7 ms·

I think I finally understand this. His detention wasn't to send a message, or intimidate the Guardian, or anything else: the BBC News article covering the injun

I think I finally understand this. His detention wasn't to send a message, or intimidate the Guardian, or anything else: the BBC News article covering the injunction that Miranda has applied for says this: "The court was also told that "tens of thousands of highly classified documents" had been seized." Miranda had at least some of the Snowden archive with him. The UK, US and friends have absolutely no idea what that archive contains - except for the information which has so far been released. Every information release has been timed for almost maximum effect; Obama in particular seems to have been caught either being misinformed or deliberately misdirecting. This is the collective's only opportunity to get ahead of the game. There is no way the court in the UK will injunct the use and sharing of this data; but even if they did, you can bet your bottom dollar that copies have already been sent out to NSA and friends. Finally it all makes sense. The various journalists involved will not send the data over the internet for obvious reasons - even if encrypted, it allows the various agencies know who has what. Sending data by personal courier is the only way. However, it's demonstrably unsafe at this point. What they need is an anonymous system of data mules, smuggling information just like drugs. Just thinking of all the mechanics you'd need to put in place to make that actually work just boggles the mind. EDIT: I meant to link to the Beeb article; it's this one: http://www.bbc.co.uk/news/uk-23790578 http://www.bbc.co.uk/news/uk-23790578 Another edit: This just struck me. The Guardian hard drive incident happened about a month ago. The Govt could have pulled this Terrorist Act stuff with them, and indeed they intimated it, but they didn't go through with it. They wanted this data, but legally didn't seem to be able to get it. One man travelling alone through an airport is much easier to pressurize, and maybe the jurisdiction is just unclear enough that their onshore-illegal tactic is legal there. Final edit: the judgement is out: http://www.bbc.co.uk/news/uk-23790578 http://www.bbc.co.uk/news/uk-23790578 The data taken can only be examined or copied for "national security purposes", which - since it's all secret - I believe basically means nothing. The various agencies will soon know exactly what Snowden took.

yungchin 13y ago
> The various journalists involved will not send the data over the internet for obvious reasons - even if encrypted, it allows the various agencies know who has what. Question out of my ignorance: couldn't the Tor network obfuscate such things sufficiently?
- ealexhudson 13y ago
  I suppose "sufficiently" is indeed the question. If the NSA own enough of the end points they can see the data coming in and out again. Snowden said encryption was good enough to keep data private, but perhaps he also believes Tor isn't good enough to keep usage anonymous.
  - crazypyro 13y ago
    What about PGP or other encryption? Surely, the NSA couldn't crack a PGP encrypted message sent over tor, could they? (Assuming no access to private keys) Disclaimer: I have basic understanding of security, but not much more.
  - cryptart 13y ago
    Tor, as a low-latency mix-net, is known to be vulnerable to a large-scale traffic analysis. However, I'm not sure exactly why the parties involved actually need anonymity -- everyone knows that Greenwald is in communication with Poitras. If the point is to shield the data from size analysis, couldn't they use padding? Of course, these are journalists and not engineers. Maybe what they need is a team of IT/crypto consultants. Surely there would be plenty of volunteers.
- papaf 13y ago
  Many papers on anonymous networks talk about a global passive adversary that has access to the data entering and leaving every node. Very few of the papers that I have read claim their networks are effective against a global passive adversary (GPA). The ones that do claim to be effective, and back that up with some calculations of entropy, are really inefficient. I don't think Tor ever claimed to be effective against a GPA. This paper gives some background: http://mice.cs.columbia.edu/getTechreport.php?techreportID=556&format=pdf& http://mice.cs.columbia.edu/getTechreport.php?techreportID=5...
panacea 13y ago
Perhaps via Zip drives? Oh that's right... flash storage is smaller than the rivets in my jeans nowadays. Will my denim jeans be confiscated next time I pass through a checkpoint? I like my jeans (and the privacy they afford my genitalia) and the rivets are used purely to keep them on my hips.
- jacquesm 13y ago
  Likely that would show up on a body scanner just fine. There's one idea to get to spend some time up close and personal with a security guard. And if you want to pursue this idea to its logical conclusion it might get uncomfortable in a hurry.
jacquesm 13y ago
If you are trying to imply here that the facility that Snowden worked at did not have auditing on top of not having proper access control then you have to wonder who else has a private copy of some of this stuff. http://www.theguardian.com/commentisfree/2013/aug/21/sending-message-miranda-gchq-nsa http://www.theguardian.com/commentisfree/2013/aug/21/sending... Has a quote to the effect that this was mostly to send a message. If that was the intended effect it failed spectacularly, if the main operational goal was to get an idea of what was taken then that paints a different light on things but so far this is mostly a theory. It would be a very interesting development. What I don't get about all this is that the only thing that Miranda should have been carrying was a one-time pad. That way they could use dead drops afterwards, to actually move the data was an unnecessary operational risk, especially if the decryption keys were in the possession of the carrier. Moving data+keys via the same carrier is the same as moving it in plain text.
- ealexhudson 13y ago
  A lot of recent stories in various papers have made reference to the NSA not knowing exactly what was taken. I don't necessarily read that as lack of audit - more that Snowden was touching so much stuff that they have not yet managed to figure out the 1% or whatever of his accesses that resulted in the data set he shouldn't have. Or it may be that their audit system is no good (I've seen that claim), or that they actually do know what is taken. I imagine it's a combination: they know for sure some of the things that were taken, they don't know for sure what other stuff was taken, and the audit system is showing them some proportion of the take. I agree about the data+keys point, that seems a dim move. Arguable legality perhaps - here in the UK, if you can't decrypt something then you can still go to jail, but I guess at least you don't disclose. Is there straightforward software to use with one-time pads that ensures you use them correctly, though?
  - jacquesm 13y ago
    > Is there straightforward software to use with one-time pads that ensures you use them correctly, though? XOR. The biggest problem with one time pads is that people don't use them just one time...
dredmorbius 13y ago
There are some anonymous messaging services / protocols. Bitmessage has been suggested to me on G+ discussions: http://en.m.wikipedia.org/wiki/Bitmessage http://en.m.wikipedia.org/wiki/Bitmessage
dTal 13y ago
"His detention wasn't to send a message, or intimidate the Guardian" Miranda was held for the full 9 hours permitted under the "law" and threatened with jail time. It doesn't take that long to confiscate/image someone's drives and extract their passwords. In conjunction with the utterly pointless and symbolic destruction of computer hardware at the Guardian offices, I think it's pretty clear that intimidation is at least partly the goal here. "The various journalists involved will not send the data over the internet for obvious reasons - even if encrypted, it allows the various agencies know who has what. Sending data by personal courier is the only way. However, it's demonstrably unsafe at this point." You need only send a hard drive of random data by courier, which can be used as a one-time pad. If you get intercepted, no loss. If not, you can thereafter communicate completely safely through pastebin.

yungchin 13y ago

> The various journalists involved will not send the data over the internet for obvious reasons - even if encrypted, it allows the various agencies know who has what. Question out of my ignorance: couldn't the Tor network obfuscate such things sufficiently?

ealexhudson 13y ago
I suppose "sufficiently" is indeed the question. If the NSA own enough of the end points they can see the data coming in and out again. Snowden said encryption was good enough to keep data private, but perhaps he also believes Tor isn't good enough to keep usage anonymous.
- crazypyro 13y ago
  What about PGP or other encryption? Surely, the NSA couldn't crack a PGP encrypted message sent over tor, could they? (Assuming no access to private keys) Disclaimer: I have basic understanding of security, but not much more.
- cryptart 13y ago
  Tor, as a low-latency mix-net, is known to be vulnerable to a large-scale traffic analysis. However, I'm not sure exactly why the parties involved actually need anonymity -- everyone knows that Greenwald is in communication with Poitras. If the point is to shield the data from size analysis, couldn't they use padding? Of course, these are journalists and not engineers. Maybe what they need is a team of IT/crypto consultants. Surely there would be plenty of volunteers.
papaf 13y ago
Many papers on anonymous networks talk about a global passive adversary that has access to the data entering and leaving every node. Very few of the papers that I have read claim their networks are effective against a global passive adversary (GPA). The ones that do claim to be effective, and back that up with some calculations of entropy, are really inefficient. I don't think Tor ever claimed to be effective against a GPA. This paper gives some background: http://mice.cs.columbia.edu/getTechreport.php?techreportID=556&format=pdf& http://mice.cs.columbia.edu/getTechreport.php?techreportID=5...

panacea 13y ago

Perhaps via Zip drives? Oh that's right... flash storage is smaller than the rivets in my jeans nowadays. Will my denim jeans be confiscated next time I pass through a checkpoint? I like my jeans (and the privacy they afford my genitalia) and the rivets are used purely to keep them on my hips.

jacquesm 13y ago
Likely that would show up on a body scanner just fine. There's one idea to get to spend some time up close and personal with a security guard. And if you want to pursue this idea to its logical conclusion it might get uncomfortable in a hurry.

jacquesm 13y ago

If you are trying to imply here that the facility that Snowden worked at did not have auditing on top of not having proper access control then you have to wonder who else has a private copy of some of this stuff. http://www.theguardian.com/commentisfree/2013/aug/21/sending-message-miranda-gchq-nsa http://www.theguardian.com/commentisfree/2013/aug/21/sending... Has a quote to the effect that this was mostly to send a message. If that was the intended effect it failed spectacularly, if the main operational goal was to get an idea of what was taken then that paints a different light on things but so far this is mostly a theory. It would be a very interesting development. What I don't get about all this is that the only thing that Miranda should have been carrying was a one-time pad. That way they could use dead drops afterwards, to actually move the data was an unnecessary operational risk, especially if the decryption keys were in the possession of the carrier. Moving data+keys via the same carrier is the same as moving it in plain text.

ealexhudson 13y ago
A lot of recent stories in various papers have made reference to the NSA not knowing exactly what was taken. I don't necessarily read that as lack of audit - more that Snowden was touching so much stuff that they have not yet managed to figure out the 1% or whatever of his accesses that resulted in the data set he shouldn't have. Or it may be that their audit system is no good (I've seen that claim), or that they actually do know what is taken. I imagine it's a combination: they know for sure some of the things that were taken, they don't know for sure what other stuff was taken, and the audit system is showing them some proportion of the take. I agree about the data+keys point, that seems a dim move. Arguable legality perhaps - here in the UK, if you can't decrypt something then you can still go to jail, but I guess at least you don't disclose. Is there straightforward software to use with one-time pads that ensures you use them correctly, though?
- jacquesm 13y ago
  > Is there straightforward software to use with one-time pads that ensures you use them correctly, though? XOR. The biggest problem with one time pads is that people don't use them just one time...

dredmorbius 13y ago

There are some anonymous messaging services / protocols. Bitmessage has been suggested to me on G+ discussions: http://en.m.wikipedia.org/wiki/Bitmessage http://en.m.wikipedia.org/wiki/Bitmessage

dTal 13y ago

"His detention wasn't to send a message, or intimidate the Guardian" Miranda was held for the full 9 hours permitted under the "law" and threatened with jail time. It doesn't take that long to confiscate/image someone's drives and extract their passwords. In conjunction with the utterly pointless and symbolic destruction of computer hardware at the Guardian offices, I think it's pretty clear that intimidation is at least partly the goal here. "The various journalists involved will not send the data over the internet for obvious reasons - even if encrypted, it allows the various agencies know who has what. Sending data by personal courier is the only way. However, it's demonstrably unsafe at this point." You need only send a hard drive of random data by courier, which can be used as a one-time pad. If you get intercepted, no loss. If not, you can thereafter communicate completely safely through pastebin.