AT&T-->NSA. WTF? -EFF

April 7, 2006 7:27 AM

EFF Accuses AT&T of diverting internet traffic to NSA. "More than just threatening individuals' privacy, AT&T's apparent choice to give the government secret, direct access to millions of ordinary Americans' Internet communications is a threat to the Constitution itself. We are asking the Court to put a stop to it now." More details from the EFF.
posted by jikel_morten (69 comments total)

Meanwhile, Attorney General Albert Gonzales claims that executive powers may extend to wiretapping phone calls that take place entirely within the United States. Says California Congressman Adam Schiff, "If the administration believes it can tap purely domestic phone calls between Americans without court approval, there is no limit to executive power. This is contrary to settled law and the most basic constitutional principles of the separation of powers."
posted by digaman at 7:47 AM on April 7, 2006

This is no doubt distressing, but sending sensitive information in cleartext over the internet these days is just as questionable.

Users of POP3, FTP, and telnet, I'm looking right at you, since you are broadcasting your login ID and password in plaintext when you use these protocols. All of these have secure alternatives (POP3-over-SSL, SFTP, SCP, SSH, etc.), so use them. For email there's OpenPGP and S/MIME.

When the proper tools are used correctly the contents of your traffic remain confidential even if the enemy has complete access to every packet sent. Of course this does nothing for the common situation of just profiling you based on the remote IP addresses that you connect to, but if you go to that level there's tor and Freenet.
posted by Rhomboid at 7:51 AM on April 7, 2006

When the proper tools are used correctly the contents of your traffic remain confidential even if the enemy has complete access to every packet sent.

When "the enemy" is defined as your own government, things have moved pretty far down a certain road -- as indeed, they have in the US. And the use of strong crypto is definitely considered a sign of having something to hide by law enforcement, which tends to really turn up the heat on you if the government decides they want to know what you're up to.
posted by digaman at 7:58 AM on April 7, 2006

I sometimes "send sensitive information" using this ancient protocol called my big fucking mouth, by that doesn't mean I should learn to speak code because the government has card blanche to drop listening devices everywhere. They're in the wrong here and all the crypto isnt going to make a difference when the lawlessness of this administration means they can just eventually beat the key out of you. There's a difference between treating the symptom and treating the disease.
posted by skallas at 7:59 AM on April 7, 2006

See this? This is my surprised face.
posted by verb at 8:04 AM on April 7, 2006

Even some Republicans are starting to lose their patience with this administration's "wholly unprecedented assertion of executive power." Accusing Gonzales of "stonewalling," Republican House Judiciary Committee chairman James Sensenbrenner, a Republican, said the other day, "If we're properly to determine whether or not the [NSA] program was legal and funded -- because that's Congress's responsibility -- we need to have answers, and we're not getting them."
posted by digaman at 8:06 AM on April 7, 2006

*one too many "Republicans" in that sentence, sorry.
posted by digaman at 8:06 AM on April 7, 2006

I don't know why anybody here thinks that encryption will keep the government's eyes off your data. Encryption is fantastic for keeping Little Jimmy out of your data, and even for keeping RivalCo's snooping eyes out.

But the government? I wouldn't be so sure.

As much as I'd like to politicize this by blaming it on the current administration, there's no reason to think that's the case.
posted by I Love Tacos at 8:31 AM on April 7, 2006

Rhomboid, how many people know how to configure and use the products, tools and services you namechecked? Isn't it fair to say that only a tiny minority of citizens even know what they are?

So while I'm sure you didn't intend it this way, your argument amounts to an assertion that only a small technical elite is entitled to the means of protection from government (or nongovernmental!) surveillance.

The strong crypto and other privacy tools that I've encountered seem to have been designed primarily for people with a strong technical background, who are comfortable with programming from the command line. I'm delighted they have access to tools like that, but dismayed that protection of the same grade simply isn't available to ordinary, nonspecialist folks like me.

People should be able to protect themselves without needing to know what SSH shell commands are, right?
posted by adamgreenfield at 8:33 AM on April 7, 2006

There's no reason to think that this administration is behind the fact that the government has the computing power to break strong crypto. Can't disagree with you there.
posted by digaman at 8:33 AM on April 7, 2006

Indeed, Adam.
posted by digaman at 8:34 AM on April 7, 2006

I enabled TLS on my Postfix-based mail server a while back. This makes all communications with likewise-enabled mail servers encrypted, so nothing passes "bare" over the wire.
posted by mrbill at 8:35 AM on April 7, 2006

Look, Al Qaeda have staged hundreds of attacks in the last 5 years in this country, tens of thousands are dead, and we're clearly under siege from all fronts. The fate of our great nation depends on this kind of information reaching the government.
posted by cell divide at 8:37 AM on April 7, 2006

I enabled TLS on my Postfix-based mail server a while back. This makes all communications with likewise-enabled mail servers encrypted, so nothing passes "bare" over the wire.

Except for, as you note, when your server communicates with a non-TLS configured server. Unless there's a way to tell your mail server to just not talk to servers configured that way.
posted by crawl at 8:41 AM on April 7, 2006

ATT has been doing thisfor some time. Your best bet: assume that anything you send, talk about electronically, mail, or receive can be checked out by the govt. Disregard any cover stories about court approved, only overseas, special cases etc and assume EVERYTHING and ANYTHING if the govt or its minions are thinking about YOU.
posted by Postroad at 8:42 AM on April 7, 2006

People should be able to protect themselves without needing to know what SSH shell commands are, right?

Why?

I mean, sure, they should be able to. That'd be great. But the lack of an 'easy button' doesn't mean someone shouldn't try to protect her information.
posted by sohcahtoa at 8:46 AM on April 7, 2006

I think its ironic that the wiretaps are supposed to be used to find enemies of the US when the enemies are really the ones implementing these policies that are not American and that are completely un-Constitutional. And just plain anti-American, if you're not willing to admit that warrantless wiretaps of anyone at anytime in this country are not Constitutionally authorized then you are existing in a fantasy.

Alberto Gonzales will approve of any Bush power grab, its what he was put there to do.

But his poll numbers are at their lowest. The GOP Congress has little support, the scandals keep mounting and Fitzmas is going to come several times this year and, with some luck, there will be a regime change.

The worst thing that happened to this country wasn't electing George W. Bush. It was giving the Republicans control of the House and Senate. Unchecked power corrupts even good people and these filthy buggers haven't been "good" since they were five years old. I'm glad that the country is swinging around to finally seeing the light.

cell divide, I hate to say it but my fear is that some attacks will be allowed to happen to panic the nation into line.
posted by fenriq at 8:47 AM on April 7, 2006

There's no reason to think that this administration is behind the fact that the government has the computing power to break strong crypto. Can't disagree with you there.

It's highly, highly doubtful that the NSA can break strong crypto. They may be able to brute force a single hypothetical message in 220 days, but they certainly cannot keep up real time with crypto messages being passed around.

It's far more likely that they've become masters at sniffing weak passphrases and rubber-hosing passwords from Persons Of Interest.

And now I'd like to say 'howdy' to all the NSAers listening to this message, especially to those UMTYMP alum that I've lost contact to.
posted by unixrat at 8:52 AM on April 7, 2006

Step into view of the viewscreen Winston.
posted by caddis at 8:55 AM on April 7, 2006

M-x spook

Mantis AFSPC FBI fraud offensive information warfare pink noise Noriega Mole ANZUS IRA militia SEAL Team 6 ANDVT AIEWS crypto anarchy
posted by IshmaelGraves at 8:56 AM on April 7, 2006

I appreciate the stalwart crypto experts posting here, but I have a practical question. I'm a journalist. How many of my sources -- inside and outside the government -- do you think would feel comfortable with me sending them email requiring considerable decrypting software on their end? Whether the NSA could break strong crypto or not, how much standard communication do you think should be required to "wear" crypto before the salient question is, Why are we all having to go through this? Are there no constitutional protections against government surveillance?

It's pretty easy to get caught up in which crypto programs can do what. Sometimes it's better to ask, why do American citizens suddenly have a reasonable expectation of having to use it?
posted by digaman at 9:02 AM on April 7, 2006

So, does this mean that people at AT&T suddenly have clearance to examine your personal information?
Arguments as to whether the government should have the right to do this aside - can they have a civilian organization do it?
Where are the safeguards against abuse?
Etc. Etc.

Of course, if the congress had a real problem with the administration doing this they’d strip some (customary) war powers from the executive branch. And stop/rewrite authorization for the particular engagements in Iraq & Afghanistan.

Looks like they’re doing a lot of talking to me.
The sword does rest sweet in the hand doesn’t it?
Harder to put down than pick up.
posted by Smedleyman at 9:21 AM on April 7, 2006

Bingo, digaman. I was looking for an elegant way to say what you just said. Thank you. Let's not allow the base of this argument to be shifted from constitutionally-protected expectation of privacy to blaming the victims for not knowing enough about PGP.
posted by squirrel at 9:30 AM on April 7, 2006

Also, if we allow this administration the powergrab it is attempting, how long do you suppose it will be before ISPs start closing ports used by SFTP and SSL. AT&T, MSN, Yahoo and AOL have all shown us that they're willing to bend over for the feds at the expense of their customer's privacy. Do proponents of blame-the-unencrypted really lack the imagination to foresee the banning of all network encryption. After all, if you're not a terrorist, what do you have to hide?
posted by squirrel at 9:35 AM on April 7, 2006

does this mean that people at AT&T suddenly have clearance to examine your personal information?

I'm pretty sure they've always had that clearance. They own the service. It is just not profitable to do in-depth monitoring beyond simple traffic shaping (afaik).

Civilian agencies are far less restricted in all kinds of surveillance than governmental agencies, even in 2006.

As much as I dislike all kinds of indiscriminant surveillance, probably the only consistent standard is "if it enters my light cone, it's mine to observe."

Of course, if you try and counter-surveil any transpersonal body like a corporation or government entity to the degree they can surveil you, you are likely to fail due to asymmetries in the application of the law.
posted by sonofsamiam at 9:38 AM on April 7, 2006

And the use of strong crypto is definitely considered a sign of having something to hide by law enforcement, which tends to really turn up the heat on you if the government decides they want to know what you're up to.

This is precisely why some people feel that we need more encryption instead of less. Make the tools easy to use so that their use is nearly automatic, and then encrypt everything, even the things that have absolutely no sensitive information.

that doesn't mean I should learn to speak code because the government has card blanche to drop listening devices everywhere. They're in the wrong here and all the crypto isnt going to make a difference when the lawlessness of this administration means they can just eventually beat the key out of you.

Of course they're in the wrong, and using encryption is not going to change that. However, the converse is not true either -- if the government were not doing this it would not suddenly be any more acceptible to put sensitive information out there without using encryption. That is my point, that we need to raise these issues and get more people educated, not that somehow using encryption should be a response to government spying.

Encryption is fantastic for keeping Little Jimmy out of your data, and even for keeping RivalCo's snooping eyes out. But the government? I wouldn't be so sure.

The NSA has long been observed to be approximately 5 to 15 years ahead of what has been generally disclosed in academic circles in terms of cryptographic algorithms. However, right now that still means that they are likely to be very far away from being able to practically crack the current leading crypto algorithms, because these still are at the level of requiring astronomically large amounts of resources to break. Of course nobody but them know for sure, but most crypto experts agree that current methods are able to provide reasonable security even to the most determined of attackers. And as mentioned already, the algorithms are usually the strongest link in a chain where much weaker links exist -- such as torture or keyloggers.

Isn't it fair to say that only a tiny minority of citizens even know what they are?

I don't think that is fair to say. Using SFTP is almost exactly the same procedure as using FTP, for example. Likewise, using "secure" POP3 normally just means ticking the correct box in your email client's settings page. You can download a plugin for Outlook or Thunderbird that makes signing and encrypting emails using OpenPGP as simple as putting a little tick-mark in a box at the top of the message. There is no need to learn arcane command line programs.

But the real problem is two-fold. One, people just aren't generally educated about encryption, or don't know what to look for. Worse, in some cases they don't even know when encryption is necessary (as in the example of FTP sending your credentials in plain-text) or that it can be had with relatively little investment in time or learning. Two, in the case of public key encryption, the software may exist to make things simple but the user still has to form a web of trust, which is a whole different can of worms.

But my point really is that no real progress will ever be made until these issues become more prominent in the public's awareness, and that just leaving it at, "this stuff is complicated and hard" doesn't do any good.

I'm a journalist. How many of my sources -- inside and outside the government -- do you think would feel comfortable with me sending them email requiring considerable decrypting software on their end?

You might check out web-based services like hushmail.com.
posted by Rhomboid at 9:40 AM on April 7, 2006

Sieg heil!

(Why do y'all hate America and freedom? If you want a police state move to China.)
posted by davy at 9:41 AM on April 7, 2006

Rhomboid, does the term "Goldstein" mean anything to you? I.e. why would hushmail be any less likely than AT&T to turn it all over, or even to be itself a "cointelpro" front for the Feds? The fact is, as digaman et al. already said, ordinary people should have no need to hide our email from the U.S. Government anyway.
posted by davy at 9:45 AM on April 7, 2006

Sure, I might check out hushmail and any number of other crypto services. But how comfortable do you think a government agent would feel in talking about sensitive issues -- and I sent email to three different federal agencies yesterday in the course of writing an article -- if I asked to speak to them using a "hushmail" address?
posted by digaman at 9:48 AM on April 7, 2006

I'm sensitive to not wanting to deflect the conversation onto technical grounds, when really it is a political development and a political discussion we need to be having.

I do want to address the "ease of use" issue, though. Rhomboid, I think you signnificantly overestimate the technical sophistication of most users in noting that it's a simple matter of checking a box in an email client's preferences pane. Extensive research has demonstrated (to my thorough satisfaction, anyway) that most users never configure any application - they set it up once (or have it set up for them) and thereafter use it with the default settings intact throughout their experience of it. Bear in mind that what's laughably trivial to you may quite simply be outside the experience and expectation of the majority of actual users.

This too, though it may be changing slowly, is political in the deeper sense, and a part of the way in which technology frequently acts to disempower us in one way even as it appears to empower in another.
posted by adamgreenfield at 10:07 AM on April 7, 2006

While it may be true that citizens of the United States and other western-style countries should be able to expect their governments not to snoop on their communications, or at least to have reasonable legal controls placed on the process, I still think that those citizens should be expected to be responsible for the security of their communications.

The government may or may not be acting in bad faith, but you can be sure that other parties out there will be. So just like the uptake of personal shredders for the home or home office, I expect digital security awareness to increase to the point where average people will know about it, and know that they have options.

People have to protect themselves from the bad elements, whoever they are. They will learn. Legislation - or even Constitutional protection - doesn't solve everything.
posted by dammitjim at 10:29 AM on April 7, 2006

Look, Al Qaeda have staged hundreds of attacks in the last 5 years in this country, tens of thousands are dead, and we're clearly under siege from all fronts. The fate of our great nation depends on this kind of information reaching the government.

I agree, and that's why I have added a BCC to [e-mail] the "normal" template of my mail application. I know these guys are really working hard (sometimes til 6 or 7 in the evening, I hear), and I don't want them to have to work harder than necessary to read my outgoing email.

I know they are extremely concerned about my answer to my wife's national securty question of the week: "should we put a litter box in the downstairs powder room?"
posted by illovich at 11:00 AM on April 7, 2006

People should be able to protect themselves without needing to know what SSH shell commands are, right?

It's interesting. Encryption has been around since Caeser, and yet nobody has found a way to implement it for internet communications in a user-friendly fashion.

My impression is that people talked about it for a while back when PGP first came out, and then basically said, "meh." There's no easily available plugin for Outlook. And for web-accessed email? Fuhgeddaboutit.

My guess is that if J. Random User starts using crypto, it will be to defend against ID theft, not government surveillance.
posted by Afroblanco at 11:05 AM on April 7, 2006

What really pisses me off is that fighting back makes you the enemy. I mean really, what options do we have if we don't like it? Write a blog? Protest with a sign? Whine to your congressman? <--That's the only thing that is 'acceptable', it doesn't change anything, because your congressman doesn't represent your views anymore, and it only makes you look like a whiner. If somebody were to actually fight (take up arms) for what they believe in, they are immediately demonized, and marginalized, everybody runs away from your position with "He's not with US!".
The slope has been sloping downhill for quite a while, and getting slipperier by the day. What options are EFFECTIVE? What can someone really do? Suck it up, shut your mouth, and enjoy the boot?
posted by Balisong at 11:11 AM on April 7, 2006

What options are EFFECTIVE? What can someone really do?

On a broad scale, I don't know. Smart people like Ron Rivest don't really know either. On an individual level, there is a lot you can do.

If you really care about crypto rights, a fun start is making your own CipherSaber. Don't cheat!

Maybe look into Diceware a method for generating very strong (high entropy) passwords.

Crypto rights are fundamental human rights. There is no law that can stop an eternal mathematical truth.
posted by sonofsamiam at 11:24 AM on April 7, 2006

Digaman,

You don't need hush mail per se.

I work with journalists often and I always try to help them to understand that the threat here isn't just about them. It's about who they're communicating with and the threats present everywhere. I don't want to talk with journalists that are a major hub in a scale free network without crypto. It's a given that my communication is being monitored when I talk to Kevin or Declan.

With regard to members of government being hard to convince, it's not that the government needs to worry about being monitored by itself (ha!). Rather, it's people sniffing your email while you're in Ritual Roasters. It's defending against people that have access, legit or otherwise.

Does a wired.com email account somehow denote security for those government agencies? Or is it identity? Which quality makes them feel good about communicating with you?

Giving people the option of using strong crypto (encryption + signatures) end to end will help you verify that it wasn't tampered with during transit. It benefits you in many tangible ways. You can ensure that a quote is correct.

The government and other people still have no right to sniff this data. However if you're operating in reality, you know that it happens anyway. You'll know that most people will not be able to decipher it's contents if it's at least encrypted. It creates a new paradigm. Rather than just having people passively listen, they have to attack, it will interfere and that's detectable. It makes it a non-trivial problem to even collect useful information other than traffic analysis.

With all that said, I'm sure you already have pgp. You already have OTR, you already use TOR, you already have a cryptophone. You already know the threats present for your line of work. You know that information conduits like yourself are at greater risk. The government shouldn't be unlawfully listening to these communications but other interesting parties are. Sometimes with government taps.

We must change the security assumptions for the landscape. Treat the network as entirely untrusted, legal or not, we're open for being massively watched by using it. And even with strong crypto we have traffic analysis, throw those key ids kids.

If you don't know most of this, I'm sure other people here can help you.
posted by ioerror at 11:33 AM on April 7, 2006

Does a wired.com email account somehow denote security for those government agencies? Or is it identity? Which quality makes them feel good about communicating with you?

Identity. That's the issue. And I suspect that delivering a lecture to each of my potential sources about how my use of crypto is for their benefit too, the whole Internet should be treated as an untrusted network, and so forth, would peg me immediately as a paranoid maniac with something to hide, even if every single thing I said was demonstrably true.
posted by digaman at 11:40 AM on April 7, 2006

Don't think for a second that if the government really wanted to go after you, for whatever reason.. tax evasion to terrorism, That just having an encryption engine, and sending encrypted emails, whether they could read them or not, reguardless of damaging content, will be used against you in a court of law as "hiding something from the government."
posted by Balisong at 11:41 AM on April 7, 2006

digaman,

Don't deliver a lecture, write a small one page informational section that gives your fingerprints and methods for contacting you securely. Explain in simple terms how email is like a postcard. Toss it in your sig. It gives people options. It gives people some credit.

How many sources do you lose because of a lack of such "paranoia?" Do you not think that some of your sources "get" the issues at hand?

As I said, in a scale free network, you're a hub. You have to have stuff like PGP, OTR, Tor and more. Your threat model should be more than the average person. Period. It's irresponsible to be an insecure conduit of information in this day and age.

And you do have things to hide. Contacts, source information, story leads, personal information, non quotable back story information and so on. Lots of non technical information, not to mention access control information such as logins and passwords.

The reality is that the internet is untrusted. It always has been. Everyone should know this. You do agree, don't you?

It's not paranoia, it's how things work.
posted by ioerror at 1:56 PM on April 7, 2006

ioerror, I'm not going to argue with you about the facts, but I strongly suspect that you're a tech guy of some sort, and not a working journalist.

How many sources do you lose because of a lack of such "paranoia?" Do you not think that some of your sources "get" the issues at hand?

As for the first question -- I have only lost one source in ten years of writing for Wired because I wouldn't use strong crypto to communicate with him. I got the information I needed anyway. As for the second question -- when I have 30 seconds to talk with someone on the phone, I don't like to bring up a lot of "issues at hand" extraneous to the subject of the interview before we even start talking.

In other words, we're both right, but I suspect that if you were a journalist, you'd be challenged to follow your own prescription, which is wise in every way but the practical one.
posted by digaman at 2:12 PM on April 7, 2006

Give me a break, ioerror.

Point the first: I used to be a mid-level network tech, and I was never able to install and configure PGP to any acceptable level of usable satisfaction. You're asking a reporter to train all his contacts to use a non-ubiquitous encryption system as part of putting together stories? Not acceptable.

I'm as bewildered as anyone that some consumer-level PnP encryption solution hasn't emerged by now. Should everyone be on encrypted networks? Yes. But they aren't, and only a very small amount of net users use it. If wishes were horses, then beggars would ride. But they aren't, and your wishing everyone would suddenly get smart and savvy isn't going to make it happen.

Point the second: don't shift the argument. The wholesale, warrantless interception of our net traffic by the feds is unconstitutional, and must be stopped.
posted by squirrel at 2:15 PM on April 7, 2006

I'd just like to point out that in my opinion, just the fact we're talking about these things in this way, talking about encrypting all our email against likely government surveillance, saying things like "the whole Internet should be treated as an untrusted network" means we're really not free anymore.

I mean that as in a practical way. When the citizens of a nation feel they need to do something like that to protect themselves from government intrusion, it doesn't matter what the Constitution says, their freedom no longer truly exists in a practical way.

We've got NSA listening to our phones, our emails, probably reading our snail-mail too. That's a police state, or at least a suspicious surveillance state.

Not a free country anymore, this is solid evidence of that.
posted by zoogleplex at 2:45 PM on April 7, 2006

digaman,

You're correct to say that I work in tech. I actually help NGO/Non profits work with tech stuff, specifically with security. I'm willing to help anyone doing "good" stuff, pro bono even. This includes you because I like journalists. If you really need help with this stuff, contact me off metafilter. I'm more than happy to help you, in person or over the net. You can ask some of your friends for a reference if you like.

Moving on, I've worked with a number of journalists that "get it." "It" is the ever important idea of being opportunistic about your encryption. "It" is the ability to be secure independent of the networks we're on. "It" doesn't mean using hushmail. You can do this with your AIM account and your wired mail account today.

Sometimes the information is worth more than the security of transport, no doubt. It's always a trade off. I will not disagree there. That's why the laws should protect people from this threat. However, part of making smart trade offs like this is understanding the reality of the issues at hand. You likely understand most of the threats. So offer the choice of PGP for those that need it. You'd never have even lost a single source and it's a free download for non-commercial use. Or GPG, it's always free for every type of use.

The networks won't get more secure. It might become more of an illegal action, technically it won't change the landscape much. The internet is made of the people that participate in it. We have to create the world we want to live in.

When you're talking over the phone, it's a different threat model (until voip right?) anyway. A telephone doesn't have an easy secure solution for most people. If your threat model is serious enough, you find a solution that also fits your budget or you stop using the telephone for anything sensitive.

And you're not entirely right, I'm not a working journalist often. However, I have worked as a photographer a number of times with publications including with breaking news. I've helped setup communication networks for entire groups of working journalists because of their threat models.

When I communicate with other journalists for that type of work, I helped them setup PGP and when I explain it, they get it. If they couldn't use PGP or OTR, at least we all know the issues at hand. It takes one small amount of effort for the returns of being able to communicate securely. It's not fool proof but it raises the bar of entry for the attacker. If you don't want to explain it, offer it in a non-obtrusive fashion and answer questions if they come up. I certainly won't fault you for not taking the time to single handily change the face of internet communication security. :-)

To be clear, I'm not saying turn off insecure communications. I'm saying, contribute to the solution rather than being stubborn about fixing the problem. :-)

Today, 90% of my buddy lists use OTR. That means that 90% of over 400 people can use encrypted communications with me and effortlessly at that. The ones that can't, have no problem communicating with me. I still always give them the option because I see a larger incentive than not.

Even if all the communcation lines were secure, I'd still do this. I trust my PC to be more secure than the network. I can verify my own security. Others do the same. Often in very public ways.

Do you honestly refuse to install PGP, OTR, TOR and the like? Do you not see their purpose?

How many sources would you have gained with PGP that you didn't know of? How many people do you suppose will read this thread and say: "Do I want to give that guy my information? No."

I suspect it's worth agreeing that the situation sucks. I also think it's not legal to have people monitoring my information or yours without warrant. I'll even go as far as to say that it's worry that by "solving" the security, it will brush the major law breaking aside. However, I think we should still be vigilant, opportunistic in our security and be realistically honest about our trade offs.

Don't you agree?
posted by ioerror at 2:49 PM on April 7, 2006

squirrel,

Point the first: I used to be a mid-level network tech, and I was never able to install and configure PGP to any acceptable level of usable satisfaction.

I can't say anything to your problems but I do believe that you likely needed to RTFM ;-) Or at least explain what "usable" is? PGP isn't a perfect solution to everything, I know that. It does however solve a bunch of problems that were unsolved before. The web of trust sucks but it can be (for many things) better than nothing.


You're asking a reporter to train all his contacts to use a non-ubiquitous encryption system as part of putting together stories? Not acceptable.


No. I'm asking a reporter to train himself because he is a point of contact. It's simple, he makes a difference with his words. That's how he makes a living. This is Wired. They should train their people, they write for hyper geeks and many of them are very technically inclined. That's not really asking to much.

And how does something become ubiquitous? We have to start using it. And really if anything is close ubiquitous, PGP is. OTR is rapidly gaining for IM security for what it's worth.

I'm as bewildered as anyone that some consumer-level PnP encryption solution hasn't emerged by now. Should everyone be on encrypted networks? Yes. But they aren't, and only a very small amount of net users use it. If wishes were horses, then beggars would ride. But they aren't, and your wishing everyone would suddenly get smart and savvy isn't going to make it happen.


Ok a few things. I don't understand why you're saying this. I'm not saying that we should encrypt all networks. That's not workable at the moment and it's unlikely in the near future.

And you're right, wishing doesn't help often. I don't spend my time wishing, I spend my time working. This thread is an example of trying to help someone with a conversation on the subject, I've even offered to help beyond metafilter. So perhaps you're wishing and I'm offering real help to at least one person? ;-)


"Point the second: don't shift the argument. The wholesale, warrantless interception of our net traffic by the feds is unconstitutional, and must be stopped."


I'm not trying to shift this. I fully agree with you. I'm simply adding to the conversation by pointing out working solutions that can help you regardless of whatever legal solutions are finally reached. You still have to deal with the reality of networks, people will break the law. CYA, right?
posted by ioerror at 3:00 PM on April 7, 2006

zoogleplex,

Not a free country anymore, this is solid evidence of that.

I would partially agree with you. This is just another example of abuse. Some people want to redefine freedom and we have to stop them. Voting helps.

None the less, security of this type isn't just about governments monitoring us, it's just a simple understanding of how networks work. It doesn't stop traffic analysis, it might slow it down. Maybe.
posted by ioerror at 3:04 PM on April 7, 2006

dirty bomb Allah airliner Bush Hamburg "Gardez safe house" Skopje cell paradise "Great Satan" martyrs virgins Osama 9/11 "coming soon" Madrid London New York "Capitol Building" "Prince Bandar"

MeFi's and my door kicking in in 5- 4-3 -2

oh wait,,,,that will be in a year and a half when they get to the transcripts. I forgot we're kinda dealing with the Post Office here

anyway....I'll put on some coffee, and oil up my AK47
posted by timsteil at 3:07 PM on April 7, 2006

And for those that haven't already, go give some money to the EFF. They're fighting this battle head on.
posted by ioerror at 3:32 PM on April 7, 2006

Users of POP3, FTP, and telnet, I'm looking right at you, since you are broadcasting your login ID and password in plaintext when you use these protocols. All of these have secure alternatives (POP3-over-SSL, SFTP, SCP, SSH, etc.), so use them. For email there's OpenPGP and S/MIME.

Nobody but people logging into routers behind firewalls use telnet anymore, and it's usually disabled.
posted by cellphone at 3:45 PM on April 7, 2006

cellphone,

Actually, I've seen telephone companies control their switches with telnet and not behind any firewalls... Scary stuff. ;-)
posted by ioerror at 4:01 PM on April 7, 2006

"Voting helps."

This remains to be seen as well, in my opinion, ioerror.

I'm taking the skeptic position on government trustworthiness, if that's not clear. :)
posted by zoogleplex at 5:22 PM on April 7, 2006

Thanks for responding to my post, ioerror. BTW, your username is such that I'm sure you have a t-shirt somewhere in your pile that says "rm -r *". ;^D

I can't say anything to your problems but I do believe that you likely needed to RTFM ;-) Or at least explain what "usable" is? PGP isn't a perfect solution to everything, I know that. It does however solve a bunch of problems that were unsolved before.

Not good enough. Not by a long shot, and everybody tip-toes around it because it's what's to be had. PGP is like the Democratic party of data protection.

The web of trust sucks but it can be (for many things) better than nothing.

Better Than Nothing is a slogan you should pitch to the manufacturers. They'll be happy for the feedback.


I'm saying, contribute to the solution rather than being stubborn about fixing the problem. :-)

Actually, the US Constitution is something I'm willing to be stubborn about. And I don't think it's a vice or a triviality to be worked around.
posted by squirrel at 5:32 PM on April 7, 2006

zoogleplex ,


"Voting helps."

This remains to be seen as well, in my opinion, ioerror.

I'm taking the skeptic position on government trustworthiness, if that's not clear. :)


I'm trying to be an optimist here. Don't think I disagree with you entirely though.
posted by ioerror at 5:59 PM on April 7, 2006

squirrel,


Thanks for responding to my post, ioerror. BTW, your username is such that I'm sure you have a t-shirt somewhere in your pile that says "rm -r *". ;^D

Heh, no problem. I actually own no such shirt but mostly because I have more silly joke t-shirts.


"I can't say anything to your problems but I do believe that you likely needed to RTFM ;-) Or at least explain what "usable" is? PGP isn't a perfect solution to everything, I know that. It does however solve a bunch of problems that were unsolved before."

Not good enough. Not by a long shot, and everybody tip-toes around it because it's what's to be had. PGP is like the Democratic party of data protection.


You didn't explain what "usable" is? Nor did you explain what problems it doesn't solve? What do you wish PGP did? What do you think it does?

For me, it provides identity. It provides integrity of messages. It provides anonymous messages encrypted to anonymous recipients. It provides verifiable messages that aren't encrypted. It provides anonymously encrypted messages. It allows me to revoke an identity. It does more too.

Can you explain what you think it doesn't do? What am I missing that you see?


"The web of trust sucks but it can be (for many things) better than nothing."

Better Than Nothing is a slogan you should pitch to the manufacturers. They'll be happy for the feedback.


The web of trust sucks because it's used by people in negative ways. It's useful to have a WoT much of the time.

It is better than nothing in that the good often out weighs the bad.


"I'm saying, contribute to the solution rather than being stubborn about fixing the problem. :-)"

Actually, the US Constitution is something I'm willing to be stubborn about. And I don't think it's a vice or a triviality to be worked around.

I fully agree. Don't get me wrong. I'm telling you to ensure your civil liberties. If you don't have the liberties, all bets are off. Crypto is only moderately useful in a police state. Probably it's going to get you killed.

So use some crypto. You're allowed to. It protects you. You'll be safer against rouge crackers and warrant-less wiretaps than no protection at all. It's the difference of having a system that fails open and a system that fails closed.

And I hate to use an analog but...
I want a cure for all STDs. It's even a crime to transmit infectious diseases. Still, I'll always use protection. It's better safe than sorry, right?

This goes double when you know your risk is so high. The risk for communications being intercepted on the internet is pretty much a given. Depending on who or where we are, it's a matter of routine.

So make it more illegal, enforce the laws that we already have and still, use crypto to ensure that what you perceive is actually the reality. [0]

[0] Secret NSA crypto breaking farms aside.
posted by ioerror at 6:17 PM on April 7, 2006

Look, take the techno penises outside and compare them all you want...but the issue at hand here is not "how should I protect my email", but is "how should we protect ourselves from an insane power grab by the executive branch".
posted by dejah420 at 6:18 PM on April 7, 2006

Yeah, io, I get the sense you're playing devil's advocate a little bit regarding the constitution argument versus the practical angle. I tend to agree with your feelings about the importance of encryption, but we disagree about the reality of how easily or completely it has, or can, become ubiquitous.

Barring any unforeseen spike in development and adoption, PGP will remain a niche utility. One can only dream of a scenario in which the geeks who know PGP will create a nice fat GUI for it all, make it PnP, and write easy to admin protocol server tools for it on all major platforms and release them open-source.

However, the point is rather academic because that hasn't happened yet and at this stage won't happen fast enough.

The point of this thread is the current reality, not the what-if scenario, that millions of unprotected citizens are having their data warehoused by their government, and there isn't a tool less complicated than an atomic microscope that they can use for protection. Your admonishments for not knowing how to install one of the available arcane and groggily supported tools are out of touch with the reality of the users.

There is a massive, unprotected user base that the collective network administration of the private sector is leaving open to a hideously invasive virus that is being operated with impunity by the US government. That's not a scenario, that's a fact.

I agree with all your points for far as they're devil's advocate or academic arguments. But please acknowledge that the reality of the operation currently underway is not going to be corrected by PGP.
posted by squirrel at 6:19 PM on April 7, 2006

ioerror, I appreciate the offer. Let's have coffee sometime, since we both live in SF. I'll get in touch.
posted by digaman at 8:08 PM on April 7, 2006

dejah420,

Look, take the techno penises outside and compare them all you want...but the issue at hand here is not "how should I protect my email", but is "how should we protect ourselves from an insane power grab by the executive branch".
posted by

This isn't about ego. I don't care if I have a techno penis. I'm sure it's much smaller than most anyway. I'm sorry if it comes off that way. I'm trying to be helpful, I'm sorry if I suck at that in this type of forum.

Still, the fact stands, I actually am telling you just one way to protect yourself from this type of threat. There are also other reasons to take these steps, not just a giant power grab by the people in power.

Not encrypting emails when you can, not encrypting IM conversations, not making an effort to become anonymous is going to cost people in the long run. Especially if those people are working in a position to have sensitive information passed their way. Whistle blowers, etc

There are files being built on everyone. It's automatic. That is the lesson here. The threat is real. They really are watching and they have help from the people that carry our communcations.

Just to be clear, I understand that the people at AT$T must feel immense pressure to comply with the state. Still, their actions are nothing less than collaboration. They've gone above and beyond. It's inexcusable to do what they have done. They should stop or be stopped. They should be punatively punished so that they never do this again.

We should also make this type of interception more diffcult for them. That's why I was urging digiman (or anyone really) to just install some basic applications that are free anyway. It's not perfect but it at least makes this type of wholesale data sniffing less useful to an attacker (the NSA and AT$T this time).
posted by ioerror at 8:56 PM on April 7, 2006

digaman,

Sounds like a plan. I look forward to it. Shoot me an email ;-)
posted by ioerror at 8:57 PM on April 7, 2006

squirrel,

Yeah, io, I get the sense you're playing devil's advocate a little bit regarding the constitution argument versus the practical angle. I tend to agree with your feelings about the importance of encryption, but we disagree about the reality of how easily or completely it has, or can, become ubiquitous.

I'm not playing anything. I'm making suggestions for solutions that are workable. I know it's not perfect but trusting the network is always someones first mistake. So you take care of trust at different layers. It's a workable solution for many people in my experience.


Barring any unforeseen spike in development and adoption, PGP will remain a niche utility. One can only dream of a scenario in which the geeks who know PGP will create a nice fat GUI for it all, make it PnP, and write easy to admin protocol server tools for it on all major platforms and release them open-source.

However, the point is rather academic because that hasn't happened yet and at this stage won't happen fast enough.


I'm starting to wonder if you've ever used PGP or GnuPG. I'm leaning towards no. The OpenPGP standard is open. It's fully implemented in free open source software as well as commercial products. Most stuff you just have to flip a switch. With OTR, you just install Adium on Mac OS X, it's on by default. Nothing to it.

There are nice friendly GUI wizards. There are HOWTOs. There are questions where PGP is the answer. Others where OTR or something like IPSEC. It depends on what you're trying to protect against.

You still haven't told me what PGP does wrong and I'm starting to think it's because you don't use it. That's OK but you should at least cop to it, I'm feeling slightly trolled but I'll give you the benefit of the doubt...

The point of this thread is the current reality, not the what-if scenario, that millions of unprotected citizens are having their data warehoused by their government, and there isn't a tool less complicated than an atomic microscope that they can use for protection. Your admonishments for not knowing how to install one of the available arcane and groggily supported tools are out of touch with the reality of the users.


I agree that the issue is that AT$T/NSA program. The tools aren't too complicated though, you give people too little credit. I work with non-technical people and often with a little analogy, they get the importance of different parts of the system. Communications security isn't just some simple problem. Just banning AT$T from doing this isn't making anything more secure. They should be banned but that shouldn't make you feel more secure. At best it should give you hope that things haven't gone too far and that our system is still workable.

Using software like PGP can be complicated but that doesn't mean it isn't useful. Much like driving a motorcycle or car can be daunting at first but eventually, it's second nature for most people if they just understand what it does and why they need it.


There is a massive, unprotected user base that the collective network administration of the private sector is leaving open to a hideously invasive virus that is being operated with impunity by the US government. That's not a scenario, that's a fact.


I agree that it's a fact. It is also a threat/risk model in my mind. I'm looking at it analytically and trying to find a stop gap solution that presumes we're not totally living in The Grim Meat Hook Future. Even if we were totally doomed and this was ruled entirely legal, I'd still advocate the use of cryptography until it became dangerous to do so. It's a form of information self defense in the information age. It stops some types of snooping and it's important, do you dispute that? Do you find no value in what I bring to the table here?


I agree with all your points for far as they're devil's advocate or academic arguments. But please acknowledge that the reality of the operation currently underway is not going to be corrected by PGP.


I wonder if you really do agree because I wonder if you understand that I'm not just advocating using PGP. PGP is just part of the game plan. I'm also advocating PERSONAL RESPONSIBILITY in the game we're all forced to play. When you send an IM, see if you can opportunistically encrypt it using OTR (http://www.cypherpunks.ca/otr/). When you send an email, see if it's possible to use PGP/GPG (http://www.pgp.com/ and http://www.gnupg.org/). When you go to a wifi hotspot, make sure you use a VPN (http://www.openswan.net) of some sort for your connections. Tunnel your web traffic over TOR (http://tor.eff.org/) when you can. Run a node. Participate. Help educate people around you.

Hell if you're in an area near me, I'll come help you personally. If there's enough of you, I'll do a free group training. We'll do a key signing and everything. I'll explain even acronym, I'll tell you why I know what I know and I'll even tell you what I don't know. There's plenty of that also. ;-)

I stand against what the NSA is doing here. I'm pissed at AT$T, they're douche bags at best and collaborating traitors at worst. What do you suggest that I do though? Just sit here and whine? How about offering solutions in addition to supporting the EFF?

What other things can one do in this situation? How can I contribute more? What are you doing about it?
posted by ioerror at 9:28 PM on April 7, 2006

ioerror wrote "We have to create the world we want to live in."

I prefer to accomplish this particular goal by being politically active, voting, asserting my rights and operating with an assumption that the government works for me rather than against me.

Strong crypto is always an option, but one I'll pursue only when my faith in the others fails me.
posted by VulcanMike at 10:29 PM on April 7, 2006

VulcanMike,


I prefer to accomplish this particular goal by being politically active, voting, asserting my rights and operating with an assumption that the government works for me rather than against me.


You had me until the last assumption. I don't just use strong crypto because of the possible (and realistic) issue of government sponsored monitoring. See above for other reasons.


Strong crypto is always an option, but one I'll pursue only when my faith in the others fails me.


I'm glad it's an option for you. I wish that people didn't see it as a last resort in a failing system though. It's a useful paradigm when you're being politically active (for collaboration on ideas that may be unpopular), when you're discussing issues (perhaps unpopular ones) that you'll vote on or when you're asserting any of your rights (perhaps ones that may go away soon).
posted by ioerror at 12:20 AM on April 8, 2006

io, I can see you're operationg from a place of good faith. I haven't meant to dodge your questions about the weakensses of PGP; I'm not a troll. To me, the individual shortcomings of PGP (e.g. it's a limited system, protecting only between protected nodes on a multi-multi-node system) are beside the point. The point I'm focused on is that the user base isn't ready for it. And I can see we'll just have to agree to disagree on that. We both have experience as technology people; my experience with users has made me less, well, expectant of the average user. Nevertheless, I can see your heart is in the right place. When the revolution comes, swing by my shelter sometime for tinned tuna and a killer merlot. Bring ammo.
posted by squirrel at 12:33 AM on April 8, 2006

"
The AT&T whistleblower speaks:


While doing my job, I learned that fiber optic cables from the secret room were tapping into the Worldnet circuits by splitting off a portion of the light signal. I saw this in a design document available to me, entitled "Study Group 3, LGX/Splitter Wiring, San Francisco" dated Dec. 10, 2002. I also saw design documents dated Jan. 13, 2004 and Jan. 24, 2003, which instructed technicians on connecting some of the already in-service circuits to the "splitter" cabinet, which diverts some of the light signal to the secret room. The circuits listed were the Peering Links, which connect Worldnet with other networks and hence the whole country, as well as the rest of the world.

One of the documents listed the equipment installed in the secret room, and this list included a Narus STA 6400, which is a "Semantic Traffic Analyzer". The Narus STA technology is known to be used particularly by government intelligence agencies because of its ability to sift through large amounts of data looking for preprogrammed targets. The company's advertising boasts that its technology "captures comprehensive customer usage data ... and transforms it into actionable information.... (It) provides complete visibility for all internet applications."

My job required me to connect new circuits to the "splitter" cabinet and get them up and running. While working on a particularly difficult one with a technician back East, I learned that other such "splitter" cabinets were being installed in other cities, including Seattle, San Jose, Los Angeles and San Diego... unlike the controversy over targeted wiretaps of individuals' phone calls, this potential spying appears to be applied wholesale to all sorts of internet communications of countless citizens.
posted by digaman at 9:25 AM on April 8, 2006

Can Narus single-handedly kill VoIP telephony?
posted by digaman at 9:28 AM on April 8, 2006

Thx, digaman. It is very interesting to hear about the specific technologies in use.
posted by sonofsamiam at 9:38 AM on April 8, 2006

Thanks squirrel. I'll keep that in mind. And thanks digaman this is important stuff.
posted by ioerror at 10:11 AM on April 8, 2006

techno penis

I believe the term the hip kids are using these days is "epeen".
posted by beth at 10:14 AM on April 8, 2006

Beth,

I've often heard it used as: "ePenis++" or "ePenis--" YMMV.
posted by ioerror at 2:07 PM on April 8, 2006

"This theory, taken to its logical conclusions, gives the President the ability to treat anyone living in the United States, including particularly U.S. citizens, as wartime enemies without having to prove their disloyalty to anyone outside the executive branch. In so doing, it offers him what can only be called dictatorial powers-- that is, the power to suspend ordinary civil liberties protections on his say so. The limits on what the President may do under this theory are entirely political-- the question is whether the American people will stand for what the President has done if they discover what he has done in their name. But if the American people don't know what their executive is doing, they can hardly be in a position to object. And so the President has tried to keep secret exactly what he has done under the unreasonable and overreaching theory of Presidential power that his Administration has repeatedly asserted in its legal briefs and public statements.

Attorney General Gonzales' latest admission should hardly surprise us once we understand how much power the President actually thinks he has. Given that we will probably never know what the President has been doing in our name, we can only hope that he has not actually tried to exercise all the power he (wrongfully) thinks he possesses."
posted by digaman at 5:18 PM on April 8, 2006