Edward Snowden: Permanent Record

Extra comment to add something I left off. There's at least two types of static analysis and solver tools: unsound and sound. The sound ones, especially RV-Match and Astree Analyzer, use a formal semantics of the code, a formal statement of the property, and automatic analysis to determine if it holds or doesn't depending on the goal. Related, SPARK Ada and Frama-C have their formal specs and code turned into verification conditions that check for code conformance to the specs. The VC's go through Why3 which sends them to multiple, automated solvers to logically check them. Far easier to scale and get adoption of these automated methods than manual proofs.

The main drawback is potential errors in the implementations of the analyzers or solvers that invalidate what they prove. Designs for certifying solvers exist which essentially are verified or produce something verifiable as they go. There's examples like verSAT and Verasco. The tech is there to assure the solvers. Personally, I'm guessing it hasn't been done to industrial solvers due to academic incentives. Their funding authorities push them to focus on quantity of papers published over quality or software improvements with new stuff over re-using good old stuff. Like infrastructure code, everyone is probably just hoping someone else does the tedious, boring work of improving the non-novel code everyone depends on.

Also, given my background in high-assurance research, I'm for each of these tools and methods, mathematical or not, to be proven over many benchmarks of synthetic and real-world examples to assess effectiveness. LAVA is one example. I want them proven in theory and practice. The techniques preventing or catching the most bugs get the most trust.

I upvoted you because your first sentence is a useful observation, but I'm having a hard time using any of that to justify throwing away a wifi adapter. Even if it were possible to fingerprint the adapter beyond its MAC address, there's no global database of whitehat pentester wifi adapter fingerprints, and such a thing would be worthless anyway. You're not going trigger countermeasures by reusing a wifi adapter. The only threat model that remotely makes sense for that kind of precaution is fear of nation-state level resources trying to identify and catch you. And that's well outside of the realm of "pentesting".

(And the idea of accidentally exfiltrating data through a reused wifi adapter is ludicrous)

We detached this subthread from https://news.ycombinator.com/item?id=20939039 and marked it off-topic.

I'll quote myself, "I'm not pretending that the sitting president's policy decisions and other influences don't have an effect. But inherited legacy, context, and the surrounding details play a huge role in how these things play out."

The point being, there are often things initiated by past presidents that come to a head within the time the sitting president is in office. How the situations that arise are handled absolutely reflects on the sitting administration. But people who ignore the history and legacy surrounding those situations because it feels good to take a shot at an administration that has a letter after it (be it R or D) that a person doesn't identify with is overly simplistic.

There were a lot of things the Obama administration did that I do not agree with. Specifically, the use of drone strikes, how the ACA was handled (albeit a lot of players were involved), continuing revolving door policies, and more.

None of the facts you have cited contradict anything I said.

The data that is sent into the PRISM system is data that is sent by cloud providers, in response to a targeted warrant. The data is not collected whole-sale - it is targeted to a particular individual. That's the whole bloody point of warrants.

Once it's been sent by the cloud providers to the NSA, it ends up in a searchable database. I don't understand what is remotely controversial about that. The source of the data was not whole-sale collection - it was targeted warrants. That it becomes searchable afterwards is not relevant to anything. There is nothing illegal about police retaining data, and maybe even putting it in a searchable database, as long as that data was legally obtained - at least, in the United States.

> And yes, there is supposed to be a formal request where an analyst requests our secret court system approve a search before they carry it out. That process is unsurprisingly a rubber stamp - the court approves 99.97% of all requests. But more importantly this is something with no meaningful oversight.

I'm not sure you understand what the purpose of search warrants is.

Search warrants are overwhelmingly rubber-stamped by courts, regardless of whether it's a secret FISA court, or a local judge who works two days a week in Small Town, AK. The point of having to get a search warrant is not to obstruct the work of police. The courts don't interpret that to be their job.

The point of having to get a search warrant is to prevent fishing expeditions, and to make sure that police are conducting a narrow, targeted search. Most judges will rubber-stamp a search warrant for Bob Joe, based on incredibly flimsy testimony. Most judges will tell a police department to go pound sand if they wanted a search warrant for an entire town.

As long as those FISA courts were dealing with search warrants of the first kind (And all evidence points to this), rubber-stamping them would not have been any different from how regular courts rubber-stamp targeted search warrants.

> "in general, the reality is this: if an NSA, FBI, CIA, DIA, etc. analyst has access to query raw SIGINT [signals intelligence] databases, they can enter and get results for anything they want."

You are conflating two separate parts of PRISM, in a misleading manner.

The first part is how it requests data from cloud providers. It does so by targeted warrant. This is incredibly similar to how regular police operate. They get a targeted warrant, a judge rubber-stamps it, and they serve it. It is incredibly likely that this is not illegal.

The second part is that after it has retrieved the data, that data goes in a database, where every Tom, Dick, and Harry that works for a TLA can search for it (And go on fishing expeditions, in the already-retrieved set of data). This is also not illegal. If you think it is, please point me to legislature, or court precedent that implies that information obtained by the police in a warrant cannot be put into a searchable database.

You are conflating the two, by making it sound like every Tom, Dick, and Harry that works for a TLA can go on an untargeted, whole-sale, unwarranted fishing expedition on Hotmail.com. The simple fact is, they can't. Not via PRISM, at least. This is why the NSA was conducting criminal tapping of cross-datacenter links - because PRISM only let them serve targeted warrants, and they wanted raw, whole-sale, untargeted, backdoor access to your data. That, for some reason, most of the firms implicated in the leaked NSA files were not granting them, hmm...