Given how many web sites were vulnerable to the Heartbleed bug, Parsons says there is likely to be a great deal of reflection on how it could have been identified sooner. Some cryptographers have estimated it may have existed for years before it was discovered last week.
This past weekend, Bloomberg News published a story alleging the U.S. National Security Agency (NSA) knew about the Heartbleed vulnerability for two years and that it may have been using it to access personal data.
The NSA denies the charge, but Parsons says it raises serious questions about the Five Eyes, the surveillance partnership between Canada, the U.S., Great Britain, Australia and New Zealand, which collaborates to detect threats such as Heartbleed.
“This is supposed to be the sort of thing that they’re supposed to find and ideally report,” says Parsons.
“I think over the coming months, we need to figure out if they knew and if they didn’t, why didn’t they, because this is what we pay them to do. And if they did know, then why weren’t they protecting us?”
Tag: NSA
Categories
Surveillance Whakery
More surveilance whakery. Gotta thank the republicans and democrats for taking away our privacy.
The second image is terrific!
Categories
2014.4.19
the [Australian Security Intelligence Organization] ASIO said that Snowden’s leaks will make it more difficult for the organization to collect meaningful data about a person, so the organization should be given more leeway to perform its surveillance duties. In its proposal, the ASIO asserted that certain technological advances are detrimental to its spying on bad actors (a refrain that is not often heard, as it’s generally accepted that technology is making it easier to spy on citizens).
…
Smaller state police organizations joined the ASIO in asking that telecom companies be obligated to retain customers’ metadata for a substantial period of time. (The ASIO cited as a preferred model President Obama’s proposal earlier this year to compel telecom companies to keep customer data rather than having the NSA siphon that data into its own repositories.) But police organizations like the Northern Territory Police and the Victoria Police also went further in requesting that the Australian government require companies to keep IP addresses and Web browsing history as part of its metadata collection.
The Northern Territory Police, for example, argued for a two-year retention of Web browsing history. The Sydney Morning Herald reports that the police thought “a shift away from traditional telephony services to Facebook, Twitter, Google Plus, and others meant that data may be included in browser histories and was ‘as important to capture as telephone records.’”
Megan Geuss, “After Snowden, Australia’s cops worry about people using crypto”
So, given that Australians are decreasing their trust in their government based on what they’re learning their intelligence services are presently doing, the same services argue that they should have even more access to Australians’ private communications? Because more data retention combined with shadowy access to telecommunications data will improve trust in government and, as a result, strengthen the democratic spirit of the Australian people, right?
Categories
2014 Munk Debate
Now with two tickets to see this Munk Debate on May 2, 2014!
Categories
2014.3.13
The term “identifiers” is NSA jargon for information relating to an individual, such as telephone number, email address, IP address and username as well as their name.
The document – which is undated, though metadata suggests this version was last updated in June 2012 – does not say whether the oversight process it mentions has been established or whether any searches against US person names have taken place.
James Ball and Spencer Ackerman, “NSA loophole allows warrantless search for US citizens’ emails and phone calls”
Perhaps foolishly, but I find it amusing that metadata is being used to evaluate how/when other metadata identifiers were being used to track the world’s populations…
Categories
2014.2.26
The NSA can’t break Tor and it [ticks] them off. Most crypto drives the NSA batty,” [Bruce Schneier] said. “Encryption works and it works at scale. The NSA may have a large budget than all of the other intelligence agencies combined, but they are not made of magic. Our goal should be to make eavesdropping more expensive. We should have the goal of limiting bulk collection and forcing targeted collection.
Bruce Schneier, quoted in Dennis Fisher, “The NSA is ‘not made of magic’”
Categories
2014.2.18
Oakland is a poor city; it can’t really afford its extravagant police force, and it certainly couldn’t afford its DAC [Domain Awareness Centre].
Surveillance trickles down in more than one way. At a time when Oakland is closing schools and dealing with more than $50 million in budget shortfalls, the DAC is made possible by DHS grants. These same grants have been militarizing the police all over America as well as giving them wide surveillance capabilities — capabilities that haven’t translated into much terrorism prevention, but have been aggressively brought to bear on protesters all over the nation in the 15 years since the Battle of Seattle in 1999.
In one of the most revealing moments of these baby Big Brothers, a FOIA request for Oakland City mails about the DAC revealed that none of the talk was about crime – no mention of murders, assaults, thefts, or the violent crime Oakland officials express constant frustration with. Instead, there was talk of tracking protests and labor strikes. The internal desires of Oakland’s minders revealed a frustration with the dissent that finds such powerful political expression in Oakland, and strategies for heading it off.
“I have also made it clear that the United States does not collect intelligence to suppress criticism or dissent,” Obama said in his speech Friday. Whether that is true or not for his NSA and Cybercommand, the Obama Executive has had no problems with funding such efforts at the local level.
Quinn Norton, “NSA Reform: What Could Have Been And What We’ve Got”
I’m not in corporate PR, but when it turns out your company (i.e. BlackBerry) holds the patent on a known-NSA-backdoored encryption standard I’m not sure shutting up and avoiding the press is the best of ideas. Especially if your product (*cough* BlackBerry *cough*) is predicated on strong security against all attackers.
Source: The strange connection between the NSA and an Ontario tech firm
The new laptop stickers have arrived. (Explanation of logo)
Excited Pixels 