Live data from Hacker News

Unraveling NSA's TURBULENCE Programs

robert.sesek.com

1–10 of 28 posts

Re: Unraveling NSA's TURBULENCE Programs

#2
This is so disturbing. I honestly feel that with every one of these revelations, my interest in the technology world is degraded more and more. The existence of such heinous things as the TAO, and its tendrils, brings on a serious depression. Just who do these people think they are, to defeat our lives so completely, for their own sakes? Despicable.

Re: Unraveling NSA's TURBULENCE Programs

#3
Would love to know more about the "Pairing and Crypt attacks" along with "Cryptovariable management". Probably the pairing here is referring to the pairing between client and server rather than the cryptographic technique of using pairings ... but it seems this hasn't surfaced in any of the other snowden docs. I often wish the journalists working on that story had released more source material.

Re: Unraveling NSA's TURBULENCE Programs

#4
post #2

This is so disturbing. I honestly feel that with every one of these revelations, my interest in the technology world is degraded more and more. The existence of such heinous things as the TAO, and its tendrils, brings on a serious depression. Just who do these people think they are, to defeat our lives so completely, for their own sakes? Despicable.

They have a very pro-end-justifies-the-means attitude. Just listen to DoJ defend most of the illegal spying they get caught with. They keep saying "...but it's effective!". As if that makes it less illegal.

The sad part is the mass surveillance done by the NSA, by and large, isn't even that. Maybe it's effective for economic spying, or spying on political leaders, or hacking into other countries infrastructures, or even helping to assassinate random people in Middle East who happen to be in the area of "terrorists", who may or may not be guilty of terrorism. But it's so easy to just press that drone's button, especially when it happens so far away from home and with nobody to hold them accountable...so who cares, I guess? It's easier and cheaper to kill someone with perhaps 20 percent chance of being a terrorist, than not doing that (I think that's their attitude towards this). Autonomous killer drones will only make this problem 10 times worse, as they can kill many more such people, faster. And with every innocent life taken this way, 10 more people ending up hating America (but not for its freedoms).

But so far there's no evidence that this mass spying would actually help with its promoted and intended goal - "stopping the next 9/11". If anything, there's probably evidence against it. A bigger haystack is just that - a bigger haystack in which to find the needle, and way more false leads, with biased algorithms that lead to the harassment of tens of thousands, if not millions, and without them ever knowing why they are even harassed in such a way.

Re: Unraveling NSA's TURBULENCE Programs

#5
post #2

This is so disturbing. I honestly feel that with every one of these revelations, my interest in the technology world is degraded more and more. The existence of such heinous things as the TAO, and its tendrils, brings on a serious depression. Just who do these people think they are, to defeat our lives so completely, for their own sakes? Despicable.

They have a very pro-end-justifies-the-means attitude. Just listen to DoJ defend most of the illegal spying they get caught with. They keep saying "...but it's effective!". As if that makes it less illegal . The sad part is the mass surveillance done by the NSA, by and large, isn't even that. Maybe it's effective for economic spying, or spying on political leaders, or hacking into other countries infrastructures, or…

> and way more false leads, with biased algorithms that lead to the harassment of tens of thousands, if not millions, and without them ever knowing why they are even harassed in such a way.

If there is one thing I feel like people should understand about algorithms and computers, it is about this. Just because something is computed does not make it more accurate. It just means greater precision based on the specifications and initial assumptions. More inaccurate calculations does not equal better. Greater dependency on machines to do our reasoning for us, I am partially concerned, has our species ignoring their own capacity to reason for themselves.

The thing I can't understand is how these people who do spy have any sense of self of which to reason with. The more they focus on that which exists outside of themselves, the harder it is to discern between what they are and what they fight against. I wish people would just honestly, sit down for like a year or something, and take a good long look in the mirror and introspect, rather than everything being action action action. Just because everything looks like it's moving doesn't mean it actually is.

Re: Unraveling NSA's TURBULENCE Programs

#6

Would love to know more about the "Pairing and Crypt attacks" along with "Cryptovariable management". Probably the pairing here is referring to the pairing between client and server rather than the cryptographic technique of using pairings ... but it seems this hasn't surfaced in any of the other snowden docs. I often wish the journalists working on that story had released more source material.

They're only slides. We don't have audio of the presentations. :)

I did wonder about that, but no "common" internet encryption protocols use pairing-friendly (in the open source cryptographic community sense) primitives. I think you're about right and it probably refers to matching public and private keys for CAs in SSL/TLS, looking up suitable intermediate CAs, for which they may have a few keys stashed away. They don't seem enthusiastic to wave them around much, however.

I believe they probably have long-term cryptologic cracking capability (HPC) including 1024-bit RSA, but probably not 2048-bit. Maybe MD5? Maybe SHA1?

Look at the long list of trusted CAs in a browser, and try to map all the intermediates they've ever signed. You may find a few likely candidates.

Re: Unraveling NSA's TURBULENCE Programs

#7

Earlier quoted context omitted.

They have a very pro-end-justifies-the-means attitude. Just listen to DoJ defend most of the illegal spying they get caught with. They keep saying "...but it's effective!". As if that makes it less illegal . The sad part is the mass surveillance done by the NSA, by and large, isn't even that. Maybe it's effective for economic spying, or spying on political leaders, or hacking into other countries infrastructures, or…

> and way more false leads, with biased algorithms that lead to the harassment of tens of thousands, if not millions, and without them ever knowing why they are even harassed in such a way. If there is one thing I feel like people should understand about algorithms and computers, it is about this. Just because something is computed does not make it more accurate. It just means greater precision based on the specifica…

Just as the historical perspective, the automatic data processing was used even before electronic computers, and even by the Nazi regime to support genocide:

http://en.wikipedia.org/wiki/IBM_during_World_War_II

That's why it's important to actively care and to organize the society to minimize the potential for the undesired use of the possibilities given by the technology: the technology can amplify both the good and and the bad acts. The society has the chance to influence that easier before the tipping points and only after a lot of harm already being done after them. On another side, once the tipping point is reached, even if some system didn't exist before, it would be implemented fast.

The position of the "consumers" in the digital world is also something that has some interesting comparisons:

http://www.wired.com/2012/11/feudal-security/

Re: Unraveling NSA's TURBULENCE Programs

#8
So if you're a VPN user, you get extra special attention from the NSA.

> In the case of VPN traffic, a system called HAMMERSTEIN identifies the traffic and sends the metadata to a database called TOYGRIPPE. The TOYGRIPPE database is a “repository of VPN endpoints”14 that is used by targeting officers to determine if that computer should be a target for further exploitation 13. The TURMOIL VPN module also looks up the IP information in a database called KEYCARD to determine if the target should be tasked for targeted SIGINT collection or to recover the VPN key. Of special note is that this VPN traffic passes through a system called “TE-VPN PIQ Blade.” PIQ refers to the PICARESQUE ECI marking 38, which is associated with BULLRUN 16. The BULLRUN program is NSA’s effort to weaken and exploit encryption that protects digial SIGINT, whether by finding bugs in cryptographic algorithms or by manipulating standards bodies or companies into weakening encryption tools. It is safe to assume that PIQ is a compartment that contains the details of a cryptologic attack against a specific VPN technology (or technologies), which the NSA/GCHQ either found or paid for.

Re: Unraveling NSA's TURBULENCE Programs

#9
post #2

This is so disturbing. I honestly feel that with every one of these revelations, my interest in the technology world is degraded more and more. The existence of such heinous things as the TAO, and its tendrils, brings on a serious depression. Just who do these people think they are, to defeat our lives so completely, for their own sakes? Despicable.

> my interest in the technology world is degraded > brings on a serious depression

Yes I feel this way, too.

It's come a long way from learning GR and HGR in Apple Basic. Telephony modems were fun... Usenet was interesting, the Internet over ethernet was fun but people started to take it seriously... Spam was an amusing nuisance. Around the time of LAMP and RealAudio, circa 1997-2000, things got a little shaky for me. The seriousness level increased. Eternal September then ubiquitous cellphones, business and lifestyles started to depend heavily on the internet. Now, toddlers with tablets, worldwide death threats, mass surveillance, daily international cyberwar, full-on regimented, intense web development and marketing, gate-of-the-month...

It's no longer a strange, miraculous garden full of surprises, but more like other mediums, an appropriated, militarized and polluted playground of propaganda, a staging ground for real-life violence. An electronic Jungian shadow.

I suppose most of the NSA's work is the result of our own base, human natures, a reflection of our failures at international reconciliation. We can't have a naive internet, because the real world is still too violent. With international hatred and war, massive inequality, we can't set up a sweet, pleasant, fun, interesting electronic bridge between one another because too many people want to use that bridge to board and destroy the rest.

But we're so damned determined to have this internet before we civilize humanity, we have to have the NSA build all these paranoiac watch points to prevent our own destruction. It just wears me out...

Re: Unraveling NSA's TURBULENCE Programs

#10
post #7

Earlier quoted context omitted.

> and way more false leads, with biased algorithms that lead to the harassment of tens of thousands, if not millions, and without them ever knowing why they are even harassed in such a way. If there is one thing I feel like people should understand about algorithms and computers, it is about this. Just because something is computed does not make it more accurate. It just means greater precision based on the specifica…

Just as the historical perspective, the automatic data processing was used even before electronic computers, and even by the Nazi regime to support genocide: http://en.wikipedia.org/wiki/IBM_during_World_War_II That's why it's important to actively care and to organize the society to minimize the potential for the undesired use of the possibilities given by the technology: the technology can amplify both the good and…

In theory, I absolutely agree with you.

In practice, every choice as to how to care and organize society become a question of what to control and what not to control. Who can be trusted, and who can't trusted. Then it just seems to go in a circle. Regulation on top of regulation. People make judgments and claim they are assertions rather than assumptions, based on correlative and observationally biased inferences. The system becomes deterministic based on individual impulse, rather than caution, patience, and 'opened' trust.

With individual impulse, it becomes a question of who decides to shape society, rather than how society is shaped. Whoever makes a move first has an advantage in the short term. But this has the potential to be twisted by greed, selfish desire, and delusions of grandeur, or the idea that "what works for me will work for you". Then things get directed towards tipping points. People start believing in power hierarchies, groups, differing orders and levels of intelligence and ability as intrinsic and permanent properties of their existence. And so the pendulum keeps swinging.

Post reply on HN