Additionally, /. has a pretty good summary of what this is [1]. -- "If you search the web for communications security information, or read online tech publications like Linux Journal or BoingBoing, you might be a terrorist. The German publication Das Erste disclosed a crumb of alleged XKeyScore configuration, with the vague suggestion of more source code to come, showing that Tor directory servers and their users, and as usual the interested and their neighbor's dogs due to overcapture, were flagged for closer monitoring. Linux Journal, whose domain is part of a listed selector, has a few choice words on their coveted award. Would it be irresponsible not to speculate further?"
Considering that XKeyscore was designed to slurp all the things, all the time, this code actually just looks like a very small, tor-specific subset of simple tagging rules.
One would assume that those tags can be used to later analyse the data to pluck out things like "find users from syria who visited tor/tails websites and is related to xyz".
That is also implied in the boingboing.net article[1]. There is one paragraph in particular which should ring a familiar bell...
One expert suggested that the NSA's intention here was to separate the sheep from the goats -- to split the entire population of the Internet into "people who have the technical know-how to be private" and "people who don't" and then capture all the communications from the first group.
And why would that be familiar? First they came for the terrorists, but I said nothing for I was not a terrorist...
which would be a good exercise if done in a controlled environment to then catch bad guys when they get that clever (hint, they aren't)
the problem is that some incopetent person paid with our money choose to list the Linux journal as a extremist publication just so he didn'thave to bother creating the system for his training. while also gaining information illegally to further help him be a lazy mofo. all while being sanctioned by even more incopetent (or ill intentioned people) above him.
anyway, off to scare some kids from my lawn now...
More than one link to the Linux Journal article with comment thread has been locked and hidden, and a previous link to the link we're commenting on now. I'm sure this one will be dead soon too. For example: https://news.ycombinator.com/item?id=7984456. hckrnews.com shows dead threads in gray. Weird, no?
So if the link to the NYT article is published on the extremist forum, and you job is to search for the extremists, you'd search for the NYT readers instead of the readers of the forum?
/*
These variables define terms and websites relating to the TAILs (The Amnesic
Incognito Live System) software program, a comsec mechanism advocated by
extremists on extremist forums.
*/
That's an interesting definition. It might cover legitimate extremists, but a quick look at Wikipedia tells me that TAILs has also been used by some pretty respectable Pulitzer Prize winners.
These comments provide an interesting and ultimately disheartening insight to how the people designing these surveillance systems view privacy software (and, by extension, privacy?).
That doesn't make sense to me. It's a definition that relates to the people they're looking for. That it's explicitly more specific than "all Tails users" really doesn't seem disheartening to me.
That Tails is used by people other than extremists doesn't invalidate the comment, by someone interested in "comsec mechanisms used by extremists", that it is, in addition to anything else it may be, a "comsec mechanism advocated by extremists in extremist forums".
It's not like "legitimate extremists" have some totally parallel universe of software that's only used by them. It's fundamental to most of these tools that they'll be used by different people in different ways, and that some of those people will be by some standard or another "bad guys".
The description is not exclusive, I'm not arguing that. Your last point makes a lot of sense; most people/groups who do nasty things do it using off-the-shelf components.
My issue is with the description painting TAILs in broad strokes as comsec for extremists. Yes, they've got National Security in the name, so they're looking at the software from a national security perspective. There is a wide gap, however, between describing software and its dangerous potential and describing software only in context of its dangerous potential.
If an analyst who hasn't heard of TAILs reads that description, it would sound to them like the program is something that's passed around extremist forums in much the same way malware toolkits are disseminated in warez forums, rather than what it is, which is a Debian fork that routes things through Tor. I say this because that was my first impression, which seemed off, leading me to google, then to wikipedia, and then back here in a huff.
Now, some examples (in order of ascending silliness) of why describing something in the context of one use case is harmful when many use cases exist:
* A lot of people use nmap to explore their home networks or as part of their jobs, potentially in the computer security industry. A lot of crackers also use nmap to case out potential targets. Calling nmap a "network scanning utility advocated by computer hackers" makes illegalizing nmap sound a lot more attractive than it actually would be, even if the statement is true.
* In the real world, certain products are systematically abused for less-than-kosher purposes. Still, we never refer to canned air as a household inhalant without mentioning its dusting use-case first. Potassium nitrate is fertilizer first, rocket fuel second, and only tangentially mentioned as an oxidizer for explosives. Other oxidizers, even the ones that are illegal for consumer sale, are written about the same way.
* Reductio ad absurdum: There's a lot of general purpose software everyone uses. I wouldn't be wrong if I said "Microsoft Word is a text management tool used by terrorist groups to hatch evil plots" or "SMS is a communications technology used by insurgents to detonate bombs" or, extending the idiom, "The Quran is a book used by militant Islamist groups to justify killing and brutalizing civilians." These descriptions are all, however, deeply misleading.
I say this because that was my first impression, which seemed off, leading me to google, then to wikipedia, and then back here in a huff.
I'm not sure I understand why you think an NSA analyst (who, inexplicably, is editing an XKEYSCORE rule file regarding Tor and Tails while being completely ignorant about Tor and Tails) is incapable of doing this same kind of information-gathering.
I'm not going to act like I think the NSA only hires the best and the brightest, but your example presumes the existence of an analyst that's all of: grossly undereducated for his duties, too mentally incompetent to be aware of it, and so far on the literal-minded end of the autism spectrum that they could be replaced by a shell script.
I believe any such analyst, if they existed, would have been promoted to management before they could cause any serious harm.
I'm sure a legitimate extremist would want to use something like TAILs.
I'm more worried about the fact they are tracking people who access articles about tails by the media than I am about that particular component. If you read one article on linuxjournal containing 'tails' you are flagged:
$TAILS_terms=word('tails' or 'Amnesiac Incognito Live System') and word('linux'
or ' USB ' or ' CD ' or 'secure desktop' or ' IRC ' or 'truecrypt' or ' tor ');
$TAILS_websites=('tails.boum.org/') or ('linuxjournal.com/content/linux*');
So they aren't really "monitoring extremists" they are monitoring anyone with an interest in security [even if its just a hobby].
We have no context for what "flagged" or "monitoring" means, though. There's no indication that these rules are taken to mean anything in isolation beyond what is frankly common sense. The idea that just Googling Tails means you're monitored is a narrative leap.
If I write an email about Viagra, the recipient's spam filter is undoubtedly going to consider it to have a non-zero probability of being spam. That doesn't mean it will be blocked, in the end. Nor does it mean that the spam filter is wrong to take notice.
I think the fact that they can tag us based on what we searched or read is chilling. It's even more chilling that now the argument has been flipped from being appalled that our right to privacy has been utterly destroyed online, to arguing if it's right to be flagged for further review for simply searching or reading about specific subjects.
I think those assumptions are not supported by the available evidence[1], and that the authors they know this. Who cares what the NSA says? I'm looking at the same thing the authors are presenting and drawing different conclusions.
[1] Including the abundance of evidence already available about XKEYSCORE.
I think erring on the side of the assumption that is bad for everyone is more likely to be true. Especially since its consistent with the NSA's overreach in other areas.
I don't have a good reason to believe that this is real, but if it is the most surprising part to me is the "mapreduce" rule definition in there. As far as I know the only group with a C++ mapreduce implementation called "mapreduce" that also uses protocol buffers (the "proto:" block is protocol buffers) is Google. This seems to say to me that the NSA is using a Google implementation of map reduce. That can't possibly be right, can it?
Well, if the NSA were among the group of organizations with a C++ mapreduce implementation (developed in-house) the code probably wouldn't be on github or otherwise divulged to the public... seems like a rather large leap of logic to assume they are using Google's code.
While mapreduce isn't my area of expertise,
my guess is it's probably easier for them to use mapreduce/ and Hadoop than invent their own wheel in some cases.
"“It is possible that its authors used an in-house framework to generate intermediary C code, or they used another completely different programming language,” Soumenkov explained.
For reference, Stuxnet was written entirely in Microsoft Visual C++.
The Kaspersky researchers say certain “slices” of code in the Payload DLL may have been initially compiled in separate object files before being linked in a single DLL, but the slice in question is different. “This slice is different from others, because it was not compiled from C++ sources. It contains no references to any standard or user-written C++ functions.”
But there a few things the researchers do know about the mystery code: It’s object-oriented and event driven, and performs its own set of related activities ideal for network applications.
The highly event driven architecture points to code which was designed to be used in variety of conditions, including asynchronous commutations."
Would I be wrong to gather that they also built an in house map reduce implementation? What year is this code from? Most of the other documents have been from 2007-2009, when did Google first implement map reduce?
There's a nice bit in here that automatically collates a list of Tor bridge nodes from snooped e-mails. The full list of bridge nodes isn't public, and one of the ways the Tor project attempted to prevent someone from building a complete list was by requiring people to use a valid GMail address to request them, effectively piggy-backing on Google's account verification to stop people from using a swathe of fake accounts to request nodes. Unfortunately, that failed to take account of the fact that the NSA had completely compromised Google's internal network.
Actually it was Britain's GCHQ that tapped Google's datacenter links and shared the data with the NSA. I only mention this to remind peeople that it's more than just one country and agency that's doing this.
// START_DEFINITION
/*
The fingerprint identifies sessions visiting the Tor Project website from
non-fvey countries.
*/
fingerprint('anonymizer/tor/torpoject_visit')=http_host('www.torproject.org')
and not(xff_cc('US' OR 'GB' OR 'CA' OR 'AU' OR 'NZ'));
// END_DEFINITION
I was surprised to see that they actually tried to exclude Five Eyes countries. The cynic in me wonders if there is "bug" that neuters the restriction.
Well, we have already learned that their idea of origin country is IP ranges, even if the data clearly indicates otherwise.
That said, they have a variable for directory servers in FVEY countries and one for non-FVEY countries. So I guess they collect everything and the distinction is only here because theres different legal boilerplate for the analysts to follow.
The "Five Eyes" term has been in use since 2006. Strangely enough the original Wikipedia document archived on the Wayback Machine seems to be unavailable, however we do know it pointed to "USAUK_Community" whose relationship was extended to include other allies which is now known as the "Five Eyes".
Before 2007 the amount of searches for "FVEY" was near zero. The relationship between these five nations wasn't named publicly until 2006 or so, before that the relationship was there - just under another name.
- The job of three-letters agencies is to find out all various enemies of the state. That includes terrorists, but also various gangsters, officials of sort-of-enemy states (like Russia). That's why they exist.
- Following US nation interests has higher priority than rights of citizens, especially in other countries.
- People, that US have a reason to spy on, probably will use Tor/Tails, or at least try to find something about it. It makes sense for NSA to filter those people and focus their spying on them specially.
- Not all Tor interested folks will be evil, but the percentage there will be much higher than in just random internet. So it makes sense to focus on them. Just like it makes sense for a local police to be in a neighbourhood, that's known for a higher criminality.
So I understand why NSA does this, and why do they single out Tor-interested folks.
While I think it should apply to non-US citizens, the fact that it technically doesn't is irrelevant as long as they're still willfully violating the rights of US citizens too.
The job of a government is towards it's country. A country is also made up of multinational companies and corporations.
Modern say spying is commercial and industrial in nature also... it's not just used to catch bad guys, it's used to get an advantage.
Whilst industrial spying does not trigger emotions as much and infringe their own citizens rights as much, it's arguably an even worse applications of our intelligence agencies.
It really doesn't. In spite of repeatedly claiming things like that people searching for Tor are "monitored" or users are "tracked", it's completely vague about what that those terms actually mean and provides zero examples.
Yes, I read it, and I stand by what I said. The article explains a set of rules used to filter a set of information out of another set, but it does not support claims about what is done with that set of information.
There is a lot of insinuation, but no example of any individual user of Tor or reader of Linux Journal, etc. being monitored or tracked simply for doing so.
You can always demand even more proofs, but it's not probable that they'll come easily -- it's obvious that such leaking is extremely dangerous. This is still significantly more that public knows now than it knew before the article.
It makes more sense to me that they actually use these in AND statements. For example, uses TOR and searches for JIHAD could be traffic that would be interesting. If I had to guess, the Linux Journal stuff was just something a geek put in there during testing.
That's what I thought—these rules obviously aren't the entire pipeline, and the results obtained from them may or may not be interesting in and of themselves.
That said, using Tails probably does increase my XKeyScore rating. Is there anything published as to the scale of the rating? Something along the lines of "Once you get a rating of (say) 500, we're gonna come and beat down your door, wife and dog, and not necessarily in that order".
There's no indication that there is such a rating exists, or that any such decisions are made based on automated rules. It's a tool for selecting some traffic out of all traffic, not for replacing human analysis or decision-making.
I believe this "source code" is made up, invented for the masses. In fact, the more and more I see of these surveillance reports and reveals, the more I believe this is all purposeful deception, and that while it may be true they're doing all these things, they aren't leaks, but announcements.
On a board where most of us should be familiar with the concept of not trusting user input, I think we should all take a step backward and treat these "leaks" as just that: input from an untrusted source. This could all be a fabrication we're buying into.
Poor enough you use a throwaway, but I see what you're trying to tell.
I personally believe the NDR/Spiegel to be reputable, trustworthy media. It may be that we have another Hitler's diary scandal there, but the other Snowden/NSA material they have published so far has held up examinations, the NSA iirc even acknowledging some of the docs as actually valid.
I'm not disputing that the NSA stuff is real - of course they're doing it, it's what the agency is expected to do.
I'm disputing whether these are leaks or announcements. The media might not even know they're part of the plan. Is it that farfetched for the NSA to say "Hey, we want to make this information public for some reason, and we're going to do so by using a whistleblower. You're going to release all these documents to a bunch of media sources and live abroad for a while and be hailed as a hero"? There's a long history of leaking information, factual or otherwise, for a number of purposes. There's potentially no end to the rabbit hole. Maybe Snowden doesn't even know he's part of the plan.
It's my opinion that the NSA, some group, or some individual, is letting us know they're watching closely. Maybe they're acclimating us to the idea of being spied on, or worse, distracting us from or preparing us for something else. I think the big picture has yet to be revealed.
Something worth considering is the conditions necessary for having both subjective and objective expectation of privacy. If nobody expects to be able to avoid the NSA, nobody can expect to have subjective expectation of privacy.
NSA will certainly know everybody's reaction to the Snowden leaks.
I figure the absolute worst case scenario imaginable is that USGOV is producing a list of sysadmins and privacy conscious individuals for extermination. Most "coding" seems to be happening now several layers up from linux systems. If the Government wanted, they could kill everyone who knew how to actually use a computer. Then they could "Teach low income Americans to program" and then just conveniently forget to teach them the full stack. Note, I don't think this is happening, but it isn't unimaginable.
In addition, the narrative has been very pro CIA since the very beginning. There have been a lot of people making the clear distinction between machine intelligence and human intelligence, which is definately a CIA line.
If it is an intentional leak then we should ask ourselves what benefit or what effect does this information have?
For example - would it reduce the number of people using TAILS, or increase? Would it make technologist laugh at incompetence and make the NSA less scary, or would it lead to more intense scrutiny and wariness?
That is what we should be asking, not disregarding the information. We should look at the effects. The nature of the comments in this thread is one of those.
Obviously the custom language (which uses $ like Bash or Perl) but which allows the programmer to include the pieces of C++. Hints: static std::string and boost!
"Cons: Some Boost libraries encourage coding practices which can hamper readability, such as metaprogramming and other advanced template techniques, and an excessively "functional" style of programming.
Decision:
In order to maintain a high level of readability for all contributors who might read and maintain code, we only allow an approved subset of Boost features."
Additionally, /. has a pretty good summary of what this is [1]. -- "If you search the web for communications security information, or read online tech publications like Linux Journal or BoingBoing, you might be a terrorist. The German publication Das Erste disclosed a crumb of alleged XKeyScore configuration, with the vague suggestion of more source code to come, showing that Tor directory servers and their users, and as usual the interested and their neighbor's dogs due to overcapture, were flagged for closer monitoring. Linux Journal, whose domain is part of a listed selector, has a few choice words on their coveted award. Would it be irresponsible not to speculate further?"
[1] http://yro.slashdot.org/story/14/07/03/1846215/nsa-considers...