Slashdot Mirror
NZ Professor Advocates Civil Disobedience Against Mass Surveillance
nut writes "We're all aware of how much surveillance we are under on the internet thanks to Edward Snowden. Gehan Gunasekara, an associate commercial law professor at Auckland University in New Zealand, wants us all to start sending suspicious looking but meaningless data across the internet to overload automated surveillance systems. Essentially he is advocating a mass distributed Bayesian poisoning attack against our watchers."
Just sending a bunch of keywords in email isn't enough - emacs has had a spook function since the 80s so they are kind of used to that stuff by now./ You'll have to act like a crazy-pants terrorist.
To make it really work we need to bring the eternal september to the islamic extremist websites. Everybody go post on those arabic jihadi websites. Uh, does anyone know of any arabic jihadi websites? Or how to read and write arabic?
What does that even mean?
Death metal to America!
I've been convincing as many people as I can to start using Retroshare as an IM program. It's encryption isn't the best - the NSA might be able to break it with a lot of effort, but they certainly can't do so for mass-surveillance. But it's compact, reliable, cross-platform (Though a rather fiddly compile), and it gets the IMs through. No central servers, all communications encrypted - you establish contacts by exchanging keys. And very hard to filter, as it doesn't run consistent ports and the preferred protocol is SSL with a UDP fallback. It can even do the UDP-dummy-start trick to get through a NAT at both ends, like Skype does. Plus it incorporates folder sharing, which means you can help to promote it by promising friends access to your folder-o-piracy.
Shameless as this plug is, I'm in no way affiliated with Retroshare. I just think it's a very nice piece of software, and more people should use it.
Fifteen years ago, I'd have been all for causing a disruption. Exercising my self-evident liberties and thwarting The Man, when he came down on me for it.
Now, I have a fucked up back from a car crash, a fucked up knee from wrestling, a mortgage, people depending on me, a professional career, and neighbors. The amount of ways they could absolutely obliterate my life at their slightest whim are uncountable. As much as I'm all about people doing something and not just playing "Reddit-pretend-rebel/protestor", we are beyond the time of, say, the 90s -- where civil disobedience and voicing your dissent or even just being a vocal weirdo just got you either a knock on the door or a two hour trip into and out of your local lockup. We're in a time where you become an instant "child molester" or you just disappear or your finances go all permanently wonky, or you get "investigated" and now your neighbors and employer and coworkers all wonder what you've been up to that has raised the interest of The Man.
We should do this, and make user-friendly encryption tools more widely available to the non-geek community as well.
Tools are not the problem. The problem is that at a certain scale you need some infrastructure to distribute and authenticate encryption keys and at that point you'll run into the same problem we're at now: You have third parties you'll have to trust. Doesn't matter then if you have to trust them not to hand over your data (like Google and ISPs do) or your encryption keys.
It's not a technical problem, it's a political problem.
Very true, for now. The short-term solution is scale: sheer volume can create enough noise and wasted effort to at least slow the bastards down a bit, albeit temporarily. Overflows still happen.
In the longer term, we just need to develop and host purpose-built junk generator applications whose sole mission is to flood the sniffer's nostrils with the digital aroma of a cattle feed lot.
Scruting the inscrutable for over 50 years.
Start with trackmenot and go from there.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Tools are not the problem. The problem is that at a certain scale you need some infrastructure to distribute and authenticate encryption keys and at that point you'll run into the same problem we're at now: You have third parties you'll have to trust. Doesn't matter then if you have to trust them not to hand over your data (like Google and ISPs do) or your encryption keys.
It's not a technical problem, it's a political problem.
I do not agree, or at least not see it as so black and white. Tools *are* a big problem, almost a complete failure even being designed by engineers for engineers. Hard to use and setup for people with no 5kill2, not up and running by default with zero configuration on programs first install. Tools today put the egg before the chicken requiring that you pay/setup/configure yourself into the "infrastructure to distribute and authenticate encryption keys" before you can encrypt anything by default, therefore the overwhelming default is that nothing is encrypted - a big fail. In this light OTR does it right - 100% everything encrypted by default after first install of chat clients supporting it, by default. If you are one of the few that wants to raise the bar on the security from there, then you can easily check signatures out of band or use a third party authenticator - but that is secondary and and very easy to do given everyone is using it already by default. PGP/SSL does it the hard/wrong way (IMO): Forces everyone into "too complicated for the average person"/$$$ solutions even before you can start encrypting (without scary browser warnings etc). End result: Nobody encrypts, an especially glaring failure in the case of email. SSL is mostly for commercial orientated websites - check stats for vast majority of websites vs those that support SSL. Self signed certs are a dirst word
Security experts will be growling "MITM", "we neeeed third party authentication", "good security is hard to do", "MITM, again", but again it is egg before the chicken missing the forest for the trees. Top priority Job #1 is get everything encrypted all the time. Job #2 you can start worrying about how to check signatures on your certs out of band, raise the visual cues that your session is both encrypted and you have taken the extra time or used a third party to authenticate the certs signatires. If the whistleblower Snowden has taught us nothing else, it is that if you do bother to encrypt whilst nobody else is doing it then your communications are automatically being targeted for extra monitoring. Oh, and if you do happen to visit some website over https that one agency or other happens to have a grudge against or wishes to perform some industrial espionage on, then your also MITM'ed.
Security tools are still in the dark ages and do not cater to humans. No amount of political hot air is going to fix that...
Do not go gentle into that good night,
Old age should burn and rave at close of day;
Rage, rage against the dying of the light.
Though wise men at their end know dark is right,
Because their words had forked no lightning they
Do not go gentle into that good night.
Good men, the last wave by, crying how bright
Their frail deeds might have danced in a green bay,
Rage, rage against the dying of the light.
Wild men who caught and sang the sun in flight,
And learn, too late, they grieved it on its way,
Do not go gentle into that good night.
Grave men, near death, who see with blinding sight
Blind eyes could blaze like meteors and be gay,
Rage, rage against the dying of the light.
And you, my father, there on the sad height,
Curse, bless, me now with your fierce tears, I pray.
Do not go gentle into that good night.
Rage, rage against the dying of the light.
-- Dylan Thomas
We should do this, and make user-friendly encryption tools more widely available to the non-geek community as well.
Tools are not the problem. The problem is that at a certain scale you need some infrastructure to distribute and authenticate encryption keys and at that point you'll run into the same problem we're at now
Oh if only there were some decentralized trust management system like PGP!
If only someone from the 1970's could travel Half a Century into the future to tell us about Diffe-Hellman key exchanges.
If only Six Degrees were about level of separation required to link all humanity to an Erdos Number of One.
WHY! Oh Why? Why have I wound up trapped in this Math Forsaken Timeline AGAIN?!!
Please, sir! Tell me they haven't outlawed plotting the series of Zn+1=Zn*Zn+c too?!
Security be damned, I just couldn't live in a world without beauty...
http://ia601203.us.archive.org/5/items/milmanual-tm-31-210-improvised-munitions-handbook/tm_31-210_improvised_munitions_handbook.pdf
happy instant woody ;)
En what? 9/11 barelly killed half of what diarrhea kill EVERY DAY. Fighting diarrhea is far less costly than fighting this so called terrorism. The real terrorists are these states instilling fear of terrorism in the population. And let me laught when they say that they have so good information about a next terrorist attack that they need to stengthen the security worldwide and not just where the next attack would be. This is probably an attempt to talk about something else than snowden and the surveillance state in the medias...
Okay, maybe this is just whooshing over my head, but ... "so the authorities have no hope of finding the actual terrorists"?
But, but, I WANT them to find the "actual terrorists".
I DON'T want them to accuse innocent people of being terrorists. I don't want them to break down doors with guns blazing because someone didn't answer the door fast enough. I don't want them to frighten young children (or adults that have the mental capacity of young children) at airports. I don't want the police to pay a visit to people just because someone Googled "pressure cookers" while his wife Googled "backpacks". I don't want them to arrest people for wearing suspicious T-shirts, or kick people off of airplanes because they are speaking Russian (or Arabic, or Spanish) to each other. I don't want them to shoot to kill because someone dark-skinned is running for the train. I do not want the police to act on false positives.
But I definitely DO want them to catch the "actual terrorists" before they can commit their acts of terrorism!
But I definitely DO want them to catch the "actual terrorists" before they can commit their acts of terrorism!
Here's a better alternative: ask yourself what causes someone to become a terrorist; then ask yourself whether you're doing something in that list; then ask yourself whether those things you're doing are necessary and important enough that it's worth it to have terrorists being formed due to you doing them; then, if the answer is "no", stop doing them. That's a good way to not have terrorists appearing, or at least to not have a majority of them appearing, meaning you won't have to worry about catching that which doesn't exist anymore.
An alternative is to do a cost-benefit analysis. In which position, relative to all other troubles are terrorism-caused violence, destruction and death? 1st place, 2nd, 3rd, 100th, 1000th? Adjust your priorities accordingly. If something kills 'n' more people than terrorists, it should be worth 'n' times more of your time than terrorism. Terrorism kills on average what? A few hundred people every year? There's stuff out there that kill a few hundred thousand people every year. Ask yourself: why aren't you worried a thousand times more about those?
Terrorism is a very minor problem. Giving it all this attention is a cognitive failure. There are much more objectively important issues out there.
Conservatism: (n.) love of the existing evils. Liberalism: (n.) desire to substitute new evils for the existing ones.
Bull feathers!
The cause of most wars and terrorism is us-versus-them. Different religions provide a dividing line between "us" and "them", but it can just as easily be ethnic origins, skin color, language, political views, gang affiliation, or any other marker.
But I still completely disagree that it should be anybody's goal to ensure that "the authorities have no hope of finding the actual terrorists."
The problem is that someone's an actual terrorist only after actually committing some terrorist activity or at least helping someone who did. Trying to go after people who are "thinking about" committing an act of terrorism is going after someone for a thought crime. No, the appropriate approach is to focus on prevention. You try the best you can, upper bound by an objective cost-benefit analysis, to prevent such acts from being successful. And if it so happens that one such act goes through the prevention efforts and end up happening, then you go after those who *now* have actually become criminals to prosecute and punish them to the full extent of their *actual* crime.
There's no place in a free society for thought crimes. Widespread surveillance is unneeded both in principle and in practice.
Conservatism: (n.) love of the existing evils. Liberalism: (n.) desire to substitute new evils for the existing ones.