9 ms·

Tech Companies and Government May Soon Go to War Over Surveillance

98 points by kristiandupont 13y ago

einhverfr 13y ago
I think we are going to see a massive showdown over crypto backdoors, the likes of which we have not seen yet. I am further not sanguine about the tech companies coming out on top this time. The problem, as the article points out, is that people are demanding greater security, and government abuse is driving this. That security comes at a cost for things like wiretaps. The choices are bleak and the showdowns are commencing. Dangerous times.....
- jerf 13y ago
  "I am further not sanguine about the tech companies coming out on top this time." Remember, though, this isn't just "government vs. the little guy". There are large interests that don't particularly care for the US government intercepting their every move. Some of these may sue, some may contribute to furthering encryption technology, who knows what else. My personal feeling is that the NSA's surveillance is going to slowly but surely get much harder over the next few years. Centralization was convenient, but if there's enough push to decentralize, it can be done, and will be done. And further, the exact stuff that the NSA is most interested in is going to be the first to go. We're overdue for another wave of decentralization anyhow.
  - wmeredith 13y ago
    >>> And further, the exact stuff that the NSA is most interested in is going to be the first to go. It's already gone. That's what's so insidious about this whole NSA/CIA/FBI/DHS/DEA debacle: it's all a wasteful charade. They haven't caught __anyone__. They haven't stopped __anything__ of import. It's a bunch of bureaucrats playing cold war with real lives and money. They shouldn't have access to anything because they don't DO anything worthwhile with it. The world is getting safer. Information/education (power) via technology is being shifted to the individual in a big way and they HATE it because it makes them irrelevant. The current state of the government three letter agencies is an ongoing FUD apparatus that exists for almost no other purpose than self sustenance. The NSA has systematically and illegally shared information with the DEA and other domestic law enforcement[1]. It has done so while encouraging them to cover it up using “parallel construction” to establish probable cause for an arrest. The FBI entraps people into terror plots and then "busted" them[2]. The ATF sells guns to the Mexican drug cartels[3]. Look at the sources below. It's Forbes, The New York Times and The Washington Post. This isn't edge case conspiracy theory. This is systematic institutionalized corruption covered daily in the main stream press . The military industrial complex and it's self-sustaining security theater is eating billions (trillions?) in real tax payer money and costing us god knows what via chilling effects and opportunity costs of human lives ruined or snuffed out. It makes me sick to think about the scale of the losses. The only good news is we (as in we, the people) are winning, as of now. We can all still talk about this stuff without secret police showing up at our door. And, more importantly we ARE talking about it. Everyone is pissed, congress' approval rating is 11%. Pretty soon everybody will know everything. Obama, Holder, Clapper and co have a lot more to hide than we do. That's why the government and their financiers are so freaked out and paranoid. [1] http://www.washingtonpost.com/blogs/the-switch/wp/2013/08/05/the-nsa-is-giving-your-phone-records-to-the-dea-and-the-dea-is-covering-it-up/ http://www.washingtonpost.com/blogs/the-switch/wp/2013/08/05... [2] http://www.nytimes.com/2012/04/29/opinion/sunday/terrorist-plots-helped-along-by-the-fbi.html?pagewanted=all&_r=0 http://www.nytimes.com/2012/04/29/opinion/sunday/terrorist-p... [3]http://www.forbes.com/sites/realspin/2011/09/28/fast-and-furious-just-might-be-president-obamas-watergate/ http://www.forbes.com/sites/realspin/2011/09/28/fast-and-fur...
    - deleted 13y ago
      [deleted]
    - codyb 13y ago
      I really feel as if when Obama was elected someone walked into the Oval Office and said "Hey. Nice speeches. Now here's how the world works so try to keep the ball rolling as long as you can." and he probably just said "Fuck." Once someone puts the whole picture together and the middle class continues to decline, and the rich get richer, and the poor get poorer, and the safety net gets dismantled more and more (although Obama Care is at least a step forward I'd say), and the prisons keep expanding, and the endless drug war keeps going on, and the debts keep rising, and the population keeps expanding, and the costs of goods keep going up and up, and the whole myriad of other things that are going on in secret and out in the open, well... I'd imagine it's not going to be pretty at best. Hopefully things can change slowly and we can avoid all the whole house of cards collapsing, but who really knows?
      - richardjordan 13y ago
        Not to mention resource depletion and the peaking of flow rates in oil extraction.
- betterunix 13y ago
  "I think we are going to see a massive showdown over crypto backdoors, the likes of which we have not seen yet" All this has happened before, all this will happen again: http://wiki.openrightsgroup.org/wiki/Crypto_Wars http://wiki.openrightsgroup.org/wiki/Crypto_Wars
  - einhverfr 13y ago
    I agree with that, but what is different now is that crypto has gone from something that will impact a few investigations to a fact that law enforcement and intelligence agencies will have to live with, and there will be much money to be made trying to build NSA-proof services. The previous battles are I think small skirmishes compared to what is coming.
    - betterunix 13y ago
      "what is different now is that crypto has gone from something that will impact a few investigations to a fact that law enforcement and intelligence agencies will have to live with" That was exactly the issue during the crypto wars. The cat was out of the bag by the time NSA agents showed up in Rivest's office and started treating it like a crime scene. The DOJ brought up stories about common criminals using PGP to avoid prosecution when Zimmerman was testifying before Congress. The crypto wars were an effort to prevent cryptography from becoming commonplace, not just about a few high-level targets using it. "there will be much money to be made trying to build NSA-proof services" First of all, privacy is not a service, at least not if "privacy" means "NSA-proof." Hushmail and Lavabit have proved that point beyond any doubt. I also doubt that privacy-enhancing technologies will be very profitable. There is a general lack of understanding of what things like PGP actually do, which makes it hard to sell such things. People want convenience more than privacy. Business users are willing to accept systems with back doors, for both their own internal needs (a dead employee's files should not be lost forever) and for compliance with various regulations (e.g. Sarbanes-Oxley). What you almost certainly will see are lots of scams and snake-oil security.
      - einhverfr 13y ago
- seiji 13y ago
  You think we're going to see that? I imagine it'll be fought, but quietly and sealed under various letters/orders/statements for the next 30 years.
16s 13y ago
Ban crypto and then only criminals and governments would have it. Same as guns.
- tvanantwerp 13y ago
  > criminals and governments You repeat yourself.
  - mitchty 13y ago
    Made me think of a favorite Mark Twain quote. Suppose you were an idiot. And suppose you were a member of Congress. But I repeat myself.
    - hga 13y ago
      Ah, but there's a more apropos one combining the two: "It could probably be shown by facts and figures that there is no distinctly native American criminal class except Congress."
    - codyb 13y ago
      It seems like it should be the other way around. Suppose you were a member of Congress. And suppose you were an idiot. But I repeat myself. Otherwise the only idiots in the world would be Congressman.
- Jayschwa 13y ago
  Pedophiles and terrorists use high-strength crypto to transmit dangerous and illegal information. There's no reason normal citizens need high-strength crypto. Besides, if it came down to it, do you really think your crypto would stand a chance against the government's three letter agencies? You can still protect yourself from passive script kiddies with ROT13.
  - sukuriant 13y ago
    For those that didn't catch it, Jay is using a mock version of the anti-gun argument in his response here. I'm pretty sure his views aren't that at all (but a part of me is terrified to think that someone will use his response as a defense for crypto to not be in normal users' hands, taking what he said completely out of context)
devx 13y ago
If only, but I just don't see companies like Google, Microsoft or Facebook implementing end-to-end encryption like OTR, ZRTP and PGP for their services, and even if they do, I'm not even sure I'd trust them not to implement a backdoor to get that data before it's encrypted somehow, at the behest of the government. Unfortunately, the alternatives will have to come from elsewhere - from disruptive (in privacy) start-ups that will launch only services with security in mind from day one, as they try to steal customers away from those companies.
seiji 13y ago
I've always toyed with the idea of tech companies gearing up militarily. Let's see Google Hellfire Missile Drones defend their datacenters against Facebook Autonomous Cockroach Bots with kilograms of incendiaries embedded in them. Just watch out for Apple's that's-no-office-building spaceship. (It's easier to disguise a launching platform as an office building rather than build an (undetected) assembly platform in LEO.)
- walshemj 13y ago
  They would lose this isn't CP2020 :-) That's a nice little phone company you have their Mr Brinn it would be terrible if something happened to your telecoms licence.
sseveran 13y ago
I figure that the NSA will simply subpoena the private SSL certs with a gag order. That gives the companies involved plausible deniability since XKeyScore (and XKeyScore whatever is next) can just record all the raw internet traffic. I don't see how large technology companies will be able to fight back. SSLv3 includes Perfect Forward Secrecy via ECC but it is not widely used.
- devx 13y ago
  Browser vendors (which seem to coincide with many of these tech companies involved) can also use certificate pinning: http://tack.io/ http://tack.io/ Or we can all start to use something like this (both projects are from Moxie Marlinspike): http://convergence.io/ http://convergence.io/
  - viraptor 13y ago
    This happens way too often... The page is served over http and asks you to install it's addon. The addon is not verified. The addon is downloaded from "http://convergence.io/releases/firefox/convergence-current.xpi" http://convergence.io/releases/firefox/convergence-current.x.... What's the point of providing such service if anyone capturing your internet traffic can change it in flight to a "return True" equivalent? Edit: tried https... come on, they're not even trying: "The certificate is only valid for the following names: whispersystems.org , www.whispersystems.org"
    - trebor 13y ago
      The github project has also been stale for 1-2 years. I'm interested but you've got to maintain a project for it to be a "solution".
  - michaelt 13y ago
    There's not much you can do to detect MITM by someone who has subpoenaed the private SSL certificates, is there? I mean, there's no way to tell apart the certificate from the intermediary from the cert from the endpoint as they're the same.
Helianthus 13y ago
>Given X-Keyscore was a program primarily designed to intercept unencrypted internet traffic, you could be forgiven for interpreting Facebook’s post as a middle finger pointed in NSA’s direction. (Sources inside Facebook say it is a coincidence, and indeed the company had been in the process of enabling this across-the-board for years. But still. The timing.) What journalistic integrity.
hardwaresofton 13y ago
Isn't the more important battle here between the government and the agencies that server as the 'backbone' of the internet (ISPs,etc?)
- ihsw 13y ago
  Indeed, the author seems to be clearly ignorant of that, be it willingly or otherwise: > My guess is the de facto interception technique of the future will involve targeting users’ endpoints (phone, computer, tablet, whatever) instead of trying to intercept communications in transit. The data is still stored in the hands of tech companies, and as such outside the realm of control of the owners of the data. The article writer would do well to realize that it's not about national security, terrorists, or China -- but instead it's about control.
  - hardwaresofton 13y ago
    Yeah, I highly doubt they will target users' endpoints (mostly because the ease and largely unreported nature of fiddling/requesting data from ISPs) No matter where the data ends up being stored, if it has to GO somewhere, and you are the man in the middle everywhere, things start getting a lot easier to track.
humanspecies 13y ago
Who said the tech companies don't want to cooperate with the government? Every CEO in this Country wants to be invited to one of those dinners with Obama, where Steve Jobs and Zuckerberg and the Google people sat at a table with the man himself. Every CEO in this Country dreams of being influential in Congress, getting invited to discuss serious issues, getting special State-level protections for their businesses in China, Russia, elsewhere.... Companies won't go to "war" against government surveillance, all they want is better guarantees that their cooperation will not be leaked and in case its leaked, they want the government to take the blame, just like Apple, Google and others have done after the NSA leaks, they pose as victims of a strong government, when in reality they're partners.
joshdance 13y ago
Have there been any examples of tech companies that have simply refused to provide access to governments?
- hga 13y ago
  Yes, it's a stark object lesson: https://en.wikipedia.org/wiki/Joseph_Nacchio#Qwest https://en.wikipedia.org/wiki/Joseph_Nacchio#Qwest ADDED: which helps explain the current behavior of other companies we'd like to think better of. I'm sure the people running them would to, but they and their families (who the Feds have targeted in other political prosecutions) would prefer they stay out of Federal prison.
deleted 13y ago
[deleted]
- pyre 13y ago
  If these nodes are standardized, then the flaws in them are also standardized, which could make automated monitoring just as easy...
RyanMcGreal 13y ago
"You want us to execute that warrant for you? Ok, sure, but the user will get a nice big popup warning telling them that their messages are likely being intercepted!" I'm pretty sure that would be illegal in the case of an NSL.
- tomjen3 13y ago
  Has the supreme court ever ruled on NSL secrecy vs the fourth amendment?
  - devx 13y ago
    I don't think it even got a ruling from a Federal Court yet, because the feds kept playing legal games, and got away with dismissing the cases. But I think it's been declared unconstitutional at least 3 times by normal Courts. http://www.youtube.com/watch?v=DYsXCNLB0CI http://www.youtube.com/watch?v=DYsXCNLB0CI
  - sseveran 13y ago
    It is usually ruled that the plaintiffs can't prove standing, meaning they can't prove they were harmed by the behavior. And of course one would probably need access to their raw data to prove standing, so its unlikely that the courts are the way to go. Even if the court does rule that its illegal it is almost impossible to enforce. The FISA court ruled that certain things were not permissible but the NSA did them anyhow.
  - magicalist 13y ago
    I don't think there's really any overlap there. The overlap with the 4th would be less about secrecy and more if someone demanded full content from an account, since NSLs are not warrants (legality of procuring "metadata" without a warrant is the much larger issue there, but so far courts have been ok with it). The secrecy part can be a violation of the 6th amendment (right to confront your accuser), but theoretically evidence procured under the NSL will be produced by trial time (except when shown to conflict with national security, which judges can sometimes accept too readily). The real problem with secrecy is the first amendment, since you are forcing people to not divulge that they received an order to hand over information. Typically prior restraint like that is heavily circumscribed to protect an ongoing investigation but no further, which means that indefinite gag orders should have correspondingly extraordinary justification. Considering the hundreds of thousands of NSLs that have been issued, this seems unlikely to be the norm. The first amendment approach has been successfully[1] argued by the EFF at the district court level. This has opened the way for more lawsuits, including an appeal of that case, which will hopefully make their way higher in the court system. (read the linked EFF article if you're interested in more. It lays the case and the judge's ruling out in great detail) [1] https://www.eff.org/deeplinks/2013/03/depth-judge-illstons-remarkable-order-striking-down-nsl-statute https://www.eff.org/deeplinks/2013/03/depth-judge-illstons-r...
tinco 13y ago
Don't be too quick in supporting the Tech Companies in this war. The only thing that will happen if they win, is that the government will have to pay to get your data. In this war, the government should win, because the government is by extension the people. It is up to the people of the world to make sure that their governments implement the right laws to restrict surveillance.
- pessimizer 13y ago
  What if your government is currently using chemical weapons on you, or imprisoning you for being gay?
  - tinco 13y ago
    Wat are tech companies going to do about that?
    - alextingle 13y ago
      Not cooperate with warrantless data requests that might reveal that someone is gay?
      - tinco 13y ago
        I don't know. That sounds right in theory.. but in practice, would a country that prosecutes people on ethnical/cultural grounds even consider allowing companies to ignore their data requests? History tells us no. History also tells us that tech companies often don't give a shit. Perhaps a highly visible company like Google or Twitter might, but a little visible company like IBM or Cisco? I wouldn't bet on it.
api 13y ago
We can hope.
junto 13y ago
I predict that more companies outside the US will start producing products and services that the US can't touch legally. As a result US tech firms would lose out. It is their interest to band together now as one powerful lobby group and force a change to the legislation.
- rfnslyr 13y ago
  I see all these posts about X has raised 40m, Y has raised 80m! Pool together money and start lobbying.
- DannyBee 13y ago
  "I predict that more companies outside the US will start producing products and services that the US can't touch legally. As a result US tech firms would lose out. " I guess I view this as highly naive. What makes you think the US won't get agreement from these places to share? They already have in a large number of cases.
  - bjelkeman-again 13y ago
    I would only say somewhat naive. There is a lot of effort in the EU that points in this direction. Not everyone is a British poudle over here. We started our work in the direction a couple of years ago, where I work. It will take a while, but it will happen.
maybeso 13y ago
That's a possibility. Google has made WebRTC encrypted by default. However, it uses RSA which still isn't the best of choices (15 years in the future, when the NSA builds a usable quantum computer).
- marcosdumay 13y ago
  We have nothing that would survive a quantum computer. RSA is even better than ECC, because it uses longer keys. But we are very far from a usable quantum computer. I doubt we'll get it in 15 years, and I doubt we'll get it before everything changes because of AI, nanotech, some other disruptive tech, or some kind of doom. Yes, there is nothing stopping you from using ECC with a 2k bits key. Except that you aren't.
DannyBee 13y ago
Historically, the government has won every political fight about this (I guess nobody remembers CALEA, or it's predecessors), and been roundly supported by both law enforcement and the populace at large. Outside of the tech community, i have yet to hear large amounts of actual outrage. I thus predict the same outcome as say, patents: Techies will complain on techie-friendly websites about how it sucks, rather than doing something productive like repeatedly contacting their congressfolks, requesting and having real live meetings with them. People will propose technical solutions, apparently oblivious to the fact that the government will simply require you not to use them (as they have in the past). Nothing will change. Techies will then blame the tech companies for losing this war, or blame it on not spending enough money on lobbyists, or some bogeyman that does not require realizing the harsh truth: As a whole, techies refuse to actually get involved when it's something that actually requires doing something other than coding or writing comments on a website. Instead, they rely on EFF and other orgs, which are simply not enough.
- snitko 13y ago
  Contacting congressfolks is useless. I don't know where you guys get this idea that it actually works, but if you simply look at incentives (not expectations of how it's supposed to be) government officials have absolutely no incentives to change their policies even if a large enough group of people demands it. Whenever something is inconvenient to a government, this group of people can simply be ignored, because nothing else would follow. No uprisings, no media coverage, and, most importantly, no reduction in financing (taxation) - nothing. The people in government know this very well, but, of course, they are interested in perpetuating this myth, because it adds legitimacy to them.
  - DannyBee 13y ago
    "I don't know where you guys get this idea that it actually works" From doing it. From watching how DC works, from working next to DC lobbyists and politicians for many years, and watching people be effective and get things done in DC for many many years. I'm not sure why you think it doesn't work. Have you actually done it? They care tremendously what their constituents believe, contrary to popular belief. They get daily morning briefings on their constituents views on issues, etc.
forgotAgain 13y ago
Makes a nice headline for a Friday afternoon. Unfortunately it will never happen. Tech company leaders don't have the stones while the government has guns and prisons.
f902370 13y ago
Friends sue each other. That's a show for their enemy. I'm supprised some of us are still thinking tech companies and their government are against each other in this case.
morgante 13y ago
Sadly a majority of the American public is completely okay with being spied on. [1] Given that is the customer base for these tech companies, I don't see them fighting very valiantly, if at all. Especially when the government can put on pressure via political prosecutions. [2] 1: http://www.people-press.org/2013/06/10/majority-views-nsa-phone-tracking-as-acceptable-anti-terror-tactic/ http://www.people-press.org/2013/06/10/majority-views-nsa-ph... 2: http://en.wikipedia.org/wiki/Joseph_Nacchio http://en.wikipedia.org/wiki/Joseph_Nacchio

I think we are going to see a massive showdown over crypto backdoors, the likes of which we have not seen yet. I am further not sanguine about the tech companies coming out on top this time. The problem, as the article points out, is that people are demanding greater security, and government abuse is driving this. That security comes at a cost for things like wiretaps. The choices are bleak and the showdowns are commencing. Dangerous times.....

jerf 13y ago
"I am further not sanguine about the tech companies coming out on top this time." Remember, though, this isn't just "government vs. the little guy". There are large interests that don't particularly care for the US government intercepting their every move. Some of these may sue, some may contribute to furthering encryption technology, who knows what else. My personal feeling is that the NSA's surveillance is going to slowly but surely get much harder over the next few years. Centralization was convenient, but if there's enough push to decentralize, it can be done, and will be done. And further, the exact stuff that the NSA is most interested in is going to be the first to go. We're overdue for another wave of decentralization anyhow.
- wmeredith 13y ago
  >>> And further, the exact stuff that the NSA is most interested in is going to be the first to go. It's already gone. That's what's so insidious about this whole NSA/CIA/FBI/DHS/DEA debacle: it's all a wasteful charade. They haven't caught __anyone__. They haven't stopped __anything__ of import. It's a bunch of bureaucrats playing cold war with real lives and money. They shouldn't have access to anything because they don't DO anything worthwhile with it. The world is getting safer. Information/education (power) via technology is being shifted to the individual in a big way and they HATE it because it makes them irrelevant. The current state of the government three letter agencies is an ongoing FUD apparatus that exists for almost no other purpose than self sustenance. The NSA has systematically and illegally shared information with the DEA and other domestic law enforcement[1]. It has done so while encouraging them to cover it up using “parallel construction” to establish probable cause for an arrest. The FBI entraps people into terror plots and then "busted" them[2]. The ATF sells guns to the Mexican drug cartels[3]. Look at the sources below. It's Forbes, The New York Times and The Washington Post. This isn't edge case conspiracy theory. This is systematic institutionalized corruption covered daily in the main stream press . The military industrial complex and it's self-sustaining security theater is eating billions (trillions?) in real tax payer money and costing us god knows what via chilling effects and opportunity costs of human lives ruined or snuffed out. It makes me sick to think about the scale of the losses. The only good news is we (as in we, the people) are winning, as of now. We can all still talk about this stuff without secret police showing up at our door. And, more importantly we ARE talking about it. Everyone is pissed, congress' approval rating is 11%. Pretty soon everybody will know everything. Obama, Holder, Clapper and co have a lot more to hide than we do. That's why the government and their financiers are so freaked out and paranoid. [1] http://www.washingtonpost.com/blogs/the-switch/wp/2013/08/05/the-nsa-is-giving-your-phone-records-to-the-dea-and-the-dea-is-covering-it-up/ http://www.washingtonpost.com/blogs/the-switch/wp/2013/08/05... [2] http://www.nytimes.com/2012/04/29/opinion/sunday/terrorist-plots-helped-along-by-the-fbi.html?pagewanted=all&_r=0 http://www.nytimes.com/2012/04/29/opinion/sunday/terrorist-p... [3]http://www.forbes.com/sites/realspin/2011/09/28/fast-and-furious-just-might-be-president-obamas-watergate/ http://www.forbes.com/sites/realspin/2011/09/28/fast-and-fur...
  - deleted 13y ago
    [deleted]
  - codyb 13y ago
    I really feel as if when Obama was elected someone walked into the Oval Office and said "Hey. Nice speeches. Now here's how the world works so try to keep the ball rolling as long as you can." and he probably just said "Fuck." Once someone puts the whole picture together and the middle class continues to decline, and the rich get richer, and the poor get poorer, and the safety net gets dismantled more and more (although Obama Care is at least a step forward I'd say), and the prisons keep expanding, and the endless drug war keeps going on, and the debts keep rising, and the population keeps expanding, and the costs of goods keep going up and up, and the whole myriad of other things that are going on in secret and out in the open, well... I'd imagine it's not going to be pretty at best. Hopefully things can change slowly and we can avoid all the whole house of cards collapsing, but who really knows?
    - richardjordan 13y ago
      Not to mention resource depletion and the peaking of flow rates in oil extraction.
betterunix 13y ago
"I think we are going to see a massive showdown over crypto backdoors, the likes of which we have not seen yet" All this has happened before, all this will happen again: http://wiki.openrightsgroup.org/wiki/Crypto_Wars http://wiki.openrightsgroup.org/wiki/Crypto_Wars
- einhverfr 13y ago
  I agree with that, but what is different now is that crypto has gone from something that will impact a few investigations to a fact that law enforcement and intelligence agencies will have to live with, and there will be much money to be made trying to build NSA-proof services. The previous battles are I think small skirmishes compared to what is coming.
  - betterunix 13y ago
    "what is different now is that crypto has gone from something that will impact a few investigations to a fact that law enforcement and intelligence agencies will have to live with" That was exactly the issue during the crypto wars. The cat was out of the bag by the time NSA agents showed up in Rivest's office and started treating it like a crime scene. The DOJ brought up stories about common criminals using PGP to avoid prosecution when Zimmerman was testifying before Congress. The crypto wars were an effort to prevent cryptography from becoming commonplace, not just about a few high-level targets using it. "there will be much money to be made trying to build NSA-proof services" First of all, privacy is not a service, at least not if "privacy" means "NSA-proof." Hushmail and Lavabit have proved that point beyond any doubt. I also doubt that privacy-enhancing technologies will be very profitable. There is a general lack of understanding of what things like PGP actually do, which makes it hard to sell such things. People want convenience more than privacy. Business users are willing to accept systems with back doors, for both their own internal needs (a dead employee's files should not be lost forever) and for compliance with various regulations (e.g. Sarbanes-Oxley). What you almost certainly will see are lots of scams and snake-oil security.
    - einhverfr 13y ago
seiji 13y ago
You think we're going to see that? I imagine it'll be fought, but quietly and sealed under various letters/orders/statements for the next 30 years.

16s 13y ago

Ban crypto and then only criminals and governments would have it. Same as guns.

tvanantwerp 13y ago
> criminals and governments You repeat yourself.
- mitchty 13y ago
  Made me think of a favorite Mark Twain quote. Suppose you were an idiot. And suppose you were a member of Congress. But I repeat myself.
  - hga 13y ago
    Ah, but there's a more apropos one combining the two: "It could probably be shown by facts and figures that there is no distinctly native American criminal class except Congress."
  - codyb 13y ago
    It seems like it should be the other way around. Suppose you were a member of Congress. And suppose you were an idiot. But I repeat myself. Otherwise the only idiots in the world would be Congressman.
Jayschwa 13y ago
Pedophiles and terrorists use high-strength crypto to transmit dangerous and illegal information. There's no reason normal citizens need high-strength crypto. Besides, if it came down to it, do you really think your crypto would stand a chance against the government's three letter agencies? You can still protect yourself from passive script kiddies with ROT13.
- sukuriant 13y ago
  For those that didn't catch it, Jay is using a mock version of the anti-gun argument in his response here. I'm pretty sure his views aren't that at all (but a part of me is terrified to think that someone will use his response as a defense for crypto to not be in normal users' hands, taking what he said completely out of context)

devx 13y ago

If only, but I just don't see companies like Google, Microsoft or Facebook implementing end-to-end encryption like OTR, ZRTP and PGP for their services, and even if they do, I'm not even sure I'd trust them not to implement a backdoor to get that data before it's encrypted somehow, at the behest of the government. Unfortunately, the alternatives will have to come from elsewhere - from disruptive (in privacy) start-ups that will launch only services with security in mind from day one, as they try to steal customers away from those companies.

seiji 13y ago

I've always toyed with the idea of tech companies gearing up militarily. Let's see Google Hellfire Missile Drones defend their datacenters against Facebook Autonomous Cockroach Bots with kilograms of incendiaries embedded in them. Just watch out for Apple's that's-no-office-building spaceship. (It's easier to disguise a launching platform as an office building rather than build an (undetected) assembly platform in LEO.)

walshemj 13y ago
They would lose this isn't CP2020 :-) That's a nice little phone company you have their Mr Brinn it would be terrible if something happened to your telecoms licence.

sseveran 13y ago

I figure that the NSA will simply subpoena the private SSL certs with a gag order. That gives the companies involved plausible deniability since XKeyScore (and XKeyScore whatever is next) can just record all the raw internet traffic. I don't see how large technology companies will be able to fight back. SSLv3 includes Perfect Forward Secrecy via ECC but it is not widely used.

devx 13y ago
Browser vendors (which seem to coincide with many of these tech companies involved) can also use certificate pinning: http://tack.io/ http://tack.io/ Or we can all start to use something like this (both projects are from Moxie Marlinspike): http://convergence.io/ http://convergence.io/
- viraptor 13y ago
  This happens way too often... The page is served over http and asks you to install it's addon. The addon is not verified. The addon is downloaded from "http://convergence.io/releases/firefox/convergence-current.xpi" http://convergence.io/releases/firefox/convergence-current.x.... What's the point of providing such service if anyone capturing your internet traffic can change it in flight to a "return True" equivalent? Edit: tried https... come on, they're not even trying: "The certificate is only valid for the following names: whispersystems.org , www.whispersystems.org"
  - trebor 13y ago
    The github project has also been stale for 1-2 years. I'm interested but you've got to maintain a project for it to be a "solution".
- michaelt 13y ago
  There's not much you can do to detect MITM by someone who has subpoenaed the private SSL certificates, is there? I mean, there's no way to tell apart the certificate from the intermediary from the cert from the endpoint as they're the same.

Helianthus 13y ago

>Given X-Keyscore was a program primarily designed to intercept unencrypted internet traffic, you could be forgiven for interpreting Facebook’s post as a middle finger pointed in NSA’s direction. (Sources inside Facebook say it is a coincidence, and indeed the company had been in the process of enabling this across-the-board for years. But still. The timing.) What journalistic integrity.

hardwaresofton 13y ago

Isn't the more important battle here between the government and the agencies that server as the 'backbone' of the internet (ISPs,etc?)

ihsw 13y ago
Indeed, the author seems to be clearly ignorant of that, be it willingly or otherwise: > My guess is the de facto interception technique of the future will involve targeting users’ endpoints (phone, computer, tablet, whatever) instead of trying to intercept communications in transit. The data is still stored in the hands of tech companies, and as such outside the realm of control of the owners of the data. The article writer would do well to realize that it's not about national security, terrorists, or China -- but instead it's about control.
- hardwaresofton 13y ago
  Yeah, I highly doubt they will target users' endpoints (mostly because the ease and largely unreported nature of fiddling/requesting data from ISPs) No matter where the data ends up being stored, if it has to GO somewhere, and you are the man in the middle everywhere, things start getting a lot easier to track.

humanspecies 13y ago

Who said the tech companies don't want to cooperate with the government? Every CEO in this Country wants to be invited to one of those dinners with Obama, where Steve Jobs and Zuckerberg and the Google people sat at a table with the man himself. Every CEO in this Country dreams of being influential in Congress, getting invited to discuss serious issues, getting special State-level protections for their businesses in China, Russia, elsewhere.... Companies won't go to "war" against government surveillance, all they want is better guarantees that their cooperation will not be leaked and in case its leaked, they want the government to take the blame, just like Apple, Google and others have done after the NSA leaks, they pose as victims of a strong government, when in reality they're partners.

joshdance 13y ago

Have there been any examples of tech companies that have simply refused to provide access to governments?

hga 13y ago
Yes, it's a stark object lesson: https://en.wikipedia.org/wiki/Joseph_Nacchio#Qwest https://en.wikipedia.org/wiki/Joseph_Nacchio#Qwest ADDED: which helps explain the current behavior of other companies we'd like to think better of. I'm sure the people running them would to, but they and their families (who the Feds have targeted in other political prosecutions) would prefer they stay out of Federal prison.

deleted 13y ago

[deleted]

pyre 13y ago
If these nodes are standardized, then the flaws in them are also standardized, which could make automated monitoring just as easy...

RyanMcGreal 13y ago

"You want us to execute that warrant for you? Ok, sure, but the user will get a nice big popup warning telling them that their messages are likely being intercepted!" I'm pretty sure that would be illegal in the case of an NSL.

tomjen3 13y ago
Has the supreme court ever ruled on NSL secrecy vs the fourth amendment?
- devx 13y ago
  I don't think it even got a ruling from a Federal Court yet, because the feds kept playing legal games, and got away with dismissing the cases. But I think it's been declared unconstitutional at least 3 times by normal Courts. http://www.youtube.com/watch?v=DYsXCNLB0CI http://www.youtube.com/watch?v=DYsXCNLB0CI
- sseveran 13y ago
  It is usually ruled that the plaintiffs can't prove standing, meaning they can't prove they were harmed by the behavior. And of course one would probably need access to their raw data to prove standing, so its unlikely that the courts are the way to go. Even if the court does rule that its illegal it is almost impossible to enforce. The FISA court ruled that certain things were not permissible but the NSA did them anyhow.
- magicalist 13y ago
  I don't think there's really any overlap there. The overlap with the 4th would be less about secrecy and more if someone demanded full content from an account, since NSLs are not warrants (legality of procuring "metadata" without a warrant is the much larger issue there, but so far courts have been ok with it). The secrecy part can be a violation of the 6th amendment (right to confront your accuser), but theoretically evidence procured under the NSL will be produced by trial time (except when shown to conflict with national security, which judges can sometimes accept too readily). The real problem with secrecy is the first amendment, since you are forcing people to not divulge that they received an order to hand over information. Typically prior restraint like that is heavily circumscribed to protect an ongoing investigation but no further, which means that indefinite gag orders should have correspondingly extraordinary justification. Considering the hundreds of thousands of NSLs that have been issued, this seems unlikely to be the norm. The first amendment approach has been successfully[1] argued by the EFF at the district court level. This has opened the way for more lawsuits, including an appeal of that case, which will hopefully make their way higher in the court system. (read the linked EFF article if you're interested in more. It lays the case and the judge's ruling out in great detail) [1] https://www.eff.org/deeplinks/2013/03/depth-judge-illstons-remarkable-order-striking-down-nsl-statute https://www.eff.org/deeplinks/2013/03/depth-judge-illstons-r...

tinco 13y ago

Don't be too quick in supporting the Tech Companies in this war. The only thing that will happen if they win, is that the government will have to pay to get your data. In this war, the government should win, because the government is by extension the people. It is up to the people of the world to make sure that their governments implement the right laws to restrict surveillance.

pessimizer 13y ago
What if your government is currently using chemical weapons on you, or imprisoning you for being gay?
- tinco 13y ago
  Wat are tech companies going to do about that?
  - alextingle 13y ago
    Not cooperate with warrantless data requests that might reveal that someone is gay?
    - tinco 13y ago
      I don't know. That sounds right in theory.. but in practice, would a country that prosecutes people on ethnical/cultural grounds even consider allowing companies to ignore their data requests? History tells us no. History also tells us that tech companies often don't give a shit. Perhaps a highly visible company like Google or Twitter might, but a little visible company like IBM or Cisco? I wouldn't bet on it.

api 13y ago

We can hope.

junto 13y ago

I predict that more companies outside the US will start producing products and services that the US can't touch legally. As a result US tech firms would lose out. It is their interest to band together now as one powerful lobby group and force a change to the legislation.

rfnslyr 13y ago
I see all these posts about X has raised 40m, Y has raised 80m! Pool together money and start lobbying.
DannyBee 13y ago
"I predict that more companies outside the US will start producing products and services that the US can't touch legally. As a result US tech firms would lose out. " I guess I view this as highly naive. What makes you think the US won't get agreement from these places to share? They already have in a large number of cases.
- bjelkeman-again 13y ago
  I would only say somewhat naive. There is a lot of effort in the EU that points in this direction. Not everyone is a British poudle over here. We started our work in the direction a couple of years ago, where I work. It will take a while, but it will happen.

maybeso 13y ago

That's a possibility. Google has made WebRTC encrypted by default. However, it uses RSA which still isn't the best of choices (15 years in the future, when the NSA builds a usable quantum computer).

marcosdumay 13y ago
We have nothing that would survive a quantum computer. RSA is even better than ECC, because it uses longer keys. But we are very far from a usable quantum computer. I doubt we'll get it in 15 years, and I doubt we'll get it before everything changes because of AI, nanotech, some other disruptive tech, or some kind of doom. Yes, there is nothing stopping you from using ECC with a 2k bits key. Except that you aren't.

DannyBee 13y ago

Historically, the government has won every political fight about this (I guess nobody remembers CALEA, or it's predecessors), and been roundly supported by both law enforcement and the populace at large. Outside of the tech community, i have yet to hear large amounts of actual outrage. I thus predict the same outcome as say, patents: Techies will complain on techie-friendly websites about how it sucks, rather than doing something productive like repeatedly contacting their congressfolks, requesting and having real live meetings with them. People will propose technical solutions, apparently oblivious to the fact that the government will simply require you not to use them (as they have in the past). Nothing will change. Techies will then blame the tech companies for losing this war, or blame it on not spending enough money on lobbyists, or some bogeyman that does not require realizing the harsh truth: As a whole, techies refuse to actually get involved when it's something that actually requires doing something other than coding or writing comments on a website. Instead, they rely on EFF and other orgs, which are simply not enough.

snitko 13y ago
Contacting congressfolks is useless. I don't know where you guys get this idea that it actually works, but if you simply look at incentives (not expectations of how it's supposed to be) government officials have absolutely no incentives to change their policies even if a large enough group of people demands it. Whenever something is inconvenient to a government, this group of people can simply be ignored, because nothing else would follow. No uprisings, no media coverage, and, most importantly, no reduction in financing (taxation) - nothing. The people in government know this very well, but, of course, they are interested in perpetuating this myth, because it adds legitimacy to them.
- DannyBee 13y ago
  "I don't know where you guys get this idea that it actually works" From doing it. From watching how DC works, from working next to DC lobbyists and politicians for many years, and watching people be effective and get things done in DC for many many years. I'm not sure why you think it doesn't work. Have you actually done it? They care tremendously what their constituents believe, contrary to popular belief. They get daily morning briefings on their constituents views on issues, etc.

forgotAgain 13y ago

Makes a nice headline for a Friday afternoon. Unfortunately it will never happen. Tech company leaders don't have the stones while the government has guns and prisons.

f902370 13y ago

Friends sue each other. That's a show for their enemy. I'm supprised some of us are still thinking tech companies and their government are against each other in this case.

morgante 13y ago

Sadly a majority of the American public is completely okay with being spied on. [1] Given that is the customer base for these tech companies, I don't see them fighting very valiantly, if at all. Especially when the government can put on pressure via political prosecutions. [2] 1: http://www.people-press.org/2013/06/10/majority-views-nsa-phone-tracking-as-acceptable-anti-terror-tactic/ http://www.people-press.org/2013/06/10/majority-views-nsa-ph... 2: http://en.wikipedia.org/wiki/Joseph_Nacchio http://en.wikipedia.org/wiki/Joseph_Nacchio