Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New Charges in Huge C.I.A. Breach Known as Vault 7

nytimes.com

Post reply on HN
Print view View original

121–130 of 187 posts

Re: New Charges in Huge C.I.A. Breach Known as Vault 7

#121

Post by squarefoot »

anonymous5133 wrote: post #114
TomMckenny wrote: post #70

Earlier quoted context omitted.

States, even relatively benevolent ones, take any steps necessary to secure national secrets, even extra legal ones. Take the likelihood that a leaky contractor coincidently is a pedophile. One who works in security yet encrypts stuff with the same cellphone password everywhere. Balance that with the possibility that a motivated state actor could plant such files on a pc or alter logs on a server they are monitoring.…

Completely agree. The narrative being presented is simply not logical to believe. Based on the narrative, this guy works for the cia, highly likely he knows cp is illegal, obtains cp, knows how to use encryption but then uses a weak password. Not using a weak password is like security 101 first 5 minutes of the first class type of knowledge. Im sure im not the only one buying this story.

I also wonder: if I was going to work for the CIA, wouldn't they triple check everything about what I do before hiring me? Whether the child porn evidence was real or planted, the agency doesn't seem to gain much credibility here.

Re: New Charges in Huge C.I.A. Breach Known as Vault 7

#122

Post by ruskerdax »

Cacti wrote: post #78
cortesoft wrote: post #48

Earlier quoted context omitted.

You don't think the CIA would be able to fake the lingo, tone, and character of the scene? I mean, they certainly have access to a ton of real IRC logs about the subject, would probably be pretty easy to swap out some usernames.

The IRC logs are minor pieces of evidence. It’s the VM that is hard to explain away.

There is nothing about the use of a VM that is "hard to explain away." You know what a VM is, right? You know anyone could plant things on a VM just like any other computer, right? You know there are many ways someone like the CIA could obtain a password used to encrypt a VM, right? Perhaps it was not always encrypted? Perhaps his host machine was infected with a key logger? Perhaps they used an exploit in the software he used to encrypt the VM, or a proprietary exploit designed to do exactly this, produced in conjunction with any number of software companies. There are many, many ways this could have happened, and the existence of a VM means literally nothing.

Why are you convinced the presence of a VM in this is significant?

Re: New Charges in Huge C.I.A. Breach Known as Vault 7

#123

Post by zaroth »

krapp wrote: post #112
burger_moon wrote: post #25

Earlier quoted context omitted.

They don't actually publish news articles like the NYTimes though right? anti-secrecy seems to be a part of what wikileaks does but I'm not sure that would be an appropriate name either.

>They don't actually publish news articles like the NYTimes though right? No, they publish classified documents. What they do is more akin to public espionage than journalism.

Ever heard of the Pentagon Papers?

Re: New Charges in Huge C.I.A. Breach Known as Vault 7

#124

Post by woah »

rosser wrote: post #33
DINKDINK wrote: post #28

Earlier quoted context omitted.

Do you mind enlightening us how Wikileaks was a propaganda arm of the Russian government when they released video of US war crimes (murder of journalists in the Collateral Murder video)? If another news organization received the DNC leaks and chose to not publish them, do you think that would have been ethical? Is your position that, one cannot be a US citizen and oppose the US government and if you do you're a Russi…

The selectivity of Wikileaks' leaks put the lie to their claim of being a journalistic entity. Julian Assange has an agenda against certain people/parties, and has demonstrably leaked things that support that, and not leaked things that refute it. I say that as a detractor of many of the same people and institutions Assange dislikes, so check your assumptions of bias before you throw them, please.

Weird definition of a "journalistic entity" I don't think that any news source satisfies your requirement that it be complete non-partisan, even such a thing was even logically possible.

Re: New Charges in Huge C.I.A. Breach Known as Vault 7

#125

Post by Cacti »

anonymous5133 wrote: post #100
Cacti wrote: post #78

Earlier quoted context omitted.

The IRC logs are minor pieces of evidence. It’s the VM that is hard to explain away.

Can you elaborate further?

The complaint is here: https://www.courtlistener.com/docket/6359557/united-states-v...

Pages 3-6 detail the VM. Basically, they found a VM on his computer that was encrypted, with an encrypted file in it, that they unlocked with a password they found on his phone. In the encrypted (truecrypt) file, they found a large amount of what was unmistakenly CP. When they examined the file system, their claim is that there was evidence of a history of using that VM and moving those files around, etc., so it's not like they just appeared one day. Partial files that weren't deleted yet, caches, inode meta data, that sort of thing.

I mean, it's possible to fake, but it would be incredibly easy to fuck that up, and incredibly risky to get caught doing that. If they really wanted to make his life hell, there are easier, less risky, and even legal ways to do it without going to the effort to fabricate 8 years of computer usage that would withstand expert cross examination.

Re: New Charges in Huge C.I.A. Breach Known as Vault 7

#126

Post by krapp »

zaroth wrote: post #123
krapp wrote: post #112

Earlier quoted context omitted.

>They don't actually publish news articles like the NYTimes though right? No, they publish classified documents. What they do is more akin to public espionage than journalism.

Ever heard of the Pentagon Papers?

Yes. But the press didn't simply publish them in their entirety without comment or context, did they?

I understand people want to lionize Wikileaks and consider Julian Assange to be the modern day equivalent to Woodward and Bernstein, but to consider what they do journalism is to discredit journalism. There's a reason Edward Snowden went to the actual press and not Wikileaks.

Re: New Charges in Huge C.I.A. Breach Known as Vault 7

#127

Post by rosser »

woah wrote: post #124
rosser wrote: post #33

Earlier quoted context omitted.

The selectivity of Wikileaks' leaks put the lie to their claim of being a journalistic entity. Julian Assange has an agenda against certain people/parties, and has demonstrably leaked things that support that, and not leaked things that refute it. I say that as a detractor of many of the same people and institutions Assange dislikes, so check your assumptions of bias before you throw them, please.

Weird definition of a "journalistic entity" I don't think that any news source satisfies your requirement that it be complete non-partisan, even such a thing was even logically possible.

I don't expect journalism to be non-partisan. I expect it to be affirmatively transparent about its partisanship.

You're right, though, that nothing actually meets that bar. It's a human institution; it's necessarily flawed. That's why you source across biases and ideologies, and correct accordingly.

The thing I'm talking about is instead the deliberate pretense of not being partisan. Fox News calling itself "fair and balanced", or claiming "We report. You decide." are just particularly egregious examples. When you aren't presenting enough of the picture for someone to form an informed opinion, you're peddling propaganda. I know the propagandist can't admit that's what he's doing, so I hold journalism to the standard of integrity of knowing, and owning, its biases.

But it's ultimately a spectrum, and it's on me to gauge where on that spectrum any given source lands. Some things are more propaganda than journalism. Some things are more or less one or the other to different degrees on different topics, at the same time. Sometimes they're at different points on the same topic, on different days, or in different stories.

It's complicated, sure. But, holding as nuanced an appreciation of this mess as I hope I've implied, I hope also that you'll give me the credit of not merely talking out my ass when I say I find Assange to be towards the propagandist pole.

Re: New Charges in Huge C.I.A. Breach Known as Vault 7

#128

Post by Cacti »

ruskerdax wrote: post #122
Cacti wrote: post #78

Earlier quoted context omitted.

The IRC logs are minor pieces of evidence. It’s the VM that is hard to explain away.

There is nothing about the use of a VM that is "hard to explain away." You know what a VM is, right? You know anyone could plant things on a VM just like any other computer, right? You know there are many ways someone like the CIA could obtain a password used to encrypt a VM, right? Perhaps it was not always encrypted? Perhaps his host machine was infected with a key logger? Perhaps they used an exploit in the softwa…

My other comment is below. Have you read the complaint? The government is claiming that there is essentially 8 years of evidence on that VM, that in addition to the actual CP, there is a long trail of metadata and inode data that would be fairly difficult to fake.

I mean, think about it: if you were the defendant, all you'd have to do is have someone examine it and find inode activity when you had a clear alibi that the government didn't know about (which would be easy, given we're talking 8 years here, he'd just have to find when he was on a date or out to dinner or something, the government isn't going to know his entire life history for 8 years), and you'd be well on your way to creating enough doubt with a jury.

Now, it's possible the government is lying, but if they're not, it strains credulity to think that they'd go to the effort, cost, and risk to fake that VM in such elaborate detail. If they wanted to ruin his life, there are hundreds of easier ways to do it than such an elaborate fraud.

Re: New Charges in Huge C.I.A. Breach Known as Vault 7

#129

Post by Cacti »

bb88 wrote: post #117
Cacti wrote: post #115

Earlier quoted context omitted.

You’re making an assumption, that it was weak. What we know is that they found the password on his phone. It could have been quite strong.

I think the question I have is did the guy have a password manager on his phone?

This is a big blank spot in the complaint, which tells me they broke or got around the encryption somehow. If it was in cleartext they would have said so because it would have added to their case.

Re: New Charges in Huge C.I.A. Breach Known as Vault 7

#130

Post by retsibsi »

pbhjpbhj wrote: post #75
mikec3010 wrote: post #67

Earlier quoted context omitted.

I arrive at the opposite conclusion from reading that. Someone smart enough to work in black hat security should know how fucking illegal CP is, how aggressively its investigated, and know not to flagrantly talk about it on an irc channel and host it to randos online. At the very least they would use tor and figure it out for themselves.

You certainly wouldn't want that guy in charge of doing anything covert! Is it trying to say he used his real name in IRC too (or is that interpretation for the file)!?

The indictment says he used the username 'Josh'.
Post reply on HN