Privacy, Government, Surveillance, and You.

Look at it this way Fighteer. Anybody can come up with some well-spun political talk for why they just must have this surveillance. We've seen enough government bullshit to know that it would take an army of lie-detectors to sift through their rationale. Hence, it's easier to simply say "How about you just don't do it?"

Besides, the whole idea of needing warrants is that there's already a way to ascertain good reasons for spying vs. not a good reason for spying.

Its not that they collect our records per se, its that they do it secretly.

Edit: added a missing "not", above.

edited 10th Jun '13 6:07:45 PM by DeMarquis

The line in the sand that I draw is that you should require probable cause to invade someones privacy, and someone needs to be there as a certifying authority to say "Ok, your probable cause isn't bullshit, go ahead and do it."

Blah blah blah probable cause etc etc. It's important. Because without that requirement, it essentially means there is no limit to the reasons required for snooping on a specific person. If probable cause isn't required, there is no justification required, it means "Well we don't like this person." is just as good a reason for invading their privacy as "Suspected Terrorist".

I must introduce you to the legal loophole that will fuck us all.

What about the postage system? You can't read other people's mail in the intermediary process?

As far as I'm aware, it's completely illegal to look into people's mail so I'm fairly certain that most things go by unmolested.

Exaclt how is sending an email different?

This wouldn't be that hard to get around, someone just needs to have a half-way decently built, free, offshore based email service that can pick up and be used by the majority which uses good encryption on all traffic.

Hell, just set it up so that on the server side end the accounts themselves make a serial which gets dubbed in to unencrypt the email, then even if you do intercept the actual data itself, it's encrypted and can't be opened particularly easily.

God-tier encryption on something as small as an email doesn't take very long.

edited 10th Jun '13 9:12:41 PM by Barkey

It is in fact a federal offense.

(never mind)

edited 11th Jun '13 4:51:30 AM by Nohbody

@Barkley: Doesnt a copy of your message still have to be loaded onto your internet service providers server first?

^

Yes, and that's what end-point encryption is for. Essentially the message sitting on the server is encrypted, and the server doesn't have the code to the encryption, but the end-user recipient does.

Basically you are encrypting your message when you hit "send". The information needed to unencrypt the message goes to the recipient, and not to the server. It is sent as a separate packet, and the message itself is just an encrypted HTML/plaintext formatted file. Then the file hops from the server to the recipient, and the recipient uses the separately distributed decryption data to unlock the email automatically, but on a client side.

So essentially, if you were to completely control and monitor the server, the processes would be operating individually. A server with global email traffic would be so cluttered with all these little exchanges of small packets of information for encryption, and then slightly larger files which are the actual messages. From the perspective of someone who tried to hack that server to collect emails, you would have to collect both the email file and the decryption algorithm.

So supposing that you did get a complete data backup that had all of the available messages and "keys" that were on the server, you would have to sort through all the bullshit and actually match the keys to the messages, which would take about as long as the actual decryption, especially if you added extra layers of security to safeguard that information on the server. Encryption inception, essentially. That would make the only practical way to get someones emails to be by actually compromising the account itself, and opening it as if you are the user.

Or having the patience to sit around and try to break two or three levels of 256 bit AES encryption for each and every individual email.

Essentially, the Sender sends the email and the key separately to the server, with the email encrypted. The server receives them, stores them in a space that is encrypted(and also separate from each other), and then forwards them both to the recipient. The recipients email client then matches the two files up to decrypt the message. If you add in a requirement that both the Sender and the Recipient require SSL certificates to generate and receive the key to decrypt the email, that makes it even more secure for the actual end-user to where even if an outside entity can get your password and username for your actual email account, they still have to be able to receive an SSL certificate to decrypt any new emails sent in.

In other words, completely secure email is entirely possible(and already exists), but the key is to get the host to be in a position to not cooperate with the governments that want to snoop on you. Basically a swiss bank in email form.

As I said in the politics thread, Barkey, you're investing all this time and energy in keeping the government from reading your emails, while your personal information is being traded around as a commodity by companies around the world and thieves are busy trying to impersonate you so they can use your credit to buy stuff.

There are some seriously skewed priorities going on here.

Most of my basic information is out there, yeah, but at the same time, I at least have lifelock to keep the identity thieves away. Relatively cheap and it works.

I'm a security buff, so part of the reason I do this sort of thing all the time is for my own personal jollies, and it's occupationally relevant to me. I'm actually heading to an Electronic Security Systems school for the military later this month. So call it part professional interest, part personal OCD.

I really don't have any realistic fears about my shit being taken or really used against me in any meaningful way, but keeping my shit secure gives me warm fuzzies, so I do it. From a broader perspective, the government has a responsibility not to be complete psychopaths like that, corporations don't, at least there is no legal expectation for them to not be assholes.

I've heard stuff about Lifelock — namely that it doesn't do anything that you can't do yourself; essentially it constantly maintains blocks and fraud alerts on all your credit records so that the agencies have to take extra validation steps any time anyone tries to do anything with your credit.

I've also read that they are violating the policies of the credit agencies, which state that you have to be the one doing that, not someone on your behalf, and that you are only supposed to use blocks when there's a legitimate need.

It works out way better for the consumer, so I don't feel too bad about that.

Besides which, I despise the 3 credit Bureau's. I'd rather there was an actual government agency responsible for maintaining my credit, moreover it's bullshit that beyond checking it once a year, I have to pay to see my own credit. That's just some straight-up bullshit.

edited 11th Jun '13 7:52:11 AM by Barkey

Incidentially, here is a selection of reactions to the NSA Business from the Worlds' Media.

edited 11th Jun '13 7:56:27 AM by Greenmantle

Oh, I completely agree that the way credit ratings work is absurd. Remember how hard it was to get a law implemented forcing them to give you a free report every year? That's our enemy — the government is small potatoes by comparison.

^

I agree, and at least in my personal case, I have just as much ire for the corporations out there, I have ire for anyone out to gun down my privacy. It's just that everyone is talking about the government aspect of it right now, and thus that's the aspect I'm talking about since it's what's on the table.

Doesn't mean most people are ignoring the corporate abuses of information out there(at least I'm not), but the NSA thing is a valid concern, and it's a current event.

I think we can agree that both corporate and government surveillance is a problem.

@Barkely: Yes, you can encrypt the content of your email messages, but how do you disguise that you are emailing someone? This controversy is about the gov't tracking phone call and emails, not listening or reading them, after all.

Good summary of the various gov't domestic spying programs.

I don't know... I find it almost axiomatic that the NSA is reading our data, and having this revealed comes across to me more as a "no shit, Sherlock" situation than an "OMG OUR PRIVACYZ" thing. It's a blatantly manufactured scandal, with all the news agencies getting together and firing blame randomly in the air, hoping that it will stick so they can get good ratings.

The fact that it further contributes to the obstructionism in Congress and the idea that the current administration is ineffective is just icing on the cake for the right wing. Frankly, the news media (including the notionally centrist networks like CNN) are doing all the work for them to ensure a continued legislative stalemate after the 2014 elections.

The true irony is that the Republicans historically have enthusiastically supported the government's right to spy on and imprison its citizens, whilst at the same time cultivating a deep distrust of government among their constituency. I have yet to figure out how that works.

edited 11th Jun '13 8:34:36 AM by Fighteer

Well, if it is any consolation,

Everyone I work with will have to be brought kicking and screaming before a grand jury or court marshalled before we give up our patients information, let along even acknowledge we know that person.

My clinic has burn orders on patients information after a certain time. There are very few occasions that would make us keep their records past our allotted time.

Given the way the IRS just treated the Tea Party, or the way the FBI harassed people in the civil rights movement, or the profiling that has gone on in the name of the War on Terror (and earlier in the name of anti-communism) I don't think that this is really a "manufactured scandal" (except in the sense that the gov't itself manufactured it). You shouldnt just trust the gov't, there has to be a way to hold them accountable, otherwise some form of abuse is almost inevitable.

The IRS did not specially target the Tea Party. They went after a wide range of political groups trying to pass themselves off as charities. In other words, they were doing their job to prevent tax fraud. That is a manufactured scandal, every bit of it.

It is crucial that the government be held to standards of accountability, but the sensationalism that accompanies these "revelations" makes it nearly impossible to sort through the mess to find out what is and is not actually a problem.

edited 11th Jun '13 8:44:05 AM by Fighteer

I don't blame the IRS for taking more time to investigate these groups, especially the Tea Party. Some of the people in them are insane.