US physically hacks 100,000 foreign computers(aljazeera.com)
aljazeera.com
US physically hacks 100,000 foreign computers
http://www.aljazeera.com/news/americas/2014/01/us-physically-hacks-100000-foreign-computers-20141154313871671.html
21 comments
It's not about spying anymore, it's about actively working to diminish the security of the everybody to make their job easier.
* Would you accept that the US Government pays tech companies to install secret backdoors in operating systems, hardware, and apps? Windows, Android, iOS are all insecure by default -- and nothing is stopping foreign governments and private agents from taking advantage of these backdoors other than simple secrecy.
* Would you accept that the US Government infiltrates tech companies to install secret backdoors? Don't users (and the tech companies themselves) deserve to know that their hardware/software is being sabotaged? Nothing is stopping foreign governments and private agents from taking advantage of these backdoors other than simple secrecy.
* Would you accept that the US Government infiltrates security standards organizations to install secret backdoors? These security standards are implemented and accepted as high-quality and reasonably free of defects, and they're utilized for all forms of communication on the planet -- but they're rendered insecure for the convenience of the US Government. Nothing is stopping foreign governments and private agents from taking advantage of these insecurities other than simple secrecy.
The US Government is destroying the padlocks on everybody's doors, paying padlock companies to manufacture shitty locks, and infiltrating padlock companies to make sure only shitty locks get manufactured. This isn't just spying, it's malicious.
It's not purely 'gov on gov' anymore -- spying on your adversaries' population gives great insight into the internal political structure of their government. Economic espionage is the norm now, and the US Government is using every advantage it can get now (regardless of the legality).
* Would you accept that the US Government pays tech companies to install secret backdoors in operating systems, hardware, and apps? Windows, Android, iOS are all insecure by default -- and nothing is stopping foreign governments and private agents from taking advantage of these backdoors other than simple secrecy.
* Would you accept that the US Government infiltrates tech companies to install secret backdoors? Don't users (and the tech companies themselves) deserve to know that their hardware/software is being sabotaged? Nothing is stopping foreign governments and private agents from taking advantage of these backdoors other than simple secrecy.
* Would you accept that the US Government infiltrates security standards organizations to install secret backdoors? These security standards are implemented and accepted as high-quality and reasonably free of defects, and they're utilized for all forms of communication on the planet -- but they're rendered insecure for the convenience of the US Government. Nothing is stopping foreign governments and private agents from taking advantage of these insecurities other than simple secrecy.
The US Government is destroying the padlocks on everybody's doors, paying padlock companies to manufacture shitty locks, and infiltrating padlock companies to make sure only shitty locks get manufactured. This isn't just spying, it's malicious.
It's not purely 'gov on gov' anymore -- spying on your adversaries' population gives great insight into the internal political structure of their government. Economic espionage is the norm now, and the US Government is using every advantage it can get now (regardless of the legality).
> Isn't this what they're supposed to be doing? I don't really have a problem with intelligence gathering against non-allied nation state actors.
Shouldn't you have a problem with them getting caught then?
I don't understand this defense of the NSA, no, its not what they are supposed to be doing. At least not anymore.
If you are in favor of the US bullying and spying everyone they don't consider an ally then you should be outraged they can't do it efectively. They got outed by a lone contractor and your "potential enemies", or however you get to call every single other country in the world to justify the spying, now have most of the technical details they need to thwart the NSA's efforts and hence make it spend lots of your taxpayer dollars in coming up with other forms of spying.
Shouldn't you have a problem with them getting caught then?
I don't understand this defense of the NSA, no, its not what they are supposed to be doing. At least not anymore.
If you are in favor of the US bullying and spying everyone they don't consider an ally then you should be outraged they can't do it efectively. They got outed by a lone contractor and your "potential enemies", or however you get to call every single other country in the world to justify the spying, now have most of the technical details they need to thwart the NSA's efforts and hence make it spend lots of your taxpayer dollars in coming up with other forms of spying.
> I don't understand this defense of the NSA, no, its not what they are supposed to be doing. At least not anymore.
What are they supposed to be doing, then? Should the US just not have any spy agencies? Should it shift away from signals intelligence and focus on human intelligence like Israel does?
What are they supposed to be doing, then? Should the US just not have any spy agencies? Should it shift away from signals intelligence and focus on human intelligence like Israel does?
>Should the US just not have any spy agencies?
Absolutely. The US should interact with foreign governments via the diplomatic process, pull up all its foreign bases, and stop playing "world policeman."
Not sure why this is so hard to understand. The justifications for actions like these either fall into "but we can't be world's policeman without these intel programs" or "the other guy does it" which are both morally bankrupt.
Being a citizen of a nation state does not require me to approve of that nation's foreign policy or military actions. In fact, I'm compelled to be extra critical of these things as they are often abused and cause not only domestic issues (large tax load, dead soldiers, blowback, etc) but worldwide issues as well.
We have yet to see any evidence that these dangerous and provocative technical programs have actually resulted in anything used to thwart attacks or other justifications from the usual defenders of the status quo. If anything, from a dollars per result perspective its a major tax dollar waste and a massive opportunity cost. If we had a Russian-like military budget my tax load would be lower and arguably allow me and others to invest and do things that can actually help domestic life, instead of watching my dollars get burned up in spy games and the slaughtering of completely innocent Iraqi and Afghani civilians over the last 10 years.
Absolutely. The US should interact with foreign governments via the diplomatic process, pull up all its foreign bases, and stop playing "world policeman."
Not sure why this is so hard to understand. The justifications for actions like these either fall into "but we can't be world's policeman without these intel programs" or "the other guy does it" which are both morally bankrupt.
Being a citizen of a nation state does not require me to approve of that nation's foreign policy or military actions. In fact, I'm compelled to be extra critical of these things as they are often abused and cause not only domestic issues (large tax load, dead soldiers, blowback, etc) but worldwide issues as well.
We have yet to see any evidence that these dangerous and provocative technical programs have actually resulted in anything used to thwart attacks or other justifications from the usual defenders of the status quo. If anything, from a dollars per result perspective its a major tax dollar waste and a massive opportunity cost. If we had a Russian-like military budget my tax load would be lower and arguably allow me and others to invest and do things that can actually help domestic life, instead of watching my dollars get burned up in spy games and the slaughtering of completely innocent Iraqi and Afghani civilians over the last 10 years.
> Absolutely.
So the US should be the only major nation with no spy agency?
> We have yet to see any evidence that these dangerous and provocative technical programs have actually resulted in anything used to thwart attacks or other justifications from the usual defenders of the status quo.
It may have accomplished nothing. It also may have accomplish something that is still undisclosed.
I'm partially playing devil's advocate here. I do agree with the sentiment that the US should stop behaving like the World Police. However, the idea that the US should have no spy agency in 2014 is ridiculous. All the major nations are spying on each other..
So the US should be the only major nation with no spy agency?
> We have yet to see any evidence that these dangerous and provocative technical programs have actually resulted in anything used to thwart attacks or other justifications from the usual defenders of the status quo.
It may have accomplished nothing. It also may have accomplish something that is still undisclosed.
I'm partially playing devil's advocate here. I do agree with the sentiment that the US should stop behaving like the World Police. However, the idea that the US should have no spy agency in 2014 is ridiculous. All the major nations are spying on each other..
Not sure why this is so hard to understand.
Because diplomats demonstrably don't always cut it when you are dealing with bad-faith actors, and the world is not so full of love and sunshine as to have eliminated all the bad-faith nation-states.
Because diplomats demonstrably don't always cut it when you are dealing with bad-faith actors, and the world is not so full of love and sunshine as to have eliminated all the bad-faith nation-states.
I can only guess your parent believes the NSA should be in defensive-only mode because we are not at war. That's the only half-rational position that fits with his statement that I can think of.
Also, that if they wan't to go offensive, they should try methods and techniques that have not been detailed in the headlines of every mayor newspaper in the world for six months.
A source for mentioned Israeli spy tactics. I've never read that they focus solely on human intelligence
I'm sure they don't focus solely on human intelligence, but the stereotype (perhaps outdated) is that the US is great at signals intelligence, and crappy at human intelligence, and that the inverse is true of Israel.
Reliable sources are hard to come by (for obvious reasons), but just as an example, see: http://www.nytimes.com/2012/03/18/world/middleeast/iran-inte...
> For its spying efforts, Israel relies in part on an Iranian exile group that is labeled a terrorist organization by the United States, the Mujahedeen Khalq, or M.E.K., which is based in Iraq. The Israelis have also developed close ties in the semiautonomous region of Kurdistan in northern Iraq, and they are believed to use Kurdish agents who can move back and forth across the border into Iran.
vs.
> While the National Security Agency eavesdrops on telephone conversations of Iranian officials and conducts other forms of electronic surveillance, the National Geospatial-Intelligence Agency analyzes radar imagery and digital images of nuclear sites. Outside analysts believe high-tech drones prowl overhead; one came down late last year deep inside Iranian territory, though American officials said they lost control of it in Afghanistan.
> Meanwhile, clandestine ground sensors, which can detect electromagnetic signals or radioactive emissions that could be linked to covert nuclear activity, are placed near suspect Iranian facilities. The United States also relies heavily on information gathered by inspectors with the International Atomic Energy Agency who visit some of Iran’s nuclear-related facilities.
> But collecting independent human intelligence — recruiting spies — has been by far the most difficult task for American intelligence. Some operational lapses — and the lack of an embassy as a base of operations ever since the hostage crisis three decades ago — have frequently left the C.I.A. virtually blind on the ground in Iran, according to former intelligence officials.
Reliable sources are hard to come by (for obvious reasons), but just as an example, see: http://www.nytimes.com/2012/03/18/world/middleeast/iran-inte...
> For its spying efforts, Israel relies in part on an Iranian exile group that is labeled a terrorist organization by the United States, the Mujahedeen Khalq, or M.E.K., which is based in Iraq. The Israelis have also developed close ties in the semiautonomous region of Kurdistan in northern Iraq, and they are believed to use Kurdish agents who can move back and forth across the border into Iran.
vs.
> While the National Security Agency eavesdrops on telephone conversations of Iranian officials and conducts other forms of electronic surveillance, the National Geospatial-Intelligence Agency analyzes radar imagery and digital images of nuclear sites. Outside analysts believe high-tech drones prowl overhead; one came down late last year deep inside Iranian territory, though American officials said they lost control of it in Afghanistan.
> Meanwhile, clandestine ground sensors, which can detect electromagnetic signals or radioactive emissions that could be linked to covert nuclear activity, are placed near suspect Iranian facilities. The United States also relies heavily on information gathered by inspectors with the International Atomic Energy Agency who visit some of Iran’s nuclear-related facilities.
> But collecting independent human intelligence — recruiting spies — has been by far the most difficult task for American intelligence. Some operational lapses — and the lack of an embassy as a base of operations ever since the hostage crisis three decades ago — have frequently left the C.I.A. virtually blind on the ground in Iran, according to former intelligence officials.
> If you are in favor of the US bullying and spying everyone they don't consider an ally
Oh come on man. This is plain old Appeal to Emotion.
Let me know when you find a powerful country that does not engage in spying.
Oh come on man. This is plain old Appeal to Emotion.
Let me know when you find a powerful country that does not engage in spying.
As you mention in your post, they didn't get "caught"
> At least not anymore.
Why not "anymore"? What has changed?
Why not "anymore"? What has changed?
Earlier leaks from Snowden showed they are doing this to allied countries, too. Have we forgotten already how they hacked European telecoms? Brazilian oil companies? Bugged EU officials? The title itself mentions EU.
Yes, I'm sure NSA does some of that work, too - their original work - but the problem is they've surpassed their boundaries way too much, and much of what they're doing today is spying on everyone - including innocent citizens and on companies and allies, too. Let's not forget that so easily.
This story seemed like a well planted one to NYT, where they mention the attacks but only to the "worst of the worst" countries, to make people like you believe that "hey, this is what they're supposed to be doing - so I guess everything is fine, then".
I think they've started improving their PR relations for this year. That article had way too many quotes from the NSA for a story about a "leak", and the responses seem well prepared, too.
This is a new year, and now we believe what NSA says about its activities? Read more carefully what the article says:
> The NSA said the technology has not been used in computers in the US.
The NSA! The NSA says. And yet I bet a lot of people read that as if the "leak says" or something along those lines, and they probably believed it.
> "NSA's activities are focused and specifically deployed against - and only against - valid foreign intelligence targets in response to intelligence requirements,'' Vanee Vines, an agency spokeswoman, said in a statement to the Times.
Again, the NSA says. Come on people. Don't be fooled so easily. Oh, and by the way - this is not a Snowden leak, if you didn't figure that out already. It actually seems like a controlled leak by NSA that shows "they are doing their job". The article itself was half-press release for the NSA.
Yes, I'm sure NSA does some of that work, too - their original work - but the problem is they've surpassed their boundaries way too much, and much of what they're doing today is spying on everyone - including innocent citizens and on companies and allies, too. Let's not forget that so easily.
This story seemed like a well planted one to NYT, where they mention the attacks but only to the "worst of the worst" countries, to make people like you believe that "hey, this is what they're supposed to be doing - so I guess everything is fine, then".
I think they've started improving their PR relations for this year. That article had way too many quotes from the NSA for a story about a "leak", and the responses seem well prepared, too.
This is a new year, and now we believe what NSA says about its activities? Read more carefully what the article says:
> The NSA said the technology has not been used in computers in the US.
The NSA! The NSA says. And yet I bet a lot of people read that as if the "leak says" or something along those lines, and they probably believed it.
> "NSA's activities are focused and specifically deployed against - and only against - valid foreign intelligence targets in response to intelligence requirements,'' Vanee Vines, an agency spokeswoman, said in a statement to the Times.
Again, the NSA says. Come on people. Don't be fooled so easily. Oh, and by the way - this is not a Snowden leak, if you didn't figure that out already. It actually seems like a controlled leak by NSA that shows "they are doing their job". The article itself was half-press release for the NSA.
"> The NSA said the technology has not been used in computers in the US.
The NSA! The NSA says. And yet I bet a lot of people read that as if the "leak says" or something along those lines, and they probably believed it."
A leak is, if verified, is both allegation and proof. The leak would be an actual NSA document, which the NSA didn't want made public. If they did, its wouldnt be a leak, it would be public record. If the leak was not true, it would not be a leak, it would be a lie, a fiction. The NSA don't even claim that. So, yes, we believe the leak.
A statement by the NSA is simply what they want to say. It cant be proven or verified, you have to take their word for it. Now, if the NSA were to release verifiable documented proof, then we would have to consider that. But it still is not as powerful as a real leak. It can't be because a NSA release has potential for manipulation since they are the source of the release.
Yes, real leaks from a given source are much more believable than statements from that source. Which is why, time to time, governments like to release information in the form of a leak. So, we do have to be very careful about where leaks come from. In the case of Snowden's leaks, I believe we can be sure that they are real and not a very clever manipulation by the NSA or US government.
So, yes, a lot of people would believe the "leak says" over "the NSA says". Rightly too.
A leak is, if verified, is both allegation and proof. The leak would be an actual NSA document, which the NSA didn't want made public. If they did, its wouldnt be a leak, it would be public record. If the leak was not true, it would not be a leak, it would be a lie, a fiction. The NSA don't even claim that. So, yes, we believe the leak.
A statement by the NSA is simply what they want to say. It cant be proven or verified, you have to take their word for it. Now, if the NSA were to release verifiable documented proof, then we would have to consider that. But it still is not as powerful as a real leak. It can't be because a NSA release has potential for manipulation since they are the source of the release.
Yes, real leaks from a given source are much more believable than statements from that source. Which is why, time to time, governments like to release information in the form of a leak. So, we do have to be very careful about where leaks come from. In the case of Snowden's leaks, I believe we can be sure that they are real and not a very clever manipulation by the NSA or US government.
So, yes, a lot of people would believe the "leak says" over "the NSA says". Rightly too.
It's completely irrelevant anyway. Whoever is in control of releasing press statements in the NSA has no idea what the organization is actually doing.
Yeah, I agree they shouldn't be tapping Angela Merkel's phone calls, and they shouldn't be using the national security apparatus to try to gain an advantage in EU trade negotiations or what have you.
But you better believe Russia, China, Iran, etc. are actively hacking (or attempting to hack) US assets.
And yes, I think this story is way too positive toward the NSA. The NYT is part of the mainstream establishment and generally kowtows to Washington.
But you better believe Russia, China, Iran, etc. are actively hacking (or attempting to hack) US assets.
And yes, I think this story is way too positive toward the NSA. The NYT is part of the mainstream establishment and generally kowtows to Washington.
I am with you. Nice job NSA. In fact, this "technology" doesn't really surprise me at all. If an article came out that said, "NSA can't hack a computer unless it is connected to their own private LAN," then I would be pretty disappointed in my tax dollars at work :)
Seems like a good way to ruin a subsection of international commerce to me! Good job guys! A++ Would trust again!
Nonsense.
Bugging a hundred thousand computers? That's a lot of resources thrown at a problem and the results are terrible. Maybe a single attack averted since 9/11. We know why: too many false positives waste resources - and you don't have that much humint to start with.
That they're doing that much surveillance is a sign that they're either incompetent or the official justification is a smoke screen. They're also spying on allies. Was it really necessary to bug Merkel's cell phone?
Spying on allies and passing off trade secrets only results in backlash - and when that many computers are bugged it's only a matter of time before it's discovered.
While you're growing sigint budgets, you're not spending enough on humint.
Do you really feel safer with the government conducting spycraft so incompetently?
Bugging a hundred thousand computers? That's a lot of resources thrown at a problem and the results are terrible. Maybe a single attack averted since 9/11. We know why: too many false positives waste resources - and you don't have that much humint to start with.
That they're doing that much surveillance is a sign that they're either incompetent or the official justification is a smoke screen. They're also spying on allies. Was it really necessary to bug Merkel's cell phone?
Spying on allies and passing off trade secrets only results in backlash - and when that many computers are bugged it's only a matter of time before it's discovered.
While you're growing sigint budgets, you're not spending enough on humint.
Do you really feel safer with the government conducting spycraft so incompetently?
The issue most people have is the warrantless data collection that's going on. If there is no warrant specifying who, what, where and for how long, there is too much room for exploitation.
It's not that they are hacking. It's that they are not accountable to the system that feeds them.
It's not that they are hacking. It's that they are not accountable to the system that feeds them.
My problem is that they seem to have a hard time keeping straight who exactly their "enemies" are. It seems to end up being us (for damn near any value of us) way too often.
...And sentators are still debating bulk phone records (the first Snowden leak from six months ago) and can't even decide whether or not the NSA should require rubber-stamp court orders to access them.
What are the odds senators will debate the privacy implications of hacking routers all over the world (let alone stop them from doing it)? I'd bet almost zero.
What are the odds senators will debate the privacy implications of hacking routers all over the world (let alone stop them from doing it)? I'd bet almost zero.
The article didn't say they hacked routers.
> The NSA calls the effort an "active defence" and has used the technology to monitor units of the Chinese and Russian armies, drug cartels, trade institutions inside the European Union, and US allies including Saudi Arabia, India and Pakistan, the Times reported.
From the viewpoint of an American: hacking the EU trade institutions, and India, bothers me. The rest is exactly what the NSA et al /should/ be doing. Saudi and Pakistan are "allies" out of necessity -- there is no history of genuine mutual trust and support.
There certainly needs to be more control of who the NSA targets, and better constraints keeping them from targeting others, but pretending that all spying is bad is silly.
> The NSA calls the effort an "active defence" and has used the technology to monitor units of the Chinese and Russian armies, drug cartels, trade institutions inside the European Union, and US allies including Saudi Arabia, India and Pakistan, the Times reported.
From the viewpoint of an American: hacking the EU trade institutions, and India, bothers me. The rest is exactly what the NSA et al /should/ be doing. Saudi and Pakistan are "allies" out of necessity -- there is no history of genuine mutual trust and support.
There certainly needs to be more control of who the NSA targets, and better constraints keeping them from targeting others, but pretending that all spying is bad is silly.
Cool, let's bomb their women and children, blow up their weddings and funerals, and then let's hack their computers because they don't "trust" us.
As long as we are appealing to emotion here, let's not forget that Saudis composed nearly 80% of the 9/11 hijackers that killed our women and children and blew up our workplaces.
Saudi Arabia has done little to engender trust.
Saudi Arabia has done little to engender trust.
Let's count.
On the one hand, put every non-US citizen killed by the US.
On the other hand, put every US citizen killed by all other countries and terrorists combined.
Guess which number is vastly bigger than the other. 5-10 thousand dead in 9/11? That's peanuts, compared to the disproportionate responses that ensued. (I'm not saying it's peanuts in an absolute sense. It's still a tragedy, of course. Any death is.)
On the one hand, put every non-US citizen killed by the US.
On the other hand, put every US citizen killed by all other countries and terrorists combined.
Guess which number is vastly bigger than the other. 5-10 thousand dead in 9/11? That's peanuts, compared to the disproportionate responses that ensued. (I'm not saying it's peanuts in an absolute sense. It's still a tragedy, of course. Any death is.)
Yes, let's. You take care of the non-US citizen part and I'll give you a low-ball for the US citizens killed by other countries number.
If we use this handy wikipedia page shown below we can see that US military casualties are at a touch over 1.3 million.
Let me know when you're done being facetious and/or have an answer for your number of non-US citizens killed.
http://en.wikipedia.org/wiki/United_States_military_casualti...
If we use this handy wikipedia page shown below we can see that US military casualties are at a touch over 1.3 million.
Let me know when you're done being facetious and/or have an answer for your number of non-US citizens killed.
http://en.wikipedia.org/wiki/United_States_military_casualti...
That's 1.3 million since 1775.
In the last 50 years, we're around 7 thousand.
In Iraq alone >10x that number have been killed since the invasion.
I was referring to American numbers, as sourced in the Wiki article above. 10x that number in Iraqi/ Afghani numbers? Sure, I'd buy that.
From my point of view, it was clear your comment and the GP both supported my insinuation that the US has killed far more people than it has lost.
And yet we have pursued no actions against Saudi Arabia... I wonder if they have something we really need that is stopping us from declaring faceless or outright war on them?
And that makes us better than the terrorists, how? 9/11 was an atrocity, no doubt, but people in Yemen and Pakistan live through the same atrocities daily.
You know when the US government tells you it's killing enemy combatants in Pakistan via drone attacks? What they don't tell you is they define any combatants as men aged 18-40 in that region.
You know when the US government tells you it's killing enemy combatants in Pakistan via drone attacks? What they don't tell you is they define any combatants as men aged 18-40 in that region.
The Saudi Arabian government didn't (as far as I know) sponsor or train the 9/11 hijackers. I also don't see how they were really furthering Saudi interests either.
We don't do those things because they don't trust us. We do those things because they are a threat that need to be contained and ideally mitigated. Pakistan is a nuclear power, and Saudi Arabia is incredibly wealthy, and both are quite hostile towards us regardless of certain feigned diplomacy.
> Cool, let's bomb their women and children,
Presumably better than bombing the men.
Presumably better than bombing the men.
> "... there is no history of genuine mutual trust and support."
Trust is supposed to work both ways. Before dismissing countries such as these it's worth looking at the history of relations from both sides.
Trust is supposed to work both ways. Before dismissing countries such as these it's worth looking at the history of relations from both sides.
[deleted]
Trust. But verify.
No. When you're managing someone, there is a status asymmetry that makes it okay. If on the other hand, a "mere" developer verified his manager's work, it would be perceived as rude.
In the case of countries, any such asymmetry is meant with resentment. It is fine that the US spies on, say, Iran? Then it means Iran has lower status than the US. Then it means that an Irani citizen (denizen?) is worth less than an American citizen. While we're at it, why don't we show what we're made up of? Knocking down a building or two should teach them a lesson…
It doesn't really matter that it is right or wrong to spy on another country. But it sure is dangerous, should you ever get caught.
In the case of countries, any such asymmetry is meant with resentment. It is fine that the US spies on, say, Iran? Then it means Iran has lower status than the US. Then it means that an Irani citizen (denizen?) is worth less than an American citizen. While we're at it, why don't we show what we're made up of? Knocking down a building or two should teach them a lesson…
It doesn't really matter that it is right or wrong to spy on another country. But it sure is dangerous, should you ever get caught.
Why post an Al Jazeera summary of an NYT article that has already been posted: https://news.ycombinator.com/item?id=7061012
I think the NYT article didn't hit the top spot. This one has a more sensationalized title and will probably perform better. I guess you have to know your audience.
So that in the future, you can cite two sources for this piece of information.
Al Jazeera has significantly more hipster cred than NYT.
> The NSA calls the effort an "active defence"
Newspeak is real.
Even if the NSA is telling the truth about this only being deployed against foreign targets, the scale of this effort is impressive.
Newspeak is real.
Even if the NSA is telling the truth about this only being deployed against foreign targets, the scale of this effort is impressive.
That's hardly newspeak. A key part of any good defense is information. Infosec to protect your own information is not sufficient.
Thus, information gathering is an active part of defensive operations.
Imagine you are an antimalware company (a real one, a good one). Maintaining a virus tank, actively trawling the internet for brand-new viruses, and studying them as they appear, would be part of an active defense against malware.
Thus, information gathering is an active part of defensive operations.
Imagine you are an antimalware company (a real one, a good one). Maintaining a virus tank, actively trawling the internet for brand-new viruses, and studying them as they appear, would be part of an active defense against malware.
I'm not saying it's not prudent or useful, just that the NSA is framing their own malicious, self-interested actions as an innocent defensive program.
Also, spying on viruses is very different than spying on people.
Also, spying on viruses is very different than spying on people.
Ok, and you are welcome to feel that way. I'm just taking issue with what I took to be the suggestion that the phrase "active defense" is inherently a newspeak/doublespeak sort of thing.
"Weeeeeeeeee!"
The sound of Dell, Intel and other hardware tech stocks of US firms plummeting over the next 12 months as they realise they can now only sell domestically as nobody else in the World trusts them any more.
Tens of thousands of jobs lost here. And of course, they'll blame it on Snowden. It was classified in part because tens of thousands of jobs relied on it.
But you have to wonder if there isn't just a little bit of an air of the two-faced about this...
The sound of Dell, Intel and other hardware tech stocks of US firms plummeting over the next 12 months as they realise they can now only sell domestically as nobody else in the World trusts them any more.
Tens of thousands of jobs lost here. And of course, they'll blame it on Snowden. It was classified in part because tens of thousands of jobs relied on it.
But you have to wonder if there isn't just a little bit of an air of the two-faced about this...
If tens of thousands of jobs were at stake, maybe they shouldn't have done it in the first place. The NSA did the crime, Snowden just told us about it.
So it is your understanding that the US has only now just started spying on foreign countries? Capable nations have been spying on friends and foes for a long time, and they will continue to do so, exposed attempts will only change implementation. If countries decided they were not going to buy foreign technology, the majority of those countries would have no technology. You think Saudi, for example, will just start manufacturing their own hardware?
I think Silicon Valley thrived for being the centre of the best technology in the World and the assumption that as a free and liberal nation it would not be as encumbered with spyware as hardware from say, China (which last year gave us the bluetooth malware clothes iron!).
That perception is now gone. The valley will suffer. Why buy Intel when I can license the blueprints for ARM, build my own chip-fab plant for less than $1 billion and build a processor myself? And if I can do that, how much more investment do I need to build my own motherboards, displays and other components?
$10 billion? Saudi makes that in oil money in a week.
You really think they're going to keep buying US tech? The golden age for US tech firms is now over, and the idea that "of course" the US was spying is laughable: the assumption was always that the spying was targeted and not carte blanche over entire populations.
That perception is now gone. The valley will suffer. Why buy Intel when I can license the blueprints for ARM, build my own chip-fab plant for less than $1 billion and build a processor myself? And if I can do that, how much more investment do I need to build my own motherboards, displays and other components?
$10 billion? Saudi makes that in oil money in a week.
You really think they're going to keep buying US tech? The golden age for US tech firms is now over, and the idea that "of course" the US was spying is laughable: the assumption was always that the spying was targeted and not carte blanche over entire populations.
Wow, these talking points are hilarious:
"We do not use foreign intelligence capabilities to steal the trade secrets of foreign companies on behalf of - or give intelligence we collect to - US companies to enhance their international competitiveness or increase their bottom line.''
"We do not use foreign intelligence capabilities to steal the trade secrets of foreign companies on behalf of - or give intelligence we collect to - US companies to enhance their international competitiveness or increase their bottom line.''
Oh, well if they said it, then it must be true.
Why is that hilarious? The Chinese DO that.
Are you implying that the Chinese are more transparent than the "Most Transparent Administration In History"? Or are you taking the claim at face value? Perhaps I misunderstand?
The biggest fuckup here is that the NSA allowed this kind of info about their core work, which is fully in line with their defined agenda, to leak out into the open.
The damage through the Snowden leaks is massive, he did not concentrate on the misuse of the NSA against US citizen, this reveals core assets in their spying ablities. What a setback. Might as well invite foreign entities a tour of the NSA data centers.
My guess is the next guy that tries such a thing gets treated very differently, too late for Snowden, he is too famous now. The next one disappears if there is only a whiff of a leak. Ms Manning might be a better example of things to come.
The people overseeing Snowden's work/access should be tried though. Gross negligence, massive impact on national security.
The damage through the Snowden leaks is massive, he did not concentrate on the misuse of the NSA against US citizen, this reveals core assets in their spying ablities. What a setback. Might as well invite foreign entities a tour of the NSA data centers.
My guess is the next guy that tries such a thing gets treated very differently, too late for Snowden, he is too famous now. The next one disappears if there is only a whiff of a leak. Ms Manning might be a better example of things to come.
The people overseeing Snowden's work/access should be tried though. Gross negligence, massive impact on national security.
It is not unthinkable that this was an approved and planned 'leak' for any number of reasons.
Also this doesn't appear to have been a leak associated with Snowden. But it is certain that the Snowden leaks even being possible is a huge f'up on the part of the NSA who is supposed to be all about secrecy and data security.
Also this doesn't appear to have been a leak associated with Snowden. But it is certain that the Snowden leaks even being possible is a huge f'up on the part of the NSA who is supposed to be all about secrecy and data security.
I don't believe that the NYTimes article [1] supports Al Jazeera's title of "US physically hacks 100,000 foreign computers". That seems to be the total number of CNE operations, not just those using hardware devices.
> [NSA] has implanted software in nearly 100,000 computers around the world [...] While most of the software is inserted by gaining access to computer networks, the N.S.A. has increasingly made use of [covert radio channels]
[1] http://www.nytimes.com/2014/01/15/us/nsa-effort-pries-open-c...
> [NSA] has implanted software in nearly 100,000 computers around the world [...] While most of the software is inserted by gaining access to computer networks, the N.S.A. has increasingly made use of [covert radio channels]
[1] http://www.nytimes.com/2014/01/15/us/nsa-effort-pries-open-c...
Anecdotal evidence, but here goes. We sell software to countries worldwide - just recently we've had new customers state that they will not buy from us if we're hosting things on Amazon EC2 (which we do). They're insisting we distribute our software in such a way that it can be hosted internally on their own infrastructure.
And yet they have very little to show for it. I'd say that at the very least there needs to be a discussion about how cost-effective this whole operation is.
>And yet they have very little to show for it
Without knowing more about how the information was leaked and what was leaked there is no way to determine if this particular NSA activity was "worth it" or not.
None of these articles about this say the source of this information was Snowden. It also doesn't seem to be his M.O. to leak about non-privacy invading bits. Like nothing here really pushes any buttons for me other than it was leaked. A separate leak?
Agree this goes against the Snowden trend. Probably not him.
But since they're claiming to hack the Chinese, Russians, Saudis, and Pakistanis, this very well could be an "authorized leak" to counter the Snowden leaks. Like, the NSA actually does go after their enemies (as well as their friends). Very few Americans would oppose to them hacking Chinese Army computers.
But since they're claiming to hack the Chinese, Russians, Saudis, and Pakistanis, this very well could be an "authorized leak" to counter the Snowden leaks. Like, the NSA actually does go after their enemies (as well as their friends). Very few Americans would oppose to them hacking Chinese Army computers.
Probably from the NSA itself, trying to do damage control through carefully controlled leaks that put them in a good light.
"New leak says NSA spies only on the bad guys".
"New leak says NSA spies only on the bad guys".
The Al Jazeera English article that sparked this thread was summarizing yesterday's New York Times article, which mentioned Edward Snowden's name five times.
Either that or your concept of his MO is wrong.
The way I see this is that it is pretty much business as usual. I think that anyone who sincerely believes that capable states do not employ similar tactics within their spy apparatus is engaging in self delusion.
States have historically spied on each other (allies and enemies). I can understand the sensationalist aspect of this as 'news', but IMHO there is nothing new here; move on.
Perhaps, someone here with a much better command of history than I do could help out with the latest time in history where the relevant technologies of the day were not key parts of nation states' intelligence gathering systems.
States have historically spied on each other (allies and enemies). I can understand the sensationalist aspect of this as 'news', but IMHO there is nothing new here; move on.
Perhaps, someone here with a much better command of history than I do could help out with the latest time in history where the relevant technologies of the day were not key parts of nation states' intelligence gathering systems.
I'll be more inclined to believe this specific claim (tiny circuit boards, 100,000 of them) once we start seeing pictures of them, teardowns, analysis, etc. 100,000 is a lot of units to keep completely secret and one assumes that the people who've been hacked don't all have an incentive to not say anything.
Yes, I'm inclined to take this news with a grain of salt (a very tiny one, mind, given the incredibleness of this entire situation) until we see some examples. As you say, you can't keep 100k devices secret.
(Although the truly paranoid might doubt the veracity of a claimed "tear down". It has become incredibly easy to accuse the NSA of doing anything, and at least be partly believed. Which, ironically, is actually a pretty good cloak of secrecy in itself!)
(Although the truly paranoid might doubt the veracity of a claimed "tear down". It has become incredibly easy to accuse the NSA of doing anything, and at least be partly believed. Which, ironically, is actually a pretty good cloak of secrecy in itself!)
A question - how long of a lifetime would this sort of operation expect to even have? If you're shipping units en masse out, it seems rational to expect that eventually the cover would be blown when supply chain analysts send components to a reverse engineering company and get a report back.
How many personnel does it require to physically compromise 100,000 machines?
1,000 people gaining access to 100 machines a piece? 100 people, breaking into 1,000 machines? Is that per year or in general?
If one targeted individual owns 10 machines, then it's 10,000 people targeted by the program.
If this includes organizations, bussinesses, institutional computer labs and offices, then maybe it's 1,000 offices with 100 work stations each.
So, perhaps a rough estimate of the scope of the program 100 to 1,000 staff attacking between 20,000 and 1,000 targets?
1,000 people gaining access to 100 machines a piece? 100 people, breaking into 1,000 machines? Is that per year or in general?
If one targeted individual owns 10 machines, then it's 10,000 people targeted by the program.
If this includes organizations, bussinesses, institutional computer labs and offices, then maybe it's 1,000 offices with 100 work stations each.
So, perhaps a rough estimate of the scope of the program 100 to 1,000 staff attacking between 20,000 and 1,000 targets?
More likely no personnel was required because they simply paid off American manufacturers to implant these circuit boards in computers they knew were going to be shipped and used overseas.
The bottom line, though? This isn't surprising. Nations spy on each other. A lot of nations have been engaging in a lot of phony outrage over our NSA spying who are doing the exact same thing, but have managed to keep it secret. Any nation who is using imported computers in sensitive operations should know enough to check those computers for possible spy hardware.
The bottom line, though? This isn't surprising. Nations spy on each other. A lot of nations have been engaging in a lot of phony outrage over our NSA spying who are doing the exact same thing, but have managed to keep it secret. Any nation who is using imported computers in sensitive operations should know enough to check those computers for possible spy hardware.
I would be surprised if they didn't simply have them installed in all machines and only have them activated in 100,000 devices overseas. Logistically seems simpler to coordinate if component-cost is a non-issue for the agency.
That is the logical implication.
No, that is an insane implication.
If they have access to the manufacturers, it would be the simplest, minimum-effort, minimum-risk approach. It is also what I would do, given the chance.
Taking into account what we have learned this year about the extent of the activities of the intelligence services, I think we have to assume that somebody (Whether the NSA, the FSB or somebody else) has compromised the manufacture of at least part of the electronics and/or software supply-chain.
I am not too sure what it would take to audit the software and hardware components in common use today?
Taking into account what we have learned this year about the extent of the activities of the intelligence services, I think we have to assume that somebody (Whether the NSA, the FSB or somebody else) has compromised the manufacture of at least part of the electronics and/or software supply-chain.
I am not too sure what it would take to audit the software and hardware components in common use today?
There is no evidence (yet, anyway) that any other country does surveillance at the level the US does. Stealing emails here and there is a completely different thing from spying on potentially every person in the world, no matter how you try to spin it, in the same way that murder and genocide are different things even if they are both about killing people.
But at least these leaks made the US halt their phony outrage at "Chinese hackers", which is a positive thing. We can move on to have a real grown-up debate about the effects of surveillance on democracy.
But at least these leaks made the US halt their phony outrage at "Chinese hackers", which is a positive thing. We can move on to have a real grown-up debate about the effects of surveillance on democracy.
[deleted]
On the upside, my 5 year old PC probably doesn't have this tech. I bet old PC's are going to become valuable because of this.
"We do not use foreign intelligence capabilities to steal the trade secrets of foreign companies on behalf of - or give intelligence we collect to - US companies to enhance their international competitiveness or increase their bottom line."
Right.
Right.
>>> and has used the technology to monitor units of the Chinese and Russian armies, drug cartels
And how is that going for the Drug Cartels? Doesn't seem to have an effect on them, considering they continue to operate with imprudence.
And how is that going for the Drug Cartels? Doesn't seem to have an effect on them, considering they continue to operate with imprudence.
Gathering intelligence and taking action based on that info are two vastly different things each with their own pros and cons.
Sure the US could take military or covert action against the drug cartels, but then where would American and other customers get their drugs? Who would then supply them? Sounds like a recipe for a new turf war (simply replace the existing cartels with newer, and possibly more ruthless groups) I'm not saying the US is allowing this, just that dismantling the cartels may bring a whole host of unwanted side effects.
Sure the US could take military or covert action against the drug cartels, but then where would American and other customers get their drugs? Who would then supply them? Sounds like a recipe for a new turf war (simply replace the existing cartels with newer, and possibly more ruthless groups) I'm not saying the US is allowing this, just that dismantling the cartels may bring a whole host of unwanted side effects.
Indeed, I’m reminded of a great Season 2 episode of the West Wing, and though fictional, points out that to go up against and wipe our a drug cartel in the jungles of Colombia would require a 10 to 1 troop ratio to secure victory. Many of these narcoarmies have over 20,000 soldiers, so we’re talking quite a large expeditionary force. Certainly something to think about.
Not to mention it would be a jungle war and likely resemble insurgencies. And as you note, someone will fill that void.
Not to mention it would be a jungle war and likely resemble insurgencies. And as you note, someone will fill that void.
Mexico isn't Columbia, and 20K poorly equipped and trained "civilian" fighters are no match for well trained, well equipped US military personal. We've heard the same arguments for years about the terrain in Afghanistan and our (I'm from the US) guys seem to do quit well even on a level playing field (see the early days after 911 when the US dropped in small groups of CIA special forces).
I loved the West Wing but feel they relied too heavily on the "Vietnam/Jungle" angle when proposing the feasibility of an actual "drug war" in Columbia. Also, the West Wing was aired before many of the US's major military actions in the middle east, which have arguably proven that the US can combat an insurgency (if they care enough to that is) and can operate in an "unconventional" manor.
I think the worries of getting sucked into another Vietnam, or getting bogged down like the Soviets in Afghanistan have been debunked. As long as the political will is there, the US military can operate successfully in almost all combat scenarios.
I loved the West Wing but feel they relied too heavily on the "Vietnam/Jungle" angle when proposing the feasibility of an actual "drug war" in Columbia. Also, the West Wing was aired before many of the US's major military actions in the middle east, which have arguably proven that the US can combat an insurgency (if they care enough to that is) and can operate in an "unconventional" manor.
I think the worries of getting sucked into another Vietnam, or getting bogged down like the Soviets in Afghanistan have been debunked. As long as the political will is there, the US military can operate successfully in almost all combat scenarios.
"I think the worries of getting sucked into another Vietnam, or getting bogged down like the Soviets in Afghanistan have been debunked. As long as the political will is there, the US military can operate successfully in almost all combat scenarios."
You must pick your definitions of "operate", "successfully", and "combat scenarios" very carefully here to be a useful statement.
You must pick your definitions of "operate", "successfully", and "combat scenarios" very carefully here to be a useful statement.
How exactly has the US military been unsuccessful in it's recent military actions? Nation building and playing peacekeeper to a civil war is one thing, straight up military action (eliminate enemy and hold ground) is quite another. I don't think anyone would argue the US sucks at the former, and kicks ass at the latter.
Most of the drug cartels have left the jungles and are now operating back in urban areas:
http://www.vocativ.com/video/colombian-cocaine-factory/
http://www.vocativ.com/video/colombian-cocaine-factory/
But I was told if we legalize weed here in the US, we'll put the cartels out of business. . .
Wishful thinking that these cartels would simply pack up and go home if we (the US) legalized one of their products. Even if we legalized all of their products I doubt they'd throw their hands up and find legitimate honest work.
I suspect they'd find a new illegal business to run, more people to extort, murder and threaten and continue on as before.
I suspect they'd find a new illegal business to run, more people to extort, murder and threaten and continue on as before.
One thing about that is that if it was suddenly announced overnight, the value of weed could crash. Given that a lot, if not most, weed trade is on credit, (they take the weed, pay the supplier once its sold on,) most dealers would be left with debt and devalued weed to try to settle it. Actually could get rather nasty.
> they continue to operate with imprudence.
While that may also be true, I suspect from context that what you meant to say was "impunity", not "imprudence". Very different meaning.
While that may also be true, I suspect from context that what you meant to say was "impunity", not "imprudence". Very different meaning.
> The NSA said the technology has not been used in computers in the US.
But of course not. The NSA wouldn't spy on Americans, would it?
But of course not. The NSA wouldn't spy on Americans, would it?
>The NSA wouldn't spy on Americans, would it?
How about domestic U.S. law enforcement? FBI, DEA, U.S. Marshals, etc.? It would be interesting to know what technologies they're using, especially when there's a long-running surveillance operation.
How about domestic U.S. law enforcement? FBI, DEA, U.S. Marshals, etc.? It would be interesting to know what technologies they're using, especially when there's a long-running surveillance operation.
Still they're about 100,000 computers behind the Chinese.
Isn't this what they're supposed to be doing? I don't really have a problem with intelligence gathering against non-allied nation state actors.
http://www.youtube.com/watch?v=cryMVK1PwuQ