9 ms·

Time for Internet Engineers to Fight Back Against the “Surveillance Internet”

144 points by kshatrea 13y ago

deleted 13y ago
[deleted]
- kanamekun 13y ago
  Facebook, Google and others offer you something in return for your data: use of their software and servers. You have a choice over whether or not to use these sites. The NSA gives you nothing in return, other than the blanket reassurance that you are safer. You have no choice but to submit to NSA surveillance, other than limiting your online footprint.
logn 13y ago
I think the best approach is P2P decentralized and mesh-networked apps running locally, licensed under the Affero GPL. That way there is no profit (or gov't) center which can collect data. And any user with the app can get the source code (per the Affero GPL). Developers can monetize their apps either with paid support/development services or by accepting cash (in lieu of a 'proof of work' by solving hashes) to be let on the mesh networks for their apps.
- mark_l_watson 13y ago
  +1 mesh networks are important for future privacy and security (e.g., after Huricane Sandy, mesh networks helped people communicate.) I would give you another +1 for mentioning the AGPL, if I could.
001sky 13y ago
“Fundamentally, surveillance is a business model of the Internet. The NSA didn’t wake up and say: ‘Let’s just spy on everybody, it said: ‘Wow, corporations are spying on everybody, let’s get ourselves a copy,’ ”
- 001sky 13y ago
  http://paulgraham.com/say.html http://paulgraham.com/say.html
  - 0xdeadbeefbabe 13y ago
    What a divisive essay. Thanks :)
selmnoo 13y ago
I want to reiterate one line of thought that's been seen here before but bears repeating: you should not give your data to Google, Facebook, or any other commercial entity just as much as you don't want NSA to have it. While NSA may have political motives and thus may use illegally obtained information for political ends, Facebook et al. could use it for reasons that serve their economic gain. That's a conclusion that's just as undesirable (if not moreso) than NSA using it. I don't see a very good future of fighting the 'surveillance internet' if we don't face the notion that once data is out there -- of lots of people, in one place -- NSA will always be interested in it and will probably get it. Pragmatically speaking, pulling out of Facebook, Google, etc. is the only surefire way to fight the surveillance internet.
- chopin 13y ago
  While not disagreeing that Facebook et al. pose a problem, the real problem is that you can't evade surveillance as you lay a digital trail of almost everything you do in your live. Your phone is location-tracked, every non-cash payment is tracked, the sites you surf onto are tracked (by your provider at least), your medical dossiers are electronic and pass eventually through public parts of the net, automatic face recognition is about to become ubiquitous,... So no, leaving Facebook or Google solves only a tiny part of the problem.
- forgottenpass 13y ago
  I think this is important to have emphasized. Especially because the opinion of business has a very loud voice in today's market-worshiping gov't. Even though there are technological remedies can be used by the most tech savvy to regain some ground, practically speaking any changes that protect the not-savvy have to be statutory. Companies will side with the consumers and howl like a dog when something more powerful than either of them surveils them, but spin on a dime and exploit their position of power over consumers. I also agree that you could make a convincing case that aside from the legality and broad social unacceptability of the collection, the way data is currently used by the government is much much more in line with the surveilled's interests than many of the businesses gobbling up consumer data. Corporate surveillance isn't inherently any better than government surveillance. Pretending otherwise makes us enablers.
PakG1 13y ago
I understand that these guys are different from a random group of guys part of Anonymous or something like that, but still, is this comment relevant at all to the situation? As in, is the end result inevitable? https://news.ycombinator.com/item?id=4100100 https://news.ycombinator.com/item?id=4100100
mtgx 13y ago
There are ways to make the Internet much more secure than it is today, and implement them tomorrow, with existing protocols and encryption methods. It's just a matter of browser vendors, hosting companies and websites agreeing to do it. That being said, I hope IETF starts working on a new highly secure Transport layer protocol to replace TCP, within the next 5 years, and I hope they use Dan Bernstein's CurveCP [1] for inspiration. We need the Internet encrypted and secure by default, and I don't care what Google or other advertising companies have to say about it. Adapt or die. Security of the web and the protection of the human right to privacy is way, way more important in my book. If they choose to fight such a move, instead of adapting and actually supporting it, then they will have become the enemy, and they'll end up on the wrong side of history. So IETF's goal should be to get everyone to switch to these more secure, already existing protocols, and implement them within a year, or two at most. In the meantime work on replacing TCP within the next 5 years, and also think about ways to create a new secure-by-default and easy to implement, IP-level protocol, to be used within 10-15 years. If we are to "take the Internet back", then it needs to stop being such an easy tool for mass surveillance, so in a way, we need to replace all of its insecure parts. [1] - http://curvecp.org/ http://curvecp.org/
rgbrgb 13y ago
Don't hide, you're beautiful.
unclebucknasty 13y ago
While we are playing cat-and-mouse with our own government, why don't we also make the NSA's activities illegal and/or enforce existing laws which already state as much? Articles like these presume that it is OK for the government to access whatever it can technically get its hands on, in spite of Constitutional constraints and laws that do or should state otherwise.
- ywyrd 13y ago
  Because that amounts to leaving a note in the cookie jar that says we really, really promise not to take any cookies unless we absolutely need to.
  - a3n 13y ago
    If we don't at least try to enforce the law (as one prong of counterattack), then we may as well not have laws.
  - unclebucknasty 13y ago
    Do you really believe that it is wise to treat our government as a virus writer and put ourselves in the position of antivirus software writers? Do you want them in the exploit business while we, the citizenry, resolve to simply apply patches? Do you really want them to have legal carte blanche to use their unlimited resources (including your own tax dollars) to do as they please, then scurry off to try to erect some defense against whatever you think they are doing next? When the NSA approaches Google, I want Google's General Counsel to deny the request with solid legal standing. Likewise with backbone providers and on down the line. We are either a nation of laws or we're not. Our government is either beholden to those laws or they are not. Had we the proper laws and commitment to our Constitution, then Snowden's revelations would have resulted in trials and prosecutions. Instead, too many seem to be ceding to the government the right to surveil its citizens with impunity, and are instead focusing on technical defenses against their own government. It's lunacy, and if the primary emphasis is not on legal redress, then we have already lost.
    - swombat 13y ago
smackay 13y ago
There are plenty of ideas for addressing the surveillance problem but perhaps it is time to take a step back and look at the "big picture". In any conflict, no matter how big or small, there is considerable advantage in having advance knowledge of your opponent's intentions. In military conflicts the invention of telegraph, radio, aircraft and satellites has more or less solved the problem with blindly marching into an area and getting annihilated. Nobody ever suggested that these technologies should be banned in order to create a level playing field. It is going to be the same patttern with all forms of electronic communication. The spectre of weapons of mass destruction (anything that can kill more than one person at a time) is the justification/motivation for government and law enforcement to monitor everything online. Whether it has merit is kind of besides the point. It is an advantage, perceived or otherwise, that is not going to be given up, under any circumstances. Another part to this is whether conspiring online actually constitutes a crime. People can chat all day about terrorist plots but until someone actually goes out and starts building a bomb or procuring weapons has a crime really taken place? Only when a society can decide on the answer to this question will it be possible to address online surveillance.
- tokenizer 13y ago
  > There are plenty of ideas for addressing the surveillance problem but perhaps it is time to take a step back and look at the "big picture". The "big picture" for me are the effects of the loss of privacy. What was once one of the most horrendous forms of punishment/torture, is now mainstream. Also, this only gives more power to already too powerful of people (you already mentioned the nukes). I think we've already proven we don't need mass surveillance to not blow ourselves up. > Another part to this is whether conspiring online actually constitutes a crime. ""To be classified as a crime, the act of doing something bad (actus reus) must be usually accompanied by the intention to do something bad (mens rea), with certain exceptions (strict liability)."" - http://en.wikipedia.org/wiki/Crime http://en.wikipedia.org/wiki/Crime In other words, it's up to the most powerful, who are also in control of the surveillance to decide this, not us. Also, the "big picture" issues here aren't really surveillance itself, but MASS surveillance, SECRET courts, and CLASSIFIED evidence.
- monsterix 13y ago
dil8 13y ago
While is support premise of the article, I have difficulty in accepting the fact that our democratically elected and funded government will continue to spy on us and is beyond our control.
- bediger4000 13y ago
  What, exactly, makes you think the government is democratically elected? I mean, if the NSA/CIA/FBI can get away with this kind of surveillance, and seeing the scope of "Tailored Access", why wouldn't they have rigged the last few elections, too? Clearly the security around voting machines isn't nearly as tight as that of Level 3,
  - malandrew 13y ago
    Good essay about this in the Atlantic recently. http://www.theatlantic.com/politics/archive/2013/11/the-surveillance-state-puts-us-elections-at-risk-of-manipulation/281232/ http://www.theatlantic.com/politics/archive/2013/11/the-surv...
diafygi 13y ago
FYI, you can start helping right away! There's the Aaron Swartz Memorial Hackathon starting tonight that has topics focusing on privacy and anonymous publications. https://www.noisebridge.net/wiki/Worldwide_Aaron_Swartz_Memorial_Hackathon_Series https://www.noisebridge.net/wiki/Worldwide_Aaron_Swartz_Memo...
ihsw 13y ago
It would be interesting to see Glenn Greenwald's new media organization take to being TOR-only and financed only by BTC.

144 points by kshatrea 13y ago

deleted 13y ago

[deleted]

kanamekun 13y ago
Facebook, Google and others offer you something in return for your data: use of their software and servers. You have a choice over whether or not to use these sites. The NSA gives you nothing in return, other than the blanket reassurance that you are safer. You have no choice but to submit to NSA surveillance, other than limiting your online footprint.

logn 13y ago

I think the best approach is P2P decentralized and mesh-networked apps running locally, licensed under the Affero GPL. That way there is no profit (or gov't) center which can collect data. And any user with the app can get the source code (per the Affero GPL). Developers can monetize their apps either with paid support/development services or by accepting cash (in lieu of a 'proof of work' by solving hashes) to be let on the mesh networks for their apps.

mark_l_watson 13y ago
+1 mesh networks are important for future privacy and security (e.g., after Huricane Sandy, mesh networks helped people communicate.) I would give you another +1 for mentioning the AGPL, if I could.

001sky 13y ago

“Fundamentally, surveillance is a business model of the Internet. The NSA didn’t wake up and say: ‘Let’s just spy on everybody, it said: ‘Wow, corporations are spying on everybody, let’s get ourselves a copy,’ ”

001sky 13y ago
http://paulgraham.com/say.html http://paulgraham.com/say.html
- 0xdeadbeefbabe 13y ago
  What a divisive essay. Thanks :)

selmnoo 13y ago

I want to reiterate one line of thought that's been seen here before but bears repeating: you should not give your data to Google, Facebook, or any other commercial entity just as much as you don't want NSA to have it. While NSA may have political motives and thus may use illegally obtained information for political ends, Facebook et al. could use it for reasons that serve their economic gain. That's a conclusion that's just as undesirable (if not moreso) than NSA using it. I don't see a very good future of fighting the 'surveillance internet' if we don't face the notion that once data is out there -- of lots of people, in one place -- NSA will always be interested in it and will probably get it. Pragmatically speaking, pulling out of Facebook, Google, etc. is the only surefire way to fight the surveillance internet.

chopin 13y ago
While not disagreeing that Facebook et al. pose a problem, the real problem is that you can't evade surveillance as you lay a digital trail of almost everything you do in your live. Your phone is location-tracked, every non-cash payment is tracked, the sites you surf onto are tracked (by your provider at least), your medical dossiers are electronic and pass eventually through public parts of the net, automatic face recognition is about to become ubiquitous,... So no, leaving Facebook or Google solves only a tiny part of the problem.
forgottenpass 13y ago
I think this is important to have emphasized. Especially because the opinion of business has a very loud voice in today's market-worshiping gov't. Even though there are technological remedies can be used by the most tech savvy to regain some ground, practically speaking any changes that protect the not-savvy have to be statutory. Companies will side with the consumers and howl like a dog when something more powerful than either of them surveils them, but spin on a dime and exploit their position of power over consumers. I also agree that you could make a convincing case that aside from the legality and broad social unacceptability of the collection, the way data is currently used by the government is much much more in line with the surveilled's interests than many of the businesses gobbling up consumer data. Corporate surveillance isn't inherently any better than government surveillance. Pretending otherwise makes us enablers.

PakG1 13y ago

I understand that these guys are different from a random group of guys part of Anonymous or something like that, but still, is this comment relevant at all to the situation? As in, is the end result inevitable? https://news.ycombinator.com/item?id=4100100 https://news.ycombinator.com/item?id=4100100

mtgx 13y ago

There are ways to make the Internet much more secure than it is today, and implement them tomorrow, with existing protocols and encryption methods. It's just a matter of browser vendors, hosting companies and websites agreeing to do it. That being said, I hope IETF starts working on a new highly secure Transport layer protocol to replace TCP, within the next 5 years, and I hope they use Dan Bernstein's CurveCP [1] for inspiration. We need the Internet encrypted and secure by default, and I don't care what Google or other advertising companies have to say about it. Adapt or die. Security of the web and the protection of the human right to privacy is way, way more important in my book. If they choose to fight such a move, instead of adapting and actually supporting it, then they will have become the enemy, and they'll end up on the wrong side of history. So IETF's goal should be to get everyone to switch to these more secure, already existing protocols, and implement them within a year, or two at most. In the meantime work on replacing TCP within the next 5 years, and also think about ways to create a new secure-by-default and easy to implement, IP-level protocol, to be used within 10-15 years. If we are to "take the Internet back", then it needs to stop being such an easy tool for mass surveillance, so in a way, we need to replace all of its insecure parts. [1] - http://curvecp.org/ http://curvecp.org/

rgbrgb 13y ago

Don't hide, you're beautiful.

unclebucknasty 13y ago

While we are playing cat-and-mouse with our own government, why don't we also make the NSA's activities illegal and/or enforce existing laws which already state as much? Articles like these presume that it is OK for the government to access whatever it can technically get its hands on, in spite of Constitutional constraints and laws that do or should state otherwise.

ywyrd 13y ago
Because that amounts to leaving a note in the cookie jar that says we really, really promise not to take any cookies unless we absolutely need to.
- a3n 13y ago
  If we don't at least try to enforce the law (as one prong of counterattack), then we may as well not have laws.
- unclebucknasty 13y ago
  Do you really believe that it is wise to treat our government as a virus writer and put ourselves in the position of antivirus software writers? Do you want them in the exploit business while we, the citizenry, resolve to simply apply patches? Do you really want them to have legal carte blanche to use their unlimited resources (including your own tax dollars) to do as they please, then scurry off to try to erect some defense against whatever you think they are doing next? When the NSA approaches Google, I want Google's General Counsel to deny the request with solid legal standing. Likewise with backbone providers and on down the line. We are either a nation of laws or we're not. Our government is either beholden to those laws or they are not. Had we the proper laws and commitment to our Constitution, then Snowden's revelations would have resulted in trials and prosecutions. Instead, too many seem to be ceding to the government the right to surveil its citizens with impunity, and are instead focusing on technical defenses against their own government. It's lunacy, and if the primary emphasis is not on legal redress, then we have already lost.
  - swombat 13y ago

smackay 13y ago

There are plenty of ideas for addressing the surveillance problem but perhaps it is time to take a step back and look at the "big picture". In any conflict, no matter how big or small, there is considerable advantage in having advance knowledge of your opponent's intentions. In military conflicts the invention of telegraph, radio, aircraft and satellites has more or less solved the problem with blindly marching into an area and getting annihilated. Nobody ever suggested that these technologies should be banned in order to create a level playing field. It is going to be the same patttern with all forms of electronic communication. The spectre of weapons of mass destruction (anything that can kill more than one person at a time) is the justification/motivation for government and law enforcement to monitor everything online. Whether it has merit is kind of besides the point. It is an advantage, perceived or otherwise, that is not going to be given up, under any circumstances. Another part to this is whether conspiring online actually constitutes a crime. People can chat all day about terrorist plots but until someone actually goes out and starts building a bomb or procuring weapons has a crime really taken place? Only when a society can decide on the answer to this question will it be possible to address online surveillance.

tokenizer 13y ago
> There are plenty of ideas for addressing the surveillance problem but perhaps it is time to take a step back and look at the "big picture". The "big picture" for me are the effects of the loss of privacy. What was once one of the most horrendous forms of punishment/torture, is now mainstream. Also, this only gives more power to already too powerful of people (you already mentioned the nukes). I think we've already proven we don't need mass surveillance to not blow ourselves up. > Another part to this is whether conspiring online actually constitutes a crime. ""To be classified as a crime, the act of doing something bad (actus reus) must be usually accompanied by the intention to do something bad (mens rea), with certain exceptions (strict liability)."" - http://en.wikipedia.org/wiki/Crime http://en.wikipedia.org/wiki/Crime In other words, it's up to the most powerful, who are also in control of the surveillance to decide this, not us. Also, the "big picture" issues here aren't really surveillance itself, but MASS surveillance, SECRET courts, and CLASSIFIED evidence.
monsterix 13y ago

dil8 13y ago

While is support premise of the article, I have difficulty in accepting the fact that our democratically elected and funded government will continue to spy on us and is beyond our control.

bediger4000 13y ago
What, exactly, makes you think the government is democratically elected? I mean, if the NSA/CIA/FBI can get away with this kind of surveillance, and seeing the scope of "Tailored Access", why wouldn't they have rigged the last few elections, too? Clearly the security around voting machines isn't nearly as tight as that of Level 3,
- malandrew 13y ago
  Good essay about this in the Atlantic recently. http://www.theatlantic.com/politics/archive/2013/11/the-surveillance-state-puts-us-elections-at-risk-of-manipulation/281232/ http://www.theatlantic.com/politics/archive/2013/11/the-surv...

diafygi 13y ago

FYI, you can start helping right away! There's the Aaron Swartz Memorial Hackathon starting tonight that has topics focusing on privacy and anonymous publications. https://www.noisebridge.net/wiki/Worldwide_Aaron_Swartz_Memorial_Hackathon_Series https://www.noisebridge.net/wiki/Worldwide_Aaron_Swartz_Memo...

ihsw 13y ago

It would be interesting to see Glenn Greenwald's new media organization take to being TOR-only and financed only by BTC.