The Widdershins

BIG BRUTHA IS AT IT AGAIN OR STILL…

Posted on: September 9, 2013

I absolutely have a need to know

I absolutely have a need to know

It’s not that we didn’t know our pals at the N.S.A. were eavesdropping on our phone calls, emails, text messages and the like.  After all, we have been told it was for our own good and for our safety.  That’s how they have been able to thwart attacks on the fatherland, uh country.  However, the agency has not been satisfied with just doing that.  Now (or rather for awhile) they have wanted to know what you know that’s so secret you’re trying to protect it.  And they have gone to extraordinary lengths to be able to do that.

Through the use of their own codebreakers, supercomputers and other means, the NSA has been determined in its efforts to not let there be any type of computer security they cannot crack.  Further, they have even asked, cajoled or threatened software companies into providing “backdoors” into software that the general public uses.  One of the most common of these “secured” technologies that most us have probably used is SSL or Secured Socket Layer over the internet.  Have you ever gone online to amazon or another merchant and made a purchase?  If so, you’ve probably seen that once you have selected your items and placed them in your “basket” and clicked on “checkout”, that the address bar in your browser changes and there is a little padlock or similar icon that shows your in a secure part of that website.    That’s supposed to mean that all the info you are providing is safe and secure and encrypted.

The Secure Socket Layer (SSL) and Transport Layer Security (TLS) is the most widely deployed security protocol used today. It is essentially a protocol that provides a secure channel between two machines operating over the Internet or an internal network. In today’s Internet focused world, the SSL protocol is typically used when a web browser needs to securely connect to a web server over the inherently insecure Internet.

Technically, SSL is a transparent protocol which requires little interaction from the end user when establishing a secure session. In the case of a browser for instance, users are alerted to the presence of SSL when the browser displays a padlock, or, in the case of Extended Validation SSL, when the address bar displays both a padlock and a green bar. This is the key to the success of SSL – it is an incredibly simple experience for end users.

It may be simple and easy for the end user but the encryption algorithms are supposed to be complex.  That’s the reason for having it.

The N.S.A. hacked into target computers to snare messages before they were encrypted. In some cases, companies say they were coerced by the government into handing over their master encryption keys or building in a back door. And the agency used its influence as the world’s most experienced code maker to covertly introduce weaknesses into the encryption standards followed by hardware and software developers around the world.

The same NY Times article states that N.S.A. rules (they have rules??)  “permit the agency to store any encrypted communication, domestic or foreign, for as long as the agency is trying to decrypt it or analyze its technical features.”  Oh I understand now.  They aren’t going to necessarily “snoop”, they are just going to “study” the technical features” of an encrypted message, bit of data or what have you that has been encrypted.

Another area the agency has hacked, cracked or otherwise rendered unsecure is in the use of VPNs or Virtual Private Networks.

Let’s say you are a representative of XYZ company and you are at the offices of ABC corporation, there to make a presentation or pitch for your company’s widget which is perfectly designed with ABC Corp. in mind.  However, the night before the presentation while you are relaxing in the luxury of your Motel 6 room (XYZ is cheap on the travel), you discover that somehow the Powerpoint presentation and documents aren’t on your corporate laptop.  No biggie because you can use that same laptop and log into the corporate VPN, find the Powerpoint files and documents, download them to your laptop and be ready to go the next day, secure in the fact that no one could intercept the transmission of those files because your corporate VPN is secure.

The N.S.A. may not have a need to see that information (which may be proprietary to XYZ Co.), but they can.

Now, we find all of this out once again, courtesy of Mr. Snowden.  The info was published by The Guardian, the Times and ProPublica.   And you-know-who wasn’t too happy about that either.

Intelligence officials asked The Times and ProPublica not to publish this article, saying it might prompt foreign targets to switch to new forms of encryption or communications that would be harder to collect or read. The news organizations removed some specific facts but decided to publish the article because of the value of a public debate about government actions that weaken the most powerful privacy tools.

Here’s another part of the article that was scary to me:

The full extent of the N.S.A.’s decoding capabilities is known only to a limited group of top analysts from the so-called Five Eyes: the N.S.A. and its counterparts in Britain, Canada, Australia and New Zealand. Only they are cleared for the Bullrun program, the successor to one called Manassas — both names of an American Civil War battle. A parallel GCHQ counterencryption program is called Edgehill, named for the first battle of the English Civil War of the 17th century.

Unlike some classified information that can be parceled out on a strict “need to know” basis, one document makes clear that with Bullrun, “there will be NO ‘need to know.’ ”

Only a small cadre of trusted contractors were allowed to join Bullrun. It does not appear that Mr. Snowden was among them, but he nonetheless managed to obtain dozens of classified documents referring to the program’s capabilities, methods and sources.

EavesdroppingThe other alarming part of this is how the agency has been able to “work with” (coerce?) companies into letting them have  “pre-encryption access to products and services such as Microsoft’s most popular services, including Outlook e-mail, Skype Internet phone calls and chats, and SkyDrive, the company’s cloud storage service.”.  And that, my friends, is why I do not utilize any type of “cloud” storage or anything like it.  If I somehow fill up the hard drive on my computer I can always buy an external drive (I have one for backup purposes) or get a thumb drive or other external device.  That way, my info, stays with me.

The Times article also states the the N.S.A. has a database of internal encryption keys for some commercial products which they refer to as the Key Provisioning Service and that allows them  to sometimes be able to automatically decrypt a message.  But even that wasn’t enough for the agency.  They have also been working with institutes to weaken the standards adopted by developers.  “One goal in the agency’s 2013 budget request was to ‘influence policies, standards and specifications for commercial public key technologies,’ the most common encryption method.”

Cryptographers have long suspected that the agency planted vulnerabilities in a standard adopted in 2006 by the National Institute of Standards and Technology and later by the International Organization for Standardization, which has 163 countries as members.

Eventually the agency got away from the idea of grabbing a piece or segment of info and decrypting it to just going out there and grabbing everything and storing it, and then searching through it for “valuable” information.  Think of a vacuum cleaner.  And that’s why they had to build this in Utah:

New NSA Data Center in Utah

With the information that Snowden has released, especially about the comfy arrangements between some of the companies we all have used on an almost daily basis, those companies have gotten blowback from some users:

American technology companies have faced scrutiny from customers and the public over what some see as too cozy a relationship with the government. In response, some companies have begun to push back against what they describe as government bullying. Google, Yahoo, Microsoft and Facebook have pressed for permission to reveal more about the government’s requests for cooperation.  [do you get that?  asked for permission!]

One company, Lavabit, simply shut down instead of dealing with the Agency.  Lavabit was an email company that offered strong encryption in its services.  It was the service that Edward Snowden used.  The founder simply put up a letter on the website of his company stating he shut it down because he would not cooperate with the NSA.  He ends the letter with this statement:

This experience has taught me one very important lesson: without congressional action or a strong judicial precedent, I would _strongly_ recommend against anyone trusting their private data to a company with physical ties to the United States.

Now, Mr. Levison is being threatened with arrest if he does not cooperate with a Federal court order.

To sum up:  I get that there are lots of bad people out there that want to do bad things to us as Americans.  I get that we need to use clandestine means and actions to sometimes thwart those bad people and that those bad people will use any and all capabilities available to them to stop those folks that are trying to stop them.  However we’re supposed to have lines that aren’t crossed.

There is a little bit of hope though on the personal privacy front.  Congressman Rush Holt D-N.J. believes the NSA has overstepped its bounds and has drafted a bill, the Surveillance State Repeal Act, which would roll back a good deal of the government’s spying powers that occurred after the 9-11 attacks.  I hate to say it but it is in the House.  He’s a Democrat.  It’s probably doomed.

Fourth Amendment to the United States Constitution

The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.

This is an open thread.

Advertisements

20 Responses to "BIG BRUTHA IS AT IT AGAIN OR STILL…"

Oh, don;t get me started.,

I’m good with all of this. No problemo. I’m glad Big Brother loves me enough to want to know everything about me. It’s to protect me. XOXO. Just pass the soma.

Beata@2: I’m so happy that you’re happy. Me not so happy. 😉

There used to be a site that Uppity Woman recommended when doing internet searches but it was more or less destroyed by google. So here’s another in the event you want to do an anonymous search:

https://duckduckgo.com/

It’s not so much about privacy per se but rather when searching that you don’t get all of the advertisements that google loves to slam you with. The same with gmail. Google doesn’t “read” your emails, so they say, but you will sure get a bunch of advertisements that seem to indicate they do do that. Mention in an email to a friend that you have to replace a roof and you’ll be amazed at the stuff that comes up about roofers (in your area), types of shingles and the like.

I had originally signed up for an account on this thing. I thought “Oh neat, all the info in one convenient location”. After I did a bit of checking into cloud storage and now after reading this NY Times piece I’m not about to put any private info on it.

G-d, Obama just called the United States “the homeland”. He really is a clone of GWB.

2016 can’t come soon enough.

Beata@6: Hell, I used “fatherland” and it was in jest! Oy vey ist mir!

Fredster, I won’t use a cloud service either for exactly the same reasons. Let’s just say, I’ve looked at clouds from both sides now…

NSA: And you were afraid your government wasn’t listening to you.

SophieCT@8: Oh I had thought about getting a subscription to Carbonite but it seems they are now using “cloud” technology so you can forget it. I don’t want that, I want a peer-to-peer connection and if they can’t do that then I’ll just get another ext. drive and clone the pc’s hard drive to that. fuhgeddaboudit !

Great to see you also!! 🙂

Fortunately, my marginal computer skills inhibit my using a cloud whatever.

Wow, excellent piece Fredster. Chilling. I don’t like Cloud either, but I think itunes automatically stores our songs on it. I want my stuff on my harddrive, period. If the house catches on fire, I can grab my backup hardrive which is always attached to my big computer and automatically updates every 24 hours. Its called Time Machine and keeps 5 days worth of every single thing on my computer, my thousands of songs, thousands of photos, movies everything.

But back to the matter at hand. Should we all email our congresspeople and ask them to support Holts bill?

@10: The only clouds I know anything about are in the sky.

socal@12: Good question about emailing the congress critters. Knowing Boehner, he’ll have it assigned to a committee where it will never see the light of day. Let me see if there’s been any action on it.

Beata@13: That’s an excellent sky!

Socal I’m going to check out that Time Machine thing. Thanks for mentioning it.

Oh poo, socal! Time Machine is just for Apple and the Mac. 😦

There’s probably something like it out there for Windows machines.

Ooops, sorry Fredster!

I love me some Hoagy C! Especially love when these old songs have a little bit of scratchiness to them!

Not to worry. There’s probably some app like it out there for Windows. I’ll just have to search to see what I can find.

I wrote my congresscritter, for what its worth.

Its pretty cool. All my info is stored on a small terabyte. And I’ve already used it and know it works. I replaced my hard drive last year for one twice as big and put all my stuff onto the new one by xferring it from the little terabyte. Simple and fast.

socal@18: Oh great! I haven’t checked yet to see what’s what with that bill, but I will.

Share your thoughts below

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Keep Up

Atrocities Documented:

What the F*ck Just Happened?!

Victories Won:

Your Victories Against Drumpf!

Wanna Be A Widdershin?

Send us a sample post at:

widdershinssubmissions at gmail dot com

Our Front-Pagers

I’m ready. Are you?

Blog Archive

September 2013
M T W T F S S
« Aug   Oct »
 1
2345678
9101112131415
16171819202122
23242526272829
30  

Our 2016 Ticket!

Our girl is gonna shine

Busted: Glass ceiling

HRC bumper sticker

She’s thinking “Less than 2 weeks I have to keep seeing that face”

Yeah I can make it

The team we’re on

Women’s March on Washington!

Right-click the pic for more info

Kellyanne Conway’s new job

So similar

Take the kids to work? NO!

3 turds control fate of healthcare for millions

That moment when *your* pussy gets grabbed