
NSA targets the privacy-conscious - freejack
http://daserste.ndr.de/panorama/aktuell/NSA-targets-the-privacy-conscious,nsa230.html
======
pessimizer
Of course this happens, and it's an obvious technique. I'm sure that _not_
having a facebook account adds to your score, using AdBlock adds to your
score, mentioning the NSA online adds to your score, refusing cookies adds to
your score, using Linux adds to your score, etc.

That's how a police state works. (XKeyScore += 5)

My mother was involved in civil rights, so she has a file. It's fine that I
have a file too. Hopefully I'll be gone before they start going door to door.

edit: [http://www.linuxjournal.com/content/nsa-linux-journal-
extrem...](http://www.linuxjournal.com/content/nsa-linux-journal-extremist-
forum-and-its-readers-get-flagged-extra-surveillance)

~~~
higherpurpose
Amplify this by 100, and welcome to Minority Report, where you get a arrested
for having a "very high score".

This is where the "mass surveillance" and "let's monitor everyone just in case
they might do something bad" thinking inevitably ends up.

~~~
sliverstorm
_... you get a arrested for having a "very high score"._

Considering this is PRECISELY how spam filtering works, it doesn't seem
_entirely_ irrational.

Much like spam filtering, it would all come down to dialing in your filters
and picking a good threshold.

Hell, if the system was good enough, it could actually improve freedoms. We
currently arrest many innocent people as part of the legal process (who are
later exonerated). What if our "arrest filter" outperformed the current
system, in terms of percentage of innocent people arrested? It doesn't have to
be perfect to be better.

~~~
tesq
The problem with such a filter is it will be perceived as inefficient and
broken by those evaluating it if it denies an officer the authority to arrest
someone he's already detained or determined to be worthy of arrest.

It will be another system which grants permission at the whims of the
department, one that absolves individual officers of blame, punishment and
consequences for bias and abuse they'll continue to revel in.

~~~
sliverstorm
There is no reason such a filter need be an authoritative source. Arrest
someone it didn't suggest, if you like. Choose not to arrest someone it did
suggest. Human discretion would still be applied. But if it proved accurate,
officers would trust it, and the population would get upset if it identified a
criminal an officer did not arrest.

No different than a virus or spam scanner, really. I trust my scanners.
Sometimes they are wrong, and I know they are, and I bypass them. But I know
they are right most of the time.

You seem to have the notion though that officers do not arrest people to
"catch the bad guy". It sounds like you are saying you believe most officers
do not actually care if the arrestee is guilty (and will thus ignore the
filter always), and merely arrest for kicks/pleasure/vengeance? I do not
believe the majority are like that.

~~~
sqrt17
At least in the US, officers have quotas of arrests to fulfill, which are most
easily fulfilled with petty crime that happens all the time and is easy to
find. Attorneys get promoted based on successful cases, meaning those where
they could convince a jury that the person is guilty; any foresight that goes
above or beyond what they can present to a jury of laymen is lost time and
will get them recognized as being ineffective.

------
jobu
Because anyone trying to keep anything private or secure must be hiding
something bad... That's just wonderful.

After 10 years of pervasive surveillance and not being able to catch a single
terrorist I can't believe the NSA is trying to rationalize it as being a good
thing. It's too bad the bill to defund the NSA didn't pass:
[http://defundthensa.com/](http://defundthensa.com/)

~~~
josu
>Because anyone trying to keep anything private or secure must be hiding
something bad...

No, that's not the reasoning. People that do bad things try to hide them.
Therefore, a good first filter to catch bad people is to target those who hide
things. They can narrow the search field afterwards.

~~~
pyre
This is true, but saying "treat all people trying to hide things as potential
terrorists" is a very wide net to cast (to the point of useless).

~~~
SeanDav
It is a vastly smaller space than "all people that use the internet". Also I
think it makes sense to assume that the "privacy seekers" set would contain a
higher proportion of "bad actors". I am not in any way supporting them, but I
understand why they do it - even if I hate the idea.

~~~
euank
The fraction of terrorists in "all people that use the internet" is
approximately equal to the fraction of terrorists in "privacy seekers" \--
both are roughly zero.

The NSA only was given such pervasive power to catch terrorists. The fact that
privacy seekers are more likely to be "bad actors" is moot unless that means
terrorists because regular "bad actors" are supposed to be innocent until
guilty, handled by police/fbi, etc. NSA only is allowed to work essentially
with no due process because it's for cathing "terrorists". Interestingly, now
that terrorists know about the NSA, they no doubt will simply not use the
internet (or phones) at all, thus making it so the NSA can't catch a terrorist
by any of its methods.

I definitely expect all terrorists are extremely careful about internet
activity now that they know the NSA is so invasive, thus making the NSA's
actions even less defensible (not that I thought they ever were).

------
caster_cp
The only way out of this, as I see it, is making privacy the default. But this
require some cooperation and motivation from the big guys at silicon valley.

Imagine if Chrome, Firefox, Safari, all of them had, just like the incognito
mode, the private mode. Of course, as anonymity also depends on the behavior
of the user online, other actions are needed to really ensure security and
privacy. But making it the default will educate more people about the
importance of privacy and, more importantly, make the point that privacy isn't
only for criminals, terrorists and wrong-doers, but that "normal", law abiding
citizens also should have the right to be private. And that is paramount for a
democracy to work.

~~~
yry4345
I think the cooperation necessary would be for the "big guys" to not have a
vested interest in selling out privacy, which has been the prevailing business
model for a long time. And, since the big guys only listen to their bottom
line, that means not using them until they support privacy. It may mean not
using the Internet substantially at all. (It's more than a little ironic to be
saying this on the preeminent "business hacker" (or "startup") community,
which has a visible subset who sympathize with some of the NSA's programs, or
at least have been able to rationalize them...)

As you say, the tools have always been there, but no one uses them. That might
be because it's a chicken-or-egg problem. At the same time, it might be
because the people in the positions to develop and promote the tools, even if
only for their own use, are being prevented by a one-track culture that
encourages them to sell out their client's privacy in addition to discouraging
them from working on projects like Tor. (Again, the HN forum is an example of
that conflict - being a largely business-oriented forum; surveillance
technology sells... Even DuckDuckGo, a favorite startup in this community, has
filters to protect us.) Rather than peer-to-peer solutions like Gnutella,
Gnunet, Tor, and even open wireless, people continue to make websites with
JavaScript encryption, despite the proven MITM threat.

I don't think JavaScript and CSS will get us out of this, but if this latest
revelation doesn't wake people up in the tech community specifically, nothing
will, since BoingBoing readership is a large number of them - which to me
means that the tech and programmer categories are themselves a primary focus
of the surveillance that some highly-respected tech pundits (and HN forum
members) have defended and rationalized as only being used for terrorists and
perverts. That definition now includes anyone with enough knowledge to build
or use strong privacy tools. The definition now includes everyone on this
forum.

~~~
aluhut
"No one" uses it because it is too complicated for "every one".

------
jqm
"It also records details about visits to a popular internet journal for Linux
operating system users called "the Linux Journal - the Original Magazine of
the Linux Community", and calls it an "extremist forum"."

WTF? I guess I am on a list. Who knew being an extremist was so easy?

~~~
kps
No, it doesn't say that Linux Journal itself is an ‘extremist forum’. It says
that TAILs is “advocated by extremists on extremist forums”, and includes
Linux Journal as a source of information about TAILs, neither of which seem
surprising.

~~~
jqm
Yes it says exactly that. Thus the quotes "" in my post.

4'th bullet point from the top in case you wish to check again.

~~~
kps
_The article_ , which presumably was written by the authors on its byline
rather than by the NSA, says that. The actual config file, linked from the
article, at
[http://daserste.ndr.de/panorama/xkeyscorerules100.txt](http://daserste.ndr.de/panorama/xkeyscorerules100.txt)
says:

    
    
      /*
      These variables define terms and websites relating to the TAILs (The Amnesic
      Incognito Live System) software program, a comsec mechanism advocated by
      extremists on extremist forums.
      */
    

Linux Journal is listed there, as a ‘website relating to TAILS’, not as an
‘extremist forum’.

Journalists gotta journalize.

------
schoen
I think an even more significant thing in the XKeyScore code (in terms of the
idea that "NSA targets the privacy-conscious") is the existence of a
"documents/comsec/" hierarchy of fingerprints. I may have _written_ some of
the documentation that's targeted elsewhere within that hierarchy.

------
blauwbilgorgel
I'd like to focus on:

 _Merely searching the web for the privacy-enhancing software tools outlined
in the XKeyscore rules causes the NSA to mark and track the IP address of the
person doing the search._

Again the media makes it sound like there exists a dragnet on (Google)
searches. But this time one of the authors is J. Appelbaum.

So which is it? Terrorist Scores based on search engine searches sounds
fantastically insane to me. But unencrypted it is possible to intercept. So
perhaps it is something in between: All accessible searches are monitored, and
search engines do not cooperate with this directly, unless they have to
legally comply with the request?

~~~
nostrademons
One of the earlier Snowden disclosures was that the NSA had tapped private
internal Google fiber lines carrying traffic between data centers. Same with
Yahoo, Microsoft, other major Internet destinations. Google has since started
encrypting all internal traffic, but for awhile pretty much anything was
available to the NSA dragnet.

~~~
alex_duf
I'm sure it still is. We just don't know how yet, but a giant corporation like
google has probably other ways to be attacked.

And if it is not possible on the technical level, the NSA will find the people
to access the data they want.

------
afarrell
When the NSA collects evidence on someone and uses that evidence to prosecute
a criminal case, they can and should file a motion to suppress that evidence.

The NSA data is collected under search issued by a FISA court. So, during a
suppression hearing, defense counsel can challenge the validity of the
warrant. If their challenge is denied, they can appeal. If their appeal fails,
they can petition the Supreme Court. In all these courts, the proceedings are
public record and the standard for a warrant can be debated by lawyers and the
public alike. We have an open process for checking the work of the humans
issuing FISA court warrants; Use it.

Even if the warrant was valid, the NSA might have overstepped its bounds. This
can also be challenged when the NSA defends the admissibility of its criminal
evidence in a suppression hearing. An independent judiciary can decide if the
executive branch has acted outside its bounds. No, an investigator isn't
punished for the overbroad evidence collection, but they are embarrassed by
having a criminal get off due to their sloppiness. We have an open process for
checking the work of human investigators in this country; Use it.

It isn't as if the government just takes that evidence and unilaterally
decides to blow people up. We have due process in this country; Use it.

/s

~~~
YokoZar
This would be a reasonable view if there weren't a systematic campaign by the
NSA, FBI, and DEA to lie to judges and prosecutors about the actual source of
underlying evidence.

[https://www.eff.org/deeplinks/2013/08/dea-and-nsa-team-
intel...](https://www.eff.org/deeplinks/2013/08/dea-and-nsa-team-intelligence-
laundering)

The EFF calls it Intelligence Laundering. The DEA calls it parallel
construction. Either way it is sinister and immoral and a court hasn't had a
chance to rule on it precisely because it is very difficult for defendants to
prove that both the prosecutor and judge were lied to.

~~~
afarrell
I don't actually hold the view expressed. I've just been trying (and failing)
to find a compelling way to articulate the following point: "The FISA court's
warrant system is flawed because the validity of its warrants or their
execution are never checked because the warrants aren't actually used to bring
criminal cases."

So, I thought I'd try sarcasm. But I couldn't come up with a concise way to
address the fact that parallel construction means that their info actually
_is_ used in criminal cases. Oh well, back to the drafting board...

~~~
pessimizer
It worked for me. It read like obvious fiction as far as to what I know about
the NSA and the last couple of administrations.

------
noobhacker
I feel quite ambiguous about these discriminating techniques. For example, it
is okay for us to give females / older people lower insurance rate because
that's what the statistics says. Likewise, it's likely that people who search
for privacy-enhancing software are more likely to engage in "subversive"
activity. So it's hard for me to determine which kind of discrimination is
justified and which not.

~~~
TazeTSchnitzel
Did you mean ambivalent, not ambiguous?

------
Istof
and the top key-word on their watch list is de-fund

------
Create
We begin therefore where they are determined not to end, with the question
whether any form of democratic self-government, anywhere, is consistent with
the kind of massive, pervasive, surveillance into which the Unites States
government has led not only us but the world.

This should not actually be a complicated inquiry.

[http://www.theguardian.com/technology/2014/may/27/-sp-
privac...](http://www.theguardian.com/technology/2014/may/27/-sp-privacy-
under-attack-nsa-files-revealed-new-threats-democracy)

------
toddnessa
What I gleaned most from the article(s) is that it's becoming increasingly
important for all of us in the tech community to take a stand ourselves along
with TOR to promote online anonymity in our companies (& possibly even think
about supporting the TOR Project itself in some way).

------
zby
That is why you should join the Pirate Party! We are a targeted group - we
must organize.

~~~
junto
Unfortunately in Germany the Piratenpartei have a few too many undesirable
links the NPD [1] (i.e. Neo-Nazis) for my liking.

Until they clean house and stamp out the far right, they'll have a problem
attracting new voters.

[http://www.sueddeutsche.de/bayern/piratenpartei-und-
rechte-u...](http://www.sueddeutsche.de/bayern/piratenpartei-und-rechte-
ueberlaeufer-klar-machen-zum-entern-1.1162369)

~~~
zby
This is two years old article - as far as I know the German pirates now are
rather leftist (actually too leftist for my liking - but as a whole the pirate
movement is rather balanced between the two poles).

Pirate Party as a new and mostly undefined movement attracted all kinds of
freaks - but it can only work as a movement of those that understand how the
Internet can be used in politics, both the dangers and the potential for good,
and who value the freedom and openness that was associated with the early net.

------
dang
Changed the url from [http://boingboing.net/2014/07/03/if-you-read-boing-
boing-the...](http://boingboing.net/2014/07/03/if-you-read-boing-boing-
the-n.html), which points to this.

There were two versions of this story on the front page. This thread has the
fuller discussion, the other the original source. In such cases we usually
merge them by reassigning the url and burying the other thread.

------
antocv
Did you seriously think news.ycombinator.com doesnt increase your score and
suspectibility of having your computing devices hacked into? And puts you on a
very interesting NSA/CIA/Letter-Combo/For-Your-Safety list?

Look at Ukraine. War just pops up. I wonder which list they will go by first.

------
jewhaseloff
Raw milk distributors.

~~~
sroerick
Wait, what? Are you being facetious? This is so oddly specific.

~~~
pekk
It's a conservative meme that raw milk producers are being unfairly
persecuted, in those circles it's supposed to be a paradigm case of the overly
intrusive nanny state.

In reality, there is hard epidemiological data showing that selling raw milk
(edit: e.g. through the normal store channels) can lead to serious harm
including deaths. So FDA bans it for interstate sales, but it's up to the
state to decide how to regulate in-state sales. Just like any other food
safety issue.

NSA is extremely unlikely to be involved in enforcing regulations against raw
milk in reality, but in the mind of the conservative conspiracy theorist it's
all of one totalitarian piece.

~~~
ajays
> _In reality, there is hard epidemiological data showing that selling raw
> milk (edit: e.g. through the normal store channels) can lead to serious harm
> including deaths._

I'd love to see the evidence, and see it compared to other food sources.

I grew up in India. There all we got was raw milk from the cowherd; in fact,
even today, my parents send the helper to get milk in a pail from the cowherd.
It's always been raw milk, warm and fresh from the udder. And the first thing
they do is to boil it.

If I were to conjecture, it's that the "no raw milk" diktat forces farmers to
go to big distribution companies with the requisite facilities for
pasteurization.

~~~
yxhuvud
Boiling milk? No thanks, boiled milk tastes funny.

You should remember that not everyone live in the same hot climate as you
where milk generally don't go bad immediately, and that there are plenty of
people around in cooler climates that have stomachs that usually can handle
milk without problem.

~~~
vidarh
> Boiling milk? No thanks, boiled milk tastes funny.

Boiled milk, yes. But unless you get milk straight from a farm, it's likely
pasteurised: Heated to 72 degrees celsius for 15 seconds. [EDIT: I didn't
realise how many places allow sales of unpasteurised milk; yikes - I'll be
careful about reading labels next time I'm travelling]

> and that there are plenty of people around in cooler climates that have
> stomachs that usually can handle milk without problem.

The "stomachs that usually can handle milk without a problem" is entirely
unrelated from why we pasteurise milk. Pasteurisation does not affect the
lactose content in the milk, and that, combined with whether or not your
_genes_ makes you lactose intolerant or not is what determines whether or not
you handle milk well.

~~~
yxhuvud
I agree totally on your points when it comes to pasteurized milk - I was
commenting on a comment that claimed regulation wasn't necessary because
farmers would boil the milk anyhow, which is simply not the case.

------
terranstyler
Warning:

The first sentence goes "If you read Boing Boing, the NSA considers you a
target for deep surveillance".

So, if you find this interesting, maybe you shouldn't read it.

~~~
Sprint
[https://en.wikipedia.org/wiki/First_they_came_..](https://en.wikipedia.org/wiki/First_they_came_..).

 _First they came for the Socialists, and I did not speak out— Because I was
not a Socialist.

Then they came for the Trade Unionists, and I did not speak out— Because I was
not a Trade Unionist.

Then they came for the Jews, and I did not speak out— Because I was not a Jew.

Then they came for me—and there was no one left to speak for me._

