It seems FBI was only doing this as a "favor" to someone, and it wasn't about finding evidence about Petraeus having an affair, that enemies could've exploited, because they weren't aware about this, and they only found it by mistake. All I'm saying is that the Government having this kind of power doesn't represent the "land of the free" very well, that US is supposed to be, and it has a lot more in common with a dictatorship/totalitarian state than with a true democratic republic. It seems to me that technology is making it irresistible for Governments all over the world, whether democratic or not, to want to spy on their citizens and know everything about them. The lure of absolute and all-knowing power is very tempting, the easier it gets with new technology. If this doesn't become a real political issue, and is not stopped, I could easily envision how 30-40 years from now, when technology will make it possible for people to interact with technology through mind control, it will also be very easy technologically wise to see what people are thinking, and the Governments will no doubt want to easily access that, too. There's already another scary trend starting to show-up - that of pre-crime recognition, although it's still in its very early stages. But imagine when we'll start to use quantum computers. Those computers could easily create all the needed statistics and possibilities to show how likely someone is to commit a crime in the near future, and I could see the government and law enforcement agencies wanting to use that. I think we've all read the reports of NYPD police raiding the OWS leaders a night before the protests were supposed to happen. This is not mere unlikely theory. It's already happening, just on a much smaller scale. It would simply be irresistible to them at the time, just like they love being able to obtain all the data about you without a warrant right now, and they'd love if it they could do even more without a warrant, and are lobbying for these types of laws in Congress. The only way to stop these sort of trends is for people to take a stand, and vote for people who are against them.
- sliverstorm 14y ago
  the Government having this kind of power doesn't represent the "land of the free" very well An interesting thought springs to mind. Being free, and the government knowing what you are up to, are not inherently at odds. This is a good thing, as hiding things is only going to get more difficult as technology progresses. Rather than fighting to keep one's deeds (or misdeeds) secret, perhaps we should be fighting to make it such that it doesn't matter if the government knows?
  - CodeMage 14y ago
    'Smith!' yelled a voice from the telescreen. '6079 Smith W.! Hands out of pockets in the cells!'
    - sliverstorm 14y ago
      I guess you're right, that's really the only choice we have; the government we have today, or the government of 1984.
      - CodeMage 14y ago
        I guess you're right, we should trust that the government of 1984 (or any other dystopia) would never come to pass if we relinquish our privacy.
  - beagle3 14y ago
    The government is made of people. So just replace "government" with "other random people" in your thought above, and see if it makes sense to you. To me, it IS "inherently at odds". edit: to expand on this - information easily leaks from government employees who have been authorized to access it. Especially when it is so easy to get, and is so broad, then a private investigator is likely to find a government employee who would copy the files about person-of-interest-X in return for $1000, for almost every X. For just one additional lookup a week, that employee can make an additional $50,000 tax free with negligible chance of getting caught (with today's nonexistent oversight) except if the resulting leak happens to become a news item. So, realistically also replace "government" with "any willing person with $2000 to spare" (the private investigator will also take a cut :) )
misnome 14y ago
I'm still confused about this whole thing. What did he do that he needed to resign for? As far as I can tell, he had an affair, which isn't exactly uncommon, and probably has zero influence on how he worked in his job.
- e40 14y ago
  Having an affair opens yourself to blackmail, and given he is the top spy this is considered a serious offence. That's the thinking, anyway. There might also be an ethical code which was broken, which is a fireable offence.
  - thechut 14y ago
    The "susceptible to blackmail" argument is a justification and easy excuse. That is the exact same argument people used to keep gays out of the military for years. Not to mention, it was leaked to the media, everyone already knows about it. How exactly could that be used to blackmail someone if the entire world already knows about it?
    - MichaelSalib 14y ago
      During the time when the affair was secret, Petraeus was vulnerable to blackmail. His failure to recognize that and alert his superiors demonstrates that can't be trusted.
      - harshreality 14y ago
        Do you really think he would allow himself to be blackmailed rather than tell the blackmailer to go ahead and go public with the information? He admitted the affair to the FBI when initially questioned about the emails. I suppose you think Clinton should have resigned (instead of lying about the affair, which made everything worse)?
        ams6110 14y ago
        Hard to know what a person might do in that situation, hence the regulations.
liotier 14y ago
Yes another reason why I still bother to maintain an email server for 150 people in our family and friends circles. It is one hundred times more expensive than industrial hosting but, if you know what you want there is only one way to get it.
- ZoFreX 14y ago
  I think you might be kidding yourself if you think that gives you any meaningful protection against government agencies. As the article said, one of the dangers of taking some protections is being lulled into a false sense of security.
  - rsync 14y ago
    Running your own mail server changes everything. At the end of the day Men With Guns(TM) may still come to your colo facility and just take the equipment, but even in that edge scenario, you would know something was up in a way you wouldn't with gmail. In non edge cases, you are the provider and the owner of the equipment, and it is you who will be given the court order - you'll see what is going on and have the opportunity to respond as YOU see fit, not as google sees fit. Furthermore, depending on your practices and countermeasures, you may have actions available to you with your own assets that, of course, you wouldn't have with gmail. In fact, the advantages of running your own mail server are so great, that over the past few years I've decided it's probably time to start self-providing my own dialtone and voicemail the same way I self-provide my own email. For all of the same reasons.
    - DanBC 14y ago
      Some people are not able to keep up with the security patching required to host their own server. Some people are not able to keep up with best current practice to ensure that email from their server is deliverable. Running your own email server is for many people a sub-optimal solution. Sure, for a small number of people it's a great idea.
      - 14y ago
haberman 14y ago
What is the difference between a warrant and a court order? Both presumably have judicial oversight, so is it just a difference in the standard required to issue one? This reminds me of an experience I had several years ago. My sweet grandma fell prey to a scam where someone called her, impersonating me, and said I was in trouble in a foreign country and needed money. She sent some money via Western Union (or a comparable service, I don't remember which one) to my name, and the scammer picked the money up. To do this the scammer needed ID under my name. I called up the company and asked to see a copy of the ID that was used, since I wanted to know if any of my documents had been compromised. The company said they wouldn't release that information without a subpoena, which seemed reasonable to me (for all they knew, I was an attacker trying to steal someone else's ID). But I couldn't find any way of getting a court order of any kind. It seemed reasonable to me that I should have standing to see what ID was used to impersonate me and steal money from my grandmother, but I couldn't find any options for actually obtaining it. In this situation, I would have loved a way to obtain a court order for this information.
- Spooky23 14y ago
  Certain types of requests by law only require an "administrative subpoena" -- Federal agencies basically are given the discretion by Congress to determine when they are necessary. Typically, they are used to establish facts needed to support a search warrant. For example, the police may subpoena a utility to obtain electricity usage when investigating a marijuana grower. Using that information, they can obtain phone data and eventually get a search warrant to search the physical location.
thechut 14y ago
This is beyond scary, we all basically live in a police state now and their is nothing we can do about it. Schneier's last line just about sums it up...
- adestefan 14y ago
  Please. This is nothing compared to what the FBI did from their inception until the late 1970s. If this happens 40 years ago you might find out about it 5 to 7 years after it occurred.
  - beagle3 14y ago
    While I agree with what you are saying, it's like saying "ha, your fatty liver isn't serious. Some people get cancer!". The fact that the FBI was even more horrible until the 1970s doesn't make the current situation any less scary.

78 points by neeee 14y ago

I don't personally buy that the solution to this is to "rein in the FBI" if we're talking about the security of the CIA chief vis-a-vis the FBI. The point is that a motivated attacker could do all these things to a high value target. It might sound far-fetched but having damaging personal information about a CIA chief is very valuable. I don't condone judging people by their worst actions, but I think that the government would rather the FBI found out this information than someone else.

deleted 14y ago
[deleted]

mtgx 14y ago

The issue is not whether or not FBI should be able to do something like this, but they should be following more strict procedures, and they should always need a warrant and "probably cause". It's pretty scary that the FBI can get all this information about someone just because there's a 10th degree relationship between someone they were following and you. But this case was pretty horrible to begin with. It seems FBI was only doing this as a "favor" to someone, and it wasn't about finding evidence about Petraeus having an affair, that enemies could've exploited, because they weren't aware about this, and they only found it by mistake. All I'm saying is that the Government having this kind of power doesn't represent the "land of the free" very well, that US is supposed to be, and it has a lot more in common with a dictatorship/totalitarian state than with a true democratic republic. It seems to me that technology is making it irresistible for Governments all over the world, whether democratic or not, to want to spy on their citizens and know everything about them. The lure of absolute and all-knowing power is very tempting, the easier it gets with new technology. If this doesn't become a real political issue, and is not stopped, I could easily envision how 30-40 years from now, when technology will make it possible for people to interact with technology through mind control, it will also be very easy technologically wise to see what people are thinking, and the Governments will no doubt want to easily access that, too. There's already another scary trend starting to show-up - that of pre-crime recognition, although it's still in its very early stages. But imagine when we'll start to use quantum computers. Those computers could easily create all the needed statistics and possibilities to show how likely someone is to commit a crime in the near future, and I could see the government and law enforcement agencies wanting to use that. I think we've all read the reports of NYPD police raiding the OWS leaders a night before the protests were supposed to happen. This is not mere unlikely theory. It's already happening, just on a much smaller scale. It would simply be irresistible to them at the time, just like they love being able to obtain all the data about you without a warrant right now, and they'd love if it they could do even more without a warrant, and are lobbying for these types of laws in Congress. The only way to stop these sort of trends is for people to take a stand, and vote for people who are against them.

sliverstorm 14y ago
the Government having this kind of power doesn't represent the "land of the free" very well An interesting thought springs to mind. Being free, and the government knowing what you are up to, are not inherently at odds. This is a good thing, as hiding things is only going to get more difficult as technology progresses. Rather than fighting to keep one's deeds (or misdeeds) secret, perhaps we should be fighting to make it such that it doesn't matter if the government knows?
- CodeMage 14y ago
  'Smith!' yelled a voice from the telescreen. '6079 Smith W.! Hands out of pockets in the cells!'
  - sliverstorm 14y ago
    I guess you're right, that's really the only choice we have; the government we have today, or the government of 1984.
    - CodeMage 14y ago
      I guess you're right, we should trust that the government of 1984 (or any other dystopia) would never come to pass if we relinquish our privacy.
- beagle3 14y ago
  The government is made of people. So just replace "government" with "other random people" in your thought above, and see if it makes sense to you. To me, it IS "inherently at odds". edit: to expand on this - information easily leaks from government employees who have been authorized to access it. Especially when it is so easy to get, and is so broad, then a private investigator is likely to find a government employee who would copy the files about person-of-interest-X in return for $1000, for almost every X. For just one additional lookup a week, that employee can make an additional $50,000 tax free with negligible chance of getting caught (with today's nonexistent oversight) except if the resulting leak happens to become a news item. So, realistically also replace "government" with "any willing person with $2000 to spare" (the private investigator will also take a cut :) )

misnome 14y ago

I'm still confused about this whole thing. What did he do that he needed to resign for? As far as I can tell, he had an affair, which isn't exactly uncommon, and probably has zero influence on how he worked in his job.

e40 14y ago
Having an affair opens yourself to blackmail, and given he is the top spy this is considered a serious offence. That's the thinking, anyway. There might also be an ethical code which was broken, which is a fireable offence.
- thechut 14y ago
  The "susceptible to blackmail" argument is a justification and easy excuse. That is the exact same argument people used to keep gays out of the military for years. Not to mention, it was leaked to the media, everyone already knows about it. How exactly could that be used to blackmail someone if the entire world already knows about it?
  - MichaelSalib 14y ago
    During the time when the affair was secret, Petraeus was vulnerable to blackmail. His failure to recognize that and alert his superiors demonstrates that can't be trusted.
    - harshreality 14y ago
      Do you really think he would allow himself to be blackmailed rather than tell the blackmailer to go ahead and go public with the information? He admitted the affair to the FBI when initially questioned about the emails. I suppose you think Clinton should have resigned (instead of lying about the affair, which made everything worse)?
      - ams6110 14y ago
        Hard to know what a person might do in that situation, hence the regulations.

liotier 14y ago

Yes another reason why I still bother to maintain an email server for 150 people in our family and friends circles. It is one hundred times more expensive than industrial hosting but, if you know what you want there is only one way to get it.

ZoFreX 14y ago
I think you might be kidding yourself if you think that gives you any meaningful protection against government agencies. As the article said, one of the dangers of taking some protections is being lulled into a false sense of security.
- rsync 14y ago
  Running your own mail server changes everything. At the end of the day Men With Guns(TM) may still come to your colo facility and just take the equipment, but even in that edge scenario, you would know something was up in a way you wouldn't with gmail. In non edge cases, you are the provider and the owner of the equipment, and it is you who will be given the court order - you'll see what is going on and have the opportunity to respond as YOU see fit, not as google sees fit. Furthermore, depending on your practices and countermeasures, you may have actions available to you with your own assets that, of course, you wouldn't have with gmail. In fact, the advantages of running your own mail server are so great, that over the past few years I've decided it's probably time to start self-providing my own dialtone and voicemail the same way I self-provide my own email. For all of the same reasons.
  - DanBC 14y ago
    Some people are not able to keep up with the security patching required to host their own server. Some people are not able to keep up with best current practice to ensure that email from their server is deliverable. Running your own email server is for many people a sub-optimal solution. Sure, for a small number of people it's a great idea.
    - 14y ago

haberman 14y ago

What is the difference between a warrant and a court order? Both presumably have judicial oversight, so is it just a difference in the standard required to issue one? This reminds me of an experience I had several years ago. My sweet grandma fell prey to a scam where someone called her, impersonating me, and said I was in trouble in a foreign country and needed money. She sent some money via Western Union (or a comparable service, I don't remember which one) to my name, and the scammer picked the money up. To do this the scammer needed ID under my name. I called up the company and asked to see a copy of the ID that was used, since I wanted to know if any of my documents had been compromised. The company said they wouldn't release that information without a subpoena, which seemed reasonable to me (for all they knew, I was an attacker trying to steal someone else's ID). But I couldn't find any way of getting a court order of any kind. It seemed reasonable to me that I should have standing to see what ID was used to impersonate me and steal money from my grandmother, but I couldn't find any options for actually obtaining it. In this situation, I would have loved a way to obtain a court order for this information.

Spooky23 14y ago
Certain types of requests by law only require an "administrative subpoena" -- Federal agencies basically are given the discretion by Congress to determine when they are necessary. Typically, they are used to establish facts needed to support a search warrant. For example, the police may subpoena a utility to obtain electricity usage when investigating a marijuana grower. Using that information, they can obtain phone data and eventually get a search warrant to search the physical location.

thechut 14y ago

This is beyond scary, we all basically live in a police state now and their is nothing we can do about it. Schneier's last line just about sums it up...

adestefan 14y ago
Please. This is nothing compared to what the FBI did from their inception until the late 1970s. If this happens 40 years ago you might find out about it 5 to 7 years after it occurred.
- beagle3 14y ago
  While I agree with what you are saying, it's like saying "ha, your fatty liver isn't serious. Some people get cancer!". The fact that the FBI was even more horrible until the 1970s doesn't make the current situation any less scary.