Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Did the Intercept bungle the NSA leak?

washingtonpost.com

Post reply on HN
Print view View original

71–80 of 245 posts

Re: Did the Intercept bungle the NSA leak?

#71

Post by shorodei »

cmiles74 wrote: post #58
user982 wrote: post #12

Earlier quoted context omitted.

> It has all the appearances of the government trying to smear a news outlet and ensure no one leaks to them again. A scheme that would be less effective if not for The Intercept's demonstrably deficient opsec in protecting its source in this affair.

I don't think The Intercept has much responsibility here at all. In my opinion, in their role as receivers of leaked information, they should verify the information provided to them and decide if it should be released to the public. Sure, they shouldn't reveal their source and The Intercept met that requirement by insuring that they themselves did not know the leaker's identity. Anyone who is thinking about leaking a…

I'm not doubting that the NSA would have figured out the source eventually, yellow dots or not, but I think it's a fair criticism to say the Intercept did not have to publish a picture of the document in full, instead of transcribing the contents.

Re: Did the Intercept bungle the NSA leak?

#72

Post by oasisbob »

thefalcon wrote: post #4
ahoy wrote: post #2

As with every headline that poses a yes/no question, the answer is usually "no". EDIT: I'm also unsure what the point of shifting the focus onto The Intercept's alleged "mishandling" of the leaker's identity is. It seems like a smear job meant to discredit a publication that the natsec community and mainstream media like WaPo dislike. It also removes the focus from the substance of the leaks and puts it on the "chara…

Except it sure seems like in this case, yeah, they bungled it. At the very least a total lack of awareness or care towards infosec to help protect sources (regardless of the fact that the lack of awareness extends to the source - I'd want a journalist to be better at this than I am if I were leaking information). [ The article doesn't mention this, but I wouldn't be surprised if these microdots, rather than "a crease…

Whoa - sure enough, there they are.

The microdots seem to be the usual xerox-style microdots, and decode properly:

Printer serial number: 535218 [or 29535218] Date: May 9, 2017 Time: 06:20

Re: Did the Intercept bungle the NSA leak?

#73

Post by amazingman »

CogitoCogito wrote: post #33
[deleted] wrote: post #25

Earlier quoted context omitted.

[deleted]

Yes it certainly is. The Intercept should have taken such precautions, but it's not very smart to assume that they always will take those precautions. If you want to be safe as the leaker, you'll have to either do that sort of thing yourself or communicate with The Intercept to make sure they will. Point is that you cannot really control how much caution third parties will take with your documents. But like I said, t…

Blaming the leaker is failing the argument.

Re: Did the Intercept bungle the NSA leak?

#74

Post by sctb »

Cozumel wrote: post #14

Check their very public social media profiles[0], Reality Winners reads like she escaped a psych ward so how she was ever given clearance should be an issue in itself. [0] http://www.informationliberation.com/?id=56840

We detached this flagged subthread from https://news.ycombinator.com/item?id=14498647.

Re: Did the Intercept bungle the NSA leak?

#75

Post by ocdtrekkie »

cmiles74 wrote: post #58
user982 wrote: post #12

Earlier quoted context omitted.

> It has all the appearances of the government trying to smear a news outlet and ensure no one leaks to them again. A scheme that would be less effective if not for The Intercept's demonstrably deficient opsec in protecting its source in this affair.

I don't think The Intercept has much responsibility here at all. In my opinion, in their role as receivers of leaked information, they should verify the information provided to them and decide if it should be released to the public. Sure, they shouldn't reveal their source and The Intercept met that requirement by insuring that they themselves did not know the leaker's identity. Anyone who is thinking about leaking a…

I disagree, if the Intercept values leaking things the public deserves to know (their whole raison d'être), they need to do better.

Bear in mind, The Intercept is likely more aware of anti-leaker strategies than most of the people they are hoping will leak them data. If they're going to encourage the act, they should do everything possible to help their sources protect themselves, and do diligence on anonymizing everything they get even further.

Re: Did the Intercept bungle the NSA leak?

#76

Post by defined »

> The methods presented in this paper have many applications in law enforcement such as tracking, counterfeiting, and child pornography. The downside is that they provide a mechanism for a simple device, a printer or a digital camera, to spy on its user. A typical user cannot turn off these signatures, particularly the intrinsic signature, without very detailed knowledge of how the device operates. This could have dire consequences for many important uses of these devices in our society. For example a whistleblower who would like to share documents with a regulatory agency could be in danger in that their printer could be identified as the one that produced the documents. [1]

Prophetic words from a 2008 paper (PDF) [1].

This paper may be duplicate information, but reading this paper impressed upon me how many more ways there may be to spy on people than I could imagine (and I know about some existing things like side-channel attacks... how do I spy on thee? Let me count the ways.)

So don't register your printer with the manufacturer, folks; the serial number may be on every page it prints. Ditto for digital cameras.

Then again, is fighting for digital privacy a losing battle when at every turn, there are deliberately hidden bits of PII? Pun intended.

[1]: https://engineering.purdue.edu/~prints/public/papers/sp_arti...

Re: Did the Intercept bungle the NSA leak?

#77

Post by rtx »

hdolt wrote: post #8

It's getting complicated managing 25 year olds at work these days. Lot of mistrust and entitlement issues I have never seen before. If you are a manager any suggestions about how to handle this stuff?

Hire people who need and respect the job.

Re: Did the Intercept bungle the NSA leak?

#78

Post by [deleted] »

CogitoCogito wrote: post #18
user982 wrote: post #12

Earlier quoted context omitted.

> It has all the appearances of the government trying to smear a news outlet and ensure no one leaks to them again. A scheme that would be less effective if not for The Intercept's demonstrably deficient opsec in protecting its source in this affair.

There's no evidence that it was The Intercept's actions that caused her to be found. I agree that they should be more careful (they should _always_ be more careful), but there are many ways the source could have been found independent of the newspaper. Regardless, the government has many incentives to claim that it was The Intercept's deficient opsec that caused them to find the leaker. There really isn't much you ca…

[deleted]

Re: Did the Intercept bungle the NSA leak?

#79

Post by cmiles74 »

paralelogram wrote: post #23

Why are almost all official documents about Russian government-sponsored hackers "secret" or "top secret"?

In this case, my guess would be fear that people would start distrusting these voting machines and, eventually, the election as a whole. Elections only work when everyone agrees the results are fair.

That said, I think that's an important story here. The infrastructure around these machines seems sloppy. The fact that there's no source code to read means they are black boxes we have to trust.

Re: Did the Intercept bungle the NSA leak?

#80

Post by CogitoCogito »

ucaetano wrote: post #53
CogitoCogito wrote: post #18

Earlier quoted context omitted.

There's no evidence that it was The Intercept's actions that caused her to be found. I agree that they should be more careful (they should _always_ be more careful), but there are many ways the source could have been found independent of the newspaper. Regardless, the government has many incentives to claim that it was The Intercept's deficient opsec that caused them to find the leaker. There really isn't much you ca…

Plenty of evidence: https://arstechnica.com/security/2017/06/how-a-few-yellow-do... Massive incompetence and amateurish stuff on part of the leaker and The Intercept. Yellow dots have been known for ages.

That article contains the following "evidence" claiming this is how the leaker was unmasked:

> Armed with this evidence, the NSA was able to quickly determine who had printed the document by checking audit logs.

So no I see exactly _zero_ evidence in that article that this was the method used. If you have any other article that has such evidence, I'm all ears.

Of course you're correct that The Intercept should have taken more care in this matter, but that doesn't mean that this was the reason why the leaker was found. The leaker should also have been a bit less amateur (e.g. not communicating with The Intercept on a _work_ computer).

Post reply on HN