Techdirt Reading List: Crypto: How The Code Rebels Beat The Government Saving Privacy In The Digital Age

from the crypto-wars-history dept

We're back again with another in our weekly reading list posts of books we think our community will find interesting and thought provoking. Once again, buying the book via the Amazon links in this story also helps support Techdirt.

As you may have noticed, we're now deep into the "Crypto Wars 2.0" these days -- especially with the news of the week concerning the FBI's demand that Apple create a special backdoor for iPhones. Thus, I thought it might be worth exploring some books on the original Crypto Wars of the 1990s, so that people can understand a bit of the history here. The one that everyone talks about is Steven Levy's Crypto: How the Code Rebels Beat the Government--Saving Privacy in the Digital Age -- though a recent review by Kendra Albert notes, unfortunately accurately, that Levy is horrible when writing about women (and, as an aside, anyone who refers to EFF boss Cindy Cohn as "diminutive" doesn't know a damn thing about Cindy Cohn who is a total badass).

In looking for some other books on the Crypto Wars, there unfortunately isn't very much. The only other thing I turned up was a book called Persuasion and Privacy in Cyberspace: The Online Protests over Lotus MarketPlace and the Clipper Chip which looks at those two different online protest efforts, written by professor Laura Gurak.

Seeing as this round of crypto wars seems to be heating up to dangerous levels, I'd certainly recommend either learning about -- or at least refreshing yourself -- on what went down the last time around.

Filed Under: crypto wars, encryption, laura gurak, steven levy

NSA Officials Hate Ed Snowden With A Passion

from the yes,-emotional-response-is-what-we-need dept

Last week we wrote about Steven Levy's big article concerning the impact on the tech industry of the NSA's activities. This week, he's written a short piece about the two hours he got to spend at Fort Meade in the NSA's headquarters meeting with some of the NSA's top officials there. He explains how they didn't seem to want to cooperate at first, but then became much more accommodating later on. He notes that the NSA doesn't seem to recognize that "protecting" Americans and "breaking everyone's crypto" might be two goals that are at odds with one another. But, the main point he makes: NSA officials really, really, really seem to hate Ed Snowden's guts:

They really hate Snowden. The NSA is clearly, madly, deeply furious at the man whose actions triggered the biggest crisis in its history. Even while contending they welcome the debate that now engages the nation, they say that they hate the way it was triggered. The NSA has an admittedly insular culture — the officials described it as almost like a family.... NSA officials are infuriated that all this havoc was caused by some random contractor. They suggest that had Snowden been familiar with the culture and the ethos of the agency, understood the level of training undergone by its employees, seen the level of regulations and oversight, he would have been less likely to abscond with all those documents. (Snowden’s interviews indicate otherwise.) Still, they are stunned that someone “inside the fence” would do what Snowden did. Even if Snowden is eventually pardoned, he’d do well to steer clear of Fort Meade.

There's something kind of funny about the fact that they look down on him as being "some random contractor" and if only he'd really been a part of the "NSA family" that he'd "understand." That seems quite unlikely, but also suggests one of the many reasons why what the NSA is doing is so problematic. Any mission that involves people having to feel a "part of the group" to make sure that the surveillance isn't abused is a system that will be abused.

Even more troubling, is that the NSA still seems to be reacting emotionally to the whole thing. That's part of the reason they still seem unable to comprehend how much damage they've done -- not Snowden.

Filed Under: ed snowden, emotion, keith alexander, nsa, rick ledgett, steven levy, surveillance

7 Things You Missed If You Didn't Read Wired's Big Story On How The NSA Is Killing The Internet

from the it's-not-almost dept

Steven Levy, who specializes in massive articles looking into aspects of the tech industry, has a new one for Wired, called How the NSA Almost Killed the Internet. It basically looks at how the NSA legally coerced the tech companies into having to comply with certain court orders to hand over information, and how the tech companies have been gagged from explaining what's going on. And then... he gets the NSA's side of the story. Much of what's in there is stuff that you probably already know (especially if you read Techdirt regularly), but I wanted to call out a few tidbits that I hadn't seen or heard anywhere else before:

1. Google doesn't charge the government for requests for information:

   FISA requires the government to reimburse companies for the cost of retrieving information. Google says it doesn’t bother to charge the government. But one company says it uses that clause, hoping to limit the extent of the requests. “At first, we thought we shouldn’t charge for it,” says an executive of that company. “Then we realized, it’s good—it forces them to stop and think.”

   This is kind of a "damned if you do/damned if you don't" situation. I know plenty of folks in the civil liberties community go back and forth on it. When companies do charge, then you see articles about how companies are "making a profit" off of violating our privacy. If they don't charge, then you see arguments about how they're making it too easy for the government to get info. Either way, the standard has been to charge basic costs, so it's interesting to see that Google doesn't charge at all, probably betting on the fact that if they did, it would be misrepresented. Of course, the fact that they don't might be misrepresented as well.
2. The NSA has no response to fear of future abuse of programs beyond "we'd never do that." Seriously.

   Critics charge that while there is not yet any evidence of massive abuse of the NSA’s collected data, there is also no guarantee that a future regime won’t ignore these touted protections. These officials discounted that possibility, saying that the majority of NSA employees wouldn’t stand for such a policy. “If that happened, there would be lines at the Inspector General’s office here, and at Congress as well—longer than a Disneyland line,” Ledgett says. (The fates of several NSA employees-turned-whistleblowers indicate that anyone in that hypothetical queue would be in for a ride far wilder than anything in Anaheim.)

   Sure, except there's a very long history of the NSA and the FBI doing exactly the opposite (the claim of no evidence of massive abuse is not actually true). And, as Levy notes in that final parenthetical, the way whistleblowers are treated these days would probably shorten that line quite a bit.
3. Keith Alexander admits that companies were compelled to comply and admits that we should stand up for the companies not to be harmed by all of this:

   “This isn’t the companies’ fault. They were compelled to do it. As a nation, we have a responsibility to stand up for the companies, both domestically and internationally. That is our nation’s best interest. We don’t want our companies to lose their economic capability and advantage. It’s for the future of our country.”
   
   Those words could have come from a policy spokesperson for Google, Facebook, Microsoft, or Yahoo. Or one of the legislators criticizing the NSA’s tactics. Or even a civil liberties group opposing the NSA. But the source is US Army general Keith Alexander, director of the NSA. Still, even as he acknowledges that tech companies have been forced into a tough position, he insists that his programs are legal, necessary, and respectful of privacy.

   This is just bizarre. If he doesn't want the companies to lose their economic capability and advantage, maybe he shouldn't have undermined a large portion of it.
4. Companies were given about 90 minutes to respond to the (misleading) claims in the original PRISM article that they had given the NSA direct access to their servers.

   “We had 90 minutes to respond,” says Facebook’s head of security, Joe Sullivan. No one at the company had ever heard of a program called Prism. And the most damning implication—that Facebook and the other companies granted the NSA direct access to their servers in order to suck up vast quantities of information—seemed outright wrong. CEO Mark Zuckerberg was taken aback by the charge and asked his executives whether it was true. Their answer: no.
   
   Similar panicked conversations were taking place at Google, Apple, and Microsoft. “We asked around: Are there any surreptitious ways of getting information?” says Kent Walker, Google’s general counsel. “No.”

   This remains one of the most unfortunate bits about the Snowden leaks. While I think that Barton Gellman, Glenn Greenwald and Laura Poitras have done an incredible job with most of their reporting, the original PRISM stories that appeared in the Washington Post and Guardian both came out rushed and were misleading, which is still impacting how people are reporting on these things today. The PRISM program and Section 702 of the FISA Amendments Act have serious issues that need exploring, but it's all been distorted by the misleading initial claims, which implied things that just weren't true.
5. The NSA claims it uses the very same encryption that it tries to push everyone else to use. Yes, the same encryption that Snowden docs have revealed was compromised by the NSA.

   And the NSA insists that, despite the implications of those Snowden-leaked documents, it does not engage in weakening encryption standards. “The same standards we recommend are the standards we use,” Ledgett says. “We would not use standards we thought were vulnerable. That would be insane.”

   Sorry, but no one believes that one at all. The clear takeover by the NSA of NIST standards shows that's clearly not true.
6. The NSA still doesn't realize how serious all of this is. They still think it's just been blown out of proportion.

   They understand that journalism conferences routinely host sessions on protecting information from government snoops, as if we were living in some Soviet society. And they are aware that multiple security specialists in the nation’s top tech corporations now consider the US government their prime adversary.
   
   But they do not see any of those points as a reason to stop gathering data. They chalk all of that negativity up to monumental misunderstandings triggered by a lone leaker and a hostile press.

7. Patent troll Nathan Myhrvold is also completely clueless about national security:

   Former Microsoft research head Nathan Myhrvold recently wrote a hair-raising treatise arguing that, considering the threat of terrorists with biology degrees who could wipe out a good portion of humanity, tough surveillance measures might not be so bad. Myhrvold calls out the tech companies for hypocrisy. They argue that the NSA should stop exploiting information in the name of national security, he says, but they are more than happy to do the same thing in pursuit of their bottom lines. “The cost is going to be lower efficiency in finding terrorist plots—and that cost means blood,” he says.

   This is stupid on so many levels. First, the old argument that it's somehow equivalent of tech companies and the NSA to make use of information -- a claim that Levy ridiculously repeats multiple times in his article -- is a line that has been debunked so many times it's really beneath Levy to give it any life at all, let alone refuse to point out how stupid it is. Companies provide a direct service to users, and they make a decision: If I give this information, I get this service in return. It's a decision made by the consumer, and a trade-off where they decide if it's worth it. We can argue that people should have more information about the costs and benefits, but it's still a trade-off where the final decision is their own. The NSA, on the other hand, is not providing a choice or a trade-off. They're just taking everything in exchange for nothing. And, oh yeah, they have guns and can put you in jail -- something no company can do.
   
   Second, Myhrvold incorrectly buys completely the line that all this data collection has been helpful in stopping terrorists. There's just one problem: there is no evidence to support that. Besides, based on his idiotic reasoning, we might as well just do away with pretty much all our rights. For example, I'm pretty sure that we could all have protected Myhrvold more completely if there were video cameras streaming video of everything he did within the privacy of his own home, cars, office or just walking around, right? We could certainly make sure that no one was attacking him or, better yet, that he wasn't about to attack anyone. The cost of not spying on every moment of Nathan Myhrvold might mean "blood." So, based on his own logic, we should violate his privacy, right?

All in all there's a lot in the article that's worth reading, but those were a few key points that really stood out.

Filed Under: keith alexander, nathan myhrvold, nsa, rick ledgett, steven levy, surveillance, tech industry
Companies: google, yahoo