NSA

Brazil’s about ready to poke out the “Five Eyes”

Frank Blog , , , , , , , , ,

A Twitter wag asked today why Glenn Greenwald doesn’t just unload all his Snowden-endowed dirt on who is spying on Brazil in one article. I thought of the old journalistic saw: “Why to sell newspapers, of course.” Sounds quaint, eh?

The Canadians reportedly busted open encryption to have their way with Brazil’s mining ministry. We’d already heard that the NSA spied on Petrobras and President Rousseff’s inner circle. Still to come: Details on how Brazil spies on its citizens. Have patience. Brazilian colleagues are surely working it.

It will be time soon for an update on the divorce Rousseff is preparing from the U.S.-centric Internet. Plenty of experts think that’s a bad idea and will only encourage Balkanization by really nasty regimes already bent on inhibiting the free flow of  information.

 

The Most Important Snowden Documents Yet

Frank Blog , , , , , , , , ,

I have always trusted Bruce Schneier, author of the much-respected 1996 “Applied Cryptography.”

Glenn Greenwald showed Schneier some of the Snowden documents that featured in today’s stories by The Guardian, The New York Times and Propublica. They are the most important, upsetting revelations to date from the Snowden trove. Without doubt.

The NSA, says Schneier, has been breaking most of the encryption on the Net.  He says the U.S. government has betrayed the Internet and we need to take it back.

Schneier summarizes what the NSA has done to make the Internet a more dangerous place and five ways to stay safe online:  Hide in the network. Encrypt your communications. Assume that while your computer can be compromised, it would take work and risk by the NSA – so it probably isn’t.  Be suspicious of commercial encryption software, especially from large vendors. Try to use public-domain encryption.

The NSA was told in the mid-1990s that it could not have the Clipper Chip, the backdoor it wanted into our digital lives . Silicon Valley and Bill Gates objected. By 1996 the Clipper Chip was defunct. So the NSA decided to begin breaking-and-entering on its own. Without our approval.

Greenwald/Snowden gave the public some time to prepare today’s disclosure. First, give it a series of primers on the extent to which the NSA is spying on the American public (not to mention allies). Then unload this zinger.

I want more details. What exactly is compromised? Is everything I do using SSL on my Mozilla Firefox browser compromised?

Boing Boing tweeted KEEP CALM AND USE OPEN SOURCE CRYPTO. Excellent advice. Time to revise my anti-surveillance toolkit.

Two small encrypted email services down. Hire the lawyers.

Frank Blog , , , , , , ,

The Snowden backlash is only just beginning. And so is the resistence. Expect U.S. tech companies that have given the National Security Agency direct access to your data to suffer commercially.  How badly, hard to say. Depends on how deep the public outrage. Three of  Germany’s biggest Internet services, one of them Deutsche Telekom, announced they’ll encrypt customers’ emails.  Unfortunately, their encryption appears to be a bad joke. Here’s Chaos Computer Club release (German).

Phil Zimmermann

The U.S. government forced the hand of a small Texas-based email service,  It seems clear that Lavabit’s owner, Ladar Levison, shut down rather than agree to grant the government access to the data of customers. Snowden is reported to have been among his users. Levison has set up a legal defense fund and is accepting contributions. He likely received a National Security Letter, a search warrant or a subpoena with a gag order attached. He can’t say but he says he’s preparing an appeal to the 4th Circut.

“This experience has taught me one very important lesson: without Congressional action or a strong judicial precedent, I would strongly recommend against anyone trusting their private data to a company with physical ties to the United States,” The New York Times quoted Levison as saying.  I can’t find an image of him online.

The other U.S. email service that preemptively shut down belonged to Silent Circle, a company co-founded by Phil Zimmerman, creator of Pretty Good Privacy encrypted email. It says it wiped the discs containing all that email. The encryption keys were on the servers. Not so with the keys that Silent Circle uses for its text-messaging, video and voice comms services. They are end-to-end secure. The encryption keys are erased when the communcation ends.

Now, which big U.S. tech companies will join the legal challenge in defense of First and Fourth Amendment rights?

Yahoo is the only one known to have challenged a gag order of the type Levison apparently got.

The Internet Archive’s Brewster Kahle, an Internet giant committed to nothing less than providing “universal access to all knowledge,” successfully fought a gag order and is one of the few people who can openly discuss what it’s like to get a National Security Letter.  Read here the New Yorker’s interview with him about it.
Meanwhile, more and more people are posting PGP public keys to servers.