12 ms·

> The NSA's official response is to suggest that wanting to secure our communications from our surveillance is inherently suspicious and suggestive of criminal

• javajosh 13y ago
  Something just came into clear focus for me: the NSA really screwed the pooch here. They had a situation where they had access to anything they wanted, but because they insisted on not getting warrants for access, they pissed off Snowden, and now people are going to punish the NSA by becoming more security savvy and using systems that are impenetrable, even with a warrant. Smooth move, NSAssholes.
  • Finster 13y ago
    And that's the core of the issue for me. I don't have any problem with the NSA working with and studying encryption and methods to break encryption. What I have a problem with is invading my privacy and gathering my communications and information without a warrant. My 4th amendment rights have been completely violated.
    • javajosh 13y ago
      Totally. No-one (including me) would have blinked an eye if it turned out the NSA was snooping on anything and everything...with a warrant. Heck, I would have probably been moderately pleased. But snooping on anything, in secret, without judicial oversight, without public consent...that is all very wrong, and Sheier is right: it's a total betrayal of the internet. Whatever short-sighted jerk-offs came up with this grand plan ought to be put in prison for harming US interests. To say that Snowden is the one who harmed US interests for revealing these activities is an intolerable act of a government that values only one thing, loyalty. Principles? Nah. Principles are soooo pre-Industrial revolution. And let's face it: with all the thousands of people working on these projects, someone was bound to blow the whistle sooner or later, because no matter how far down the rabbit hole an agency like the NSA goes when it comes to defining new norms, there are always some awesome weirdos who don't buy it, no matter how normal everyone around them treats it. (Hat tip to you, Snowden, for not drinking the Kool-Aid). Guess what bozos (yes, NSA, I'm talking to you): national security is affected by abrogation of trust and betrayal of people like you. Our position as an exemplar of personal freedom, and self-restrained government, has been badly damaged by you. Going after Snowden, doubling down on internal security...these damage you, and us, further. Maybe Congress is confused on this issue, but I (and most everyone I've talked to) am not: you need to stop collecting data without warrants immediately. You need to dismantle your capacity to do so. You need to delete all information that you've gathered under those conditions. And this should be the last act of the NSA's senior leadership before resigning.
      • malandrew 13y ago
        "...weirdos...." I prefer to describe them as people with a conscience, that are cognizant of the consequences of hypocrisy and danger of the actions of the organization which they serve.
      • einhverfr 13y ago
        Not quite. We don't allow general warrants so a court order to decrypt all internet traffic is not Constitutional. If the NSA was snooping on anything and everything with a warrant, that is no different than what is happening, and it is not Constitutional (particularity requirement not met). What is the problem is the NSA doing this sort of blanket surveillance where a warrant is normally required but where they make an end-run around the Constitution. We require warrants because we require magistrates to require particularity in the warrant. But it gets worse. What will come out of this is a massive market for more secure communications, much of it designed to thwart this sort of surveillance. The NSA by not respecting our rule of law has now encouraged people to do exactly what they are afraid of and in the end, wiretaps will now go dark. The NSA broke their end of the legal bargain and now the entire government will pay a price, and that price will, no doubt, impede legitimate law enforcement efforts as well as this.
        • MacsHeadroom 13y ago
          Snooping on "anything and everything" traversing the Internet without a warrant is perfectly constitutional according to SCOTUS, POTUS, most of Congress, and the 3 letter agencies doing the snooping. Information traversing the Internet has been legally deemed to not be included in one's "person, house, paper or effects" and as such is not constitutionally protected by the fourth amendment.
          • einhverfr 13y ago
            > Snooping on "anything and everything" traversing the Internet without a warrant is perfectly constitutional according to SCOTUS, POTUS, most of Congress, and the 3 letter agencies doing the snooping. Please provide citations regarding SCOTUS. In fact, given that Katz v. United States was never overruled, that sounds very suspicious. The closest I think you can get is Amnesty International v. Clapper but that was a standing issue and never reached the merits.
    • doktrin 13y ago
      Totally agree. I wish this would get more emphasis. This is primarily a matter of policy and respect for the rule of law. The involvement of technology is incidental, IMHO.
    • harryh 13y ago
      FWIW, you have an incorrect understanding of what your 4th amendment rights actually are.
      • cliffu 13y ago
        No, congress and the tech companies have the incorrect understanding that phone calls and emails going through a third party gives that third party consent to share them with the government.
        • mpyne 13y ago
          If that's an incorrect understanding, it's an incorrect understanding that the EFF also shares, just so you know: https://ssd.eff.org/your-computer/govt/privacy https://ssd.eff.org/your-computer/govt/privacy
          • cliffu 13y ago
            Yes, I'm being flippant with the terminology. I know that to be true but strongly disagree that we should have no reasonable expectation of privacy for emails. Telephone calls go through a third party and they are covered.
            • mpyne 13y ago
              Yes, but telephone calls are covered because Congress passed a law making it so, not because of a Supreme Court ruling per se. Separate laws had to be passed to protect cell phone calls, beepers, etc.
        • rdl 13y ago
          4A as it has been interpreted is woefully inadequate for privacy protections in the modern world. Absent a complete change in how the courts do this, we need laws like ECPA (but better), technical countermeasures and a strikedown of laws like CALEA (which is unconstitutional already), or a constitutional amendment explicitly protecting privacy. Or all 3.
  • malandrew 13y ago
    It's several things beyond just the lack of warrants. It the opportunistic monitoring as opposed to the targeted monitoring and the activities beyond their jurisdiction. Parallel construction to me suggests that they have been funded with so much cash that they now have enough money to fund scope creep beyond their jurisdiction. They should never had had more cash than they needed to do their job. I personally would like to see the NSA organization around defense and not offense. Make better tools to protect us. Don't backdoor things since any backdoor they have can be discover and used by others. etc. Worth a read: "How the NSA could stop sucking and be awesome instead" by Ted Dziuba: http://teddziuba.com/post/58735980543/how-the-nsa-could-stop-sucking-and-be-awesome-instead http://teddziuba.com/post/58735980543/how-the-nsa-could-stop...
    • ISL 13y ago
      On can sensibly argue that passively reading traffic is defensive. Infiltrating computers, planting bugs, and actively eavesdropping is more of an offensive stance. Listening to what everyone says in a public square (the internet) is comparatively passive. The trouble is that, in aggregate, the knowledge acquired is powerful and transcends time-honored boundaries.
  • brown9-2 13y ago
    I think what is more likely to happen here is just a continuation of the natural ebb and flow of code-makers and codebreakers. For thousands of years, some groups of humans have been trying to find ways to protect their communications, and other groups of humans have sought ways to break those protections. At times the code-makers become aware of the breakthroughs that the codebreakers have made and change their tactics, or new technology gives them a new cipher. Either way, the codebreaker sets a setback and has to change their tactics as well. This new revelation doesn't seem like anything too different from that cycle - it is just revealing a larger breakthrough than is regularly revealed.
  • jacquesm 13y ago
    This is exactly the point of the whole debate, and lost on quite a few of the parties. The NSA went in the eyes of many from being the good guys to being at a minimum the tools of potential bad guys and quite possibly to being bad guys themselves. So now the curtain has been pulled back and there is no undoing that.
• greenyoda 13y ago
  "No, their official response is to suggest that encrypting your communications makes you indistinguishable (at their end) from those who encrypt for criminal activity." However, it is not within the NSA's authority to pursue criminal activity within the U.S. — they're only mandated to spy on communications between the U.S. and a foreign country, or entirely outside the U.S. If I'm in the U.S. and send an encrypted message to somebody else in the U.S. (like my friend or my bank), they have no legal excuse to spy on me. If I'm under criminal suspicion for a crime committed in the U.S., the FBI or local law enforcement agencies need to get a warrant to intercept my communications. But, as the article states: In fact, the NSA's "minimization" techniques — touted as methods for restricting spying to foreign terrorists instead of U.S. citizens — are often transparently and insultingly ridiculous.
  • tjr 13y ago
    If I'm under criminal suspicion for a crime committed in the U.S., the FBI or local law enforcement agencies need to get a warrant to intercept my communications. There is evidence that the FBI also engages in warrantless wiretapping. See http://mitpress.mit.edu/books/privacy-line http://mitpress.mit.edu/books/privacy-line
  • mpyne 13y ago
    Yes, minimization was one of his good points. But the architecture of the Internet also seems to make it very difficult to determine conclusively that a given communication has nothing whatsoever to do with someone outside the U.S. Consider a VPN/proxies for instance, or even an email from an American to AQ_Recruiter at gmail (where the owner of AQ_Recruiter logs in from Yemen via a series of proxies, the endpoint of which is wholly-domestic). I guarantee you that NSA wishes that problem was easy... they could pawn off the mere "domestic" stuff wholly on the FBI and focus on the "interesting" work of international spying and counter-terrorism (because again, in bizarro-world they aren't simply spying on people just because, but because they have a specific mission to attend to as directed by Congress and the DoD, which having to filter USPERS detracts from).
    • jacquesm 13y ago
• rayiner 13y ago
  There's also a fundamental logic error in that sentence. The NSA says: "It should hardly be surprising that our intelligence agencies seek ways to counteract our adversaries’ use of encryption. Throughout history, nations have used encryption to protect their secrets, and today, terrorists, cybercriminals, human traffickers and others also use code to hide their activities. Our intelligence community would not be doing its job if we did not try to counter that." Ken replies: "The NSA's official response is to suggest that wanting to secure our communications from our surveillance is inherently suspicious and suggestive of criminal activity." But that doesn't follow at all! A cop might say "well of course we have battering rams for breaking down locked doors." That doesn't mean he thinks anyone who locks their door is a criminal!
  • woah 13y ago
    There's a fundamental logic error in your analogy. Difference here is that the cops have been going around with their battering ram and breaking down every door in town.
    • rayiner 13y ago
      We don't know how much traffic the NSA actually decrypts, just that it has the capability to do so.
      • Seigmen 13y ago
        That doesn't mean we should trust trust them not to decrypt the trafic though.
        • rayiner 13y ago
          We shouldn't, but that's besides the point, which is that the point in the article is wildly illogical.
          • tptacek 13y ago
            I love Popehat, and Ken in particular, but any issue that intersects with his politics tends to get the same semilogical hyperbolic treatment. The "Buckyball" magnet thing was, if anything, even worse.
• derefr 13y ago
  > No, their official response is to suggest that encrypting your communications makes you indistinguishable (at their end) from those who encrypt for criminal activity. Good way to put it. An analogy that might help this stick in your mind: encrypting your communications is like walking around downtown in black clothes and a face-covering balaclava. You might not be doing anything wrong--but if someone in the same area robs a convenience store, the police won't be able to tell that you aren't them, and they'll have to at least stop you and search you for stolen goods before they can let you go. Interestingly, just asking you to take off the mask (i.e. knowing that the source and destination headers on the packets are both local) isn't enough; they don't know what the face of the guy who robbed the store looks like under his mask, so knowing what you look like under yours won't tell them whether you're him or not. (Likewise, they don't know that the chinese hackers they're trying to infiltrate aren't using Tor with a US exit node, so they can't trust US-to-US traffic to be, well, US traffic.)
  • stefantalpalaru 13y ago
    > encrypting your communications is like walking around downtown in black clothes and a face-covering balaclava No, it's like walking around clothed when most people are naked. You may have legitimate reasons to cover your body, but because you're part of a minority you stand out.
    • mpyne 13y ago
      Well, you may have legit reasons to wear a balaclava. You may have a facial scar which you don't want people seeing. You may be doing a film for a director friend of yours. It may be freaking cold outside. Either way changing the labels you use doesn't significantly change the point.
  • antsar 13y ago
    I would also add that using encryption online is much more of a norm than walking around downtown in black clothes and a face-covering balaclava. While both activities are perfectly legal and acceptable, the former is performed by millions on a daily basis and is essential to the successful continuity of businesses and personal lives. That is to say the likelihood of a random encrypted message on the internet being malicious is infinitely smaller than the likelihood of a person wearing all black with a facemask in the vicinity of a crime perpetrated by someone also wearing all black with a facemask.
• codelust 13y ago
  Honestly, crytpo -- whether we need more of it or less of it -- itself is not the problem. It boils down really to who do you think can be a suspect, just because they have locks on their doors. If all crypto users are potential criminals, then all gun owners, knife owners or any person who owns an item that can maim another human being is a suspect. A state that suspects almost all of its citizenry, is a state that has bigger problems than terrorists. Even worse, a state this does this, sooner or later, will convert a large chunk of its perfectly good citizens into behaving like bad ones because they are no longer sure what exactly constitutes bad. At the heart of a democratic society is the social contract that the state will, largely, do things that will keep most of the citizens safe and un-harassed; while, on the flip side, the citizens are largely expected to behave in a manner that is not detrimental to the state. What you see play out right now is that contract being broken. Important question is, what is the right price to pay in freedom for what is deemed to be adequate security?
• niels_olson 13y ago
  > if the government hires a lockpicker to plant a bug in an embassy then by definition they now have the technical ability to pick locks This reminds me of a conversation I had with a locksmith in the spring: he is essentially a full time contractor and goes around the city drilling out locks to which the military custodians have lost the combo. Your tax dollars at work.
• w_t_payne 13y ago
  It is quite simple, really: Only terrorists and paedophiles use cryptography.