Hi Friends,

I Find Absolutely FREE PlayBoy & Penthouse:

http://www.oxpe.net/playboy/

If I find something else I'll inform you.

Best Regards,
Vera

The concern seems to be that shooting a bullet at someone will lead to his death.

NSA's programmers and system designers are probably smart guys, but there are a lot of smart guys in the world.

This really doesn't get at the heart of the problem. It's not that the NSA doesn't have really smart people, it's that those smart people will very likely be ignored if they don't say what the political people want them to say.

I can't imagine that pushback from NSA scientists and engineers is going to alter in the slightest the insistent demands of Cheney and company.

NSA is allowed to tap only communications between foreigners

Not true. Thanks to Congress, the NSA can now do anything it wants so long as it is "directed at a person reasonably believed to be located outside of the United States." Only one end of the communication has to be outside the United States, and neither party has to be a "foreigner." If surveillance is directed at a U.S. citizen traveling abroad talking to another U.S. citizen in the U.S., that's fair game.

Once such infrastructure is in place, others could use it to intercept communications.

Ever heard of protecting access with a password? Pretty simple right? And they call this a guy a "expert"? Sheesh.

"On the technical issues, only someone with very specialized knowledge is qualified to have an opinion."

Wrong. As we've seen time and time again, the only people qualified to have opinions on technical issues are policy analysts at conservative think tanks.

http://www.mit.edu/hacker/hacker.html

A brief history of what technogeeks were able to do pretty much at will to over simple phone lines to sytems before there was even an internet.

I don't think there's any reason to believe that intelligent, knowledgable, motivated people would have any less success in wreaking havoc on the proposed infrastructure, even if it's only out of simple curiosity.

This has already happened in Greece: unauthorized rogues managed to exploit features intended for government wiretapping, to do their own wiretapping.

I don't know how seriously to take Landau's concerns.

Yes, Kevin, Landau's concerns need to be taken seriously, and not just for the reasons he articulates. Do we really want NSA controlled backdoors in all of our communication devices?

Ever heard of protecting access with a password?

LMAO.

Oh, and as I have pointed out before, the bad guys are already communicating on encrypted channels that take even the NSA months to break, and make real-time datamining totally useless. The only reason to spy on our communications is capture intel from people who have no reason to encrypt their comm.

Ever heard of protecting access with a password? Pretty simple right? And they call this a guy a "expert"? Sheesh.

I believe this sets a new ignorance high water mark for whichever "al" this one is, and that wasn't easily achieved. (yeah, I know, feeding the trolls is a bad practice)

Al wrote, "Ever heard of protecting access with a password? Pretty simple right? And they call this a guy a 'expert'?" thus blowing his cover as an NSA operative.

It's a real threat, Kevin.

Only by the grace of whatever has it not happened yet.

Installing these things remotely is like leaving the keys to your car on the outside of it - not granted to be found by the common thief, but once someone knows where to look...

Oy, it's like someone wants those cyberpunk movies to happen.

Gee, it isn't as if the Russian, the Chinese, organized crime in several countries, and even terrorists, won't be working overtime to compromise this system. Not to mention the laptops, removable hard drives, etc. that will inevitably be "burgled" from NSA employees and contractors.

AS an earlier poster pointed out, the bad guys are not using insecure comm and they're not about to call each other up and discuss details in clear. This isn't intelligence gathering - it's eavesdropping on anyone and everyone.

Ever heard of protecting access with a password?

If you Google "password crack" you only get 8,550,000 returns.

Vera, I like your ideas. Do you have a newsletter I can subscribe to?

"NSA's programmers and system designers are probably smart guys, but there are a lot of smart guys in the world."

And what are the chances that the smartest of these smart guys are working for the government - at government wages - and not in private industry?

I don't know how seriously to take Landau's concerns.

Obviously somone didn't get out to Live Free or DIE HARD this summer.

Isn't this a paradigm for what Republicans and the Bush administration is doing to America?

They peddle fear to justify actions they claim will make us safer but actually all they're interested in is increasing their own power, never mind that the consequences of their actions actually make us much less safe down the road.

And all it costs us are our civil rights under the constitution, the rule of law, our military, our standing in the world, the value of our currency, 10 trillion dollars in new debt, a shrinking middle class, and increasing economic instability. Hey but at least the ultra-super-rich are getting richer! So that's something.

AL:

"Thanks to Congress, the NSA can now do anything it wants so long as it is "directed at a person reasonably believed to be located outside of the United States." Only one end of the communication has to be outside the United States, and neither party has to be a "foreigner." If surveillance is directed at a U.S. citizen traveling abroad talking to another U.S. citizen in the U.S., that's fair game."

Clearly, this is a bunch of unnecessary handwringing. The Attorney General would never let those kinds of abuses happen.

As someone who used to work in technical telecom, I can attest to how bad an idea this is.

The US phone infrastructure is so large, so myriad and so patchwork as to make any full scale integration of this type nearly impossible and inherently dangerous.

This system spans a continent and has taken nearly a century to evolve. In many places the hardware is decades old while other areas enjoy cutting edge machinery. Moreover, as the technology has moved away from land lines, the diaspora of communications technology has become increasingly complex and unpredictable.

The stupidity of this idea truly boggles me

I don't know how seriously to take Landau's concerns.

Actually, I happen to know Susan (or at least I did, back when she was faculty and I was a Ph.D. student). She's not "just" a distinguished engineer at Sun, but a Fellow of the AAAS, which publishes Science. The technical issues she raises should be taken very seriously.

Ah, Kevin.

More hysteria from the web's resident liberal worry wart, Kevin Dum.

Kevin would rather capitulate to the terrorists. He's so eager to display his liberal multiculturalism and hatred of white civilization that he can't wait for the terrorists to come marching into Washington on their camels as conquerers. Only thing is, he doesn't realize that once he's subjected to the islamofascism, he'll probably be sentanced to death for his athiesm.

Good thing we got regular folks like George W. Bush and Dick Cheney in the White House who have both feet on the ground who see that defense in the defense of liberty is no vise.

Jeebus Kevin, I think you missed the BIGGER point here.

To avoid wiretapping every communication, NSA will need to build massive automatic surveillance capabilities into telephone switches.

So HOW has the Bush administration been able to say they ONLY wiretap foreign phone calls to and from American if, indeed there is no technical way possible to distinguish between purely domestic phone calls and foreign ones?

Bush really lies about everything doesn't he.

and to be quite honest, talent follows money. Do you think that the NSA offers a quarter to it`s programmers that SUN, Apple, or Microsoft does.

If you can pay for it, any system is hackable.

Here are some of the details about the NSA/AT&T program. Maybe there are parts of the NSA program that I don't understand (snark), but the parts that have been explained involve the following: A laser splitter to send 1/2 of the fiber optic data to the normal routes, and 1/2 of the data to the NSA computers. I suppose the risk is that someone could hack into the NSA boxes & eavesdrop on the entire United States population.

http://www.wired.com/science/discoveries/news/2006/04/70621

puh-leeze -- nsa's gonna crash out their electrical grid before they refine their ability to spy on everyone/everywhere...

www.baltimoresun.com/news/nation/bal-nsa0126,0,4411381.story

baltimoresun.com
Sun follow-up
NSA electricity crisis gets Senate scrutiny
By Siobhan Gorman
Sun Reporter
January 26, 2007
WASHINGTON
The National Security Agency's impending electricity shortfall is "sort of a national catastrophe," Sen. John D. Rockefeller IV, the chairman of the Senate Intelligence Committee, said yesterday.

Rockefeller, who took over as head of the panel when Democrats regained control of the Senate this month, called the power shortage a symptom of a larger problem: the NSA's failure to manage long-range issues."They haven't focused on the large picture," the West Virginia Democrat said in an interview.

The Sun reported last year that the NSA expects its power demands to exceed its supply within the next two years - an issue it has been aware of since the late 1990s. NSA Director Lt. Gen. Keith B. Alexander has acknowledged the problem and assured lawmakers that he has assigned some of his top lieutenants to tackle it, according to a committee aide.

and to be quite honest, talent follows money. Do you think that the NSA offers a quarter to it`s programmers that SUN, Apple, or Microsoft does.

Really, you're way off base here. NSA gets its share of top flight talent. The allure of having your hands on some of the deepest secrets of modern day technology is very powerful for a good number of people. For example, it's well known that the NSA hires some of the very best mathematical minds on offer -- it probably has more in its stable than any other single organization in the world.

I agree with frankly0 on this one. As an undergrad, I had this brilliant CS friend. He joined the NSA when he graduated, and no one has heard from him since.

Here are the words of an expert, Richard Clarke, who was in charge of national cybersecurity policy early in the Bush Administration and of counterterrorism for President Clinton. He was canned by Bush for committing the sin of competence. This is quoted from his description of the technologies portrayed in his slightly futuristic novel, "Breakpoint."

" -- The state of cyber security described in the novel is, unfortunately, not fiction. Identities (name, date of birth, Social Security number, credit-card number) are bought and sold in cyberspace hacker chat rooms. Software coding errors are regularly used by hackers to enter networks and computers. Scientists at U.S. government national laboratories have demonstrated the possibility of taking down the power grid through hacking."

Hacking of networked infrastructure by both foreign and domestic enemies is a major theme of the novel. It is very frightening and very plausible.

Remember in WWII for sensitive communications they had Navaho guys speaking in their language to confuse the Japs. Just get yourself a couple of Navahos and charge it to aWol.

You are aware that EVERY Blackberry message goes through a CANADIAN server. Just sayin', is all...

He joined the NSA when he graduated, and no one has heard from him since.

Normally that isn't a compliment.

Remember in WWII for sensitive communications they had Navaho guys...

Unfortunately, they are all gay.

Ah, and Rove and the rest of the WH uses Blackberrys... perhaps Leahy could get more cooperation from the Canadians?

"Unfortunately, they are all gay."

Unfortunately, nothin'. It made shore leave worth living for.

Kevin, there are, indeed, a lot of smart people in the world. Unfortunately, there are not many wise ones.

Most switches are located in what are known generically as "central offices", often shared by several telecom companies and usually located in windowless discrete buildings in metropolitan areas. Although the security is usually tight to enter these facilities, a well-placed bomb could take one of these out easily and disrupt telecommunications in that city for months, if not years. I have always wondered why terrorists haven't targeted one of these places before. Most international traffic comes through transoceanic undersea cables that routinely get severed or otherwise damaged by undersea landslides, volcanoes, etc. However, because they are many and redundant, voice and data traffic can be re-routed easily with little loss in transmission speed or clarity.

Central offices remain a huge vulnerability in most metropolitan areas and President Doorknob and Skeletor (Mr. Chertoff) seem oblivious to this fact.

it is a fair issue to raise. But it is a question that cannot be answered in the open. A senator or rep on the intel committee would say "is this an issue" and the NSA or DCI would say "yes" or "no". and thats it.

fair issue - but in no way political. nor should it be

I for one am pleased at the new policy here of having Vera post at her kind offer of free access to low quality internet porn (and the opportunity to have your cruddy PC infected by malware) at the top of every thread. Seems a highly effective way to divert the influx of troll contributions.

absent observer >"...A laser splitter to send 1/2 of the fiber optic data to the normal routes, and 1/2 of the data to the NSA computers..."

The way you wrote that is very misleading & probably (giving you the benefit of the doubt) not what you intended. The splitters essentially create full copies of the data stream & send a full set of traffic to both (all) destinations. As the reference(s) you point to make clear, this does decrease the signal level available to the receiving equipment & causes some technical problems now and then which is partly how those "not cleared for access" have figured out what is happening.

As someone that has worked in very "mission critical" telecom situations (the NSA was one of our private line customers "back in the day") as well as network (and other) security I would say that Mr Schneier & Ms Landau actually do know that of which they write. While I disagree from time to time with his policy ideas, Mr Schneier`s understanding of these issues is on a ROCK SOLID technical foundation.

I have little doubt that these scenarios are most likely "best case".

Remember that the juvenile inmates ARE in charge these days.

"If you`re not nervous, you don`t understand what`s happening." - John Young

The way you wrote that is very misleading & probably not what you intended.

Yeah.. you're right. The fiber optic signal is split into two, and a copy is sent to: 1) the NSA and 2) the intended recipient.

On an aside: I use Tor when I want to encrypt whatever browsing I'm doing (i.e., I don't want a sex toy purchase, etc. on my permanent record.)

There is no way such surveillance can be carried out without listening in on EVERY phone call. Do you imagine it'll be like this: a group of surveillance guys are sitting around and a call goes through. Uh Oh! that guy out in Rock Island is putting through another call to Osama! Get those head phones on guys and see what's up.

No, it cannot be like that. They cannot know what calls to listen in to and they cannot rely on hearing one call between two numbers to know if the two parties are up to no good or not. They have to listen to a number of calls and see if some patterns exist in the call.
Further, what if the callers are speaking another language. In those cases the call must be logged to disk and run through translation software before they can decide one way or the other.

I see no way what so ever that this cannot be done without intercepting every international call, copying it to a hard disk or other media and then analyzing it for something significant.

They are not trying to find out what people are doing wrong.

They are trying to find out what people are doing right, and who's doing it.

...the defense of liberty is no vise.

Jesus, egbert, a vise is something your authoritarian heroes use to put the clamps on our constitution. A vice is your habit of parroting their pronouncements.

...the defense of liberty is no vise.

Karl Hess is rolling in his grave.

The key issue is not whether the NSA will mandate access that allows them to eavesdrop (they will), or whether measures to ensure reasonable security are feasible (they are), but whether the NSA can or will also mandate the measures necessary to ensure security to the telecomm providers (likely they can't and won't).

In short, the NSA knows what needs to be done to make this secure, but they are likely to leave much of that security to the telecomm providers--who have no interest in doing more than the minimum necessary, and which have historically been insufficient. Which means there will be holes. Or we subsume control of the communications infrastructure to the NSA. Yuck.

As a total ignoramus, I have a question: suppose you had enough storage capacity to record every phone call, e-mail, or other electronic transmission with a foreign connection, passing through the US. Total access to the data, total retention for months at least. How much forwarder would you be at identifying a "sleeper cell" of al-Qaida operatives in the US?

I'm sure NSA has astounding resources at its disposal, but I find it hard to believe that merely _having_ the data accomplishes anything. Presumably, you need to search through the data in some intelligent way. That is, you examine this pile of hay over here, and not that one over there, because you have some intelligible reason to expect the needle to be in _this_ pile. If it's intelligible to you, the NSA, why would it be unjustifiable to a FISA court?

daCascadian: While I disagree from time to time with his policy ideas, Mr Schneier`s understanding of these issues is on a ROCK SOLID technical foundation.

Sorry, allow me to rant for a moment... Unfortunately this is not primarily a technical issue. The technology is, for the most part, well understood. The means and methods necessary to secure it are, for the most part, well understood.

While Ms. Landau's concerns are valid, she (and Mr. Schneier) do a disservice by lobbing "fear grenades"--the same shit we've seen from the other side. And as a participant in this debate on many levels for the last two decades, and having recieved more shit than I can stomach from both sides, I can only say that I am sick of it. Everyone needs to fucking grow up.

has407 >"...Everyone needs to fucking grow up."

Maybe you should follow your advise there bucko because you are out of line on this (and if you do have the background experience you claim, you are FAR, FAR out of line & should know better; get off your political hobby horse).

Ms. Landau & Mr. Schneier are doing EXACTLY what a knowledgeable professional should be doing given a society attempting to be a democratic one being subverted by the thugs in power positions.

We mature adults are sick and tired of impolite, greedy, selfish frat punks rat fu*king OUR political process because they can get away with it.

Get It ?

"The whole aim of practical politics is to keep the populace alarmed (and hence clamorous to be led to safety) by menacing it with an endless series of hobgoblins, all of them imaginary." - H. L. Mencken

daCascadian -- Like I said, ...allow me to rant for a moment... And it was, I admit, a rant.

But to your point... does anyone really believe that compromise of the telecomm system and abuse of wiretapping capabilities is anything new? I think not, at least for anyone remotely familiar with what's occurred in the last 20 years. That this should somehow and of a sudden become a major issue among the congnescenti--who should know better--smells to high heaven.

While I have been much more immersed in this this than the average Joe, you don't have to be privy to anything special to understand that there is a problem, and the problem has existed for decades (see link in jonathan's post at 1:49PM).

So yes, color me cynical about the voices we now hear that express such heartfelt concern. Better late than never I suppose.

Making massive quantities of data searchable and cross-indexed is what SQL was designed to do. Petabytes of data is not out of the question.

You'd be reduced to traffic analysis to search for buffer overruns in the sniffer code, and that can be mitigated with proper routing.

Unless you can get a sploit on the router copying the traffic to a subnet, you can completely isolate the sniffer network, making it essentialy invisible and unhackable.