Slashdot Mirror
Surveillance Story Turns Into a Warning About Employer Monitoring
rtfa-troll writes "The story from yesterday about the Feds monitoring Google searches has turned into a warning about how work place surveillance could harm you. It turns out that Michele Catalano's husband's boss tipped off the police after finding 'suspicious' searches (including 'pressure cooker bombs') in his old work computer's search history. Luckily for the Catalanos, who even allowed a search of their house when they probably didn't have to, it seems the policemen and FBI agents were professional and friendly. Far from being imperiled by a SWAT raid, Catalano spoke to some men in black cars who were polite and even mentioned to Catalano that 99 times out of 100, these tip-offs come to nothing. Perhaps the lesson is to be a bit more careful about your privacy, so that what you do on the internet remains between you and the professionals at the NSA."
Oh I see. The man searched thinks it was all just a misunderstanding. I guess that makes it OK then.
I guess it also covers the costs in time, money, equipment and paperwork spent on a search that should never have happened. I guess it also makes up for any useful work the men involved could have been engaged in like looking for actual terrorists or investigating organised crime in the banks. I would worry about how the NSA's Ur-dragnet/Informer hotline is throwing up so many false flags that law enforcement is now too busy to deal with actual problem, but this splendidly chipper blog post had allayed all of my concerns.
I'm glad that's all cleared up then.
May the Maths Be with you!
I take away a different lesson from this: maybe it's a good idea to wait until you have more facts before starting to run around screaming "The sky is falling!!!!111".
The fact that some real shady things in terms of corporate and governmental surveillance do go on is no reason to just give up being rational.
"I know I will be modded down for this": where's the option '-1, Asking for it'?
So, this story turns out to be nothing to do with the NSA but you think what the hell, I'll add a sarcastic sentence about the NSA to the summary to make it look like its malign.
Not sure if you realise... but when you're on a work computer, all your internet requests usually go through some form of proxy server - which is how your IT department finds out what you access regularly and blocks it. Clearing your browser history is useless since every request is logged in a centralised server before it goes out to the net.
... wait, what?
Oh I get it. Now I see why "chicks with dicks" never turned up funny pictures of girls with their boyfriends.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
Perhaps the lesson is to be a bit more careful about your privacy, so that what you do on the internet remains between you and the professionals at the NSA.
I know you're being snarky, Slashdot, but I'd trust the professionals at the NSA over middle management any day of the week. The NSA doesn't ruin your life if it goes through your google history and finds a few keywords. It doesn't assume the worst. The NSA gathers up the data, forwards it to a team of analysts, and, seeing this kind of thing every day, make an informed and reasoned decision to either forward it up the chain, or bin it. And as your own article says: 99 times out of 100, it's nothing. That's probably a conservative estimate; There have only been a few dozen acts of bona fide terrorism in the past year or so, and if the tin foil hat crowd is right, the NSA is monitoring everyone pervasively, so it's more like 999,999 times out of a 1,000,000.
The moral of the story here is that people who aren't law enforcement are really, really, epic bad at being judges of character. Especially when you're dealing with someone whose job is often earned on something other than critical thinking skills, investigative talent, and attention to detail... three things I think most will agree you don't find in most mid-level managers. It's like how during the midst of the Boston bombing, the internet armchair sleuth crowd wrongly identified many innocent people and forced the police to divert valuable resources to take those people into protective custody while the real bomber was left unidentified. The professionals, meanwhile, correctly identified them hours later, and then took them down without any innocent people getting caught in the cross fire.
I know it's politically popular right now to say law enforcement is a bunch of clueless, authoritarian, surveillance-happy asshats, but that's a slanted view. On the whole, they know what they're doing, and most of the time they get it right. You only hear about the times when they screw up. Now, considering how low of esteem they're held in for that track record, ask yourselves about the track record of middle managers, internet armchair pundits, and vigilantes have had doing the same things... and I'm betting their reputation with you is a lot better.
Chew on that for a bit.
#fuckbeta #iamslashdot #dicemustdie
Prediction: this article will not get 850 comments, and many people will continue pointing to this story as proof that Google lets the federal government rifle through all of everyone's data.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
99 times out of 100, these tip-offs come to nothing
That's not quite what was said. From the original blog ; "they mentioned that they do this about 100 times a week. And that 99 of those visits turn out to be nothing."
So we have three possibilities;
1/ this statistic is a bullshit overstatement, talking up a minimal danger
2/ they are arresting terrorist bombers at a rate of 1 a week
3/ they are prosecuting 1 person a week on an unrelated matter, after gaining access to their house on the pretext of "war against terrorism".
Which do we think it is?
If there was some sort of massive sifting of google terms by local law enforcement, or the NSA were passing on every single combination of "pressure cooker + backpack", there wouldn't be an isolated incident, there would be tens of thousands of these investigations. How many other terms would get similar scrutiny? Would local police act on all of the millions of searches that would throw up a red flag?
The police might be increasingly militarized, but they aren't limitless in either manpower or funding, as much as they would have you believe otherwise.
What I'd like to know from all this is why the police are now so frequently travelling around in armed units just to conduct inquiries.
Some people might want to search for news stories pressure cooker bombs, or information about what they look like so they might be able to identify one if they see it on the sidewalk.
Typing "pressure cooker" lists pressure cooker bomb as the 3rd suggestion in Google.
Jason.
A surveillance society is still a surveillance society and this story simply reveals how this is done in the real world. While lots of people have fantasies about the NSA reading their email or looking at their porn habits in the real world this is done by peoples employers day in day out.
Put down the tin foil hats, have a wake up call and realize that your employers are the ones performing the real world surveillance on the contents of your browsing, email and other habits.
If your work browser is configured to accept certificates from the proxy server, SSL might not give you privacy.
The devices might only have one purpose, but there might be other purposes for searching for it other than to build one. Reading this story made me want to google "pressure cooker bomb" just to see what it is. So then I would be searching for simple curiosity. A week from now, if I were trying to find a link to this story about a man being investigated for terrorism, I might google "pressure cooker bomb" because it's a detail I remember from the story. So then my interest might be in electronic privacy, and not bombs at all. In fact, I've now written the word "bomb" several times in this post. It's a suspicious word, but what I'm talking about here actually has very little to do with actual bombs. I just made a "bomb" related google search, just now, looking for information to support my arguments.
Aside from that, I'm not even sure I agree that bombs have no practical use other than terrorism. Maybe he wanted to build a small bomb, under safe conditions, as a method of learning about science/chemistry/construction. Maybe he wanted to blow something up, out in the middle of nowhere, for entertainment. Maybe he had a tree stump on some rural patch of property that he wanted to remove, and he got it into his head that he wanted to blow it up with a bomb. Maybe this guy is interested, not for terrorism, but for the purposes of general idiocy.
I don't necessarily blame the employer for reporting it, since he may have had legitimate reasons for concern. I don't blame the FBI for investigating it, because they kind of have to investigate something like this once it's reported. But I do blame you for implying that there's no valid reason to ever search for "bomb" unless you're a terrorist.
A good proxy server is going to allow your system administrators to decrypt your SSL connection. The proxy feature works for SSL but not before exposing all of the information in your connection to the administrators. So using an external proxy and SSL is not going to provide any security. You are going to have to be a little more savvy than that which will also be obvious to your system admins that you are subverting their tracking/logging system.
I object to power without constructive purpose. --Spock
You should run an ssh tunnel through the corporate proxy to your own installation of an apache proxy running on your home server. Then use that as your proxy for firefox. At least then you'll be spared the embarrassment of a SWAT team turning up at work.
Key points you're missing:
1) Suffolk county police claim the wife searched for pressure cooker bombs, and the husband searched for backpacks.
2) According to the wife, she was shopping for pressure cookers, and the husband was shopping for backpacks.
The important detail missing is that the couple wasn't searching for bombs. It appears the police added the word "bombs" to cover up their amateur-hour faux pas so that an investigation sounds reasonable.
Now, perhaps the wife is just bullshitting people to say that she wasn't researching how to build a pressure cooker bomb, but I find it far more likely that she was shopping for a pressure cooker (a common activity), than researching how to build a pressure cooker bomb (an uncommon activity), and all parties involved concede that the wife wasn't actually doing anything that should give cause for concern.
Hm? RTFS... the boss sees someone searching for bombs, thinks "hey, this could be bad", tip the police, turns out it is nothing.,,
From the aricle, they specify that it's a former boss, and there's no mention of how amicable the termination was. So, it's also possible that the employer, due to a grudge, discovered the suspicious searches and decided that it would be an easy way to make their life difficult for a little bit.
Actually, we'll probably never know they entire story. The employer, no matter what their motivation, is going to stick to "Hey... if you see something, say something...".
Exactly! So, shut the fuck up, slaves. Employers pay for your time, not your work. Employers OWN you for the duration of that time. You have no rights beyond that which your employer affords you. You should act like the good little worker machines that you are unless your employer gives you permission to do otherwise.
God damn these lazy employees these days, thinking they can be human on an employer's dime.
The important detail missing is that the couple wasn't searching for bombs. It appears the police added the word "bombs" to cover up their amateur-hour faux pas so that an investigation sounds reasonable.
That doesn't appear to be correct according to the fine article:
The former employee’s computer searches took place on this employee’s workplace computer. On that computer, the employee searched the terms ‘pressure cooker bombs’ and ‘backpacks.’
much of left-wing thought is a kind of playing with fire by people who don't even know that fire is hot - George Orwell
So dad searched pressure cookers at work and the employer allegedly turned this over to the cops, but who turned in mom's Google search history? How was the match made? Was there a request made too Google? Did the Feds hack the computers using a MS-NSA or Apple-NSA backdoor? According to the article, the task force didn't even look at the computers or confiscate them.
This is only half a story, (if it is indeed true about the employer turning over the suspicious weblogs). How did the Feds/Police/Joint Task Force get the other half of the info.
And according to the article this occurs 100 times per week and we are just hearing about it.
There is more to this story and this simple explanation is only half of it.
Agreed, there is a certain amount of totalitarianism raging about the use of corporate networks, but nevertheless, there is a case to be made that if there's something you don't want your boss to know (regardless of whether or not you're doing anything wrong), then you don't use his network to talk about it.
In these times, where trust between employer and employee is largely a one-way-street, it's a simple matter of common-sense and self-preservation. Sure, a monthly data traffic allowance on your phone bill has a monetary cost, but for peace of mind, it makes sense to use that rather than put your life in your boss's hands.
You CAN be too careful.
Before calling the police in a non-urgent situation, ask yourself
"If everyone in my exact situation called the police, a few crimes may be prevented but a lot of lives would be intruded on and a lot of police resources and taxpayer money would be spent. Would it be better for society if, as a rule, the police were called in this exact situation or if, as a rule, they were not?"
This goes not just for bombs but for thinks like someone unfamiliar walking around your neighborhood at 3AM, your kid's friend sporting frequent unexplained bruises, and the guy who who hangs round the local kiddie park without kids in tow.
Each of these "no matter what I do, there's a good chance that I could wind up doing the wrong thing" cases and many others like it require a gut-check and a realistic assessment of the situation before calling the police. Sometimes the "best answer" is to call the cops. Sometimes the "best answer" is to talk to the person acting suspicious or get friends and neighbors together and talk to the person. Sometimes the "best answer" is to do nothing.
Finally, if you do make a well-thought-out decision and it turns out to be wrong - if you DON'T turn in the guy who searches for pressure cookers and he turns out to be a bomber, or if you DO turn him in and as a result the police are busy interviewing the person and can't get to an armed-robber-in-progress call in time to avoid bloodshed, don't feel guilty about your decision.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
A good proxy server is going to allow your system administrators to decrypt your SSL connection.
Yes and no. Yes, a proxy can do MITM attacks, but no, barring a key compromise, it can't do so undetectably. A computer-savvy employee who is concerned about a MITM attack can do some testing beforehand and on an ongoing basis to assess his risk.
Some things an employee who doesn't 0wn his own box probably cannot check for is a keyboard logger. Employees probably cannot check for other things like hidden cameras and other off-the-computer surveillance.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
I'm not certain if you're trolling... Expectations are a two way street. Within reason, there is a right of the employee to receive a personal call or to send a personal email during work hours. This is doubly true considering the work day no longer ends when you leave the office. Since the work life pours into our personal, the personal has to pour into our work.
This is why when in the past I worked for others I always surfed via my own personal hotspot, not the corporate network. Yes, it does not help you with the NSA, but it at least avoids the entire issue of corporate IT.
Do what you can, with what you have, where you are.
One or two rules in the firewall and no OpenVPN for you.
Seriously, do your private shit from your home - or at least from your phone with your own data plan - instead of wasting your and sysadmin's time playing tag with network policies.
This is the bigger issue with the surveillance state. In a free society you can read what you want, think what you want and say what you feel: WITHOUT FEAR OF RETRIBUTION. The chilling effect that occurs, that even searching for a news item such as this flags you and puts you on a watch list. It is a direct assault on personal liberties.
When you say that "aside from self-educating concerned citizens, no one other than an engineer should be searching for such a thing" I find it truly offensive. No one has the right to tell you what you should think, what you can read or what can be said. There is no humanity or dignity in a world where the level of control and power has shifted to allowing for this. No person should be afraid of retribution for free thinking, learning or reading what they want for whatever reason they want. The mere fact that you can justify the infringement of these liberties shows how far the ideals this country was founded upon have slipped away.
That is a truly frightening testimony against the American employer culture.
(Assuming you are an American, which is probably a safe bet here).
Modern copyright is theft of culture from everyone and it retards the progress of the useful arts and sciences.
I don't use work PCs for anything but that. If I want personal connectivity I can pay for it.
Jobs which do not use computers don't pay for me to surf on their time, either.
A computer is like any other tool, for example a milling machine or a welder. If I want to borrow one of those for a bit, I ASK the shop owner.
"This post is an artistic work of fiction and falsehood. Only a fool would take anything posted here as fact."
Someone once called the fire department thinking I had recklessly left my kids in a hot car without supervision.
Unless they mistook some inanimate object in your car for children, then you fucking did.
Everyone should see this PSA about leaving kids in cars.
An enigma, wrapped in a riddle, shrouded in bacon and cheese
The former employeeâ(TM)s computer searches took place on this employeeâ(TM)s workplace computer. On that computer, the employee searched the terms âpressure cooker bombsâ(TM) and âbackpacks.â(TM)
Yeah, because there's zero chance he was just searching for news stories about the Marathon bombing and possible copycats. Or because he was just plain interested, as an intellectual exercise, in the relative efficacy of pressure cookers as a bomb containment device vs., say, a layer of ball bearings embedded in a core of C4.
Come and get me, you NSA assholes.
https://app.box.com/WitthoftResume Code: https://github.com/cellocgw
When you're using your company's computer and your company's network, there is exactly ZERO expectation of privacy. No doubt, you've signed an "acceptable use policy". . . . Read it next time. . . .
It doesn't matter if she was searching for 'pressure cooker bombs', because that is not illegal!
She has not committed any crime, nor should she be suspected of one. In fact, she shouldn't have let them in the house, because they have no warrant, nor any valid reason to suspect her of doing anything against the law.
Since when was curiosity or knowledge seeking a crime? Is that where we are now? Living in fear of learning more, because those who think they're holding the power, are looking at everything we do?
That "fine article" is paraphrasing other sites, which are paraphrasing other sites. They're claiming the searches were for pressure cooker bombs based on statement from the police, which conflicts with that of the couple, but their slapdash editor didn't even notice.
This is the site owned by the wife, where she explains from her perspective: https://medium.com/something-like-falling/2e7d13e54724
This is the original breaking story from Gizmodo that Wired is just paraphrasing:
http://whitenoise.gizmodo.com/yes-the-fbi-is-tracking-americans-google-searches-981986667
An employer needs to follow the guidelines outlined in the Human Rights Act and respect the private life of an employee. This means that throughout the working day, employees are allowed by law to use telephone and email for private purposes, not only during break times but throughout the day. I am not a lawyer, but when recently writing a new IT Policy/Employee handbook we employed legal counsel to guarantee all employee rights were respected and protected.
He's not lying (or even fibbing, not even a little). The last 3 jobs I've had as a tech required 10+ hour days Mon/Fri, and if I wanted to do anything on the weekend that would take more than a few hours I had to notify my boss (in case they tried to reach me and I was unavailable). I'm no manager or lead or anything like that...I'm just the guy that they want to make sure is available in case a computer breaks.
Once upon a time those jobs were restricted to the heads of the company and they were awarded accordingly. Now those jobs are everywhere unless you're literally the bottom rung on the ladder.
The working climate in the US is dismal.
This is true, but only if your employer has or otherwise gains access to your computer's certificate store and installs a root certificate whose private key is known by the proxy. The proxy can then sign fake SSL certificates which it uses to decrypt, capture and re-encrypt the connection.
"In prison you just have to shut your eyes and take it. Here you have to shut your eyes and give it."
Well, I don't know about you, but if the police show up, act in a courteous and polite fashion, ask a few questions, and then leave satisfied nothing bad is going on, I consider that a job well done.
As a thought experiment, imagine that the couple had been Muslim, but otherwise exactly the same people. Does anyone honestly still think the visit by police would have been so courteous and polite? And yet in the USA we supposedly have freedom of religion, which should guarantee equal treatment by law enforcement whatever one's beliefs.
And it doesn't matter where the tip came from, this kind of thing is wrong, potentially dangerous, and not the way I want my Country to be. So it's just civilians spying on other civilians, that somehow makes it OK for a squad of armed police to show up at someone's home on the basis of a Google search term? Seriously??? Is this really the kind of society you want to live in? This is simply NOT acceptable police behavior, and never will be, regardless of who sends in the tip. A society in which an online search for anything at all, legal or otherwise, causes the police to knock on the door is simply not a free society, no matter how you want to spin it.