Cybersecurity as Realpolitik by Dan Geer presented at Black Hat USA 2014

All it takes is metadata . The "digital exhaust" we leave behind is extremely revealing. I usually use COTRAVELER as my example of how just a few data points (without any PII) can reveal a LOT about your social interactions, but browser history is another powerful data source. I believe this is why Dan Geer, in his incredible talk last year[1], suggested that "privacy" should now be defined as "the effective capacity to misrepresent yourself". To avoid exactly the type of analysis, you need the capability to misrepresent yourself, and you need to regularly be in the habit of use use that capability. Misrepresentation is using disinformation to frustrate data fusion on the part of whomever it is that is watching you. Some of it can be low-tech, such as misrepresentation by paying your therapist in cash under an assumed name. Misrepresentation means arming yourself not at Walmart but in living rooms. Misrepresentation means swapping affinity cards at random with like-minded folks. Misrepresentation means keeping an inventory of misconfigured webservers to proxy through. Misrepresentation means putting a motor-generator between you and the Smart Grid. Misrepresentation means using Tor for no reason at all. Misrepresentation means hiding in plain sight when there is nowhere else to hide. Misrepresentation means having not one digital identity that you cherish, burnish, and protect, but having as many as you can. [1] [VIDEO] [LINK]

Dan Geer at his important talk at Black Hat: The central dynamic internal to government is, and always has been, that the only way for either the Executive or the Legislature to control the many sub-units of government is by way of how much money they can hand out. [...] Suppose, however, that surveillance becomes too cheap to meter, that is to say too cheap to limit through budgetary processes. Does that lessen the power of the Legislature more, or the power of the Executive more? I think that ever-cheaper surveillance substantially changes the balance of power in favor of the Executive and away from the Legislature. While President Obama was referring to something else when he said "I've Got A Pen And I've Got A Phone," he was speaking to exactly this idea -- things that need no appropriations are outside the system of checks and balances. [VIDEO] [LINK] While Congress has been occupied with infighting and stupid political theater, the Executive branch has been taking a lot of their power. Is it "making war" when Congress is clearly abdicating their responsibilities? It has certainly done more damage to the country than any army has ever accomplished.

Y Not - Adventures in Functional Programming by Jim Weirich [LINK] The Coming Civil War over General Purpose Computing by Cory Doctorow [LINK] Cybersecurity as Realpolitik by Dan Geer [VIDEO] [LINK]

> Obfuscation may be our best digital weapon. From Dan Geer's talk "Cybersecurity as Realpolitik" (which everyone should hear[1]/read[2]): >> There are so many technologies now that power observation and identification of the individual at a distance. They may not yet be in your pocket or on your dashboard or embedded in all your smoke detectors, but that is only a matter of time. Your digital exhaust is unique hence it identifies. Pooling everyone's digital exhaust also characterizes how you differ from normal. Privacy used to be proportional to that which it is impossible to observe or that which can be observed but not identified. No more -- what is today observable and identifiable kills both privacy as impossible-to-observe and privacy as impossible-to-identify, so what might be an alternative? If you are an optimist or an apparatchik, then your answer will tend toward rules of data procedure administered by a government you trust or control. If you are a pessimist or a hacker/maker, then your answer will tend towards the operational, and your definition of a state of privacy will be my definition: the effective capacity to misrepresent yourself . >> Misrepresentation is using disinformation to frustrate data fusion on the part of whomever it is that is watching you. Some of it can be low-tech, such as misrepresentation by paying your therapist in cash under an assumed name. Misrepresentation means arming yourself not at Walmart but in living rooms. Misrepresentation mea

From your other posts you seem to have a very good sense of social responsibility, so I'm surprised at this comment. Multiple identities are incredibly important to anybody in a minority that is threatened by their local mainstream culture. Black people in may areas (even today), gay or lesbian people in many parts of the world, and trans people just about anywhere[1] are some obvious examples. There are numerous others, which bring varying amounts of risk if exposed publicly. These people are often forced to put on a facade when in public, to avoid the risk of being fired (only a few of these are protected classes), beaten, or even killed. The internet has created a space where these people can be themselves... as long as it doesn't connect back to their real name and identity. Yes, leaving a job is a good way to avoid a bigoted manager, but that isn't an option for everybody. Your boss isn't the only threat, either: it wasn't that long ago that being openly gay could get you lynched in some areas. This comes down to the basic concept of privacy. I recommend Dan Geer's definition[2] of privacy in light of modern technology: Privacy used to be proportional to that which it is impossible to observe or that which can be observed but not identified. No more -- what is today observable and identifiable kills both privacy as impossible-to-observe and privacy as impossible-to-identify, so what might be an alternative? If you are an optimist or an apparatchik, then your answer will

> technology is going to make mass surveillance relatively easy > a la Gestapo In 2013 Tom Scott made an incredibly prescient sketch of our grim surveillance-state future. It absolutely terrifying . [LINK] It's terrifying because it's the power of Stasi-style informants modernized into a simple Uber-like app. No more scary clandestine meetings, now you can inform on your friends, family, and neighbors with one click from the comfort of your own home. Similar to the "social credit" system, Tom's "Oversight" could work, because they both efficiently incentivize close peers against each other. "You should stop spending time with your friend John. I heard him talking like a dissident recently... that could damage your Social Credit rating!" > enters with their phone Which is exactly why I follow Dan Geer's advice[1] and don't carry around a tracking device. He's been trying to warn us for years[2], and we still aren't listening[3]. [1] [LINK] [2] [VIDEO] (transcript: [LINK] ) [3] [LINK] (transcript: [LINK] )

> If a couple of Texas brothers could corner the world silver market,[HB] there is no doubt that the U.S. Government could openly corner the world vulnerability market, that is we buy them all and we make them all public. Simply announce "Show us a competing bid, and we'll give you 10x." Sure, there are some who will say "I hate Americans; I sell only to Ukrainians," but because vulnerability finding is increasingly automation-assisted, the seller who won't sell to the Americans knows that his vulns can be rediscovered in due course by someone who will sell to the Americans who will tell everybody, thus his need to sell his product before it outdates is irresistible. This strategy's usefulness comes from two side effects: (1) that by overpaying we enlarge the talent pool of vulnerability finders and (2) that by making public every single vuln the USG buys we devalue them. Put differently, by overpaying we increase the rate of vuln finding, while by showing everyone what it is that we bought we zero out whatever stockpile of cyber weapons our adversaries have. We don't need intelligence on what weapons our adversaries have if we have something close to a complete inventory of the world's vulns and have shared that with all the affected software suppliers. Source: [LINK] Video: [VIDEO]

Even if you ignore JFK, a good case can be made that the security agencies (probably FVEY?) currently seem to have at least de facto control basically anywhere they want. Exercising that control got a lot easier - and less obvious - as technology became available. Traditional informants and enforcers sometimes get noticed, but JOIN...WHERE user.id=foo across phone location data is very hard to discover. The key part, I think, is that COINTELPRO ended in name only. Worse, as the use of the internet increased, the number of times I've had to consider "JTRIG-style disruption, paid corporate shill, or useful idiot" has increased dramatically. While a "silent coup" is one possibility, I have been liking how Dan Geer's described[1] the high-level picture of our situation as a Cold Civil War . Cold wars are fought by proxy, and there has been a lot of pointer-chasing to trace in the modern political situation. [1] [VIDEO] ( [LINK] )