Live data from Hacker News

Google Security Team Member on NSA: "Fuck These Guys"

plus.google.com

271–280 of 420 posts

Re: Google Security Team Member on NSA: "Fuck These Guys"

#271
post #89

I think it's pretty clear that we need both technical and legislative fixes to NSA surveillance. Just one of the two isn't enough: to get be even vaguely confident that surveillance ends, we need both. The technical fixes I can't speak to, but the legislative ones I've been thinking about for a while. In the last week, there have been two prominent bills announced to deal with surveillance: - Bill 1: The FISA Improve…

Leahy is the author of CALEA, a surveillance law that is one big reason we're in this situation to begin with. He introduced portions of the Patriot Act under the name EPPSCA a year before the Sep. 11 attacks (http://thomas.loc.gov/cgi-bin/query/R?r106:FLD001:S58859).

Leahy has sat on modest surveillance reform (requiring search warrants for email, cell phone location) for over three and a half years without advancing it to the Senate floor. One proposal he circulated a year ago included an exception allowing dozens of federal agencies to access email without a warrant (http://news.cnet.com/8301-13578_3-57552687-38/). Then, after Snowden's revelations, when the political tide was moving toward significant reform, Leahy's first instinct was to handcuff companies from challenging NSLs (http://news.cnet.com/8301-13578_3-57592778-38/).

I suspect that, after all the likely political compromises and conference committees and markups, any bill principally authored by Leahy will follow the same pattern as CALEA and the Patriot Act. One obvious solution, of course, is to avoid limiting yourself to looking at a pair of existing flawed bills and find a politician willing to back real reform.

Another solution, better for HN, is to work toward technical solutions that will work in the likely event that our esteemed leaders in Washington, D.C. get it wrong once again. Trust math, not laws.

Re: Google Security Team Member on NSA: "Fuck These Guys"

#272
post #89

I think it's pretty clear that we need both technical and legislative fixes to NSA surveillance. Just one of the two isn't enough: to get be even vaguely confident that surveillance ends, we need both. The technical fixes I can't speak to, but the legislative ones I've been thinking about for a while. In the last week, there have been two prominent bills announced to deal with surveillance: - Bill 1: The FISA Improve…

"But some really big names (ACLU, CDT)" Just to point out, neither of these are actually big names to congress, or more importantly, particularly effective at getting things passed when push comes to shove. If you want these things passed, never rely on advocacy orgs to do the work of the people.

In fact, there are many members of Congress that would be delighted to oppose whatever the ACLU is recommending (and perhaps even put out a press release announcing it!).

Re: Google Security Team Member on NSA: "Fuck These Guys"

#274

Earlier quoted context omitted.

U.S. law follows U.S. citizens around the world. For example if a U.S. citizen rob a bank in the U.S. and then flees to the UK, when the UK police catch him, he will be extradited and prosecuted in a U.S. court. He's not stuck into a UK jail without a trial. That's the minimum issue here--Google ships the data of U.S. citizens around the world, and the NSA knows it. They are trying to play a cute game by pretending t…

U.S. law does follow U.S. citizens around the world, but only in certain circumstances does it apply to conduct abroad. For example, there is a law against U.S. citizens engaging in underage sex tourism abroad. But such laws are the exception. If you, e.g., murder someone in England, the U.S. can't hold you accountable under American law. Your example is a bad one, because in your example the law is broken by conduct…

The conduct in this case is not the fiber tapping, but the possession and use of U.S. citizen data by the NSA. It does not matter how they gather it, their restrictions are the same--they must limit and justify it.

Re: Google Security Team Member on NSA: "Fuck These Guys"

#275
post #169
post #12

Earlier quoted context omitted.

Why do people assume the Chinese government is not able to use similar techniques?

Why on Earth are you comparing a suppressive regime to the a western democracy? Of course the Chinese gov is able to do so without any repercussions. The difference should be that in a democracy you can't abuse your power without repercussions.

"The difference should be that in a democracy you can't abuse your power without repercussions."

Do you see the irony? Western governments are abusing their powers.. and they are getting away with it. Democracy means nothing if the government doesn't hold itself accountable.

Re: Google Security Team Member on NSA: "Fuck These Guys"

#276

It's ironic that when the Chinese attack against Google occurred, we thought the Chinese government was the most hostile state actor threat to worry about, but it turned out to be the US and UK government.

China is a much more hostile state actor in how it would use any information it gathers up, especially to a free-enterprise company like Google.

That's quite a claim. Right now the NSA holds privileged information for millions of Americans. What happens if one of those people becomes some populist political entity. It would be trivial for the NSA to leak dirt of any kind (sexual fetishes, hangups, private emails to wife, other private things that when taken to the public would look bad, trash talking others, etc) to help discredit this person. Imagine that this person ran on a platform for cutting down the NSA or reforming the intelligence agencies. How "protected" do you think this "metadata" would be?

The Chinese wouldn't do that to me. They don't have a dog in this fight.

Re: Google Security Team Member on NSA: "Fuck These Guys"

#277
post #218

Earlier quoted context omitted.

I know that people don't like lawsuits. But for security to work there should be consequences for not doing security right. To give you an example, if a company X doesn't have any risks or damages from lack of security, then company X should not be investing in security to save money. However, if there is a monetary (or other) liability from a security breach, then the company X will have to make a choice and hopeful…

That would make sense if you had a signed contract from Google that they were encrypting their internal traffic. I don't have that and I doubt anyone else does either. If the courts get involved it should 100% be at the hacking perpetrator, not to the victim.

Side note: Sec 702 of the FAA gives NSA complete immunity from all federal, state, and local laws, criminal prosecutions, and civil lawsuits when doing this kind of fiber tapping. "Notwithstanding" is an extremely powerful phrase. Wildcard. Trumps all other laws.

(And this is why some of us were concerned about CISPA, which uses the identical language. Note CISPA's proponents have quietly faded into the woodwork post-Snowden revelations.)

Re: Google Security Team Member on NSA: "Fuck These Guys"

#278
post #169

Earlier quoted context omitted.

Why on Earth are you comparing a suppressive regime to the a western democracy? Of course the Chinese gov is able to do so without any repercussions. The difference should be that in a democracy you can't abuse your power without repercussions.

"The difference should be that in a democracy you can't abuse your power without repercussions." Do you see the irony? Western governments are abusing their powers.. and they are getting away with it. Democracy means nothing if the government doesn't hold itself accountable.

No, democracy means nothing if the people don't hold the government accountable.

Relying on the government to hold itself accountable makes democracy no different from monarchy.

Re: Google Security Team Member on NSA: "Fuck These Guys"

#279

Earlier quoted context omitted.

You had enemies in the cold war. The USSR was much, much worse.

Things US did for Brazil: Sent aircraft carriers, ships and soldiers to help depose a democratically elected president, just because he wanted closer ties with China and wanted to do agrarian reform. Disappeared lots of people (I don't know any personally, because I am too young, but I DO know personally lots of people that still want disappeared people back) Spied on us (erm, that part still applies, no?). Sabotaged…

[deleted]
Post reply on HN