Stewart Baker, ex-DHS guru, ex-NSA General Counsel, writes,
We're actually closer to 1984 than most people realize. Antidemocratic forces have the ability to turn on cameras in our homes and offices — to monitor our every action and every keystroke. That's the lesson of the ghostnet report.
The ghostnet report is about large-scale zombie computer networks. So there's the tiniest bit of hyperbole here, since the cameras being turned on in your home to which Baker refers are, so far, web cams. (The more interesting question to me is which cell phones can be turned on remotely, but the ghostnet report doesn't discuss that.)
Baker wants to sound like an optimist: he tells us he's confident that “the 1984ish powers aren't being exercised by the US government or NSA”. I actually share this confidence: Why zombie millions of computers, leave traces and create a host of fourth amendment issues, when the NSA can instead intercept all your packets at the switch?
One solution is/was to move to .MARS.
The population on .MARS. is concerned because rumor has it that The Big Lie Society* is headed there also. Americans are paying the Russians to transport them.
* The Big Lie Society – 52 People You Never Want to Allow Near Your Children’s Network(s)
“IT” Seeks Overall Control – Americans better wake up and route around “IT”
I’m basically with you although I’ll point out that they (for whatever value of “they”) can only intercept the traffic you send, and if you use encryption it increases the effort to look at it. If there’s interest in snagging images off your webcam or eavesdropping on conversations in your office they’re going to have to turn on those services and transmit those packets.
Things to think about…
The U.S. FCC dictates that the POWER LEVEL of some consumer WIFI device be set LOW, to avoid interference. Company X designs a device and VIA SOFTWARE sets power level low. Hacker Y
enters, via software, turns power level way UP, the device HEATS UP, catches fire and burns your
house down.
Liability to FCC ? Company X ? Hacker Y ?
…or to the lawyers who have no clue and who could not care less because they have no such device…
…don’t try to pin any liability on the lawyers, they are not involved, they are only paid agents…
Or, as a consumer, should you be smart enough to remove the case from the WIFI device and void the warranty, and protect your home…?
Or does Company X pay dearly to make sure that the U.S. Government never discloses the potential problem…?
Or, are the homeless, living on streets safer ?…they have no house to burn down…
…head on over to other countries and see people living in tents at the beach…free as birds…
…some think Americans put themselves in boxes and then spend their lives trying to get out…
In this context, maybe Americans surround themselves with boxes and try to get away from them…
* The Big Lie Society – 52 People You Never Want to Allow Near Your Children’s Network(s)
“IT” Seeks Overall Control – Americans better wake up and route around “IT”
Privacy is a funny thing. If I am hiking in the hills and fall, I love my phone as gps device. Other times, not so much.
And with these complex systems, capability is the real issue, because once capability exists you can anticipate exploitation of whatever systems you have to control abuse (or not, as in the case of GOP ideology).
The capability of my phone to let slip my location is a big, big advantage to, say, a hypothetical monolithic power structure. Maybe I am a little old, but web cameras are not such a fundamental part of life to me. Then again I am fairly botnet proof.
News in Iran has locked down the Chinese internet, no blogspot for me today.
The funny thing is if we just mandated that every computer user switch to Linux the botnet danger would end, at least for some time, and it would be a fair fight afterwards, not like today. In other words, we could regulate Windows to the point where it had to be safer, could we not? All the power and wealth of the bot nets is provided by each clueless windows user, incrementally.
By the way, Michael, I have been meaning to ask: How is it that no organization ever sued the big box computer retailers under anti-trust laws, in order to ensure that these companies would sell Linux machine set-ups?
The idea that I can only get a full computer set up (which is of course what most people want) in windows or mac flavor, not Linux, would seem to comprise a claim of action, no?
It’s been a long time, maybe I am off base.
On LAN bridging…
LAN parties are popular for video gamers because they could connect to a hub in one room and play with dozens of people. The hub and LAN party can be extended via software to allow people on the Internet to play FREE with other like-minded people.
One simple way to bridge the LANs together is via 3D worlds. When you walk near others, your home LAN routers start sending their packets to the other routers of the people you are “near”, in 3D. Your games connect, and you are in a LAN Party.
Are the parents (on the same router) concerned that maybe their children’s LAN Party is causing their data packets to be sent to other houses ?
Or, have the LAN party technology designers filtered out all Non-Game traffic because the kids certainly don’t want dad’s FTP download messing up their video game play ?
In the ebb and flow world of thin-client vs. thick-client, the thin-client folks find it easier to “tap” into a home LAN to have everything sent to the data-center where they can sort out the service offerings at a later date. The device in the home is then very dumb, like a phone. If someone plugs a web cam into that LAN and it streams images then those images are likely to also be sent to LAN parties and to ISPs who want all the traffic to make future service offerings “easier”.
As bandwidth increases with fiber-to-the-home it is “easier” to have everything in the home sent to the central location, for future service deployment. If that is not done, then some intelligent device has to be placed in the home and that device has to be maintained. ISPs do not want to maintain those devices. Educated consumers may be willing to maintain those devices. Many of those devices are based on Linux, because they have to be cheap to sell in volume. Open Source is a double edge sword. It may be very difficult to tell what is in those devices, especially those modified (flashed) once in the home.
Kids may think they are doing the parents a favor “upgrading” their home routers, for a LAN Party.
Hi Michael,
I’m a fan of your brother’s too. Hope you can weigh in on that soon.
FYI, Years ago NSA could turn legacy phones into cheap bugs by hitting the relays with high frequency signals. Cell phones are, if anything, easier targets.
We have only the illusion of privacy on web connected computers. Microsoft’s acknowledged collaboration with NSA on “security” issues guarantees OS level access. Hardware firewalls are minimal barriers. Even simple speedtests can jump NAT giving internal addresses. Try JDLAB NDT server http://jlab4.jlab.org:7123/ to see for yourself.
If you have not had a chance to read it, try James Bamford’s “The Shadow Factory” for excellent reporting on the post 911 NSA.
Enjoy your vacation/anniversary.
Oops, In engaging the “national technical means” issue I dropped the answer to your original question.
Remote access to cell phones and computers can collect personal information that is not willingly communicated to anyone. Every phone or microphone can be a bug, every phone or web camera can be a surveillance device. All can be remotely accessed without your knowledge. That capability is here now. It is in addition to the acknowledged capability to capture 100% of web and phone traffic.
Listen to Baker. He has used a simple open source technology to illustrate a sophisticated classified capability.
For more than 50 years NSA has had the most advanced information technology in the world. I infer, also strictly from open sources, that NSA has maintained a 5-10 lead on what we have access to. Look at Bamford, “The Puzzle Palace” and “Body of Secrets” or Kahn “The Codebreakers” for the history and for context for Bamford’s “The Shadow Factory”. Please also think about the capabilities you personally have today versus 10 years ago. How quaint does Y2K hysteria seem today? Project that past rate of change 5-10 years forward and you will have NSA’s capability today.
Capability and intent are always different assessments. My paranoia is not high enough to make me fear surreptitious bugging (intent), yet. Guess that makes me an “optimist” too. However, to rationalize away the potential (capability) is foolish.
It was not so many years ago that the first commandment at the NSA was to NEVER EVER turn their tools inward on domestic targets. That generation of spooks has mostly retired or died. Now, even more than before, when used domestically, the NSAs tools are the stuff of dictators and totalitarians.
Did you take the batteries out of your cell phones/pdas/notebooks and unplug the house phones when you celebrated your anniversary? There is an old rehab counselors motto “Just because you’re paranoid it doesn’t mean nobody is after you.”
Ah for the good old days when we could get Word Perfect on 2 diskettes. Have we really made progress since then?