Live data from Hacker News

Hacking Team, Computer Vulnerabilities, and the NSA

schneier.com

61–70 of 75 posts

Re: Hacking Team, Computer Vulnerabilities, and the NSA

#61
post #60

Earlier quoted context omitted.

How does it matter?

If years after the Snowden revelation, no one has gotten a court to rule that blatant widespread constitutional violations took place at the NSA, you might want to reconsider your claim that there were blatant violations.

You're disingenuous so I'll just not bother anymore.

Re: Hacking Team, Computer Vulnerabilities, and the NSA

#62
post #55

Earlier quoted context omitted.

Look, the NSA as an organization, as a whole, is blatantly violating the Constitution, which is supposedly the most sacrosanct law of the nation. The fact that they don't care about what laws say doesn't get any clearer than that. The fact that no one from NSA has gone to jail for the NSA violating the Constitution shows.. well, pretty much that the government doesn't bother punishing itself for violating its own law…

Has any court ruled NSA actions to be against the Constitution?

http://www.reuters.com/article/2015/05/07/us-usa-security-ns...

http://www.freedomwatchusa.org/federal-judge-rules-against-n...

http://edition.cnn.com/2013/12/16/justice/nsa-surveillance-c...

Re: Hacking Team, Computer Vulnerabilities, and the NSA

#63
post #57
post #51

Earlier quoted context omitted.

They haven't even denied breaking into the HT Network. Should they be accused, would they? I bet a dime-to-a-dollar that should they be accused, they'd release a non-statement to the press: "We cannot comment on...."

Facebook hadn't denied it either. Perhaps they are to blame.

is it facebook's mission statement to provide foreign intelligence to US agencies?

Re: Hacking Team, Computer Vulnerabilities, and the NSA

#64
post #62
post #55

Earlier quoted context omitted.

Has any court ruled NSA actions to be against the Constitution?

http://www.reuters.com/article/2015/05/07/us-usa-security-ns... http://www.freedomwatchusa.org/federal-judge-rules-against-n... http://edition.cnn.com/2013/12/16/justice/nsa-surveillance-c...

The first one doesn't say anything about constitutional issues.

The appeals court did not rule on whether the surveillance violated the U.S. Constitution.

The second link has a ton of links. The first one is only referring to a preliminary injunction; i.e., it found that "there's a good chance the plaintiff will win", but did not find in favor of the plaintiff. As far as I can tell, all the other links there are about the same ruling.

The third link is talking about that same ruling, again:

A federal judge said Monday that he believes the government's once-secret collection of domestic phone records is unconstitutional

Emphasis on believes; that was not a judicial finding that the government violated the constitution.

He didn't even order the government to stop:

However, he put off enforcing his order barring the government from collecting the information, pending an appeal by the government.

What happened on appeal? http://www.cadc.uscourts.gov/internet/opinions.nsf/ED64DC482..., or a more readable summary here http://www.bloomberg.com/news/articles/2015-08-28/u-s-appeal... and http://www.ibtimes.com/nsa-phone-surveillance-ruling-reverse...

Re: Hacking Team, Computer Vulnerabilities, and the NSA

#65
post #60

Earlier quoted context omitted.

If years after the Snowden revelation, no one has gotten a court to rule that blatant widespread constitutional violations took place at the NSA, you might want to reconsider your claim that there were blatant violations.

You're disingenuous so I'll just not bother anymore.

You're stating that the organization "as a whole" is "blatantly" violating the Constitution. Don't you see why your statement is being challenged? It's largely baseless. At most, a small number of programs that the NSA has used have been shown to maybe be unconstitutional.

Re: Hacking Team, Computer Vulnerabilities, and the NSA

#66

Schneier didn't discuss what is IMO the biggest reason for NSA not to report vulnerabilities: it's "pissing into the wind", it's futile. When 10 vulnerabilities are reported and fixed, 11 new ones are quickly found. The vulnerabilities are overwhelming us. Back around the year 2000 Microsoft was being beaten up for all the vulnerabilities in their software. So in 2002 Bill Gates announced "Trustworthy Computing".[1][…

This is why I have an issue with Project Zero. You will NEVER patch all the 0days. There are only a few bugs that I've seen that were so impactful (Heartbleed for example) that it made a massive impact to release and patch it. And as you implied, patching an 0day often publicizes a new vulnerable attack surface with new bugs to follow.

The real way to fix security issues isn't to find new exploits and expose them. It's to architect new ways to prevent whole families of exploits from being possible. I've only really seen Project Zero do one sort of recommendation in this way. Outside of that, I don't feel that them finding 0days and releasing them is actually a significant improvement on security because they aren't even close to plugging all of the holes (or even enough to really make a difference).

Re: Hacking Team, Computer Vulnerabilities, and the NSA

#67
post #53

Earlier quoted context omitted.

One thousand times NO. The rule of law applies to all equally. This the ideal insofar as it is agreed that our current implementation does not achieve that it is an agreed deficiency. The president murders their spouse, expect them to be charged. By definition the rule of law applies to all. The End. Period. The price of freedom is eternal... etc.

> One thousand times NO. The rule of law applies to all equally. This is just your cognitive dissonance talking. You can say "NO" a million times, but Bradley Manning was just imprisoned without trial (and tortured for months.. years?), even though Habeas Corpus was supposed to apply. > The president murders their spouse, expect them to be charged. Why would you expect that? If the president murders his spouse, he's…

You have to accept the rule of law is a worthy ideal to find any real or imagined example of its infringement a problem. To give up on it, to give up on the ideal, to stop raging against the violation of that ideal is to give up on Freedom.

I won't.

Re: Hacking Team, Computer Vulnerabilities, and the NSA

#68
post #48

Earlier quoted context omitted.

The NSA consists of many parts. Some people within it breaking the law does not mean that laws don't matter there.

Look, the NSA as an organization, as a whole, is blatantly violating the Constitution, which is supposedly the most sacrosanct law of the nation. The fact that they don't care about what laws say doesn't get any clearer than that. The fact that no one from NSA has gone to jail for the NSA violating the Constitution shows.. well, pretty much that the government doesn't bother punishing itself for violating its own law…

Also, even if someone at the NSA carried out a program that violated the Constitution, there still wouldn't be jail time. That's not how the Constitution works.

The Constitution is strictly a metric by which courts decide what laws are allowed to say. It binds Congress, not other government workers. And there's generally a presumption that a law is legal until decided to be unconstitutional in court, otherwise people would be afraid to do their jobs.

Re: Hacking Team, Computer Vulnerabilities, and the NSA

#69
post #68

Earlier quoted context omitted.

Look, the NSA as an organization, as a whole, is blatantly violating the Constitution, which is supposedly the most sacrosanct law of the nation. The fact that they don't care about what laws say doesn't get any clearer than that. The fact that no one from NSA has gone to jail for the NSA violating the Constitution shows.. well, pretty much that the government doesn't bother punishing itself for violating its own law…

Also, even if someone at the NSA carried out a program that violated the Constitution, there still wouldn't be jail time. That's not how the Constitution works. The Constitution is strictly a metric by which courts decide what laws are allowed to say. It binds Congress, not other government workers. And there's generally a presumption that a law is legal until decided to be unconstitutional in court, otherwise people…

> Also, even if someone at the NSA carried out a program that violated the Constitution, there still wouldn't be jail time.

It is true that such would be unlikely to be prosecuted, especially if it was authorized from above (and, depending on how it was authorized, there might even be a legal defense -- while ignorance of the law is not a defense, reasonable reliance on legal representations of those responsible for enforcing the law can be), but there is a specific criminal statute that applies to government employees acting deliberately contrary to Constitutional rights (deprivation of rights under color of law, 18 USC Sec. 242.) And an unconstitutional program might also violate the criminal provisions of FISA.

So its not impossible for them to end up in jail, just unlikely for them to prosecuted.

> That's not how the Constitution works.

Sure, the Constitution itself doesn't provide criminal penalties, but there (as noted above) are statutory provisions creating criminal liability for government officers that use their position to deny people Constitutionally-protected rights.

> The Constitution is strictly a metric by which courts decide what laws are allowed to say. It binds Congress, not other government workers.

This is not, in fact, true. Government actions by actors other than Congress, and not justified by appeals to statute, can be decided on Constitutional grounds, both negative (Constitutional limitations) and positive (questions of whether positive authority is granted.)

Some parts of the Constitution, by their own terms, bind Congress directly (but even these have often been construed as more general restrictions on government power even when not exercised through Congress.)

Re: Hacking Team, Computer Vulnerabilities, and the NSA

#70
post #50

Earlier quoted context omitted.

Did the NSA spy on google or did they spy on information passing through googles network? How much "interesting" intelligence would likely be found on HT's network? As for defense, they obviously didnt pass along what they found. If securing US networks was the reason for hacking, they completely failed to accomplish their goal.

I really think that's a distinction without a difference. For all intents and purposes, they spied on google. If you consider the fact that Google considers consumers to be more product than client, the distinction matters even less. But to your other point: This is the NSA's mission statement: The National Security Agency/Central Security Service (NSA/CSS) leads the U.S. Government in cryptology that encompasses bot…

That's an interesting point that the NSA may also be secretly bin patching government systems, but not a theory I've seen expounded much.
Post reply on HN