Former Microsoft Privacy Chief Doesn't Trust Company, Uses Open Source Software

← Back to Stories (view on slashdot.org)

Former Microsoft Privacy Chief Doesn't Trust Company, Uses Open Source Software

Posted by timothy on Tuesday October 1, 2013 @02:46AM from the takes-one-to-know-one dept.

MojoKid writes "Microsoft's onetime Chief Privacy Advisor, Caspar Bowden, has come out with a vote of no-confidence in the company's long-term privacy measures and ability or interest to secure user data in the wake of the NSA's PRISM program. From 2002 — 2011, Bowden was in charge of privacy at Microsoft, and oversaw the company's efforts in that area in more than 40 countries, but claims to have been unaware of the PRISM program's existence while he worked at the company. In the two years since leaving Microsoft, Bowden has ceased carrying a cell phone and become a staunch open source user, claiming that he no longer trusts a program unless he can see the source."

39 of 199 comments (clear)

Min score:

Reason:

Sort:

Now, also make it understandable by d33tah · 2013-10-01 02:50 · Score: 5, Funny

The next obvious step is not to use it unless you can understand it.
1. Re:Now, also make it understandable by d33tah · 2013-10-01 03:41 · Score: 2
  
  DIdn't mean that. Complexity is usually a sign of bad design. Actually, most of concepts in CS are pretty straightforward and if you get stuff complicated, it's more prone to bugs and thus, security problems. For example, take ECDSA and RSA. Modular exponentation is a pretty simple concept while the whole elliptic-curve thing was complicated enough for guys smarter than us to insert a backdoor into the equations. We should definitely go for simple and transparent designs.
2. Re:Now, also make it understandable by cellocgw · 2013-10-01 04:22 · Score: 2
  
  DIdn't mean that. Complexity is usually a sign of bad design. Actually, most of concepts in CS are pretty straightforward ...
  Counterargument: the Rubik's Cube is a pretty snazzy, simple design. Try to solve it.
  
  --
  https://app.box.com/WitthoftResume Code: https://github.com/cellocgw
3. Re:Now, also make it understandable by egamma · 2013-10-01 04:30 · Score: 2
  
  The next obvious step is not to use it unless you can understand it.
  So you're not going to use your car because you don't understand internal combustion engines or the chemical properties of gasoline?
  
  --
  Battlemaster--Game with friends in medival realms
4. Re:Now, also make it understandable by njnnja · 2013-10-01 04:33 · Score: 2
  
  Actually, gp is a little right, although most people misunderstand the Amish relationship with technology. They don't ban all technology; rather, they make a conscious decision about whether to adopt or not adopt a new technology, based upon their values. In the same way, instead of using every new technology that someone tries to sell to us, we should evaluate it using non-technical metrics to determine whether using it is really the right thing to do. Much of social media, cloud storage, and proprietary crypto would have a very difficult time passing this test, and we would probably be better off being more Amish-like and avoiding technologies that are not consistent with the way we want to live rather than jump onto every new shiny shiny that's put in front of us.
Good for him by techsoldaten · 2013-10-01 02:57 · Score: 5, Insightful

Without assigning any kind of reason to his shift in attitudes - it's refreshing to see a privacy officer come out like this. I can't think of a reason any CPOs should act differently.
1. Re:Good for him by CastrTroy · 2013-10-01 03:36 · Score: 2
  
  He seems to have gone a little too "tinfoil-hat" for my tastes. He doesn't carry a cell phone anymore. I think that says a lot more than becoming an open source user.
  
  --
  
  Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
2. Re:Good for him by intermodal · 2013-10-01 03:55 · Score: 2
  
  I think it says more about mobile networks than it does about him.
  That said, once upon a time I worked at Microsoft, back in the just-after-9/11 days. Seeing how the place worked is one of the reasons that I haven't owned a system that ran Microsoft since 2001.
  
  --
  In SOVIET RUSSIA... erm...NSA AMERICA, the Internet logs onto YOU!
3. Re:Good for him by SteveFoerster · 2013-10-01 05:02 · Score: 2
  
  It does indeed say more, but it doesn't say that he's crazy.
  
  --
  Space game using normal deck of cards: http://BattleCards.org
4. Re:Good for him by bill_mcgonigle · 2013-10-01 06:50 · Score: 5, Insightful
  
  He seems to have gone a little too "tinfoil-hat" for my tastes. He doesn't carry a cell phone anymore. I think that says a lot more than becoming an open source user.
  If the government mandated that everybody carry a tracking device, keep it on at all times, and that they'd be storing the tracking data in perpetuity, there'd be a goddamn revolution.
  But when they do so voluntarily, and the NSA steals all that data - leading to the exact same end point - people are all like, "oh, look, Walter White is twerking again."
  At least this guy is being true to his privacy milieu.
  
  --
  My God, it's Full of Source!
  OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
5. Re:Good for him by gmhowell · 2013-10-01 11:07 · Score: 2
  
  Neither does RMS...is he a bit tinfoil-hat too?
  I think he's the next level up: toe cheese canapes.
  
  --
  Jesus was all right but his disciples were thick and ordinary. -John Lennon
6. Re:Good for him by zbaron · 2013-10-01 20:33 · Score: 2
  
  Erg, no it wouldn't. Excuse coffee deprived brain.
Routing Connections from Point A to Point B by jiadran · 2013-10-01 03:05 · Score: 5, Interesting

The article mentions that a connection from one point to anohter within Europe would likely stay within Europe. Maybe technically... On a recent trip to Paris I did a traceroute to an e-mail server in Switzerland, and essentially what I saw was: Paris (F) -> London (UK) -> Paris (F) -> London (UK) -> Paris (F) -> Lyon (F) -> Geneva (CH). There might be good reasons why the connection would go through London, but twice, and then come back? Considering that the UK is closely collaborating with the US in its data gathering, I have a feeling that this routing was not entirely by accident.
1. Re:Routing Connections from Point A to Point B by StripedCow · 2013-10-01 03:21 · Score: 5, Funny
  
  There might be good reasons why the connection would go through London, but twice, and then come back?
  Perhaps the packet forgot its toothbrush?
  Never attribute to malice what can be adequately explained by stupidity.
  
  --
  If Pandora's box is destined to be opened, *I* want to be the one to open it.
2. Re:Routing Connections from Point A to Point B by Anonymous Coward · 2013-10-01 03:43 · Score: 3, Funny
  
  If you didn't tell me I would have assumed:
  Paris (Maine) -> London (Ohio) -> Paris (Pennsylvania) -> London (Minnesota) -> Paris (Texas) -> Lyon (Mississippi) -> Geneva (New York).
3. Re:Routing Connections from Point A to Point B by SSpade · 2013-10-01 04:10 · Score: 4, Informative
  
  I'm pretty sure that you don't really know where the physical hardware using the intermediate IP addresses shown in the traceroute actually was. Reverse DNS tends to show who owns it, *not* which country it's in. And geoip services are doing well if they can identify the right country in Europe, let alone anything more accurate than that.
  Even if you did see routing like that, and it really did go to the cities you claim, it still wouldn't be that odd - when routing is optimized at all it's optimized for cost, rather than distance. For long-haul the two tend to go together, but for relatively short distances in the well-connected first world they don't.
The next obvious step is to ... by Taco+Cowboy · 2013-10-01 03:05 · Score: 5, Insightful

... use caution in everything we do.
There is no way we can understand everything. There are just too many things out there that we use daily - even software alone consist of so many layers ( from the spreadsheet software program that we use, to the device drivers, the OS, to the embedded firmwares residing inside the chips, to the myriad mix of software that keep the Net humming.
Yes, I know, it is no fun.
The paranoids have a point, after all --- BIG BROTHERS (plural) want to know everything about us.

--
Muchas Gracias, Señor Edward Snowden !
1. Re:The next obvious step is to ... by Fnord666 · 2013-10-01 03:21 · Score: 5, Insightful
  
  even software alone consist of so many layers ( from the spreadsheet software program that we use, to the device drivers, the OS, to the embedded firmwares residing inside the chips, to the myriad mix of software that keep the Net humming.
  Don't forget the compilers and linkers that build the software. The source may look fine, but where did the compiler come from?
  
  --
  'The tyrant will always find pretext for his tyranny.' - Aesop's Fables
2. Re:The next obvious step is to ... by Anonymous Coward · 2013-10-01 03:31 · Score: 5, Informative
  
  There's still the trick described by Ken Thompson which involves a compiler taking the source code of a compiler but also injecting a backdoor into the binary at the same time. This means that there can be a trojan replicating itself over multiple generations even though it never shows up in the source.
3. Re:The next obvious step is to ... by disposable60 · 2013-10-01 03:32 · Score: 2
  
  Someone around here mentioned an attack on this supposed haven. The upshot was that in the first set of source, compromizing code was inserted and compiled, instructing the compiler to compile that bit, then remove it from the source. In subsequent compiles of the compiler, if the compromizing source was not found, the code would still be inserted. Anything compiled by that compiler would then be compromized, but no review of the source would reveal it - you would have to walk the binary.
  
  --
  You're looking for quotes? See my journal.
4. Re:The next obvious step is to ... by Thanshin · 2013-10-01 03:39 · Score: 5, Funny
  
  Open source compilers... that compile themselves.
  It's compilers all the way down.
5. Re:The next obvious step is to ... by Pope · 2013-10-01 04:10 · Score: 4, Funny
  
  Open source compilers... that compile themselves.
  It's compilers all the way down.
  My god, it's even worse: Turtle Logo compilers!
  
  --
  It doesn't mean much now, it's built for the future.
6. Re:The next obvious step is to ... by mcgrew · 2013-10-01 05:02 · Score: 2, Insightful
  
  There is no way we can understand everything.
  True, but one can understand everything about something, and enough of everything to get by. If you know how electricity and electronic components work, how logic gates and ALUs work, know assembly and higher level languages you can pretty much understand enough.
  The secret is reading LOTS of books and then practicing. Unfortunately, 97% of the population are aliterate -- they can read, but don't. I don't understand those people! Probably never will.
  
  --
  Free Martian Whores!
7. Re:The next obvious step is to ... by dead_user · 2013-10-01 05:38 · Score: 2, Funny
  
  aliterate
  
  The other 3% can't spell illiterate. ;)
8. Re:The next obvious step is to ... by Windwraith · 2013-10-01 07:51 · Score: 2
  
  ...and what SIM card does it use? Because you don't get 3G without a SIM card, and 3G is not free to use. You get the bill for it, or does Intel have some form of international superserver?
  It's true that paranoia turned out to be real, but come on.
9. Re:The next obvious step is to ... by Xtifr · 2013-10-01 09:03 · Score: 2
  
  A trick that relies on the compiler recognizing its own code, which, as the code is edited over the years, would require truly amazing AI. Thompson had it fairly easy, because he was dealing with a relatively simple and fairly static compiler, and could use simple pattern matching to identify the places to insert his trojan. GCC, on the other hand, has undergone some major rewrites over the years.
  Of course, if you really want to be sure, you can load the compiler source into something completely different. I once built GCC using a C interpreter, and then used the interpreted version to compile the compiler again, and got identical binaries, so I'm pretty confident that GCC has no such trojans lurking. But you're welcome to try the same trick yourself.
10. Re:The next obvious step is to ... by aztracker1 · 2013-10-01 10:17 · Score: 3, Interesting
  
  I really wish we had a -1 Misinformation mod. We have a +1 Informative.. but there are actual posts, like the parent that are just plain inaccurate, wrong and misleading.
  
  --
  Michael J. Ryan - tracker1.info
Message received by Tokolosh · 2013-10-01 03:07 · Score: 5, Insightful

Recent history teaches us that he knows things that he is not allowed to talk about. This is his way of legally signalling that all is not well.
We have congresscritters trying to send the same message, without being labeled "traitors". See http://www.wyden.senate.gov/news/press-releases/wyden-udall-statement-on-reports-of-compliance-violations-made-under-nsa-collection-programs

--
Prove anything by multiplying Huge Number times Tiny Number
1. Re:Message received by turgid · 2013-10-01 03:33 · Score: 4, Insightful
  
  You're not thinking cynically enough.
  With my Slashdot ubiquitous Microsoft Shill hat on consider the following.
  If you don't like/trust/use Microsoft, you are immature and stupid and a stinking long-haired communist FOSS hippy.
  Someone from the company you HATE leaves the company and announces that they don't trust their former employer which also happens to be the company you HATE, and that they have converted to the FOSS way.
  That means what you suspected all along is true! Right?
  Ah but, it's a trap! You see, the FOSS is back-doored to high heaven as well and all this is a psychological trick to make you feel secure and validated in your own mind.
  Muhahahhahahhahah! Elop will soon rule the galaxy.
  
  --
  Stick Men
2. Re:Message received by smash · 2013-10-01 04:36 · Score: 2
  
  They're in the firmware/hardware anyway. That 87 megabyte NVIDIA blob you're running? HAHA! That intel microcode update? Guess what!
  
  --
  I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
I'm surprised MS had a Chief Privacy Advisor... by jkrise · 2013-10-01 03:07 · Score: 5, Funny

that itself is more newsworthy. At first glance I thought Piracy Advisor; who suggests making things difficult to pirate.
Why would MS appoint somebody to advise them on privacy of their customer's data? How does it benefit the shareholders?

--
If you keep throwing chairs, one day you'll break windows....
Former Employee Uses Competing Product by rodrigoandrade · 2013-10-01 03:12 · Score: 3, Funny

News at 11.
Read this FA ... by Taco+Cowboy · 2013-10-01 03:39 · Score: 3, Informative

http://scienceblogs.com/goodmath/2007/04/15/strange-loops-dennis-ritchie-a/
Both AC and disposable60 were trying to explain to you the concept outlined by Mr. Thompson.
Read, and ponder.

--
Muchas Gracias, Señor Edward Snowden !
Caspar Bowdens testimony in the EU Parliament by Christian+Engstrom · 2013-10-01 03:47 · Score: 4, Informative

Last week, Caspar Bowden testified at a hearing in the European Parliament, and presented a report on the NSA surveillance to the European Parliament's Committee for Fundamental Rights LIBE.
Link to the report: http://www.europarl.europa.eu/meetdocs/2009_2014/documents/libe/dv/briefingnote_/briefingnote_en.pdf
Link to the Youtube-video with Bowden's statement and the following Q&A (63 min): http://youtu.be/qa83l2_ZzEo

--
Christian Engström, Former Member of the European Parliament 2009-2014 for The Pirate Party, Sweden
Re:Worthless by Virtucon · 2013-10-01 03:47 · Score: 4, Informative

He doesn't have too, it appears that the Key exchange protocols were weakened and it's not necessary to break AES but extract the keys during KEP negoitiation. http://www.zdnet.com/has-the-nsa-broken-ssl-tls-aes-7000020312/
You also have to remember that it's a negotiation and unless you set your browsers up and websites to use more secure protocols you could default to say RC4-RSA under SSLv2.0. There's acknowledged flaws in TLS 1.0 (SSLv3.0) but it wasn't until a couple of months ago that Firefox supported TLS 1.1 and it still doesn't support TLS 1.2. Chrome (Version 30+) and IE (9+) support TLS 1.1 and TLS 1.2. So you should see more and more websites turning on TLS 1.2 support and turning off TLS 1.0 and 1.1 if they can. http://en.wikipedia.org/wiki/Transport_Layer_Security
I've already had change requests come in from customers to get away from AES and to push more TLS 1.2 out there and you're already seeing companies and other government agencies distancing themselves from NIST blessed standards and that's lamentable but the credibility of the organization has been irreparably compromised by NSA influence. As a result, may see more ChaCha or more TwoFish implementations start to come into the mix over this, which is a good thing because it means that we have diversity in ciphers and less reliance on NIST and its standards processes.

--
Harrison's Postulate - "For every action there is an equal and opposite criticism"
Re:Two ways this guy is silly, or naive by david672orford · 2013-10-01 04:27 · Score: 2

It's utopian, and silly, to think that 1. everyone can so carefully inspect all software they use that you can keep snoopers out and 2.
True, but the risk is still greater if no one can inspect it.
Not to worry... by unimind · 2013-10-01 05:28 · Score: 2

This ought to lay everyone's concerns to rest:
Azure certified by DOD

Obviously, this guy is just disgruntled. Nothing to see here..

--
The following statement is true: The previous statement is false.
citizen or no by sacrilicious · 2013-10-01 06:00 · Score: 3, Insightful

As Bowden goes on to point out, if you aren't a US citizen, you have no protection whatsoever from PRISM.

Um, and if I'm a citizen, I'm protected from prism? Nuh uh.

--
- First they ignore you, then they laugh at you, then ???, then profit.
Re:There's still the solution to that. by lennier · 2013-10-01 14:55 · Score: 2

I guess it's the entitlement culture... that insists that an infinite number of things be known by them without having to put an infinite amount of time into it.
Maxwell's Information Demon says: "Hi! It looks like you're trying to enumerate an infinite number of uncountably infinite sets in your head! Would you like me to read to you from the collected works of Kurt Godel and Georg Cantor while you're waiting to finish that? Aleph-1 Klein bottles of beer on the wall, Aleph-1 Klein bottles of beer, take one down, pass it around, Aleph-2 Klein bottles of beer, hey! Darn, I broke one. Now there's Koch snowflakes all over the Sierpinski carpet. Got a Menger sponge?"

--
You are not a brain: http://books.google.com/books?id=2oV61CeDx-YC