Slashdot Mirror
UK's GCHQ Admits To Using Vulnerabilities To Hack Target Systems
Bismillah (993337) writes "Lawyers for the GCHQ have told the Investigatory Powers Tribunal in the UK that the agency carries out the same illegal Computer Network Exploitation (CNE) operations that criminals and hackers do. Except they do it legally. GCHQ is currently being taken to court by Privacy International and five ISPs from UK, Germany, the Netherlands, Zimbabwe and South Korea for CNE operations that the agency will not confirm nor deny as per praxis."
Thankfully, the beta project has been abandoned.
How much abuse was required to accept what the users were complaining about from day one? It must be over a year?
And shameless, too.
will not confirm nor deny as per praxis.
What does an explodey Klingon moon have to do with this?
systemd is Roko's Basilisk.
Something is illegal when there are laws or treaties adopted by the country in question that render the actions illegal. If there is no law or treaty that interdicts the GCHQ from hacking third parties then it cannot be illegal.
Timothy & the people he likes to promote often use words like "unconstitutional" & "illegal" using their own private definitions of the words -- but all they do is render their utterances meaningless hype.
Democracy is a sheep and two wolves deciding what to have for lunch. Freedom is a well armed sheep contesting the issue
IPT is a rubber stamping agency, to hide the illegality from legal challenge by having a layer of yes men between it and the legal system.
But even they admit the illegal nature of spying on Brits for a foreign power. Although they're only limited to whether it violates some narrow rules, so they found it was illegal because it wasn't transparent, and now that Snowden has leaked it, its now transparent hence legal:
https://www.techdirt.com/articles/20150206/07190329935/uks-secretive-court-says-intelligence-sharing-between-nsa-gchq-was-unlawful-past-now-it-isnt.shtml
But hey, if you call it 'sharing' that makes it sound so much better! They didn't spy for America, they 'shared' a bulk collection feed of mostly British data with them. See? Not traitors betraying their countries secrets at all!
"Police carry the same projectile weapons that criminals do. Except they do it legally."
@phayes: "Something is illegal when there are laws or treaties adopted by the country in question that render the actions illegal. If there is no law or treaty that interdicts the GCHQ from hacking third parties then it cannot be illegal.
Computer Misuse Act 1990
'Sections 1-3 of the Act introduced three criminal offences:
unauthorised access to computer material, punishable by 6 months' imprisonment or a fine "not exceeding level 5 on the standard scale" (currently £5000);
unauthorised access with intent to commit or facilitate commission of further offences, punishable by 6 months/maximum fine on summary conviction or 5 years/fine on indictment;
unauthorised modification of computer material, subject to the same sentences as section 2 offences.'
There are also laws against killing people, yet law enforcement and the military may lawfully do so in certain situations.
The summary would be accurate if it simply struck the word illegal:
"the agency carries out the same Computer Network Exploitation (CNE) operations that criminals and hackers do. Except they do it legally."
Is anyone surprised by this? NSA and CYBERCOM do it, too, under US Title 50 and Title 10 authorities, respectively.
And there is no equivalence between the actions of criminals and democratic governments, nor between repressive government and democratic governments, without an ugly morass of moral relativism.
GCHQ is an intelligence component of a free and democratic society operating with clear and specific legal authorities, even though some may disagree with them, utterly misunderstand them, or incorrectly believe that is not the case. Intelligence activities also require secrecy in order to be effective, even in free societies.
There appears to be a fundamental misunderstanding even in the tech companies of what GCHQ and NSA are actually doing and why. Gone are the days where the US or UK targeted foreign communications on distant shores, or cracked codes used only by our enemies. No one would have questioned the legitimacy of breaking the German or Japanese codes during WWII. The difference today is that our adversaries -- from terrorists to nation-states -- use the same systems, services, networks, operating systems, devices, software, hardware, cloud services, encryption standards, and so on, as our citizens and much of the rest of the world. The distinction is no longer the technology or the place, but the person(s) using a capability: the target. In a free society based on the rule of law, it is not the capability to do a thing, but the law which defines how we behave, that is paramount.
An important thing to remember here is that because adversaries use the same systems we're using, the fact that Americans or Britons or others also use them does not suddenly or magically mean that no element of US or UK intelligence should ever target them. When a terrorist in Somalia is using Hotmail -- or an iPhone -- instead of a walkie-talkie, that does not mean we pack our bags and go home. That means that, within legal authorities and duly authorized missions, we aggressively pursue any and all possible avenues, within the law, that may allow us to intercept and exploit the communications of foreign intelligence targets.
If they are using hand couriers, we target them. If they are using walkie-talkies, we target them. If they are using their own custom methods for protecting their communications, we target them. If they are using HF radios, VSATs, satellite phones, or smoke signals, we target them. If they are using GMail, Facebook, iPhones, Android, SSL, web forums running on Amazon Web Services, etc., we target them -- within clear and specific legal frameworks that govern the way our intelligence agencies operate, including with regard to our own citizens.
That doesn't mean it's always perfect; that doesn't mean things are not up for debate; that doesn't mean everyone will agree with every possible legal interpretation; that doesn't mean that some may fundamentally disagree with the approach to, e.g., counterterrorism. But the intelligence agencies do not make the rules, and while they may inform these, they do not define national policy or priorities.
"We're pretty aggressive within the law. As a professional, I'm troubled if I'm not using the full authority allowed by law." - General Michael Hayden, Director, National Security Agency (DIRNSA), November 2007
"Gone were the days when signals of interest [...] went along some dedicated microwave link between strategic rocket forces headquarters in Moscow and some ICBM in western Siberia. By the late '90s, what NSA calls targeted communications -- things like al Qaeda communications -- coexisted out there in a great global web with your phone calls and my e-mails. NSA needed the
How can voters 'approve' of secret programs, to spy on them?
Their people in the House of Lords recently tried to slip 'snoopers charter' into an amendment, the Lords rejected it demanding instead a debate of surveillance. Hence nobody can pretend this has approval, even the Lords want to find the details of it and debate it. Also you don't try to legalize something that is already legal. We found out they have a huge database of private British info, and its freely accessed by Ministry staff. No warrants, no checks, and Snoopers Charter would have made it legal retrospectively.
Good luck telling a judge that his private info, and that of his family are freely available to everyone in certain ministries without so much as a warrant, or check.
Fearmongering isn't necessary if approval is given:
https://www.privacysos.org/node/1660
"If you’re submitting budget proposals for a law enforcement agency, for an intelligence agency, you’re not going to submit the proposal that ‘We won the war on terror and everything’s great,’ cuz the first thing that’s gonna happen is your budget’s gonna be cut in half. You know, it’s my opposite of Jesse Jackson’s ‘Keep Hope Alive’—it’s ‘Keep Fear Alive.’ Keep it alive." - FBI assistant director Thomas Fuentes
Oh, my! Hah ha ha, please forgive me! Ha ha ha ha That's a good one!
Scruting the inscrutable for over 50 years.
What they've done is to use a blanket warrant to grab ALL data on the excuse of 'terrorism', that gives them a searchable database, which no longer has the individual judicial checks. In particular they've done a full take on the pipes into the UK, which by its nature carries mostly UK to UK data.
GCHQ then handed this feed to the NSA, who have indexed it, on the promise they won't misuse it, and NSA in return has given them access to a search interface, PRISM back on this data and others.
NSA built a haystack, and the one thing we know is it isn't likely to contain needles, because its easy-to-get bulk data on everyone, not difficult-to-get signals intelligence on terrorists. The quantity of 'hay' they collect is connected to the ease by which they can intercept it, not the likeliness of it for 'terrorism'.
And of course once you remove the judicial protections and checks and balances, it all goes out the window. We learned of the memo saying NSA should keep any UK intelligence useful to the US, despite the 5 eyes 'no-spy' treaty, and that the SWIFT agreement was circumvented by simply assigning NSA staff to the treasury. Well duh!
In the process of turning US industry into surveillance machines, they've undermined encryption, withheld security holes, signed secret corporate commercial surveillance agreements. Undermining US products by coercion and bribery.
All because one General decided that instead of 'thin thread' approach of going after just the info they needed, they'd do a big 'store it all', and then do the searches adhoc without judicial checks after the fact.
You say 'clear legal framework' but it was clear from the leaks that the FISA judge was misled about the database stuff. He approved a tap, for a specific purpose, and instead it went into a database for other purposes. If FISA judges cannot be told the truth then how can this be a 'clear' anything?
NSA lied to the court:
https://www.techdirt.com/articles/20130821/16331524274/declassified-fisa-court-opinion-shows-nsa-lied-repeatedly-to-court-as-well.shtml
None of this has been approved by the democracy it operates in. We get glimpses of how abused the systems was sometimes:
https://www.techdirt.com/articles/20140813/23203228207/unsealed-jewel-v-nsa-transcript-doj-has-nothing-contempt-american-citizens.shtml
Keep in mind we're not talking about detail here, the basis of "collect everything one judicial warrant then search it later without warrant", for Britain this was one of the parts of Snoopers Charter. When GCHQ failed to get it, it went ahead with Tempora anyway with a faulty legal interpretation. It was clearly a breach of the law, yet they did it anyway.
So now we're in the position where politics is corrupted in 5 eyes countries, where the hard line military leaders win elections, and up coming parties have their telephone calls leaked against them. All of that needs to be pulled back in, the protections put back in place, GCHQ staff involved need to be ejected (prosecuted even) and replaced by people loyal to their country, and GCHQ need to only hand narrow data over, on terrorism, with proper judicial checks each time.
Should GCHQ be spying on data, which is mostly British, including sensitive data on commercial, political, journalistic and democratic actors from 200 fibre optics, handing it to NSA who give it to 800,000 NSA staff and private contractors ? It's a no-brainer. No they should not.
https://orderoftruth.wordpress.com/2013/06/22/uk-communications-bill-snoopers-charter-legalises-illegal-activity-of-gchq-and-nsa-in-uk-exposed-by-snowden/
GCHQ staff, to me you are compartmentalized into seeing tiny parts of the bigger picture. Classic 'rubes'.
I'm sorry but did anyone even think that they DIDN'T already do this?
And water is wet.
So are they responsible for the breach just before Christmas 2013 that exposed millions of credit card details?
Target should sue them, and there could be a class action lawsuit from the affected customers.
And the 1700 workers that were fired in the Twin Cities the other day should get some of the damages too.
the agency carries out the same illegal Computer Network Exploitation (CNE) operations that criminals and hackers do. Except they do it legally.
LOL, So... it is a crime, not because it is morally and ethically questionable, but because you told us it is, and you told us it's OK for you to do it.
"If any question why we died, Tell them because our fathers lied."
"it is not illegal if the president does it"
Hear hear! That's the most intelligent comment I have ever read from an AC. So intelligent, that given that you posted it as an AC I'm stealing it for future reuse.
Some people ask me "why even attempt to argue against Timothy & his ilk". Your post is a great example of why.
Democracy is a sheep and two wolves deciding what to have for lunch. Freedom is a well armed sheep contesting the issue
Drivel. Utter drivel.
The NSA, GCHQ, DGSE, etc have all been authorized, even instructed by the elected officials & courts over them to perform the collection they do. That YOU as a basement dwelling AC with no clearance does not have proof of this & believe that your ignorance is proof of anything is just another sign of how ignorant you are.
Democracy is a sheep and two wolves deciding what to have for lunch. Freedom is a well armed sheep contesting the issue