The Five Dumbest Ways That People Defend NSA Spying

S

Over the past year, as the Snowden revelations have rolled out, the government and its apologists have developed a set of talking points about mass spying that the public has now heard over and over again. From the President, to Hilary Clinton to Rep. Mike Rogers, Sen. Dianne Feinstein and many others, the arguments are often eerily similar.

But as we approach the one year anniversary, it's time to call out the key claims that have been thoroughly debunked and insist that the NSA apologists retire them.

So if you hear any one of these in the future, you can tell yourself straight up: "this person isn't credible," and look elsewhere for current information about the NSA spying. And if these are still in your talking points (you know who you are) it's time to retire them if you want to remain credible. And next time, the talking points should stand the test of time.

The discredited claim: NSA defenders have thrown out many claims about how NSA surveillance has protected us from terrorists, including repeatedly declaring that it has thwarted 54 plots. Rep. Mike Rogerssays it often. Only weeks after the first Snowden leak, US President Barack Obama claimed: "We know of at least 50 threats that have been averted" because of the NSA's spy powers. Former NSA Director Gen. Keith Alexander also repeatedly claimed that those programs thwarted 54 different attacks.

Others, including former Vice President Dick Cheney have claimed that had the bulk spying programs in place, the government could have stopped the 9/11 bombings, specifically noting that the government needed the program to locate Khalid al Mihdhar, a hijacker who was living in San Diego.

Why it's not credible:These claims have been thoroughly debunked. First, the claim that the information stopped 54 terrorist plots fell completely apart. In dramatic Congressional testimony, Sen. Leahy forced a formal retraction from NSA Director Alexander in October, 2013:

"Would you agree that the 54 cases that keep getting cited by the administration were not all plots, and of the 54, only 13 had some nexus to the U.S.?" Leahy said at the hearing. "Would you agree with that, yes or no?"

"Yes," Alexander replied, without elaborating.

But that didn't stop the apologists. We keep hearing the"54 plots" line to this day.

Read the original here:
The Five Dumbest Ways That People Defend NSA Spying

Google, in promoting encryption, calls out Microsoft and Comcast

Encryption is like a relationship -- both parties need to be on the same page for it to work. And Microsoft and Comcast are apparently not on Google's page.

Google began a campaign Tuesday to raise awareness around encryption, and in the process it reported that less than 1 percent of emails sent during May from Gmail to Comcast.net accounts were encrypted in transit.

For Microsoft's Hotmail service (now called Outlook.com), just over half of emails to and from Google were encrypted. Outlook.com users can enable encryption but, unlike with Gmail, it's not turned on by default.

Google's figures appear in a new section in its transparency report that aims to give people better information on the security of their email.

The use of encryption has gained added attention since last year's leaks about U.S. government surveillance, prompting more service and software providers to promise customers they'll keep their data safe.

Encryption is meant to scramble messages and other data so it can only be read by the sender and receiver. Google has been encrypting all Gmail messages by default since 2010.

But encryption only works when it's supported by email providers at both ends of an exchange. In the figures it released Tuesday, Google said between 40 percent and 50 percent of all emails sent between Gmail and other providers during May were not encrypted in transit.

Yahoo fared better than others. Ninety-nine percent of inbound messages from Yahoo to Gmail accounts were encrypted, while 100 percent of outbound messages were.

Google's numbers don't reveal the proportion of emails encrypted within each provider's own walls. So it's possible that all messages sent among Microsoft's own users were encrypted, for example.

Microsoft said late last year that it would be expanding encryption across its services, with plans to encrypt all of its key communications services by the end of 2014.

More:
Google, in promoting encryption, calls out Microsoft and Comcast

Google Tries to Make Encryption Hip

Is encryption the new black?

Google on Tuesday touted its use of encryption on email messages, which turns the messages into garble that can only be read with a key. Google began encrypting email by default in 2010.

Tuesday, it highlighted for users that encryption only protects messages if both parties use it. And it called out other email providers including Comcast and Frances Orange for not using encryption.

On one day last month, for instance, fewer than 1% of Gmail messages sent to Comcast.net email addresses remained encrypted and none of the messages sent to Frances Orange service were scrambled, Google said.

Fewer than half of the messages sent to and from Microsofts Hotmail servers were encrypted. In a December blog post, Microsoft said it is working with other email providers to make sure messages remain encrypted.

Microsoft, Comcast and Orange could not immediately be reached for comment.

In the year since former National Security Agency contractor Edward Snowden released previously confidential documents showing the extent of the NSAs electronic monitoring, many companies have offered apps and gadgets promising to keep the NSA out of your inbox likely an overstated marketing claim.

Yet theres little evidence yet that consumers are flocking to the technology.

Still, Christopher Soghoian, a technologist at the American Civil Liberties Union, says Googles step Tuesday could help drag other tech companies forward.

Googles naming. We can shame, Soghoian said. And we will.

View post:
Google Tries to Make Encryption Hip

Google boosts Chrome encryption amid email warning

Summary: The Internet giant tries to convey to users that many emails are not secure once it leaves Google's hands.

Google routinely publishes reports to establish transparency into how often responds to data requests from law enforcement agencies, but its latest update pertains more to industry competitors.

The Internet giant issued a memo on Tuesday -- a reminder to some and maybe a heads-up to others -- that while Google might promise to keep emails encrypted within its bounds, it can't say the same when messages float beyond its digital grasp.

In fact, Google estimated that between 40 and 50 percent of emails sent between Gmail and other email providers arent encrypted at all.

Brandon Long, the tech lead for the Gmail Delivery Team, offered a real world comparison in a blog post on Tuesday to nail home the point for Internet users of all proficiency levels:

When you mail a letter to your friend, you hope shell be the only person who reads it. But a lot could happen to that letter on its way from you to her, and prying eyes might try to take a look. Thats why we send important messages in sealed envelopes, rather than on postcards.

Email works in a similar way. Emails that are encrypted as theyre routed from sender to receiver are like sealed envelopes, and less vulnerable to snoopingwhether by bad actors or through government surveillancethan postcards.

While acknowledging other email providers to encrypt their emails too (albeit without naming names), Long noted a few public service announcements intended to nudge others to do the same.

That starts with a new section in Google's Transparency Report dedicated to promoting safer email infrastructures.

Google also has a few other security-minded announcements this week, including End-to-End, a new Chrome extension powered by OpenPGP, an open standard touted to be supported by existing encryption tools.

Read more:
Google boosts Chrome encryption amid email warning

More turn to encrypted email amid spying fears

SAN FRANCISCO -- The volume of email cloaked in encryption technology is rapidly rising as Google, Yahoo, Facebook and other major Internet companies try to shield their users' online communications from government spies and other snoops.

Google and other companies are now automatically encrypting all email, but that doesn't ensure confidentiality unless the recipients' email provider also adopts the technology.

In an analysis released Tuesday, Google said that about 65 percent of the messages sent by its Gmail users are encrypted while delivered, meaning the recipient's email provider also supports the technology. That's up from 39 percent in December. Incoming communiques to Gmail are lesas secure. Only 50 percent of them encrypted while in transit, up from 27 percent in December.

The volume of email cloaked in encryption technology is rapidly rising as major Internet companies try to shield their users' online communications from government spies and other snoops. (AP Photo/Damian Dovarganes, File)

Encryption reduces the chances that email can be read by interlopers. The technology transforms the text into coding that looks like gibberish until it arrives at its destination.

Google and other Internet services rely on a form of encryption known as Transport Layer Security, or TLS. Security experts say that encryption method isn't as secure as other options. But encryption that is tougher to crack is also more complicated to use.

Gmail, with more than 425 million accounts worldwide, was one of the first free email services to embrace TLS. Yahoo, Facebook and AOL also are encrypting their email services. Microsoft Corp., whose stable of email services includes the Outlook, MSN and Hotmail domains, has started encrypting many accounts as part of transition that won't be completed until later this year.

Less than half of the correspondence from a Hotmail account to Gmail isn't encrypted as of late May, Google said. Security is even worse at Comcast.net and Verizon.net, where less than 1 percent of the traffic coming to and from Gmail is encrypted, according to Google.

The Google report comes a year after the first wave of media reports about the U.S. government's intrusive techniques to monitor online communications and other Internet activity. The National Security Administration says its online surveillance focused on people living outside the U.S. as the agency tried to defuse threats of terrorism.

After lashing out at the government spying, Google and other Internet companies began encrypting email and other online services in an attempt to reassure users worried about their privacy. The Internet companies are hoping their efforts to thwart government surveillance will make Web surfers feel comfortable enough to continue to visit their services. The companies make more money from online ads if their audiences keep growing.

More:
More turn to encrypted email amid spying fears

Met Office swaps Oracle for PostgreSQL

UK weather service, the Met Office, has started swapping Oracle for PostgreSQL in a strategy to deploy more open source technology.

James Tomkins, data services portfolio technical lead at the Met Office, said: "Traditionally we have always used Oracle as our relational database management system. It is quite a difficult monopoly break."

He said the Met Office wanted to reduce its dependency due to the cost of annual support and maintenance, in a broader initiative to embrace open source software across the organisation.

As Computer Weekly has previously reported, the Government Service Design Manual recommends: "Where appropriate, government will procure open source solutions. When used in conjunction with compulsory open standards, open source presents significant opportunities for the design and delivery of interoperable solutions."

The manual also states that proprietary software should only be used to solve "rare problems".

"Problems which are rare, or specific to a domain, may be best answered by using software as a service, or by installing proprietary software. In such cases, take care to mitigate the risk of lock-in to a single supplier by ensuring open standards are available for interfaces," it states.

The migration away from Oracle follows on from the Met Offices open source plans to use Red Hat and PHP scripting in 2012. At the time, Met Office executive head of technology, Graham Mallin, said the Met Office used IBMs AIX proprietary operating system on its supercomputers, but was running Python internally for software, with Red Hat running on its IBM mainframes. It had 500 Red Hat desktop users, alongside 1,300 Windows users.

While MySQL is the most popular open source relational database, the Met Office was cautious over using it because it is owned by Oracle. Tomkins said there were many branches of development in MySQL source code, which would have made managing the code more difficult than if only one version existed. The Met Office selected the open source PostgreSQL relational database instead.

The Met Office considered MySQL as an open source database to replace Oracle. But the team was cautious over using it because it was owned by Oracle and there were quite a lot of branches of development in the MySQL source code. The Met Office selected PostgreSQL instead.

Rather than attempt a big bang approach to replacing Oracle, the Met Office targeted two pilot migration projects.

Follow this link:
Met Office swaps Oracle for PostgreSQL