Category: Privacy, Surveillance, & Security

Source: Moxie Marlinspike Makes Encryption for Everyone | Popular Science

The Signal developer on why the FBI and governments can’t be trusted

I have the somewhat unpopular opinion that it should be possible to break the law. … We can only desire based on what we know. It is our present experience of what we are and are not able to do that largely determines our sense for what is possible.

The FBI wants us to believe that strong encryption in consumer products will enable terrorists, but they already have access to encryption. It’s the rest of us that don’t.

Source: You Can’t Escape Data Surveillance In America – The Atlantic

The Fair Credit Reporting Act was intended to protect privacy, but its provisions have not kept pace with the radical changes wrought by the information age.

people don’t object to spying on the grounds that the secret dossier about them might be full of errors. They object to spying because it’s spying.

The effect of letting someone sue without showing harm is obvious: It makes it really easy to sue. … Yet when it comes to privacy invasion, it’s difficult to show real life injury. … Having to show harm, or not having to show harm, can make or break an entire genre of lawsuits.

while it’s tempting to simply call for more federal intervention, paternalistic impulses sometimes harm the most vulnerable among us.

Source: Edward Snowden: The Internet Is Broken | Popular Science

The activist talks to Popular Science about digital naïveté

security, surveillance, and privacy are not contrary goals. You don’t give up one and get more of the other. If you lose one, you lose the other. If you are always observed and always monitored, you are more vulnerable to abuse than you were before.

Why doesn’t mass surveillance work? That is the problem with false positives and false negatives. If you go look, our program is 99.9 percent effective, and that sounds really good, but when you think about that in the context of a program, that means one out of every thousand people is going to be inaccurately identified as a terrorist, or one out of every thousand terrorists is actually going to be let go by the system, and considered to not be a terrorist.

Let’s think about the example of AT&T sharing with the government more than 26 years of phone records. That’s the full span of these people’s lives. They’ll never have made a phone call on AT&T that hasn’t been captured.

Metadata is the technical word for an activity record, so the government has been aggregating perfect records of private lives. And when you have all of someone’s phone records, purchase records, every website they’ve ever visited or typed into Google, or liked on Facebook, every cell phone tower their phone has ever passed and at what time, and what other cell phones were at that tower with them, what you’ve done is you’ve written a secret biography of every person that even they themselves don’t know.

Source: IRS Security – Schneier on Security

In addition to sending the IRS your money, you’re also sending them your data.

It’s a lot of highly personal financial data, so it’s sensitive and important information.

Is that data secure?

The short answer is “no.”

So we’re stuck. We have no choice but to give the IRS our data. The IRS isn’t doing a good job securing our data. Congress isn’t giving the IRS enough budget to do a good job securing our data.

Source: Keeping secrecy the exception, not the rule: An issue for both consumers and businesses – Microsoft on the Issues

We believe these actions violate two of the fundamental rights that have been part of this country since its founding. These lengthy and even permanent secrecy orders violate the Fourth Amendment, which gives people and businesses the right to know if the government searches or seizes their property. They also violate the First Amendment, which guarantees our right to talk to customers about how government action is affecting their data. The constitutional right to free speech is subject only to restraints narrowly tailored to serve compelling governmental interests, a standard that is neither required by the statute being applied nor met by the government in practice here.