[atonse]

What an interesting time to be in intelligence gathering.

Why even bother breaking into an air gapped DoD network to get classified data when you can target all these third party cloud companies that have secondary data that isn't air gapped in classified networks, and most won't have the security resources to really lock things down.

This is somewhere in the awkward middle between what's called "open source intelligence" and traditional intelligence.

I don't envy defensive cybersecurity staff and their jobs/responsibilities.

[strictnein]

One of the jokes going around Twitter last night was whether or not Strava would be able to handle the server load from all the intelligence agencies breaking in and dumping their data.

This isn't just heat maps they have, they have the movement and timestamped location of millions of people around the world. Undoubtedly some of those people are "interesting" to someone, especially since Strava just revealed that a lot of them hang out in unique places.

edit: For example: https://twitter.com/thegrugq/status/957851350099832834

[atonse]

Geez yeah no kidding. And they'll have other account data like first and last names. But then again, it's likely they've already been hacked (same with FitBit) and don't even know it.

The data these companies have is too valuable, cleanly IoT collected, and keyed by email, for nation states to not try to get.