[rfrank]

Before leaks, "Thinking the government is monitoring everyone online and using their mobile devices to spy on them is insane, you conspiracy theorist."

After leaks, "This is barely news, everyone knew this already."

Every. Single. Time.

[willstrafach]

Similar to the first "Vault 7" release, this is guidance related to spy tools. No mass surveillance or anything which appears to be unjust. These all require close-access exploitation, they are not remote, in fact most of the guidance specifically relates to these being designed for devices which are to be gifted to the targets.

[rfrank]

Yeah, that cache of zero days and all those DLLs aren't for mass surveillance. Ok. That's super duper believable.

[willstrafach]

I do not understand your response. You have not refuted my comment at all.

By design, a zero day cannot be reasonably used for mass surveillance. Every endpoint targeted increases the chance of discovery. This is how many would probably prefer to see a spy agency be operating; Focus on their specific targets instead of dragnet surveillance.

As for this specific release, it requires physical access (and a very outdated OS).

[rfrank]

Why should I believe the CIA isn't using its "targeted" tools on say, American ISPs or carriers, giving them access to a dragnet level of data through a single "targeted" attack? The CIA is not staffed by reasonable people, and I have 0 reason to trust they operate in good faith or with the best interest of anyone but their own organization in mind. Which they like to demonstrate by being consistently Caught In the Act influencing foreign elections, trafficking drugs, etc. Any tool they have will be abused.

[willstrafach]

I definitely am not trying to make you believe anything, nor am I defending any past actions of the CIA (I don't know enough about all that to have an opinion). My comment is only based on my own review of all documents released so far in Vault 7. All indications show that these tools are made for use on specific targets, applied on devices by a human operator or asset.

[rfrank]

It's very clear we have different ideological opinions on the actions of the CIA. The actions of US intelligence agencies over the last decade (at least) is absolutely disgusting.

[mimi89999]

Infection of device on a supply chain isn't? Many people that aren't suspected of anything could end up with a backdoored device.

[willstrafach]

That is a very fair point, but I think WikiLeaks actually misunderstood that. I assume you are referencing this:

> Also included in this release is the manual for the CIA's "NightSkies 1.2" a "beacon/loader/implant tool" for the Apple iPhone. Noteworthy is that NightSkies had reached 1.2 by 2008, and is expressly designed to be physically installed onto factory fresh iPhones. i.e the CIA has been infecting the iPhone supply chain of its targets since at least 2008.

It seems that WikiLeaks has misunderstood the meaning of "factory fresh" in the manual. This simply means it is a new device. If you look at all the source documents, it appears that NightSkies was built under the user requirement that a CIA agent is in a position to gift a device to their target, pre-infected. Regardless of how one might feel about that practice, I think it is a big difference with regards to the "supply chain" phrasing because they mistakenly indicate that the infection would literally occur at the factory, and that is definitely not indicated in any of the documents.

[jaredhansen]

Yes, but that's not as crazy as it sounds.

I think many folks draw an (implicit, often subconscious) distinction between invasions of privacy that they care about, vs those they don't, and the former ties closely to the presence of a human mind on the other end of the wire. For most people it seems, the whole concept is linked much more closely to the fear of shame (e.g., your slightly bizarre kink will be outed to friends or family who might look at you differently) than to the fear that the regime will find out you are a threat to it, and will come after you.

In other words: because the CIA's computers don't care if I am a furry and are never going to tell what they hear, I don't have to care that they're listening.

People (rightfully) dismiss as insane the notion that some weird dude is sitting in the basement of the NSA listening to the details of your life, in particular (the NSA's basement and budget are not big enough to house enough weird dudes to listen to make the chance of your life being monitored any more than vanishingly small). But it's been pretty common knowledge for a very long time that if Power really wants to know something (whether it's about you or anything else), it has a pretty good chance of learning it.

[rfrank]

> ...and are never going to tell what they hear, I don't have to care that they're listening.

Why do you think this is the case?

Has the government sufficient ability to secure data that the very fact they possess databases of information on US citizens isn't fundamentally problematic? Based on only the last year of breaches, I'd argue no.

> People (rightfully) dismiss as insane the notion that some weird dude is sitting in the basement of the NSA listening to the details of your life

That is not a claim that any rational critic of bulk surveillance makes. And, ya know, machine learning exists. They won't (or don't) need humans to analyze the data they collect.

> ...the whole concept is linked much more closely to the fear of shame...

Embedded journalists, activists, people with sensitive medical information.

[tgragnato]

> Embedded journalists, activists, people with sensitive medical information.

This reference sample is very small if compared to the possibilities.

Everybody has something private that can be used to extort informations, to gain privileges or what-else.

The US is not in the position to assure the current surveillance infrastructure (and so the confidentiality of the data) will endure the centuries.

An example ? ...

When you read [https://byparker.com/blog/2016/tim-cook-s-privacy-battle-is-...],

knowing that back during the cold war the stasi used to target `a certain kind of people` (with romeos and wiretapping),

knowing that the stasi lost control of what are called "the pink files" and that we currently have no idea of whoever is benefiting from them,

you start to realise that what currently can be considered a non-issue may in the future be something very dangerous.

[rfrank]

> Embedded journalists, activists, people with sensitive medical information.

And? At risk populations are always minorities.

Journey Into the Whirlwind by Eugenia Ginzburg is a book you'd probably enjoy.

https://www.amazon.com/Journey-into-Whirlwind-Eugenia-Ginzbu...

[tgragnato]

Minorities are the most exposed and I perfectly agree, but with the new capabilities (big data analysis in particular) I believe that ANYONE can be a target, not only minorities.

Edit: the book seems great, I'm gonna buy it, thank you for the hint.

[rfrank]

Oh totally, that's the point of the system. I brought up who I perceive as groups most vulnerable to surveillance to address the "most people only care because shame" point. IE the medical data that could be considered 'sensitive' (and negatively impact career potential if more open) could include things like depression/anxiety, high blood pressure for a stressful work environment, etc. I'm generally of the opinion that open data hardens stereotypes, not breaks down walls.

[mnm1]

It doesn't matter if there is someone actually looking at the information or not. The violation comes in collection. If they collect, I will self-censor. Free speech cannot exist without privacy because speaking to myself is not actually speaking and speaking to anyone else freely becomes impossible. But you're right about one thing: most people are indeed too stupid to realize why they should care. The government doesn't care about people who are furry ... until furries do something that the government doesn't like. Then they'll care. Then they'll care a lot. Too bad it'll be too late by then to do anything but watch the furries get executed.