10 ms·

Hacking Online Polls and Other Ways British Spies Seek to Control the Internet

211 points by unclebucknasty 12y ago

mnem 12y ago
To be fair though, hasn't everyone who has started playing with HTTP in code manipulated online polls at some point just to learn? Does anyone actually put any weight in online polls other than linkbait headline sites?
- ejr 12y ago
  Well a significant percentage of HN folk certainly, but I doubt this translates well outside this sphere. I'm more alarmed by the email spoofing. Isn't this the same as manufacturing evidence? Consider: An entity is under surveillance, however the powers that be decide the scope is too limited. What better way to invite scrutiny than ensuring an email from the desired target arrives in the monitored entity's inbox?
- kubiiii 12y ago
  Apparently UK government does.
- cma 12y ago
  You realize you are asking this on a site which is basically a continuous online poll, right? :P
- davb 12y ago
  Consider online opinion polls around the Scottish independence debate. Whichever side you support, it's easy to recognise the political and democratic ramifications of an opinion poll being altered to reflect the current government's position.
  - cmdkeen 12y ago
    Except there are plenty of real polls, being conducted by reputable polling companies, that people actually pay attention to. GCHQ aren't manipulating Scottish independence, they have plenty of Scottish staff, it would leak and that would be ammunition for the Nats.
- tripzilch 12y ago
  Of course. But that is nothing "to be fair" about. It's wrong to do so if you're a teenage hacker who just discovered scripting, and it's wrong to do so if you're a government. And the latter is IMO much worse than some teenage kid playing around because of scale, impact, accountability and the fact that, in a "democracy", the government should be influenced by the people and not the other way around.
  - mnem 12y ago
    Really? It's wrong? By what measure? It's certainly not illegal to manipulate online polls. In fact, I personally find it quite amusing to do so, in certain cases. Do you agree? [ ] Yes [ ] No
    - tripzilch 12y ago
      I agree it can be amusing. I try to never conflate the meaning of the words "illegal" and "wrong", as they are rather orthogonal, even if many people do not realize this. And I think it's wrong (unethical) to do so for a multitude of reasons. Two main ones are because it's misleading to people reading/interpreting the results, and that it's actively trying to sabotage the intent of whoever set up the poll. Don't get me wrong though, if we're talking about a stupid or silly poll, on a stupid or silly site, or if it's in the context of a really good prank, etc, it can be a forgiveable type of "wrong". In fact in certain circumstances one could even argue that it's not actually completely wrong, simply because I wouldn't want to live with a system of ethics where pranks are never right. That's a tricky one (as is often the case with discussions about ethics). However, that's not really the type of manipulating of polls we were discussing here.
- fnordfnordfnord 12y ago
  >Does anyone actually put any weight in online polls... Yes, their "results" are often read on daily news broadcasts.
agd 12y ago
The original story (with more depth) is here https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/ https://firstlook.org/theintercept/2014/07/14/manipulating-o...
- mc_hammer 12y ago
  this title is clearly fud, this is a relabeling of the actual tech - the entire purpose of this is to manipulate forums and spread disinformation
richardmjohn 12y ago
"ANGRY PIRATE"? http://www.urbandictionary.com/define.php?term=angry+pirate http://www.urbandictionary.com/define.php?term=angry+pirate
- SideburnsOfDoom 12y ago
  The naming strategies are discussed here: http://www.theguardian.com/uk-news/shortcuts/2014/jul/16/what-gchq-geeky-misogynistic-code-names-tell-us http://www.theguardian.com/uk-news/shortcuts/2014/jul/16/wha...
pjc50 12y ago
Clearly they were losing the arms race with 4chan.
rayiner 12y ago
Online polls are worthless anyway. In high school, someone in our class hacked an online poll to win a contest to get Mandy Moore to perform at our school. NBD.
- thomasahle 12y ago
  Ever heard of "moving with the stream"? Everyone does that sometimes, as you have to pick your fights. If you can create a fake public consensus, you've basically changed the direction of the stream. Many people might even reevaluate their opinions if it seems that everyone else agrees on the opposite idea. It's pretty human.
  - rayiner 12y ago
    Which is precisely why online polls are worthless. I wonder what sorts of results you'd get if you ran a poll about domestic surveillance on HN, Reddit, etc. You think that'd be a representative viewpoint? Who puts any stock in these sorts of poll results? Plus: if GCHQ can manipulate them, so can a whole bunch of other people...
    - badkungfu 12y ago
      Yes, they're worthless, but, anchoring effect.
- coldtea 12y ago
  >Online polls are worthless anyway It's not about their accuracy. It's about skewing them, so people perceive some opinion as "non mainstream" while it could even be the majority opinion.
  - pjc50 12y ago
    Fanatical supporters are quite capable of doing this on their own. For example, UKIP supporters dominate the comments section and polls on the Telegraph, while making up about 10% of the population. (Yes, 30% of the vote in the Euro elections .. of a very low turnout)
eponeponepon 12y ago
> GATEWAY: “Ability to artificially increase traffic to a website.” Are they actually just talking about DDoS here? It seems an unusually euphemistic description if so, given how plin-spoken a lot of the previously published documents are. And if not, why would they want or need to increase traffic? I'm puzzled.
- coldtea 12y ago
  Some uses that come to mind: 1) increase traffic on articles that favor topic X (one the government likes). The publisher (owner of site) perceives it as public's interest, and adds more articles on X. 2) make some independent pro-government site appear more popular than it is. This could enabled ad money to come its way (including from state ad campaigns), as an indirect method of funding it.
- meowface 12y ago
  I think they mean things like artifical visitor inflation. For example, to make a Youtube video "viral" they could seed it with 30,000 fake views. Or, perhaps, they could mass upvote certain HN threads as soon as they're posted... Remember that intelligence agencies generally care more about exploitation (figuratively) and manipulation than attack.
- beejiu 12y ago
  Perhaps if you are a terrorist organisation using the Internet to spread propaganda, believing a particular medium is reaching a wide audience, you might be more inclined to continue publishing via that medium. Of course, all of the content falls directly into the laps of GCHQ and the NSA.
- jameshart 12y ago
  Create noise to mask specific human-directed activity?
cmsefton 12y ago
I didn't realize GCHQ was in the SEO game. If they released an online tool, they'll make a mint selling this to marketing agencies. Some examples: AIRWOLF - YouTube profile, comment and video collection BEARTRAP - Bulk retrieval of public BEBO profiles from member or group BIRDSONG - Automated posting of Twitter updates BIRDSTRIKE - Twitter monitoring and profile collection. BUGSY - Google+ collection (circles, profiles etc.) FATYAK - Public data collection from LinkedIn FUSEWIRE - Provides 24/7 monitoring of Vbulletin forums for target postings/online activity. Also allows staggered postings to be made. GODFATHER - Public data collection from Facebook GOODFELLA - Generic framework for public data collection from social networks. INSPECTOR - Tool for monitoring domain information and site availability RESERVOIR - Facebook application allowing collection of various information. GATEWAY - Ability to artificially increase traffic to a website GESTATOR - amplification of a given message, normally video, on popular multimedia websites (Youtube) SLIPSTREAM - ability to inflate page views on websites TANGLEFOOT - is a bulk search tool which queries a set of online resources. This allows analysts to quickly check the online presence of a target.
- michaelt 12y ago
  I always thought those incredibly awkward product names were chosen at random. Does this mean there are actual humans coming up with these things?
  - dijit 12y ago
    oh, definitely, remember the "Anti-Crisis Girl" software[0] (screenshots leaked in Snowdens Revalations), an obvious nod to Svetlana Loboda's song[1] of the same name from Eurovision. The people crafting these things are people too, they go about daily life the same as we do, albeit in the firm belief they're doing it for the good of the people. [0] - http://leaksource.info/2014/02/19/anticrisis-girl-nsa-gchq-surveillance-of-wikileaks-and-human-network-that-supports-them/ http://leaksource.info/2014/02/19/anticrisis-girl-nsa-gchq-s... [1] - https://www.youtube.com/watch?v=iA-HL-EfUbI https://www.youtube.com/watch?v=iA-HL-EfUbI
  - proofofconcept 12y ago
    I find that if I think of military/intelligence project names as being in part a form of marketing for which I am not the target demographic, and then imagine the sorts of people who are in that demographic, they make a whole lot more sense.
deleted 12y ago
[deleted]
mkal_tsr 12y ago
"Snowden: Dropbox is hostile to privacy, unlike 'zero knowledge' Spideroak" - http://www.theguardian.com/technology/2014/jul/17/edward-snowden-dropbox-privacy-spideroak http://www.theguardian.com/technology/2014/jul/17/edward-sno... and from https://firstlook.org/theintercept/document/2014/07/14/jtrig-tools-techniques/ https://firstlook.org/theintercept/document/2014/07/14/jtrig... under Honeypots we have, LONGSHOT - file-sharing and upload website. And Condoleezza Rice just got on their board. I haven't seen anything that makes an official link between those but at least I moved off Dropbox :-P
- mikevm 12y ago
  How can we trust SpiderOak when their client is not open sourced?
  - makmanalp 12y ago
    I think the more important question is if their client is open sourced, how can we trust that the binaries are made with exactly those sources? There should be a measure of testing it without the sources too, maybe sniffing packets to check for the encrypted content is a start.
    - mkal_tsr 12y ago
      https://github.com/SpiderOak https://github.com/SpiderOak || https://github.com/SpiderOak/nimbus.io https://github.com/SpiderOak/nimbus.io
    - Kryptor 12y ago
      Checking for encrypted packets wouldn't tell you anything about the binaries' trustworthiness. A back door might just encrypt the data with a second key, or more specifically, encrypt the key that encrypts the data with another key. A reliable way of testing binaries doesn't seem very feasible to me. It's like antivirus vendors trying to find new viruses: the malware authors can always obfuscate their code just a little more, do it just a little bit differently, and now it does the same thing while escaping detection. Authors of open source software who want to distribute trustable binaries should include instructions for how to reproduce the binary exactly from the source. A third party verifier could reproduce the binary, then publish a digital signature affirming that they reproduced it, allowing anyone who doesn't want to compile it to check with a trusted third party. But all of that is a moot point if the source code isn't being very carefully checked.
higherpurpose 12y ago
This is why we shouldn't touch online voting systems with a ten foot pole. Stuff like blockchain and next-gen/biometric auth systems give us some hope that in the future we can eventually have online voting for elections, but I'd still like it to be researched and tested for decades before such a system is implemented in a country.
- mkal_tsr 12y ago
  Just automate out the politicians, no greed nor corruption!
  - icegreentea 12y ago
    Then you can just game the algorithm directly. No need to fiddle with human intermediates.
    - mkal_tsr 12y ago
      Not if it's open-source (or at least, harder to game). All you gotta do is co-opt the "Read the Bills Act" with a requirement to video-record the congress-person reading the bill (as that becomes their affidavit). Make that open-source, and then it just starts bleeding out. Auto-upload that to an app where people could get speech-to-text transcription / notifications / annotate sections / review past laws being read by past congress-people / etc. From there, ensure all bills can be edited in a central and private repositories (probs git, erryone likes git, though svn treats me well), so that all final bills can have all individual contributions clearly marked/annotated automatically. Oh look, auto-matching bill-text with campaign contributions :-P. Code is law. Patch the corruption.
      - jqm 12y ago
        If automation can take away Joe Factory Workers' job it could take away his managers job as well. And even more important it could take away his governments job. I mean.. how much worse could it do?
- 12y ago
jjgreen 12y ago
The nasty and antidemocratic behaviour of GCHQ is, at last, losing them sympathy: http://golem.ph.utexas.edu/category/2014/03/should_mathematicians_cooperat.html http://golem.ph.utexas.edu/category/2014/03/should_mathemati...
lotsofmangos 12y ago
Of all the predictors of future dystopia, I think Asimov may be closest with the Foundation series in a weird kind of a way. I do wonder who the mule is though.
TomGullen 12y ago
It's a revolting program they are running. You can't even justify a lot of this stuff with "terrorism" or "national security". Manipulation of public opinion is simply a power play. These agencies are out of control and entirely untrustworthy. I feel entirely powerless about it all as well.
- orta 12y ago
  Don't vote for the big three. We've seen it with DRIP, and it will only get worse with time. Start getting active with the green party, or the pirate party UK. Both of their manifestos are about individual liberty over state surveillance: http://www.greenparty.org.uk/values/ http://www.greenparty.org.uk/values/ https://pirateparty.org.uk/policy https://pirateparty.org.uk/policy
  - pjc50 12y ago
    Or one of the regional parties on this convenient list of those who voted "no": http://anotherangryvoice.blogspot.co.uk/2014/07/51-mps-drip-emergency.html http://anotherangryvoice.blogspot.co.uk/2014/07/51-mps-drip-... SNP, Plaid, DUP, Alliance, SDLP.
- konstruktor 12y ago
  The "terrorism" and "national security" justifications aren't absolute either: They are, in the best case, a shorter way of saying "what the informed public considers the right balance between security and freedom". It's frightening if the same agencies that are given a lot of powers based on this are also manipulating public opinion.
- konstruktor 12y ago
  The "terrorism" and "national security" justifications aren't absolute either: They are, in the best case, a shorter way of saying "what the informed public considers the right balance between security and freedom". It's frightening if the same agencies that are given a lot of powers based on this are also manipulating public opinion.
canvia 12y ago
I wonder if upvotes and downvotes on news aggregation sites could be considered to be online polls.
zeristor 12y ago
So how come the UK does so badly in the Song for Europe contest then?
bayesianhorse 12y ago
Seriously, schoolchildren can manipulate online polls.....
- grey-area 12y ago
  Obviously defeating a naive online poll is trivial, but it is also trivial to detect. Presumably this software does it in untraceable ways - with a botnet of IPs from the country in question, with delays and stutter etc so that it is indistinguishable from real traffic. You should not underestimate the power of online actions in shaping opinion - for example if stories on a particular tech consistently made the top of HN, a significant no. of people would start thinking it was popular amongst this demographic. If a BBC or Daily Mail story which was a puff piece for GCHQ was consistently on the top of their 'most read' section, people would be far more exposed to that story over a given period. etc.
  - Torgo 12y ago
    Running completely gameable, "unscientific polls" should be considered journalistic malpractice. It was annoying and stupid before, continuing to do so going forward knowing that it will be abused by governments and hidden organizations to manufacture consent is unacceptable.
    - grey-area 12y ago
      This is in no way confined to polls. Almost every website has a voting component of some kind, be that measuring which stories are read most, allowing up/downvotes, Q&A or comment systems etc. It doesn't have to be a straightforward poll to be gamed. I think it would be better to address the malpractice by our governments than to blame journalists - if the gov. is sufficiently determined, and is given the funds to spend on it, they will find ways to distort online discourse. The UK has just increased funding for 'intelligence' (what an oxymoron) by £800 million, so you can expect more of this to come, and we should lay the blame where it belongs - with those agencies poisoning the well of online discussion.
  - bayesianhorse 12y ago
discostrings 12y ago
It would be incredibly easy to use this sort of program to game visibility on HN. This story itself serves as the perfect example. When it was submitted four days ago [0], it quickly took a huge ranking hit and dropped off the front page. When a story drops off the front page this quickly, it's nearly impossible for it to get the upvote momentum required to gain any additional visibility. And the same URL can't be submitted again, so the opportunity for discussion of the article has essentially been removed. Then, we're left discussing a breaking story as the top item four days later, when a summary report about the original story that contains no new information is published on Slate. One might be quick to blame moderators, but in the discussion of another recent First Look story, dang said most of the penalty came from users flagging the story. [1] How many users flagging the story does it take to produce this outcome? Does GCHQ just need three accounts with a little karma to seriously diminish visibility here for days? Safeguards should be developed to prevent this sort of malicious activity. Maybe some sort of collusion penalty, where if the same users are flagging the same stories, the effect is diminished? Or a greater restriction on the maximum penalty? [0] https://news.ycombinator.com/item?id=8031791 https://news.ycombinator.com/item?id=8031791 [1] https://news.ycombinator.com/item?id=8008472 https://news.ycombinator.com/item?id=8008472 EDIT: And it's happened again! This story was #1 when the link was to [3]. About a half hour ago, the link was changed to firstlook.org, and within minutes, the story fell to the center of the main page. Now, thirty minutes later, it's at number 47 (with 200 points after six hours). It was at the top for hours, then dropped to 47 within thirty minutes of the link being changed. The fact that flagging happened right after the link was changed seriously suggests that some someone has automated monitoring for First Look links to flag. [3] http://www.slate.com/blogs/future_tense/2014/07/15/documents_show_gchq_manipulating_online_information_like_web_polls_and_traffic.html http://www.slate.com/blogs/future_tense/2014/07/15/documents...
discostrings 12y ago
This story was in the first position on the front page less than an hour ago. It was there for hours. The link was then changed from [0] to [1], and within thirty minutes, it was on the second page at number 47. (It first took a drop to around 17, hovered there for a while, then hit 47.) Could we have an explanation of what's going on here? How can penalties from flagging be this steep for a story with 200 upvotes and 90 comments? Why did the position suddenly change shortly after the link was changed, but not right away? [0] http://www.slate.com/blogs/future_tense/2014/07/15/documents_show_gchq_manipulating_online_information_like_web_polls_and_traffic.html http://www.slate.com/blogs/future_tense/2014/07/15/documents... [1] https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/ https://firstlook.org/theintercept/2014/07/14/manipulating-o...

211 points by unclebucknasty 12y ago

mnem 12y ago

To be fair though, hasn't everyone who has started playing with HTTP in code manipulated online polls at some point just to learn? Does anyone actually put any weight in online polls other than linkbait headline sites?

ejr 12y ago
Well a significant percentage of HN folk certainly, but I doubt this translates well outside this sphere. I'm more alarmed by the email spoofing. Isn't this the same as manufacturing evidence? Consider: An entity is under surveillance, however the powers that be decide the scope is too limited. What better way to invite scrutiny than ensuring an email from the desired target arrives in the monitored entity's inbox?
kubiiii 12y ago
Apparently UK government does.
cma 12y ago
You realize you are asking this on a site which is basically a continuous online poll, right? :P
davb 12y ago
Consider online opinion polls around the Scottish independence debate. Whichever side you support, it's easy to recognise the political and democratic ramifications of an opinion poll being altered to reflect the current government's position.
- cmdkeen 12y ago
  Except there are plenty of real polls, being conducted by reputable polling companies, that people actually pay attention to. GCHQ aren't manipulating Scottish independence, they have plenty of Scottish staff, it would leak and that would be ammunition for the Nats.
tripzilch 12y ago
Of course. But that is nothing "to be fair" about. It's wrong to do so if you're a teenage hacker who just discovered scripting, and it's wrong to do so if you're a government. And the latter is IMO much worse than some teenage kid playing around because of scale, impact, accountability and the fact that, in a "democracy", the government should be influenced by the people and not the other way around.
- mnem 12y ago
  Really? It's wrong? By what measure? It's certainly not illegal to manipulate online polls. In fact, I personally find it quite amusing to do so, in certain cases. Do you agree? [ ] Yes [ ] No
  - tripzilch 12y ago
    I agree it can be amusing. I try to never conflate the meaning of the words "illegal" and "wrong", as they are rather orthogonal, even if many people do not realize this. And I think it's wrong (unethical) to do so for a multitude of reasons. Two main ones are because it's misleading to people reading/interpreting the results, and that it's actively trying to sabotage the intent of whoever set up the poll. Don't get me wrong though, if we're talking about a stupid or silly poll, on a stupid or silly site, or if it's in the context of a really good prank, etc, it can be a forgiveable type of "wrong". In fact in certain circumstances one could even argue that it's not actually completely wrong, simply because I wouldn't want to live with a system of ethics where pranks are never right. That's a tricky one (as is often the case with discussions about ethics). However, that's not really the type of manipulating of polls we were discussing here.
fnordfnordfnord 12y ago
>Does anyone actually put any weight in online polls... Yes, their "results" are often read on daily news broadcasts.

agd 12y ago

The original story (with more depth) is here https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/ https://firstlook.org/theintercept/2014/07/14/manipulating-o...

mc_hammer 12y ago
this title is clearly fud, this is a relabeling of the actual tech - the entire purpose of this is to manipulate forums and spread disinformation

richardmjohn 12y ago

"ANGRY PIRATE"? http://www.urbandictionary.com/define.php?term=angry+pirate http://www.urbandictionary.com/define.php?term=angry+pirate

SideburnsOfDoom 12y ago
The naming strategies are discussed here: http://www.theguardian.com/uk-news/shortcuts/2014/jul/16/what-gchq-geeky-misogynistic-code-names-tell-us http://www.theguardian.com/uk-news/shortcuts/2014/jul/16/wha...

pjc50 12y ago

Clearly they were losing the arms race with 4chan.

rayiner 12y ago

Online polls are worthless anyway. In high school, someone in our class hacked an online poll to win a contest to get Mandy Moore to perform at our school. NBD.

thomasahle 12y ago
Ever heard of "moving with the stream"? Everyone does that sometimes, as you have to pick your fights. If you can create a fake public consensus, you've basically changed the direction of the stream. Many people might even reevaluate their opinions if it seems that everyone else agrees on the opposite idea. It's pretty human.
- rayiner 12y ago
  Which is precisely why online polls are worthless. I wonder what sorts of results you'd get if you ran a poll about domestic surveillance on HN, Reddit, etc. You think that'd be a representative viewpoint? Who puts any stock in these sorts of poll results? Plus: if GCHQ can manipulate them, so can a whole bunch of other people...
  - badkungfu 12y ago
    Yes, they're worthless, but, anchoring effect.
coldtea 12y ago
>Online polls are worthless anyway It's not about their accuracy. It's about skewing them, so people perceive some opinion as "non mainstream" while it could even be the majority opinion.
- pjc50 12y ago
  Fanatical supporters are quite capable of doing this on their own. For example, UKIP supporters dominate the comments section and polls on the Telegraph, while making up about 10% of the population. (Yes, 30% of the vote in the Euro elections .. of a very low turnout)

eponeponepon 12y ago

> GATEWAY: “Ability to artificially increase traffic to a website.” Are they actually just talking about DDoS here? It seems an unusually euphemistic description if so, given how plin-spoken a lot of the previously published documents are. And if not, why would they want or need to increase traffic? I'm puzzled.

coldtea 12y ago
Some uses that come to mind: 1) increase traffic on articles that favor topic X (one the government likes). The publisher (owner of site) perceives it as public's interest, and adds more articles on X. 2) make some independent pro-government site appear more popular than it is. This could enabled ad money to come its way (including from state ad campaigns), as an indirect method of funding it.
meowface 12y ago
I think they mean things like artifical visitor inflation. For example, to make a Youtube video "viral" they could seed it with 30,000 fake views. Or, perhaps, they could mass upvote certain HN threads as soon as they're posted... Remember that intelligence agencies generally care more about exploitation (figuratively) and manipulation than attack.
beejiu 12y ago
Perhaps if you are a terrorist organisation using the Internet to spread propaganda, believing a particular medium is reaching a wide audience, you might be more inclined to continue publishing via that medium. Of course, all of the content falls directly into the laps of GCHQ and the NSA.
jameshart 12y ago
Create noise to mask specific human-directed activity?

cmsefton 12y ago

I didn't realize GCHQ was in the SEO game. If they released an online tool, they'll make a mint selling this to marketing agencies. Some examples: AIRWOLF - YouTube profile, comment and video collection BEARTRAP - Bulk retrieval of public BEBO profiles from member or group BIRDSONG - Automated posting of Twitter updates BIRDSTRIKE - Twitter monitoring and profile collection. BUGSY - Google+ collection (circles, profiles etc.) FATYAK - Public data collection from LinkedIn FUSEWIRE - Provides 24/7 monitoring of Vbulletin forums for target postings/online activity. Also allows staggered postings to be made. GODFATHER - Public data collection from Facebook GOODFELLA - Generic framework for public data collection from social networks. INSPECTOR - Tool for monitoring domain information and site availability RESERVOIR - Facebook application allowing collection of various information. GATEWAY - Ability to artificially increase traffic to a website GESTATOR - amplification of a given message, normally video, on popular multimedia websites (Youtube) SLIPSTREAM - ability to inflate page views on websites TANGLEFOOT - is a bulk search tool which queries a set of online resources. This allows analysts to quickly check the online presence of a target.

michaelt 12y ago
I always thought those incredibly awkward product names were chosen at random. Does this mean there are actual humans coming up with these things?
- dijit 12y ago
  oh, definitely, remember the "Anti-Crisis Girl" software[0] (screenshots leaked in Snowdens Revalations), an obvious nod to Svetlana Loboda's song[1] of the same name from Eurovision. The people crafting these things are people too, they go about daily life the same as we do, albeit in the firm belief they're doing it for the good of the people. [0] - http://leaksource.info/2014/02/19/anticrisis-girl-nsa-gchq-surveillance-of-wikileaks-and-human-network-that-supports-them/ http://leaksource.info/2014/02/19/anticrisis-girl-nsa-gchq-s... [1] - https://www.youtube.com/watch?v=iA-HL-EfUbI https://www.youtube.com/watch?v=iA-HL-EfUbI
- proofofconcept 12y ago
  I find that if I think of military/intelligence project names as being in part a form of marketing for which I am not the target demographic, and then imagine the sorts of people who are in that demographic, they make a whole lot more sense.

deleted 12y ago

[deleted]

mkal_tsr 12y ago

"Snowden: Dropbox is hostile to privacy, unlike 'zero knowledge' Spideroak" - http://www.theguardian.com/technology/2014/jul/17/edward-snowden-dropbox-privacy-spideroak http://www.theguardian.com/technology/2014/jul/17/edward-sno... and from https://firstlook.org/theintercept/document/2014/07/14/jtrig-tools-techniques/ https://firstlook.org/theintercept/document/2014/07/14/jtrig... under Honeypots we have, LONGSHOT - file-sharing and upload website. And Condoleezza Rice just got on their board. I haven't seen anything that makes an official link between those but at least I moved off Dropbox :-P

mikevm 12y ago
How can we trust SpiderOak when their client is not open sourced?
- makmanalp 12y ago
  I think the more important question is if their client is open sourced, how can we trust that the binaries are made with exactly those sources? There should be a measure of testing it without the sources too, maybe sniffing packets to check for the encrypted content is a start.
  - mkal_tsr 12y ago
    https://github.com/SpiderOak https://github.com/SpiderOak || https://github.com/SpiderOak/nimbus.io https://github.com/SpiderOak/nimbus.io
  - Kryptor 12y ago
    Checking for encrypted packets wouldn't tell you anything about the binaries' trustworthiness. A back door might just encrypt the data with a second key, or more specifically, encrypt the key that encrypts the data with another key. A reliable way of testing binaries doesn't seem very feasible to me. It's like antivirus vendors trying to find new viruses: the malware authors can always obfuscate their code just a little more, do it just a little bit differently, and now it does the same thing while escaping detection. Authors of open source software who want to distribute trustable binaries should include instructions for how to reproduce the binary exactly from the source. A third party verifier could reproduce the binary, then publish a digital signature affirming that they reproduced it, allowing anyone who doesn't want to compile it to check with a trusted third party. But all of that is a moot point if the source code isn't being very carefully checked.

higherpurpose 12y ago

This is why we shouldn't touch online voting systems with a ten foot pole. Stuff like blockchain and next-gen/biometric auth systems give us some hope that in the future we can eventually have online voting for elections, but I'd still like it to be researched and tested for decades before such a system is implemented in a country.

mkal_tsr 12y ago
Just automate out the politicians, no greed nor corruption!
- icegreentea 12y ago
  Then you can just game the algorithm directly. No need to fiddle with human intermediates.
  - mkal_tsr 12y ago
    Not if it's open-source (or at least, harder to game). All you gotta do is co-opt the "Read the Bills Act" with a requirement to video-record the congress-person reading the bill (as that becomes their affidavit). Make that open-source, and then it just starts bleeding out. Auto-upload that to an app where people could get speech-to-text transcription / notifications / annotate sections / review past laws being read by past congress-people / etc. From there, ensure all bills can be edited in a central and private repositories (probs git, erryone likes git, though svn treats me well), so that all final bills can have all individual contributions clearly marked/annotated automatically. Oh look, auto-matching bill-text with campaign contributions :-P. Code is law. Patch the corruption.
    - jqm 12y ago
      If automation can take away Joe Factory Workers' job it could take away his managers job as well. And even more important it could take away his governments job. I mean.. how much worse could it do?
12y ago

jjgreen 12y ago

The nasty and antidemocratic behaviour of GCHQ is, at last, losing them sympathy: http://golem.ph.utexas.edu/category/2014/03/should_mathematicians_cooperat.html http://golem.ph.utexas.edu/category/2014/03/should_mathemati...

lotsofmangos 12y ago

Of all the predictors of future dystopia, I think Asimov may be closest with the Foundation series in a weird kind of a way. I do wonder who the mule is though.

TomGullen 12y ago

It's a revolting program they are running. You can't even justify a lot of this stuff with "terrorism" or "national security". Manipulation of public opinion is simply a power play. These agencies are out of control and entirely untrustworthy. I feel entirely powerless about it all as well.

orta 12y ago
Don't vote for the big three. We've seen it with DRIP, and it will only get worse with time. Start getting active with the green party, or the pirate party UK. Both of their manifestos are about individual liberty over state surveillance: http://www.greenparty.org.uk/values/ http://www.greenparty.org.uk/values/ https://pirateparty.org.uk/policy https://pirateparty.org.uk/policy
- pjc50 12y ago
  Or one of the regional parties on this convenient list of those who voted "no": http://anotherangryvoice.blogspot.co.uk/2014/07/51-mps-drip-emergency.html http://anotherangryvoice.blogspot.co.uk/2014/07/51-mps-drip-... SNP, Plaid, DUP, Alliance, SDLP.
konstruktor 12y ago
The "terrorism" and "national security" justifications aren't absolute either: They are, in the best case, a shorter way of saying "what the informed public considers the right balance between security and freedom". It's frightening if the same agencies that are given a lot of powers based on this are also manipulating public opinion.
konstruktor 12y ago
The "terrorism" and "national security" justifications aren't absolute either: They are, in the best case, a shorter way of saying "what the informed public considers the right balance between security and freedom". It's frightening if the same agencies that are given a lot of powers based on this are also manipulating public opinion.

canvia 12y ago

I wonder if upvotes and downvotes on news aggregation sites could be considered to be online polls.

zeristor 12y ago

So how come the UK does so badly in the Song for Europe contest then?

bayesianhorse 12y ago

Seriously, schoolchildren can manipulate online polls.....

grey-area 12y ago
Obviously defeating a naive online poll is trivial, but it is also trivial to detect. Presumably this software does it in untraceable ways - with a botnet of IPs from the country in question, with delays and stutter etc so that it is indistinguishable from real traffic. You should not underestimate the power of online actions in shaping opinion - for example if stories on a particular tech consistently made the top of HN, a significant no. of people would start thinking it was popular amongst this demographic. If a BBC or Daily Mail story which was a puff piece for GCHQ was consistently on the top of their 'most read' section, people would be far more exposed to that story over a given period. etc.
- Torgo 12y ago
  Running completely gameable, "unscientific polls" should be considered journalistic malpractice. It was annoying and stupid before, continuing to do so going forward knowing that it will be abused by governments and hidden organizations to manufacture consent is unacceptable.
  - grey-area 12y ago
    This is in no way confined to polls. Almost every website has a voting component of some kind, be that measuring which stories are read most, allowing up/downvotes, Q&A or comment systems etc. It doesn't have to be a straightforward poll to be gamed. I think it would be better to address the malpractice by our governments than to blame journalists - if the gov. is sufficiently determined, and is given the funds to spend on it, they will find ways to distort online discourse. The UK has just increased funding for 'intelligence' (what an oxymoron) by £800 million, so you can expect more of this to come, and we should lay the blame where it belongs - with those agencies poisoning the well of online discussion.
- bayesianhorse 12y ago

discostrings 12y ago

It would be incredibly easy to use this sort of program to game visibility on HN. This story itself serves as the perfect example. When it was submitted four days ago [0], it quickly took a huge ranking hit and dropped off the front page. When a story drops off the front page this quickly, it's nearly impossible for it to get the upvote momentum required to gain any additional visibility. And the same URL can't be submitted again, so the opportunity for discussion of the article has essentially been removed. Then, we're left discussing a breaking story as the top item four days later, when a summary report about the original story that contains no new information is published on Slate. One might be quick to blame moderators, but in the discussion of another recent First Look story, dang said most of the penalty came from users flagging the story. [1] How many users flagging the story does it take to produce this outcome? Does GCHQ just need three accounts with a little karma to seriously diminish visibility here for days? Safeguards should be developed to prevent this sort of malicious activity. Maybe some sort of collusion penalty, where if the same users are flagging the same stories, the effect is diminished? Or a greater restriction on the maximum penalty? [0] https://news.ycombinator.com/item?id=8031791 https://news.ycombinator.com/item?id=8031791 [1] https://news.ycombinator.com/item?id=8008472 https://news.ycombinator.com/item?id=8008472 EDIT: And it's happened again! This story was #1 when the link was to [3]. About a half hour ago, the link was changed to firstlook.org, and within minutes, the story fell to the center of the main page. Now, thirty minutes later, it's at number 47 (with 200 points after six hours). It was at the top for hours, then dropped to 47 within thirty minutes of the link being changed. The fact that flagging happened right after the link was changed seriously suggests that some someone has automated monitoring for First Look links to flag. [3] http://www.slate.com/blogs/future_tense/2014/07/15/documents_show_gchq_manipulating_online_information_like_web_polls_and_traffic.html http://www.slate.com/blogs/future_tense/2014/07/15/documents...

discostrings 12y ago

This story was in the first position on the front page less than an hour ago. It was there for hours. The link was then changed from [0] to [1], and within thirty minutes, it was on the second page at number 47. (It first took a drop to around 17, hovered there for a while, then hit 47.) Could we have an explanation of what's going on here? How can penalties from flagging be this steep for a story with 200 upvotes and 90 comments? Why did the position suddenly change shortly after the link was changed, but not right away? [0] http://www.slate.com/blogs/future_tense/2014/07/15/documents_show_gchq_manipulating_online_information_like_web_polls_and_traffic.html http://www.slate.com/blogs/future_tense/2014/07/15/documents... [1] https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/ https://firstlook.org/theintercept/2014/07/14/manipulating-o...