Yahoo's Government Email Scanner Was Not A Modified Spam Filter, But a Secret Hacking Tool: Motherboard (vice.com) 45
The spy tool that the US government ordered Yahoo to install on its systems last year at the behest of the NSA or the FBI was a "poorly designed" and "buggy" piece of malware, according to two sources closely familiar with the matter, reports Motherboard. From the article: Last year, the US government served Yahoo with a secret order, asking the company to search within its users' emails for some targeted information, as first reported by Reuters this week. It's still unclear what was the information sought, but The New York Times, citing an anonymous official source, later reported that the government was looking for a specific digital "signature" of a "communications method used by a state-sponsored, foreign terrorist organization." Anonymous sources told The Times that the tool was nothing more than a modified version of Yahoo's existing scanning system, which searches all email for malware, spam and images of child pornography. But two sources familiar with the matter told Motherboard that this description is wrong, and that the tool was actually more like a "rootkit," a powerful type of malware that lives deep inside an infected system and gives hackers essentially unfettered access.
Hacking? (Score:4, Informative)
Re:Hacking? (Score:4, Informative)
Re: (Score:2)
Re: (Score:3)
Bulk domestic collection is not legal. The Foreign Intelligence Surveillance Act even has the word "Foreign" in it so courts, the wider public and staff can more easily understand what is legal.
The Church Committee https://en.wikipedia.org/wiki/... [wikipedia.org] went all over that the last time vast domestic spying was discovered.
This is TRON, he fights for the Users. (Score:3)
Re: (Score:2)
I wonder what the "rootkit" was looking for that the existing filters couldn't do. Looks at header information that content filters don't search? Correlating multiple messages?
Re: (Score:2)
Re: (Score:1)
What would happen if the zombies from Yahoo mated with with Ebola victims of AOL? And would we still need to bus their asses around?
Buggy rootkit = 500 million accounts hacked? (Score:5, Interesting)
Re: (Score:2, Informative)
The accounts were hacked in 2014 and this was put in place in 2015 so not related. Not to say yahoo wasn't doing something else we don't know about back then, or purposely not investing in security to give the feds a deniable way in, either seem likely for such a terrible company.
It's not the intrusion per se (Score:5, Interesting)
As I have always maintained, what is most troubling is not the government's surveillance itself, but the complete lack of accountability and oversight with respect to such policy, and that this deliberate opacity is used to hide government malfeasance under the pretense of protecting national security.
In a recent NPR interview I listened to on the radio, this is how the conversation played out: the interviewer kept focusing on drawing comparisons to situations where companies that collect and relay personal data might filter or flag such data for legitimate purposes (e.g., child pornography), and the interviewee did a remarkably poor job of addressing the real issue as I have mentioned above. So long as we focus on the legality of the surveillance itself, such discussions are a losing battle for advocates of privacy and personal liberty, because there are always persuasive moral, legal, and ethical arguments to be made in favor of some kind of broad but algorithmic surveillance without explicit human intervention or judgment. The real point of attack, then, is to bring attention to the fact that the government does their spying on the general public in a way that so totally removes any liability on their part that in the vast majority of cases, we either (1) do not know or cannot confirm the existence of such surveillance in the first place; (2) private corporations are coerced to cooperate and are prevented from divulging the methods used by the government to spy on users; (3) individuals who are subjects of surveillance are unable to defend themselves in a court of law because they aren't granted access to evidence; (4) there is no oversight of such surveillance programs to ensure no abuses take place or that it even operates as is claimed; (5) no results are ever shown that demonstrate the utility or effectiveness of such programs.
In short, if the government wants to throw our constitutional protections out the window in the name of keeping us safe, they could at least do it in a way that makes it clear that it's happening. But since they don't, the only logical conclusion is that they are entirely aware that their programs are illegal, hence the need to lie and hide. And this, I argue, is the root of the problem.
Re: (Score:1)
Re:It's not the intrusion per se (Score:5, Insightful)
In some sense, yes: the government really shouldn't have secrets, at least in the context of withholding information that is needed to maintain their accountability to the American public, who are in principle the source of the government's power. This is the essential meaning of the famous conclusion of Lincoln's Gettysburg Address: "...that government of the people, by the people, for the people, shall not perish from the earth."
The NSA is a good example of what happens when the government is entrusted to monitor the scope of its own secret-keeping. Their testimony to Congress after the Snowden revelations proves that they regard themselves as not accountable to the people, choosing to directly lie under oath to public officials, even if they believe that doing so ultimately serves the public interest.
To address your more specific case of "how do we catch terrorists or other enemies via their communications if we are obligated to announce how we are monitoring communications," one could just as easily turn the argument around and ask how police can catch criminals if they are obligated to have probable cause and obtain warrants. That is to say, the constraints imposed upon the enforcement of the law are not defined by what is technologically or physically possible or expedient, but from the rights and responsibilities guaranteed by the law itself, and that it is the duty of law enforcement to work within the legal framework they are sworn to uphold, rather than to define that framework and not only choose what tactics are permissible, but prevent anyone but themselves from knowing what is permissible or not. Otherwise, we have no rights, and the government can act with impunity (e.g., extrajudicial killings, summary executions, warrantless search and seizure, all in the name of rooting out crime and terrorism). And we can easily point to contemporaneous examples of the consequences of such policies and see how this is essentially tyranny of the state and the collapse of democratic governance.
How do we catch terrorists? To put it simply, good old fashioned detective work. Build and earn trust between the public and law enforcement. Rather than relying on the government to institute secret panopticon tactics, recognize that the public itself is a far better observer of illegal activities. There will be, of course, vehement criticism of such ideas as "naive" and "wildly idealistic." But it is actually eminently realistic because it begins with the recognition that not every threat can be stopped. What is unrealistic is the notion that a government can detect and respond to all threats through a sophisticated, secret, and pervasive surveillance network. That is the stuff of spy-thriller and dystopian sci-fi fantasy movies.
Re: It's not the intrusion per se (Score:2)
That's easy. We declare war and let the military do it. Say we are at war with ISIS or whoever and monitor their communications like the military complex would do in any other war.
Of course domestic lone wolves would be off limits like they should be anyway. You can't be guilty of a crime without actually committing one. Obviously we've gone too far requiring ID and and recording such information any time someone buys a pressure cooker, right? Right?
Re: (Score:1)
And then, once it's in place and the bad men are caught, then sure. The agent can snoop on his ex-girlfriend's emails, for fun.
Because why the hell not?
Re: (Score:2)
The United States Constitution is clear on what needs to be done to get a search warrant for domestic access.
Once that color of law sets in to set aside constitutional protections from mil and gov tasking over generations, all other protections are lost.
AC with sharing this goes to a city and state level. State task forces push requests up, other agencies push data down to the city and state level.
A lot of local eyes are now getting to see, requesting or getting the product of su
Re: (Score:2)
That which is dead can never die (Score:2)
The problem is you have people who call themselves hackers, unfamiliar with the underlying code and why it was built that way, trying to use a hammer as a pry bar.
If you need a pry bar, make a pry bar. Make it from a cold pressed cylindrical bar, not from a piece of metal modifed from a spade.
We made the hammer, and the underlying code, for a different reason.
They need to realize if you intend to sup from the well of souls, that you must first be able to drink deeply and without ceasing. And that the act of
Yahoo runs with non-denial again. (Score:2)
"does not"? How about denying that it ever existed on their systems? Or perhaps there is some element of the description that isn't quite right (hence the "described in the article")?
Dead-drop email accounts (Score:2)