Slashdot Mirror
The Register: 4 Ways the Guardian Could Have Protected Snowden
Frosty Piss writes with this excerpt from The Register: "The Guardian's editor-in-chief Alan Rusbridger fears journalists – and, by extension, everyone – will be reduced to using pen and paper to avoid prying American and British spooks online. And his reporters must fly around the world to hold face-to-face meetings with sources ('Not good for the environment, but increasingly the only way to operate') because they believe all their internet and phone chatter will be eavesdropped on by the NSA and GCHQ. 'It would be highly unadvisable for any journalist to regard any electronic means of communication as safe,' he wrote. El Reg would like to save The Guardian a few bob, and reduce the jet-setting lefty paper's carbon footprint, by suggesting some handy tips – most of them based on the NSA's own guidance."
"most of them based on the NSA's own guidance"
Should you take guidance from people who have been proven to lie?
here are the four things, pulled from the article:
1. Encryption: It's not hard
* Keep your private key secret, encrypted and in one place (eg, not a police interrogation room)
* Meet the Advanced Encryption Standard
2. Use clean machines
3. How to shift the data securely
4. Using hidden services
When secret police come with secret orders based on secret laws signed by a secret court we secretly dispose of their bodies?
"Kill 'em all and let Root sort 'em out"
The Freenet network is still alive and is very useful for this kind of thing.
https://freenetproject.org/
1.) Encryption: It's not hard
Shouldn't really be a factor now that Snowden is known publicly. When Snowden was trying to escape the U.S. it was necessary for him to be paranoid and secretive. Now he's already given a full copy of all of his information to Greenwald in person. Snowden was protected well by his news contacts. They had him reveal himself to the world on his own time and not have his name leak before he wanted it to leak. He was safe when it mattered. The Guardian did an acceptable job getting Snowden to safety.
2.) Use clean machines
Extremely difficult. The US has deals with phone companies, operating system creators, and hardware manufacturers, to put backdoor systems into so many devices. They monitor so many email and phone companies. How can you be fully sure you didn't buy a machine that has a secret backdoor entry that the FBI or CIA can get into easily? How can you know that your PC isn't already set up for intercepts on all of your activity? You'd need to be an expert on computer software, hardware, intercept technology, and so many other things just to detect that you were being actively monitored. And being passively monitored like how the NSA just copies everything sent anywhere.
3.) How to shift the data securely
The governments of the world can potentially intercept ANYTHING. Phone calls, emails, text messages, picture messages, faxes, voices through a hidden microphone, credit card transactions, smoke signals, bank statements, parabolic intercepts. Nothing is truly secure in this day and age. A reporter can use a courier by land or plane and that person can be held in a cell for nine hours while being interrogated. But an in-person intercept is known to both parties. A phone intercept is tough to fully know about unless you have an inside source telling you "your personal phones and prepaid phones are all tracked". Thanks to Snowden I now assume that EVERYTHING is tracked by the government.
4.) Using hidden services
The government is cracking down on those. Lavabit could not stop the government. Why would any other black site or anonymous exchange be able to stop the government? The government can stop billion dollar companies from operating overnight. Like a small email or messaging company can withstand the onslaught of a multi-national cyber-military operation?
Snowden and the reporters he communicated with did use encryption and other means to preserve secrecy while he was initially doing the leaks. But once it became front-page news, he wanted the publicity, and he told them to go public.
Encryption: It's not hard
Yes it is. It fails the mom test badly. More properly it is key management that is too difficult. The actual key generation can be automated mostly. Distribution and use of keys is inherently difficult with no obviously easy solution.
From TFA:
"El Reg would like to save The Guardian a few bob, and reduce the jet-setting lefty paper's carbon footprint, by suggesting some handy tips â" most of them based on the NSA's own guidance".
Since the NSA gets a lot more information from metadata than from the message itself, I imagine they'd be delighted to have journalists encrypting everything important (lazy buggers that they are, they probably wouldn't bother with anything that wasn't).
By jumping through all the hoops in the NSA guidelines, you just sorted yourself into a tiny minority that has something to hide. You can guarantee you'll have spooks from every spy agency in the free world tracking where you go, who you talk to, who THEY talk to and what all of you do all day, where you keep your money, where you spend it, and who makes your morning coffee when the wife's out of town.
And laughing. You just KNOW they'll be laughing.
I've calculated my velocity with such exquisite precision that I have no idea where I am.
No, even then you can't guarantee it. There was an article by Dennis Ritchie (yes, one of the co-authors of the C language) that pretty much proved how there could already be back doors in compilers which are slipping in back doors to executable files without anyone knowing it. You can't stop with reading the source code. You would actually have to go through the machine code, line by line.
Seven puppies were harmed during the making of this post.
I was about to post this!
Here's a link to the article: The Ken Thompson Hack
TFA (& everyone else it seems) misses a key option: release anonymously using US First Amendment protection.
The US has **the most journalistic freedom in the world**
Accept it...in fact, the Guardian is working with NY Times to release future Snowden info *precisely* because the US has the 1st Amendment. From The Guardian's editor:
Not only that, in the US, journalists may use **anonymous sources**...they risk their reputation and job, and it has to be cleared by their editors, but it is done routinely (ex: Deep Throat).
If journalists release secret info, they can be subpoenaed to reveal their source. IF THEY REFUSE...the journalist can be jailed ONLY a short period of time, never more than 6-9 months as a 'coercive tactic'...but the gov't HAS TO LET THEM GO if they still don't talk!!!
This process is something every college journalism major learns.
Glenn Greenwald is using Snowden to further his career...the way he's shopping Snowden interviews around proves it.
The Guardian could have done this **completely differently** and Snowden would still have his job, and Greenwald would have a book deal and a ton of street cred...
Thank you Dave Raggett
I agree...and I think you are being overly fair to the Guardian and Greenwald. They could have done this completely differently and Snowden would still have his job and hot 'girlfriend'...
Anonymous source.
IMHO, Greenwald and the Guardian led Snowden around like a sheep, taking advantage of his internal motivations for releasing the info.
The truth is, Snowden's info isn't actually revealing of any *new* info, only operational details of already-reported on programs...and seriously it's common knowledge that the Feds could spy on us via the Patriot Act.
Read it for yourself, from USA Today in 2006:
He broke the law technically, revealing info that was Top Secret, but it's not exactly "news"....unless you muckrake and take advantage of the fact that most journalists never understood what the Patriot Act allows.
It's all hype...we definitely could have had a "national conversation about privacy and surveillance" without all this flap!
Thank you Dave Raggett
I can read it on your machine before you encrypt it
The "clean machine" never connects to the 'net. It handles the encryption and is the only machine that sees the decrypted data. The machine that touches the net (somewhere remote to your home/office connection) only sees the encrypted file.
When you realize that I have the power to quickly mobilize any police force almost anywhere in the world to get what I want, you will realize by how much you are screwed.
"If you just want to "stay anonymous from the NSA", or whomever good luck with that. My advice? Pick different adversaries."
Science is all about firing a drunk pig out of a cannon just to see what happens.
7. Start doing steps 1-6 NOW. Routinely. Across your entire media organisation. When you don't need it.
Don't wait until you're doing something you want to hide, then suddenly start using high-end crypto and data obfuscation and special networks to shout "LOOK AT ME, I HAVE SOMETHING TO HIDE".
Science is all about firing a drunk pig out of a cannon just to see what happens.
But I can read it on your machine before you encrypt it, cos I'm the NSA and if Microsoft won't give me a back door (usually they do), I just lean on Nvidia, Hewlett Packard, or someone to write me a trojan into their drivers so I can get my back door. It's trivial.
This is one of the reasons that El Reg pointed us to the NSA's own recommendation to USE LINUX. Specifically, use a hardened Linux which is far more secure than any version of Windows, and rather less prone to insertion of back doors into drivers. Here's the relevant bit from El Reg:
"Buy new machines for cash from a shop and harden them against attack: why not (again) take the NSA's own advice and make sure you're using Security-Enhanced Linux, a series of patches for the open-source OS that are now part of Linus Torvalds' official mainline kernel."
Those who can make you believe absurdities can make you commit atrocities. - Voltaire
No. I am arguing that one might give more weight to the results of polls among a large number of journalists around the planet, rather than the opinion of this single guy -- Guardian editor or not.
And even if he's right that NYTimes are better equipped for this kind of thing, that's still a far cry from saying that the US does therefore in its entirety have "the most journalistic freedom" in the world -- which was what you were arguing.
Gosh, thanks. That must be why the other ships call me Meatfucker -- GCU Grey Area (Eccentric)