7 ms·

Oh, I like this game. Let's play again: WHICH IS MORE LIKELY?! * The world's largest online retailer that does $54M in sales per day has a bug in its procureme

Oh, I like this game. Let's play again: WHICH IS MORE LIKELY?! * The world's largest online retailer that does $54M in sales per day has a bug in its procurement system that randomly transposes tracking codes. ORRRRRRRR! * The intelligence agency whose massive scope and pervasive operational shortcomings were recently exposed by one low-level operative had a slip-up in applying a well-publicized tactic to an obviously high value target. On the other hand, what's great about your way of putting it is that it juxtaposes your belief in the all encompassing nature of the NSA's programs with your incredulity that such a program might have been applied specifically here. I also like the part where the NSA is guarded by the Catch-22 "it wasn't them, because if it was, you'd never know", such that that there's no scenario in which you could be convinced that the NSA did anything. And yet again, maybe it's time to stop thinking of the NSA as some far-off abstraction and start thinking about it is an actual thing that affects our daily lives.

tptacek 13y ago
I don't understand. Richard's point doesn't depend on an Amazon bug that transposes tracking codes. But your point does depend on the NSA redirecting packages to Alexandria in such a way that anyone who checked their order status would notice.
- mikeash 13y ago
  And why Alexandria? Part of this discussion seems based on a lack of understanding of the geography of the DC area. Alexandria is near these agencies, omg! But the fact is that there isn't much government in Alexandria. USPTO is there, and otherwise it's charming old houses, quirky shops, crappy strip malls, cookie-cutter suburbia, smallish high-rise apartments, railroad facilities, light industry, and other such similar things. It's roughly like seeing your Mac get misdelivered to Richmond, CA and deciding that holy crap it's been intercepted by Apple on its way to me.
  - busterarm 13y ago
    The NSA does rely heavily on outside contractors though. Maybe this page is of interest? https://www.ida.org/aboutus/organization/hpcc.php https://www.ida.org/aboutus/organization/hpcc.php http://en.wikipedia.org/wiki/Institute_for_Defense_Analyses http://en.wikipedia.org/wiki/Institute_for_Defense_Analyses Spy the address down at the bottom. And if you wanna get really crazy or are just interested: http://en.wikipedia.org/wiki/Columbia_University_protests_of_1968 http://en.wikipedia.org/wiki/Columbia_University_protests_of...
    - mikeash 13y ago
      I don't get it. Why is an administrative non-profit at all interesting here?
      - busterarm 13y ago
        Did you actually read the three paragraphs on the first linked page?
        mikeash 13y ago
        The ones that say their research activities occur in California and New Jersey?
        busterarm 13y ago
        Yes, one part of what they do is in NJ/CA. Alexandria is where they're based. I'm not leaping to any conclusion; it just seems remotely possible and they're based there. You're the one saying there's nothing interesting in Alexandria. Given what the company researches, their history and mission, it seems like exactly the sort of place where this wild theory suggested by the OP could be a reality.
        mikeash 13y ago
        The headquarters of a company like this isn't interesting. Headquarters are administrative centers. It's not where you send a laptop to have a bug installed.
- dchichkov 13y ago
  Why do you think NSA cares much about hiding their activities from you? I can tell you a story. Some years ago, back in Russia, as a [naive] kid, I've developed a surveillance system for Telrad telecom exchange [ultimately for FSB]. Do you think anyone cared to do that project in secrecy? I can give you the answer. Nope. As far as I understand NSA can legally intercept packages and can legally install undetectable surveillance devices. As long as they are not using collected surveillance data, legally they are fine and they do not absolutely have to hide their activities at all costs. Hiding large scale operation is difficult and plugging every information leak is expensive. So they are not necessarily prioritizing that. So, yes, there is a change that we simply see their activity. And yes, it could be just an Amazon bug.
  - tptacek 13y ago
    Gee, I don't know what gave me the impression that NSA was secretive.
    - busterarm 13y ago
      It's going after low-hanging fruit to say this and while the link I'm providing is not the NSA, our government agencies seem to have a real hard time keeping secrets lately. http://www.techdirt.com/articles/20131220/10200525651/fbi-agent-tries-to-register-copyright-top-secret-interrogation-manual-making-it-available-to-anyone.shtml http://www.techdirt.com/articles/20131220/10200525651/fbi-ag... Apparently keeping secrets is hard. Human error and all.
  - ewoodrich 13y ago
    It would be pretty stupid for a spy agency to give a target clear warning that their electronics were tampered with. Isn't the whole point of this program to capture information that the target wouldn't otherwise broadcast publicly?
  - jonhohle 13y ago
    During the cold war (and shortly after), this type of activity would be exactly what red-blooded Americans would say differentiated us from Russia (not hiding it, but doing it at all). Americans have constitutional protection against unreasonable search and seizure by the government. These days you could probably drop the country and year and have trouble differentiating tactics used by the US and Russia.
- gojomo 13y ago
  No one thinks redirection would be visible to 'anyone'. The theory is thhis could be a one-time screw-up, like a redaction failure, revealing a waypoint that was supposed to be secret. (Maybe a label that was supposed to go on the outer box went on the inner box instead?) I'd agree an innocent screw-up is far more likely, here and in any particular case where something weird happens. Weird stuff happens with shipping all the time. But since we know shipment interception is part of the NSA toolkit, and the NSA cares about Tor, people aren't crazy to be curious and even paranoid around remote possibilities. And if I were a Tor developer, I might buy all my hardware from store shelves with cash.
- skue 13y ago
  No, he's saying that anyone who checked their order status shouldn't notice (by design), but maybe that part of the process failed this time. Also, that failure might be technical or intentional. As I mentioned on another subthread, it's always possible this was "accidentally" exposed by an employee working at the merchant or postal service. The program would require their cooperation. After all, we first learned about the telco spying because telco employees spoke up. As for whether it's conceivable that NSA would target a Tor developer? A few months they were spying on our close friends and allies simply because they could. If that same mindset were applied to the intercept program, then this isn't impossible to imagine. Just because the NSA and administration has finally recognized their overreach and has started backpedalling doesn't mean these programs change overnight.
  - dchichkov 13y ago
    It is difficult to predict NSA actions, but opportunistically putting up inexpensive surveillance on all Tor users and nodes seems like a reasonable thing to do. As a developer she is a Tor user and also probably operates a few Tor nodes [for debugging and testing purposes]. So she would be in that group. I think this is plausible. I doubt that NSA would specifically target a Tor developer in US, without court order, as this would probably be illegal. [Although subverting some Tor developers, especially ones who build Tor binaries would be useful.]
mikeash 13y ago
As if Amazon is the only place for a screwup to happen here. There are a lot of different benign possibilities: 1. Amazon transposed a tracking code. 2. A third-party reseller transposed a tracking code. 3. USPS transposed a tracking code. 4. The tracking code is correct, but an error in USPS's backend showed tracking data for another shipment anyway. 5. The tracking code is correct, and the tracking data is correct, and the package went to Virginia because USPS screwed up. I've personally seen #5, and none of the others are all that hard to believe.
OverlordXenu 13y ago
USPS tracking codes aren't the most accurate thing.
rwg 13y ago
The intelligence agency whose massive scope and pervasive operational shortcomings were recently exposed by one low-level operative had a slip-up in applying a well-publicized tactic to an obviously high value target. A few comments: • This "low-level operative" was a system administrator who used social engineering to obtain other people's authentication credentials and gain access to material to which he wasn't authorized. He wasn't the janitor or some clueless field agent. • Did Snowden expose operational shortcomings? Absolutely. A lot of the programs that have been publicly revealed through his leaks have been running for over a decade without ever seeing the light of day, though. That tells me these "pervasive operational shortcomings" aren't very pervasive. (If they were, the NSA would be absolute shit at their mission.) • I don't think Andrea is a "high value target," or at least high value enough to risk compromising whatever method they might use to bug her keyboard. I don't say this to belittle her or her work in any way — she seems to be a skilled programmer/hacker/infosec person. And that's exactly why this whole "the NSA is bugging her keyboard" theory doesn't make any sense. Let's assume for the sake of argument that the NSA had planned to bug her keyboard, and that keyboard is now sitting in an NSA (or contractor) facility in/near Alexandria, Virginia, waiting for some modification to be made before shipping it back out. But, oops, they screwed up and forgot to fake the USPS tracking information. They know she knows because she tweeted about it. She's also tweeted that she can never trust the keyboard if/when it shows up. Why would they ship her a bugged keyboard at this point? If/when the keyboard shows up, she's probably going to take it apart and share anything interesting she finds with the world. There will be hard evidence. Even if they hadn't bungled the tracking information in our hypothetical argument, they're risking exposure of the exact methods they use to bug a machine for not much potential gain. (Remember, Andrea's a skilled hacker/programmer. There's a very good chance she'll figure out what's going on and tell the world if she has any inkling that her laptop's been tampered with.) • The keyboard she ordered fits a ThinkPad T60/T61/T400/T500 (and the equivalent "R" models, plus a few others). Internally, the keyboard and TrackPoint speak PS/2. While they could log keystrokes to an on-board chip and transmit keystrokes via radio, there aren't any especially interesting things the NSA can do to her laptop via a modified keyboard. They certainly won't be rooting it that way. • I said that I don't think Andrea is a "high value target," despite her work on Tor, because everything about Tor is open. Anyone can download the code and see exactly how it works. The protocol is well-known. There's no curtain to peek behind and gain strategic information about Tor's workings. So while I don't reject the argument that the NSA is trying to bug her laptop as impossible, I think it's exceedingly improbable. My money's still on "seller screwed up the tracking number." I also like the part where the NSA is guarded by the Catch-22 "it wasn't them, because if it was, you'd never know", such that that there's no scenario in which you could be convinced that the NSA did anything. The flip side of this argument, which everyone here seems to be clutching onto and running with, is that if the NSA is capable of it, they're doing it at every available opportunity, even when it doesn't make any sense to.
eitally 13y ago
a couple weeks ago, my wife received an order from Banana Republic that was intended for a recipient in Newfoundland. the correct recipient's name was on the packlist inside the box but they showed it to the wrong person. likewise, my wife's actual offer took a few days longer to arrive, too. I suspect it was simple mistake inn the warehouse where an operator had two boxes, printed waybill stickers for both, and then slapped them on the wrong - already sealed - packages. I bet similar things happen regularly.
joevandyk 13y ago
I work in e-commerce, we get bad/transposed tracking numbers entered into our systems all the freaking time.

tptacek 13y ago

I don't understand. Richard's point doesn't depend on an Amazon bug that transposes tracking codes. But your point does depend on the NSA redirecting packages to Alexandria in such a way that anyone who checked their order status would notice.

mikeash 13y ago
And why Alexandria? Part of this discussion seems based on a lack of understanding of the geography of the DC area. Alexandria is near these agencies, omg! But the fact is that there isn't much government in Alexandria. USPTO is there, and otherwise it's charming old houses, quirky shops, crappy strip malls, cookie-cutter suburbia, smallish high-rise apartments, railroad facilities, light industry, and other such similar things. It's roughly like seeing your Mac get misdelivered to Richmond, CA and deciding that holy crap it's been intercepted by Apple on its way to me.
- busterarm 13y ago
  The NSA does rely heavily on outside contractors though. Maybe this page is of interest? https://www.ida.org/aboutus/organization/hpcc.php https://www.ida.org/aboutus/organization/hpcc.php http://en.wikipedia.org/wiki/Institute_for_Defense_Analyses http://en.wikipedia.org/wiki/Institute_for_Defense_Analyses Spy the address down at the bottom. And if you wanna get really crazy or are just interested: http://en.wikipedia.org/wiki/Columbia_University_protests_of_1968 http://en.wikipedia.org/wiki/Columbia_University_protests_of...
  - mikeash 13y ago
    I don't get it. Why is an administrative non-profit at all interesting here?
    - busterarm 13y ago
      Did you actually read the three paragraphs on the first linked page?
      - mikeash 13y ago
        The ones that say their research activities occur in California and New Jersey?
        busterarm 13y ago
        Yes, one part of what they do is in NJ/CA. Alexandria is where they're based. I'm not leaping to any conclusion; it just seems remotely possible and they're based there. You're the one saying there's nothing interesting in Alexandria. Given what the company researches, their history and mission, it seems like exactly the sort of place where this wild theory suggested by the OP could be a reality.
        mikeash 13y ago
        The headquarters of a company like this isn't interesting. Headquarters are administrative centers. It's not where you send a laptop to have a bug installed.
dchichkov 13y ago
Why do you think NSA cares much about hiding their activities from you? I can tell you a story. Some years ago, back in Russia, as a [naive] kid, I've developed a surveillance system for Telrad telecom exchange [ultimately for FSB]. Do you think anyone cared to do that project in secrecy? I can give you the answer. Nope. As far as I understand NSA can legally intercept packages and can legally install undetectable surveillance devices. As long as they are not using collected surveillance data, legally they are fine and they do not absolutely have to hide their activities at all costs. Hiding large scale operation is difficult and plugging every information leak is expensive. So they are not necessarily prioritizing that. So, yes, there is a change that we simply see their activity. And yes, it could be just an Amazon bug.
- tptacek 13y ago
  Gee, I don't know what gave me the impression that NSA was secretive.
  - busterarm 13y ago
    It's going after low-hanging fruit to say this and while the link I'm providing is not the NSA, our government agencies seem to have a real hard time keeping secrets lately. http://www.techdirt.com/articles/20131220/10200525651/fbi-agent-tries-to-register-copyright-top-secret-interrogation-manual-making-it-available-to-anyone.shtml http://www.techdirt.com/articles/20131220/10200525651/fbi-ag... Apparently keeping secrets is hard. Human error and all.
- ewoodrich 13y ago
  It would be pretty stupid for a spy agency to give a target clear warning that their electronics were tampered with. Isn't the whole point of this program to capture information that the target wouldn't otherwise broadcast publicly?
- jonhohle 13y ago
  During the cold war (and shortly after), this type of activity would be exactly what red-blooded Americans would say differentiated us from Russia (not hiding it, but doing it at all). Americans have constitutional protection against unreasonable search and seizure by the government. These days you could probably drop the country and year and have trouble differentiating tactics used by the US and Russia.
gojomo 13y ago
No one thinks redirection would be visible to 'anyone'. The theory is thhis could be a one-time screw-up, like a redaction failure, revealing a waypoint that was supposed to be secret. (Maybe a label that was supposed to go on the outer box went on the inner box instead?) I'd agree an innocent screw-up is far more likely, here and in any particular case where something weird happens. Weird stuff happens with shipping all the time. But since we know shipment interception is part of the NSA toolkit, and the NSA cares about Tor, people aren't crazy to be curious and even paranoid around remote possibilities. And if I were a Tor developer, I might buy all my hardware from store shelves with cash.
skue 13y ago
No, he's saying that anyone who checked their order status shouldn't notice (by design), but maybe that part of the process failed this time. Also, that failure might be technical or intentional. As I mentioned on another subthread, it's always possible this was "accidentally" exposed by an employee working at the merchant or postal service. The program would require their cooperation. After all, we first learned about the telco spying because telco employees spoke up. As for whether it's conceivable that NSA would target a Tor developer? A few months they were spying on our close friends and allies simply because they could. If that same mindset were applied to the intercept program, then this isn't impossible to imagine. Just because the NSA and administration has finally recognized their overreach and has started backpedalling doesn't mean these programs change overnight.
- dchichkov 13y ago
  It is difficult to predict NSA actions, but opportunistically putting up inexpensive surveillance on all Tor users and nodes seems like a reasonable thing to do. As a developer she is a Tor user and also probably operates a few Tor nodes [for debugging and testing purposes]. So she would be in that group. I think this is plausible. I doubt that NSA would specifically target a Tor developer in US, without court order, as this would probably be illegal. [Although subverting some Tor developers, especially ones who build Tor binaries would be useful.]

mikeash 13y ago

As if Amazon is the only place for a screwup to happen here. There are a lot of different benign possibilities: 1. Amazon transposed a tracking code. 2. A third-party reseller transposed a tracking code. 3. USPS transposed a tracking code. 4. The tracking code is correct, but an error in USPS's backend showed tracking data for another shipment anyway. 5. The tracking code is correct, and the tracking data is correct, and the package went to Virginia because USPS screwed up. I've personally seen #5, and none of the others are all that hard to believe.

OverlordXenu 13y ago

USPS tracking codes aren't the most accurate thing.

rwg 13y ago

The intelligence agency whose massive scope and pervasive operational shortcomings were recently exposed by one low-level operative had a slip-up in applying a well-publicized tactic to an obviously high value target. A few comments: • This "low-level operative" was a system administrator who used social engineering to obtain other people's authentication credentials and gain access to material to which he wasn't authorized. He wasn't the janitor or some clueless field agent. • Did Snowden expose operational shortcomings? Absolutely. A lot of the programs that have been publicly revealed through his leaks have been running for over a decade without ever seeing the light of day, though. That tells me these "pervasive operational shortcomings" aren't very pervasive. (If they were, the NSA would be absolute shit at their mission.) • I don't think Andrea is a "high value target," or at least high value enough to risk compromising whatever method they might use to bug her keyboard. I don't say this to belittle her or her work in any way — she seems to be a skilled programmer/hacker/infosec person. And that's exactly why this whole "the NSA is bugging her keyboard" theory doesn't make any sense. Let's assume for the sake of argument that the NSA had planned to bug her keyboard, and that keyboard is now sitting in an NSA (or contractor) facility in/near Alexandria, Virginia, waiting for some modification to be made before shipping it back out. But, oops, they screwed up and forgot to fake the USPS tracking information. They know she knows because she tweeted about it. She's also tweeted that she can never trust the keyboard if/when it shows up. Why would they ship her a bugged keyboard at this point? If/when the keyboard shows up, she's probably going to take it apart and share anything interesting she finds with the world. There will be hard evidence. Even if they hadn't bungled the tracking information in our hypothetical argument, they're risking exposure of the exact methods they use to bug a machine for not much potential gain. (Remember, Andrea's a skilled hacker/programmer. There's a very good chance she'll figure out what's going on and tell the world if she has any inkling that her laptop's been tampered with.) • The keyboard she ordered fits a ThinkPad T60/T61/T400/T500 (and the equivalent "R" models, plus a few others). Internally, the keyboard and TrackPoint speak PS/2. While they could log keystrokes to an on-board chip and transmit keystrokes via radio, there aren't any especially interesting things the NSA can do to her laptop via a modified keyboard. They certainly won't be rooting it that way. • I said that I don't think Andrea is a "high value target," despite her work on Tor, because everything about Tor is open. Anyone can download the code and see exactly how it works. The protocol is well-known. There's no curtain to peek behind and gain strategic information about Tor's workings. So while I don't reject the argument that the NSA is trying to bug her laptop as impossible, I think it's exceedingly improbable. My money's still on "seller screwed up the tracking number." I also like the part where the NSA is guarded by the Catch-22 "it wasn't them, because if it was, you'd never know", such that that there's no scenario in which you could be convinced that the NSA did anything. The flip side of this argument, which everyone here seems to be clutching onto and running with, is that if the NSA is capable of it, they're doing it at every available opportunity, even when it doesn't make any sense to.

eitally 13y ago

a couple weeks ago, my wife received an order from Banana Republic that was intended for a recipient in Newfoundland. the correct recipient's name was on the packlist inside the box but they showed it to the wrong person. likewise, my wife's actual offer took a few days longer to arrive, too. I suspect it was simple mistake inn the warehouse where an operator had two boxes, printed waybill stickers for both, and then slapped them on the wrong - already sealed - packages. I bet similar things happen regularly.

joevandyk 13y ago

I work in e-commerce, we get bad/transposed tracking numbers entered into our systems all the freaking time.