subject:"Re\: \[liberationtech\] Boundless Informant\: the NSA's secret tool to track global surveillance data"

Re: [liberationtech] Boundless Informant: the NSA's secret tool to track global surveillance data

2013-06-17 Thread Rich Kulawiec

On Sun, Jun 09, 2013 at 10:11:08AM -0400, Nadim Kobeissi wrote:
 On 2013-06-09, at 10:08 AM, Rich Kulawiec r...@gsp.org wrote:
  Second: stupidity, in all forms, fully deserves to be slapped down --
 
 This is where I stop reading.

I have to admit, even though I've read this half a dozen times,
I don't get it.  I tried coffee.  Nope.  I tried scotch.  Nope.
I tried staring at the clouds.  Nope.

So let me try explaining my take on it.

We're not playing around here.  There are people out there reading
this list and trying to figure out how to use technology to fight
human rights abuses, stop wars, reveal corruption, etc.  And they're
opposed, in many cases, by very smart very nasty very ruthless people
who will not hesitate to threaten, kidnap, torture and kill anyone
they perceive as a credible threat.

The advice we hand out here, the technology we create, may be the
difference in keeping the former group safe from the latter.

So if one of us makes a mistake, then we all need to know.  If I recommend
bad crypto because I don't know any better, *someone* had better smack
the crap out of me as quickly as possible before someone else makes the
mistake of listening to me.  I'll get over the momentary embarrassment:
heck, I make enough mistakes in an average day that I've gotten pretty
used to it.  I won't get over knowing that my error cost someone else dearly.

We owe that to all the people who are in the field trying to make this
world a better place.  We need to be as right as we can be, with our
limited knowledge and human propensity for mistakes.  And we need to not
worry about *who's* right or *how* they're right, because once we've
rid the world of poverty and starvation and disease and bigotry and
prejudice and violence and ignorance and superstition and repression,
then we'll have plenty of time to sit around and philosophically
debate the fine points of who should get which credit for what part of
the glorious and peaceful new reality.

Also there will be scotch.  Really, really good scotch. ;-)

So yes, stupidity SHOULD be slapped down.  So should ignorance,
superstition, prejudice, bigotry, and all of the other negative things
that -- during all of recorded human history and likely before --
have been the tools of tyrants and dictators.  Empires come and go,
political structures become fashionable and then fade away, the names
and places change constantly...but *these* things are the constant
enemy.  If we are to overcome them in those we oppose -- we must
first overcome them in ourselves.

---rsk

--
Too many emails? Unsubscribe, change to digest, or change password by emailing 
moderator at compa...@stanford.edu or changing your settings at 
https://mailman.stanford.edu/mailman/listinfo/liberationtech

Re: [liberationtech] Boundless Informant: the NSA's secret tool to track global surveillance data

2013-06-17 Thread Brian Conley

Hold on...
On Jun 11, 2013 12:27 AM, Yosem Companys compa...@stanford.edu wrote:

snip The distinction between direct or indirect access is semantic, not
substantive, and likely irrelevant to most Americans. snip

And then...

 As I said, a recent NY Times article spoke specifically of the embedding
of NSA employees at US tech firms via firms' corporate legal departments,
and we know how it happened at ATT, with the employee getting cart blanche
to do whatever he wanted at the firm and take as much data as he wanted
with no questions asked.

highlight  we know how it happened at ATT, with the employee getting
cart blanche to do whatever he wanted
snip

That's not substantively different from a FISC finding being issued in each
case? *that * is EXACTLY the difference between direct and indirect and it
IS substantive.

This ATT issue involved an individual being trusted solely to do the
right thing. Whether we like it or not, an FISC ruling is a big
difference, even if is not public, for the individual being monitored by a
stalker ex, for example.

Indirect access doesn't make it more acceptable, but direct could and
should make it LESS.

 On Mon, Jun 10, 2013 at 3:09 PM, Jacob Appelbaum ja...@appelbaum.net
wrote:

 x z:
  @Jacob, I agree with your points regarding American exceptionalism.
  @Eugen, to prepare for the worst scenario is one thing, to advocate
some
  shady rumor as fact is another.
  @Rich, those are good movie scripts :-). But it does not work for 9
firms,
  and hundreds of execs all with diverse values and objectives.
  @Nadim, when you say we all always 'knew' this was happening, I don't
  know what this refers to. Is it NSA surveillance, or is it the
direct
  access bit?
 
  To me, the crucial point is the *direct access*, and also Guardian's
  claim of these firms willingly participating in PRISM. I argued that
  direct access is untrue in my previous email, but none of your
replies
  (except Rich's) are relevant to my arguments.

 What would you call a FISA API for government agents to query a system
 and return data on a target? Would you call that direct access or an
 indirect access? If Google runs the FISA API server, does that make it
 more or less direct than if the FISA API server is a blackbox run by the
 NSA?

 
  The direct access bit is what made this story sensational. Without
this
  bit, the story would be much less juicy but more true. In the long run,
  truth gives more power than lies. Washington Post has backed down to
  reality, for which I applaud their judgment. Guardian has not, and
keeps on
  defending their misinformation and bad reporting, for which I resent
deeply.
 

 You don't know the truth and you seem to think you do. The story that is
 important is that Google makes one claim, while the NSA slide makes
 another. Note that the law doesn't allow Google to even tell the press
 the whole truth.

  If Snowden and Greenwald do not mislead the world on 'direct access
and
  just report it rationally, I'd applaud their courage. Now I think
Snowden
  is not more than a self-aggrandizing douche.
 

 I'm sorry, did you watch his video interview? On what grounds to you
 call him a self-aggrandizing douche exactly?

  I hope internet freedom can advance with accurate awareness, not by
public
  paranoia.

 You take issue with a very weird semantic bit of the larger story. How
 does such semantic nitpicking, where you don't actually even know the
 facts behind your speculations, help advance any cause, anywhere?

 All the best,
 Jacob
 --
 Too many emails? Unsubscribe, change to digest, or change password by
emailing moderator at compa...@stanford.edu or changing your settings at
https://mailman.stanford.edu/mailman/listinfo/liberationtech



 --
 Too many emails? Unsubscribe, change to digest, or change password by
emailing moderator at compa...@stanford.edu or changing your settings at
https://mailman.stanford.edu/mailman/listinfo/liberationtech
--
Too many emails? Unsubscribe, change to digest, or change password by emailing 
moderator at compa...@stanford.edu or changing your settings at 
https://mailman.stanford.edu/mailman/listinfo/liberationtech

Re: [liberationtech] Boundless Informant: the NSA's secret tool to track global surveillance data

2013-06-17 Thread Jacob Appelbaum

Rich Kulawiec:
 On Sun, Jun 09, 2013 at 10:11:08AM -0400, Nadim Kobeissi wrote:
 On 2013-06-09, at 10:08 AM, Rich Kulawiec r...@gsp.org wrote:
 Second: stupidity, in all forms, fully deserves to be slapped down --

 This is where I stop reading.
 
 I have to admit, even though I've read this half a dozen times,
 I don't get it.  I tried coffee.  Nope.  I tried scotch.  Nope.
 I tried staring at the clouds.  Nope.
 
 So let me try explaining my take on it.

Lets reword it - rather than stupidity - lets rephrase it 'illiteracy' -
and rather than slapped down, lets be more direct: we should work
tirelessly to raise consciousness about this illiteracy, to improve
literacy for every person on the planet.

 
 We're not playing around here.  There are people out there reading
 this list and trying to figure out how to use technology to fight
 human rights abuses, stop wars, reveal corruption, etc.  And they're
 opposed, in many cases, by very smart very nasty very ruthless people
 who will not hesitate to threaten, kidnap, torture and kill anyone
 they perceive as a credible threat.
 

I met a woman today in Tunis who told me that this is her concern - that
she will be kidnapped and killed as a result of surveillance. She asked
me to evaluate her current work flow and when I did so, I showed her
what I could capture, what others can likely capture and what could be
done with the data. She nearly started to cry while I dryly explained
the vulnerabilities in using a network under heavy surveillance, about
the privacy concerns presented by GSM/UTMS and about the kind of malware
specifically known to be deployed against her friends.

What do we do?

People understand the stakes - we can also appraoch this in a way that
is more humble. It is hard at times because many of us, myself included,
simply screw this humility up. We should strive to have humility and to
improve things for those who are open to it.

There is a flip side - there are people, people on this list even, where
they refuse to acknowledge reality. Those people fought obvious
realities about Skype, about Google, about even Twitter - each company
has different issues, obviously. However, none of them are actually
secure in a meaningful sense.

 The advice we hand out here, the technology we create, may be the
 difference in keeping the former group safe from the latter.
 

I agree. This is not to be taken lightly. At the same time - we must not
be so angry, we must not be so loud and rude, we must try to welcome the
people who are just now realizing many of us were right for a decade.
For a decade and for some, two decades many of us looked like crazy
people. We no longer look like crazy people. Now, we must work very
hard, very smartly to not screw this up - people care and people want to
make changes. Now is our time to shine - now is our time to really help,
to really help bring policy and technology in line - we should not screw
up this opportunity.

 So if one of us makes a mistake, then we all need to know.  If I recommend
 bad crypto because I don't know any better, *someone* had better smack
 the crap out of me as quickly as possible before someone else makes the
 mistake of listening to me.  I'll get over the momentary embarrassment:
 heck, I make enough mistakes in an average day that I've gotten pretty
 used to it.  I won't get over knowing that my error cost someone else dearly.
 

You will, others won't. This is fragile. I understand that someone
giving bad advice should be clearly and firmly told the facts that are
known, or the risks of being dead wrong. It can be done in a way that
won't drive people away.

 We owe that to all the people who are in the field trying to make this
 world a better place.  We need to be as right as we can be, with our
 limited knowledge and human propensity for mistakes.  And we need to not
 worry about *who's* right or *how* they're right, because once we've
 rid the world of poverty and starvation and disease and bigotry and
 prejudice and violence and ignorance and superstition and repression,
 then we'll have plenty of time to sit around and philosophically
 debate the fine points of who should get which credit for what part of
 the glorious and peaceful new reality.
 
 Also there will be scotch.  Really, really good scotch. ;-)
 
 So yes, stupidity SHOULD be slapped down.  So should ignorance,
 superstition, prejudice, bigotry, and all of the other negative things
 that -- during all of recorded human history and likely before --
 have been the tools of tyrants and dictators.  Empires come and go,
 political structures become fashionable and then fade away, the names
 and places change constantly...but *these* things are the constant
 enemy.  If we are to overcome them in those we oppose -- we must
 first overcome them in ourselves.

It should be done with kindness and compassion whenever possible. It is
almost always possible, it is however sometimes very difficult.
Understandably but still, we should

Re: [liberationtech] Boundless Informant: the NSA's secret tool to track global surveillance data

2013-06-11 Thread Eugen Leitl

On Mon, Jun 10, 2013 at 10:27:33PM +0200, Guido Witmond wrote:

 The big deal is that now it's become impossible to believe the lies, and
 that you [Americans] are forced to accept the truth.

Reality check: https://twitter.com/_nothingtohide

http://www.people-press.org/2013/06/10/majority-views-nsa-phone-tracking-as-acceptable-anti-terror-tactic/

No further questions, your honor.
 
 And truth hurts! Especially when you want to believe the lies. Wanting
 to believe is easier than facing the truth, even when deep in your heart
 you've known the truth for a long time.
 
 Now is the time to come clear with your conscience, end this abusive
 relationship and kick the abusive partner out of your life. (ie: repeal
 the unjust laws.)

Realistically, we should be thankful for this brief
flash of interest (already waning) and use it to reignite
interest in stalled projects.
--
Too many emails? Unsubscribe, change to digest, or change password by emailing 
moderator at compa...@stanford.edu or changing your settings at 
https://mailman.stanford.edu/mailman/listinfo/liberationtech

Re: [liberationtech] Boundless Informant: the NSA's secret tool to track global surveillance data

2013-06-11 Thread michael gurstein

Sad but I guess true, but there has been a huge amount of learning from this
particularly internationally and the reverberations on that will continue
and perhaps even grow for a very very long time.

M

-Original Message-
From: liberationtech-boun...@lists.stanford.edu
[mailto:liberationtech-boun...@lists.stanford.edu] On Behalf Of Eugen Leitl
Sent: Tuesday, June 11, 2013 6:21 AM
To: liberationtech@lists.stanford.edu
Subject: Re: [liberationtech] Boundless Informant: the NSA's secret tool to
track global surveillance data

On Mon, Jun 10, 2013 at 10:27:33PM +0200, Guido Witmond wrote:

 The big deal is that now it's become impossible to believe the lies, 
 and that you [Americans] are forced to accept the truth.

Reality check: https://twitter.com/_nothingtohide

http://www.people-press.org/2013/06/10/majority-views-nsa-phone-tracking-as-
acceptable-anti-terror-tactic/

No further questions, your honor.
 
 And truth hurts! Especially when you want to believe the lies. Wanting 
 to believe is easier than facing the truth, even when deep in your 
 heart you've known the truth for a long time.
 
 Now is the time to come clear with your conscience, end this abusive 
 relationship and kick the abusive partner out of your life. (ie: 
 repeal the unjust laws.)

Realistically, we should be thankful for this brief flash of interest
(already waning) and use it to reignite interest in stalled projects.
--
Too many emails? Unsubscribe, change to digest, or change password by
emailing moderator at compa...@stanford.edu or changing your settings at
https://mailman.stanford.edu/mailman/listinfo/liberationtech

--
Too many emails? Unsubscribe, change to digest, or change password by emailing 
moderator at compa...@stanford.edu or changing your settings at 
https://mailman.stanford.edu/mailman/listinfo/liberationtech

Re: [liberationtech] Boundless Informant: the NSA's secret tool to track global surveillance data

2013-06-11 Thread Rich Kulawiec

On Mon, Jun 10, 2013 at 01:48:23PM -0700, x z wrote:
 @Rich, those are good movie scripts :-). But it does not work for 9 firms,
 and hundreds of execs all with diverse values and objectives.

Two responses.

hundreds?  Not necessary.  Not desirable, from the NSA's point of view,
either.  One person per firm would suffice, and they need not be an executive.
Surely you can't think for a moment that the NSA is incapable of placing
its own people on the datacenter staff of any major operation?

Second, how's this for a movie script?

(quoting myself)

 Ad I'd also, by the way, develop custom lookalike hardware.  (With
 the NSA's budget, this could be done with chump change.)  Who's going to
 open up a Cisco router and yank a board and look at it closely enough
 to figure out that it didn't come from Cisco?

Now quoting this (h/t to Rob Slade):


http://www.scribd.com/doc/95282643/Backdoors-Embedded-in-DoD-Microchips-From-China

This paper is a short summary of the first real world detection
of a backdoor in a military grade FPGA.  Using an innovative
patented technique we were able to detect and analyse in the
first documented case of its kind, a backdoor inserted into the
Actel/Microsemi ProASIC3 chips. The backdoor was found to exist
on the silicon itself, it was not present in any firmware loaded
onto the chip. Using Pipeline Emission Analysis (PEA), a
technique pioneered by our sponsor, we were able to extract
the secret key to activate the backdoor. This way an attacker
can disable all the security on the chip, reprogram crypto and
access keys, modify low-level silicon features, access unencrypted
configuration bitstream or permanently damage the device. Clearly
this means the device is wide open to intellectual property theft,
fraud, re-programming as well as reverse engineering of the design
which allows the introduction of a new backdoor or Trojan. Most
concerning, it is not possible to patch the backdoor in chips
already deployed, meaning those using this family of chips have
to accept the fact it can be easily compromised or it will have
to be physically replaced after a redesign of the silicon itself.

---rsk

--
Too many emails? Unsubscribe, change to digest, or change password by emailing 
moderator at compa...@stanford.edu or changing your settings at 
https://mailman.stanford.edu/mailman/listinfo/liberationtech

Re: [liberationtech] Boundless Informant: the NSA's secret tool to track global surveillance data

2013-06-11 Thread Guido Witmond

On 11-06-13 12:21, Eugen Leitl wrote:

On Mon, Jun 10, 2013 at 10:27:33PM +0200, Guido Witmond wrote:

The big deal is that now it's become impossible to believe the lies, and
that you [Americans] are forced to accept the truth.

Reality check: https://twitter.com/_nothingtohide

http://www.people-press.org/2013/06/10/majority-views-nsa-phone-tracking-as-acceptable-anti-terror-tactic/

No further questions, your honor.

1st step to recovery is denial...

However, the question of Pew Research (in that second link) is not
fair: Which is more important?
A. Investigate terrorist threats;
(or) B. Not intrude on privacy (of the general public)

There is a third choice:
C. Investigate terrorist threats AND not intrude on privacy (of the
general public). We pay you people $X Billion dollars to do so.

I tend to agree with Lauren Weinsteins opinion that it is rampant
paranoia that lead us (the world) into this.

http://lauren.vortex.com/archive/001044.html

Realistically, we should be thankful for this brief
flash of interest (already waning) and use it to reignite
interest in stalled projects.

I am very grateful for mr Snowden and Greenwald to leak this. Now it is
ok for EU-commissioner mrv Viviane Reding to state that privavcy isn't a
luxury but a right.

Regards, Guido.

PS: Check out the background picture on that twitter-page, sheep!

Re: [liberationtech] Boundless Informant: the NSA's secret tool to track global surveillance data

2013-06-10 Thread Rich Kulawiec

On Mon, Jun 10, 2013 at 01:30:19AM -0700, x z wrote:
 First of all, I don't feel offended by Jacob's reply to my email at all,
 probably because I know and expect his style of wording. So far I think the
 discussion is still pretty civil.

I concur.  This is what spirited discussion looks like.  It's healthy.

Let's dig in.

 - The PRISM slides do not prove such direct access (as we interpret it)
 exists.  [snip]

You're correct.   To take your point further, they don't prove *anything*,
they...well, for lack of a better word, they indicate.  They point in
a general direction, omitting significant details -- which is of course
why we're debating just what those details are.

But, that said: the NSA (and every other similar agency) has a long
history of engineering for their convenience over engineering for due
process and safeguards.  And certainly direct access is far more convenient
for them than multistep processes.  So I think it's pretty safe to say
that the NSA would very much *like* direct access if they can get it.
Which leaves us with the question of whether or not they have.  Yet.

 - The firms (Apple, Google, Facebook, etc) do not have any incentive to
 participate in such a program to offer direct access to NSA.

A, but I think they do.  There's a message I noticed on this list
this morning, which was forwarded from Dave Farber's excellent IP
(Interesting People) mailing list and explains one such incentive:


https://mailman.stanford.edu/pipermail/liberationtech/2013-June/008815.html

 Then, what kind of power do people think NSA possesses that
 can secretly coerce these firms into cooperation?? 

That kind of power.  (see link, just above).  To paraphrase an old
saying, you can get much more with a kind word and a hide nailed to
the wall than you can with just a kind word.

 Will these firm's CEO or Chief Legal Officer go to jail, for not providing
 direct access?

Maybe.  See above.  But jail is not the only possible unhappy outcome.
There are other kinds of pressure that can be brought to bear as well.

Consider the set S of {all Cxx executives at all the tech companies
mentioned so far plus the ones involved but not yet mentioned}.

Now consider the number N of members of set S who (a) are in financial
difficulty (b) have a monkey on their back (c) have something in their
past (d) did something dubious on their tax returns (e) failed to disclose
something to the SEC (f) etc.

As the size of set S increases, the probability that N=0 decreases.
And whatever N is, it provides N opportunities for leverage.

I think it's also safe to say that some of those people would do it
merely because they're asked: it appeals to their sense of patriotism.
We might argue that this is wrong, that it violates the Constitution and
thus is about as unpatriotic as it's possible to be; but they would not
agree with us.

And there's another approach: large companies like this are very
sensitive to bad press, or even the possibility of bad press.
None of them want any part of this potential future story:

US law enforcement: we could have stopped [name of future
attack], but Internet giant Blah, Inc. wouldn't cooperate.

Yeah, that's a longshot, but to risk-averse Cxx people, it might be
enough of a nonzero probability to convince them.  (And there's
already a long history of blame the Internet narratives, so it
would dovetail nicely.)  Blah, Inc.'s stock would drop a kazillion
points in the minutes after that story broke and thus so would the
personal fortunes of many.  Then there would follow recriminations
and the blame game, board meetings and firings, and in the end,
suitably obedient people would be put in place to make sure that
it never happened again.

 - If all these participating firms have built such a system to feed NSA's
 request automatically, many people would have got involved. This is not a
 trivial task, the executives need to find engineers to make it happen. And
 the number of engineers won't be small, given the diversity of data
 mentioned here. 

I think this is the strongest argument in support of your proposition.
I've spent some time over the past few days trying to figure out how
this could be done and haven't yet figured out a method that would be
likely to succeed.

On the other hand, the NSA has had years, billions of dollars, and
thousands of people to throw at the problem, so if a solution within
those constraints exists, they're far more likely to have found it
than I'll ever be.

But let me requote something you wrote:

[...] the executives need to find engineers to make it happen.

Not if the executives weren't involved.

The NSA *could* go directly to the NOC engineers, for example, and
there are certain advantages to doing so: for one, these are people
with a lot less wealth and power, thus perhaps more readily manipulated.
For another, these are the people who actually need to do the work --
unlike the Cxx-level people who don't need to be

Re: [liberationtech] Boundless Informant: the NSA's secret tool to track global surveillance data

2013-06-10 Thread Maxim Kammerer

On Mon, Jun 10, 2013 at 12:01 PM, x z xhzh...@gmail.com wrote:
 Occam's razor would give us the following is what has actually happened in
 the past three days: a semi-clueless whistle blower fed an overzealous
 journalist a low-quality powerpoint deck, which met the privacy-paranoia and
 exploded.

I agree. I also don't understand what's the big deal. It is well-known
that the NSA (with cooperation with SIGINT agencies of other
countries) scans all communication channels it can get to. By reaching
popular communication methods like webmail and social media, it is
just doing its job. What apparently is at the core of the hysterical
public reaction is that the NSA spies on Americans, who think that
they are special, and should be treated differently. The reason they
think they are special is that the huge geopolitical / economic /
military-industrial complex influence of the United States elevates
and accustoms them to a position that's completely out of proportion
with their actual value to the world — utterly un-democratic, if you
think about it. Well, your spy agencies are more democratic than you
guys — they spy on you, too. If that wouldn't have been the case, it
would mean that your military-industrial complex is not that powerful,
which would imply that you are not special anymore, which, ironically,
rejects the original premise. Hopefully someone else can appreciate
the irony as well (hence writing this).

--
Maxim Kammerer
Liberté Linux: http://dee.su/liberte
--
Too many emails? Unsubscribe, change to digest, or change password by emailing 
moderator at compa...@stanford.edu or changing your settings at 
https://mailman.stanford.edu/mailman/listinfo/liberationtech

Re: [liberationtech] Boundless Informant: the NSA's secret tool to track global surveillance data

2013-06-10 Thread Jacob Appelbaum

Maxim Kammerer:
 On Mon, Jun 10, 2013 at 12:01 PM, x z xhzh...@gmail.com wrote:
 Occam's razor would give us the following is what has actually happened in
 the past three days: a semi-clueless whistle blower fed an overzealous
 journalist a low-quality powerpoint deck, which met the privacy-paranoia and
 exploded.
 
 I agree. I also don't understand what's the big deal. It is well-known
 that the NSA (with cooperation with SIGINT agencies of other
 countries) scans all communication channels it can get to. By reaching
 popular communication methods like webmail and social media, it is
 just doing its job. What apparently is at the core of the hysterical
 public reaction is that the NSA spies on Americans, who think that
 they are special, and should be treated differently. The reason they
 think they are special is that the huge geopolitical / economic /
 military-industrial complex influence of the United States elevates
 and accustoms them to a position that's completely out of proportion
 with their actual value to the world — utterly un-democratic, if you
 think about it. Well, your spy agencies are more democratic than you
 guys — they spy on you, too. If that wouldn't have been the case, it
 would mean that your military-industrial complex is not that powerful,
 which would imply that you are not special anymore, which, ironically,
 rejects the original premise. Hopefully someone else can appreciate
 the irony as well (hence writing this).

Occam's razor doesn't work the way that it is presented here. All things
being equal, the multi-billion dollar spy agency really does the spying
and it was really just revealed.

And yes, it really does shatter the idea American exceptionalism - that
is actually the best part of the entire discussion. Americans need this
wakeup call - with our drone strikes that kill people based on their
metadata (eg: signature strikes) surveillance programs and with our
death camp (eg: Gitmo) in Cuba. We as a nation should be ashamed of
these things and the first step to such shame is the inability to deny
what is being done in our name.

It is now the case that it is impossible to deny the dragnet
surveillance order published about Verizon. Our leaders have
acknowledged it. It is also impossible to deny the massive surveillance
as a whole - the DNI, the White House and other agencies have confirmed
it. It is also now impossible to deny the existence of specific programs
named UPSTREAM, PRISM and BOUNDLESSINFORMANT.

The open questions are merely about scope. In time, we'll learn the
details - but we need not debate that this is just the tip of the
iceberg - it is obviously the case that we don't have all the details.

To attack Glenn and Snowden is pointless. Without a doubt, if anyone
knows less than them - it is all of us. Unless you hold a TS/SCI
clearance, of course. In which case, please do feel free to speak up -
we'd love to hear some clarifications on the matter! Though overall - we
should all be speaking up - but lets be clear that not all voices here
have access to the same information, or the same understanding even when
presented with the same information.

All the best,
Jacob
--
Too many emails? Unsubscribe, change to digest, or change password by emailing 
moderator at compa...@stanford.edu or changing your settings at 
https://mailman.stanford.edu/mailman/listinfo/liberationtech

Re: [liberationtech] Boundless Informant: the NSA's secret tool to track global surveillance data

2013-06-10 Thread Guido Witmond


On 10-06-13 21:36, Jacob Appelbaum wrote:

Maxim Kammerer:

On Mon, Jun 10, 2013 at 12:01 PM, x zxhzh...@gmail.com  wrote:

Occam's razor would give us the following is what has actually
happened in the past three days: a semi-clueless whistle blower
fed an overzealous journalist a low-quality powerpoint deck,
which met the privacy-paranoia and exploded.


I agree. I also don't understand what's the big deal.


The big deal is that now it's become impossible to believe the lies, and
that you [Americans] are forced to accept the truth.

And truth hurts! Especially when you want to believe the lies. Wanting
to believe is easier than facing the truth, even when deep in your heart
you've known the truth for a long time.

Now is the time to come clear with your conscience, end this abusive
relationship and kick the abusive partner out of your life. (ie: repeal
the unjust laws.)


Cheers, Guido.
--
Too many emails? Unsubscribe, change to digest, or change password by emailing 
moderator at compa...@stanford.edu or changing your settings at 
https://mailman.stanford.edu/mailman/listinfo/liberationtech

Re: [liberationtech] Boundless Informant: the NSA's secret tool to track global surveillance data

2013-06-10 Thread Griffin Boyce

Nadim Kobeissi na...@nadim.cc wrote:

 What qualifies a journalist as overzealous? Is it passion and hard work?
 When this passion produces a consistent stream of intelligent arguments and
 debate, is it still overzealous? Ask yourself these questions.


I don't think Glenn Greenwald is overzealous, but I think his passion is...
untempered at times.  Not a bad thing at all.  But not everyone's going to
like his work.

~Griffin
--
Too many emails? Unsubscribe, change to digest, or change password by emailing 
moderator at compa...@stanford.edu or changing your settings at 
https://mailman.stanford.edu/mailman/listinfo/liberationtech

Re: [liberationtech] Boundless Informant: the NSA's secret tool to track global surveillance data

2013-06-10 Thread Jacob Appelbaum

x z:
 @Jacob, I agree with your points regarding American exceptionalism.
 @Eugen, to prepare for the worst scenario is one thing, to advocate some
 shady rumor as fact is another.
 @Rich, those are good movie scripts :-). But it does not work for 9 firms,
 and hundreds of execs all with diverse values and objectives.
 @Nadim, when you say we all always 'knew' this was happening, I don't
 know what this refers to. Is it NSA surveillance, or is it the direct
 access bit?
 
 To me, the crucial point is the *direct access*, and also Guardian's
 claim of these firms willingly participating in PRISM. I argued that
 direct access is untrue in my previous email, but none of your replies
 (except Rich's) are relevant to my arguments.

What would you call a FISA API for government agents to query a system
and return data on a target? Would you call that direct access or an
indirect access? If Google runs the FISA API server, does that make it
more or less direct than if the FISA API server is a blackbox run by the
NSA?

 
 The direct access bit is what made this story sensational. Without this
 bit, the story would be much less juicy but more true. In the long run,
 truth gives more power than lies. Washington Post has backed down to
 reality, for which I applaud their judgment. Guardian has not, and keeps on
 defending their misinformation and bad reporting, for which I resent deeply.
 

You don't know the truth and you seem to think you do. The story that is
important is that Google makes one claim, while the NSA slide makes
another. Note that the law doesn't allow Google to even tell the press
the whole truth.

 If Snowden and Greenwald do not mislead the world on 'direct access and
 just report it rationally, I'd applaud their courage. Now I think Snowden
 is not more than a self-aggrandizing douche.
 

I'm sorry, did you watch his video interview? On what grounds to you
call him a self-aggrandizing douche exactly?

 I hope internet freedom can advance with accurate awareness, not by public
 paranoia.

You take issue with a very weird semantic bit of the larger story. How
does such semantic nitpicking, where you don't actually even know the
facts behind your speculations, help advance any cause, anywhere?

All the best,
Jacob
--
Too many emails? Unsubscribe, change to digest, or change password by emailing 
moderator at compa...@stanford.edu or changing your settings at 
https://mailman.stanford.edu/mailman/listinfo/liberationtech

Re: [liberationtech] Boundless Informant: the NSA's secret tool to track global surveillance data

2013-06-10 Thread Nadim Kobeissi


On 2013-06-10, at 6:09 PM, Jacob Appelbaum ja...@appelbaum.net wrote:

 x z:
 @Jacob, I agree with your points regarding American exceptionalism.
 @Eugen, to prepare for the worst scenario is one thing, to advocate some
 shady rumor as fact is another.
 @Rich, those are good movie scripts :-). But it does not work for 9 firms,
 and hundreds of execs all with diverse values and objectives.
 @Nadim, when you say we all always 'knew' this was happening, I don't
 know what this refers to. Is it NSA surveillance, or is it the direct
 access bit?
 
 To me, the crucial point is the *direct access*, and also Guardian's
 claim of these firms willingly participating in PRISM. I argued that
 direct access is untrue in my previous email, but none of your replies
 (except Rich's) are relevant to my arguments.
 
 What would you call a FISA API for government agents to query a system
 and return data on a target? Would you call that direct access or an
 indirect access? If Google runs the FISA API server, does that make it
 more or less direct than if the FISA API server is a blackbox run by the
 NSA?
 
 
 The direct access bit is what made this story sensational. Without this
 bit, the story would be much less juicy but more true. In the long run,
 truth gives more power than lies. Washington Post has backed down to
 reality, for which I applaud their judgment. Guardian has not, and keeps on
 defending their misinformation and bad reporting, for which I resent deeply.
 
 
 You don't know the truth and you seem to think you do. The story that is
 important is that Google makes one claim, while the NSA slide makes
 another. Note that the law doesn't allow Google to even tell the press
 the whole truth.
 
 If Snowden and Greenwald do not mislead the world on 'direct access and
 just report it rationally, I'd applaud their courage. Now I think Snowden
 is not more than a self-aggrandizing douche.
 
 
 I'm sorry, did you watch his video interview? On what grounds to you
 call him a self-aggrandizing douche exactly?

I can't believe I was actually feeling bad for this guy yesterday. Dismissing 
one of the greatest whistleblowers of century as a self-aggrandizing douche 
is just beyond words. Maybe we're being trolled.

NK

 
 I hope internet freedom can advance with accurate awareness, not by public
 paranoia.
 
 You take issue with a very weird semantic bit of the larger story. How
 does such semantic nitpicking, where you don't actually even know the
 facts behind your speculations, help advance any cause, anywhere?
 
 All the best,
 Jacob
 --
 Too many emails? Unsubscribe, change to digest, or change password by 
 emailing moderator at compa...@stanford.edu or changing your settings at 
 https://mailman.stanford.edu/mailman/listinfo/liberationtech

--
Too many emails? Unsubscribe, change to digest, or change password by emailing 
moderator at compa...@stanford.edu or changing your settings at 
https://mailman.stanford.edu/mailman/listinfo/liberationtech

Re: [liberationtech] Boundless Informant: the NSA's secret tool to track global surveillance data

2013-06-10 Thread Nadim Kobeissi

On 2013-06-10, at 6:26 PM, Yosem Companys compa...@stanford.edu wrote:

 The distinction between direct or indirect access is semantic, not 
 substantive, and likely irrelevant to most Americans.  What Americans want to 
 know is whether there is access to their personal data, and I would bet focus 
 groups would show that's the key takeaway of this incident.

Hear hear. And not just Americans want to know this — due to the fact that most 
Big Data is centred in the US, these secret programs affect the privacy of 
world citizens as well, just as much, and in the same way, as they affect 
Americans

NK

 
 As I said, a recent NY Times article spoke specifically of the embedding of 
 NSA employees at US tech firms via firms' corporate legal departments, and we 
 know how it happened at ATT, with the employee getting cart blanche to do 
 whatever he wanted at the firm and take as much data as he wanted with no 
 questions asked.  
 
 On Mon, Jun 10, 2013 at 3:09 PM, Jacob Appelbaum ja...@appelbaum.net wrote:
 x z:
  @Jacob, I agree with your points regarding American exceptionalism.
  @Eugen, to prepare for the worst scenario is one thing, to advocate some
  shady rumor as fact is another.
  @Rich, those are good movie scripts :-). But it does not work for 9 firms,
  and hundreds of execs all with diverse values and objectives.
  @Nadim, when you say we all always 'knew' this was happening, I don't
  know what this refers to. Is it NSA surveillance, or is it the direct
  access bit?
 
  To me, the crucial point is the *direct access*, and also Guardian's
  claim of these firms willingly participating in PRISM. I argued that
  direct access is untrue in my previous email, but none of your replies
  (except Rich's) are relevant to my arguments.
 
 What would you call a FISA API for government agents to query a system
 and return data on a target? Would you call that direct access or an
 indirect access? If Google runs the FISA API server, does that make it
 more or less direct than if the FISA API server is a blackbox run by the
 NSA?
 
 
  The direct access bit is what made this story sensational. Without this
  bit, the story would be much less juicy but more true. In the long run,
  truth gives more power than lies. Washington Post has backed down to
  reality, for which I applaud their judgment. Guardian has not, and keeps on
  defending their misinformation and bad reporting, for which I resent deeply.
 
 
 You don't know the truth and you seem to think you do. The story that is
 important is that Google makes one claim, while the NSA slide makes
 another. Note that the law doesn't allow Google to even tell the press
 the whole truth.
 
  If Snowden and Greenwald do not mislead the world on 'direct access and
  just report it rationally, I'd applaud their courage. Now I think Snowden
  is not more than a self-aggrandizing douche.
 
 
 I'm sorry, did you watch his video interview? On what grounds to you
 call him a self-aggrandizing douche exactly?
 
  I hope internet freedom can advance with accurate awareness, not by public
  paranoia.
 
 You take issue with a very weird semantic bit of the larger story. How
 does such semantic nitpicking, where you don't actually even know the
 facts behind your speculations, help advance any cause, anywhere?
 
 All the best,
 Jacob
 --
 Too many emails? Unsubscribe, change to digest, or change password by 
 emailing moderator at compa...@stanford.edu or changing your settings at 
 https://mailman.stanford.edu/mailman/listinfo/liberationtech
 
 --
 Too many emails? Unsubscribe, change to digest, or change password by 
 emailing moderator at compa...@stanford.edu or changing your settings at 
 https://mailman.stanford.edu/mailman/listinfo/liberationtech

--
Too many emails? Unsubscribe, change to digest, or change password by emailing 
moderator at compa...@stanford.edu or changing your settings at 
https://mailman.stanford.edu/mailman/listinfo/liberationtech

Re: [liberationtech] Boundless Informant: the NSA's secret tool to track global surveillance data

2013-06-10 Thread x z

I argue that direct access or not is is substantive, not semantic. We have
the following two versions of the story:

*A: The Guardian story alleges that NSA has direct access to user data from
major internet firms, and these firms are willingly cooperating with NSA
for the capability of en masse data pull. It indicates that NSA can pull
whatever data they feel like, and that NSA has such dark power that all the
internet firms have to kowtow.*

*B: On the other hand, NSA and these companies' statement is consistent to
what most of us have already known, that NSA can request data from these
firms on the basis of FISA. And the data pull is quite limited. (By the
way, it doesn't really matter it's US or non-US citizens to me, there's
nothing special about America).*

Do you think the difference between the two is merely semantic? Also, if
you believe in A, then everybody on the NSA/corporation side are liars, and
we are truly living in a police state. This, is, not, semantic.

@Jacob, if your hypothetical FISA API thingy works only on the limited data
the firms knowingly disclose to NSA, then it's not big deal. This FISA
API thing is semantic, not substantive, to use your classification scheme.

@Yosem, I always applaud the accurate disclosure of the ATT and Verizon
cases. That is one thing that we need to change.

Let me stress it again, I am not rooting for B, I think it need more
transparency and FISA need revision. But let's not pretend that the
government is so powerful, that *is* paranoia.



2013/6/10 Jacob Appelbaum ja...@appelbaum.net

 Yosem Companys:
  The distinction between direct or indirect access is semantic, not
  substantive, and likely irrelevant to most Americans.  What Americans
 want
  to know is whether there is access to their personal data, and I would
 bet
  focus groups would show that's the key takeaway of this incident.

 Indeed.

 
  As I said, a recent NY Times article spoke specifically of the embedding
 of
  NSA employees at US tech firms via firms' corporate legal departments,
 and
  we know how it happened at ATT, with the employee getting cart blanche
 to
  do whatever he wanted at the firm and take as much data as he wanted with
  no questions asked.

 The word stasi comes to mind with this kind of DIRECT ACCESS. The
 server, taps and likely API itself are almost irrelevant details when we
 consider HUMAN INFILTRATION as part of the NSA strategy.

 Land of the free... refill?

 All the best,
 Jacob
 --
 Too many emails? Unsubscribe, change to digest, or change password by
 emailing moderator at compa...@stanford.edu or changing your settings at
 https://mailman.stanford.edu/mailman/listinfo/liberationtech

--
Too many emails? Unsubscribe, change to digest, or change password by emailing 
moderator at compa...@stanford.edu or changing your settings at 
https://mailman.stanford.edu/mailman/listinfo/liberationtech

Re: [liberationtech] Boundless Informant: the NSA's secret tool to track global surveillance data

2013-06-10 Thread Jacob Appelbaum

x z:
 I argue that direct access or not is is substantive, not semantic. We have
 the following two versions of the story:
 
 *A: The Guardian story alleges that NSA has direct access to user data from
 major internet firms, and these firms are willingly cooperating with NSA
 for the capability of en masse data pull. It indicates that NSA can pull
 whatever data they feel like, and that NSA has such dark power that all the
 internet firms have to kowtow.*
 

That is correct.


 *B: On the other hand, NSA and these companies' statement is consistent to
 what most of us have already known, that NSA can request data from these
 firms on the basis of FISA. And the data pull is quite limited. (By the
 way, it doesn't really matter it's US or non-US citizens to me, there's
 nothing special about America).*

This sounds like semantic bickering. If the FISA order says to pull data
on your account, your account is pulled; Twitter did not automate it,
others did.

 
 Do you think the difference between the two is merely semantic? Also, if
 you believe in A, then everybody on the NSA/corporation side are liars, and
 we are truly living in a police state. This, is, not, semantic.

Yes. It is semantic. The reason is because under FISA, basically any and
all data is fair game. Thus, a FISA API may be only limited in what it
might say and as we see from Verizon, well, gosh, some limit! However,
UPSTREAM tells us how they complete the picture.

So in the case of the Verizon order, if they installed a tapping device
on a span port in Verizon's network - does that count as direct access?
I'd say yes.

 
 @Jacob, if your hypothetical FISA API thingy works only on the limited data
 the firms knowingly disclose to NSA, then it's not big deal. This FISA
 API thing is semantic, not substantive, to use your classification scheme.
 

The firms don't know it, perhaps some agent might know but say, the CEO
of Google? Is he read into the program and cleared? If not, actually,
I'd argue that the firm doesn't know it. Nor would the board.

 @Yosem, I always applaud the accurate disclosure of the ATT and Verizon
 cases. That is one thing that we need to change.

 
 Let me stress it again, I am not rooting for B, I think it need more
 transparency and FISA need revision. But let's not pretend that the
 government is so powerful, that *is* paranoia.
 

FISA needs to be torn down. It is a disgrace.

The US Government is powerful and what we see is that the only thing
you're grasping at here is about direct versus indirect access
semantics. In good time, I think you will find that you were seriously
mistaken by your read on all of these things. I look forward to hearing
your suggestions on what to do next - once you accept the seriously
awful reality that is reflected in these leaks and in places like Bluffdale.

All the best,
Jacob
--
Too many emails? Unsubscribe, change to digest, or change password by emailing 
moderator at compa...@stanford.edu or changing your settings at 
https://mailman.stanford.edu/mailman/listinfo/liberationtech

Re: [liberationtech] Boundless Informant: the NSA's secret tool to track global surveillance data

2013-06-10 Thread fukami

Heu! 

On 11.06.2013, at 01:11, x z xhzh...@gmail.com wrote:
 I argue that direct access or not is is substantive, not semantic. We have
 the following two versions of the story:
 
 *A: The Guardian story alleges that NSA has direct access to user data from
 major internet firms, and these firms are willingly cooperating with NSA
 for the capability of en masse data pull. It indicates that NSA can pull
 whatever data they feel like, and that NSA has such dark power that all the
 internet firms have to kowtow.*
 
 *B: On the other hand, NSA and these companies' statement is consistent to
 what most of us have already known, that NSA can request data from these
 firms on the basis of FISA. And the data pull is quite limited. (By the
 way, it doesn't really matter it's US or non-US citizens to me, there's
 nothing special about America).*
 
 Do you think the difference between the two is merely semantic? Also, if
 you believe in A, then everybody on the NSA/corporation side are liars, and
 we are truly living in a police state. This, is, not, semantic.

Taking a look how this works in other countries, I'm sure it works pretty
much the same way in the US. I.e. in Germany there is traffic duplication 
at provider level where the data gets send over so called SINA boxes - 
nowadays even without any sort of real safe guards, and providers simply 
don't know anymore what's really going on in their networks (so far for the 
Upstream part for LI and homeland secret service). 

For direct data access there are in fact known APIs for everything, be 
it Swift, PNR or whatever. You shouln't need much fantasy to get an idea 
of the actual implementation at service level. So I agree 100% with Jake.
And really: At the end it doesn't matter how exactly it works - it just 
does and it is widely used. 

As a side note: An interesting story popped up today in the German press 
where a 18 year old Au Pair got send back home because of her private Facebook 
conversations. So it seems that even the DHS has this kind of capabilities. 
Giving the fact that there are thousands of people entering the US every day,
do you really think they don't get this information in an automated fashion
via API? I seriously doubt that.  

 @Jacob, if your hypothetical FISA API thingy works only on the limited data
 the firms knowingly disclose to NSA, then it's not big deal. This FISA
 API thing is semantic, not substantive, to use your classification scheme.

Jake made the most important point already: The laws doesn't allow the 
companies to even tell the whole story. Although it might look like a weak 
argumentation, it is in fact a strong one. 

Also do you *really* believe a guy like Zuckerberg more than internal training 
material of the NSA? I don't for a simple reason: Why should they lie on these 
slides? It makes no sense at all. These were not made with a public audience 
in mind. This has nothing to do with paranoia of any sort but common sense.


Take care,
  fukami


--
Too many emails? Unsubscribe, change to digest, or change password by emailing 
moderator at compa...@stanford.edu or changing your settings at 
https://mailman.stanford.edu/mailman/listinfo/liberationtech

Re: [liberationtech] Boundless Informant: the NSA's secret tool to track global surveillance data

2013-06-09 Thread Jacob Appelbaum

x z:
2013/6/8 Jacob Appelbaum ja...@appelbaum.net

Oh man, Glenn Greenwald is my hero and a hero to us all.

Do you still believe Glenn's reporting that NSA has direct access to
servers of firms including Google, Apple and Facebook?

Yeah, I think it is clearly a FISA interface or API of some kind. Either
that or it is pwnage of the server. Probably one or the other in some cases.

In my view, he
misled the world intentionally (the few prism training slides published did
not seem to claim this). Glenn is at best a wacky journalist without common
sense.

He just broke the story of the decade, good to know your views on him.

His reporting on the Verizon case was good, but I think his credibility
bankrupted after the PRISM one.

We disagree, obviously. You'll see soon enough and when you're eating
crow, I'm sure we'll have another discussion.

Everyone on
this list who was looking for 'some evidence' about global surveillance
and previously ignored all other evidence, well, here you go!

Revealed: The NSA's powerful tool for cataloguing data – including
figures on US collection

http://www.guardian.co.uk/world/2013/jun/08/nsa-boundless-informant-global-datamining

This screenshot from the program is very web 2.0:

http://static.guim.co.uk/sys-images/Guardian/Pix/pictures/2013/6/8/1370715185657/boundless-heatmap-large-001.jpg

The NSA is spying on the US and on the rest of the planet. There is no
ability to deny this anymore. Anyone who denies it is a complete moron.

I don't understand why this evidence is significant in any way. NSA
certainly has lots of information, and a web2.0'ish tool is nothing
surprising. It's rather moot to state anyone who denies it is a complete
moron. It's like the highway patrol keeping my driving record.

Why does it matter if you are surprised?

Also, your analogy is tired and boring. This is nothing like a highway
patrol.

Again, I'm not rooting for NSA. I think its power need to be limited and it
needs more transparency. But I hate using misinformation or hyperbole to
achieve that goal. This hurts the credibility of all the pro-privacy groups
in general.

I don't see any misinformation or hyperbole from Glenn. I see
contradicting claims between governments and corporations. I also see
that he wanted to ensure everyone understood what each side claimed.
Note the very carefully worded denials all around.

Re: [liberationtech] Boundless Informant: the NSA's secret tool to track global surveillance data

2013-06-09 Thread Nadim Kobeissi

Jake,
I don't agree with x z (and rather agree with you), but I'm really tired of
just how aggressive and rude you always are on Libtech. And it doesn't appear
to just be towards me. I'm not the only person who feels like this.

Even if you're right, tone your ego knob down already. Be nice. I can barely
read through threads anymore. Thank you.

On 2013-06-09, at 9:15 AM, Jacob Appelbaum ja...@appelbaum.net wrote: