Is the NSA Reading Your E-Mail?

Richard M Smith has some interesting ideas on how to test if the NSA is eavesdropping on your e-mail.

With all of the controversy about the news that the NSA has been monitoring, since 9/11, telephone calls and email messages of Americans, some folks might now be wondering if they are being snooped on. Here’s a quick and easy method to see if one’s email messages are being read by someone else.

The steps are:

  1. Set up a Hotmail account.
  2. Set up a second email account with a non-U.S. provider. (eg. Rediffmail.com)
  3. Send messages between the two accounts which might be interesting to the NSA.
  4. In each message, include a unique URL to a Web server that you have access to its server logs. This URL should only be known by you and not linked to from any other Web page. The text of the message should encourage an NSA monitor to visit the URL.
  5. If the server log file ever shows this URL being accessed, then you know that you are being snooped on. The IP address of the access can also provide clues about who is doing the snooping.

The trick is to make the link enticing enough for someone or something to want to click on it. As part of a large-scale research project, I would suggest sending out a few hundred thousand messages using various tricks to find one that might work. Here are some possible ideas:

  • Include a variety of terrorist related trigger words
  • Include other links in a message to known AQ message boards
  • Include a fake CC: to Mohamed Atta’s old email address (el-amir@tu-harburg.de)
  • Send the message from an SMTP server in Iraq, Afghanistan, etc.
  • Use a fake return address from a known terrorist organization
  • Use a ziplip or hushmail account.

Besides monitoring the NSA, this same technique can be used if you suspect your email account password has been stolen or if a family member or coworker is reading your email on your computer of the sly.

The only problem is that you might get a knock on your door by some random investigative agency. Or get searched every time you try to get on an airplane.

But I think that risk is pretty low, actually. If people actually do this, please report back. I’m very curious.

Tags: , , ,

Posted on December 26, 2005 at 12:31 PM • 133 Comments

Comments

Michael Ash • December 26, 2005 12:56 PM

Nice idea.

If anyone tries this, keep in mind how extremely insecure e-mail actually is. If you get a ping and you’re absolutely positive that nobody has the password, it doesn’t mean it’s the NSA. It could simply be a person on your local network with a sniffer, a bored mail server admin, etc. It could even be some sort of ultra-sophisticated virus scanner or spam checker that loads URLs mentioned in the message.

If positive hits are obtained, it would be interesting to repeat with increasing layers of crypto. If it’s casual snoopers, even a pass of ROT-13 should stop them. Then again, if the NSA is doing wholesale e-mail surveillance, they may not be able to afford to break everybody’s crypto even if it’s something dumb.

I would love to see the results if someone tries this.

Nick Lancaster • December 26, 2005 1:02 PM

Sorry, my blog already got a visit from shaggy4.corp.nsa.gov. That was so disturbing I neglected to check the referring page, so I don’t know if it was a bot sniffing for keywords.

RC • December 26, 2005 1:06 PM

What you are suggesting is probably illegal. It is a good way to get yourself arrested on charges related to terrorism.

Nick Lancaster • December 26, 2005 1:23 PM

None of the suggestions (which are Richard M. Smith’s and not Bruce Schneier’s) would appear to be illegal, unless you link to or state credible plans for an actual attack.

It’s kind of goofy to assume that only al-Qaeda members would visit an al-Qaeda website, or even that al-Qaeda expects the message boards to be a secure means of exchanging information.

Dom De Vitto • December 26, 2005 1:28 PM

Gee.

I guess if they are reading you email in-transit, why exactly would your web browsing habits be out of reach?

Or putting it another way, don’t you think someone by now would have posted publically: “hey, I emailed a link to some private stuff, but then the URL on my server got a load of hits from bobs-pc.nsa.gov !”, and the’re running IE4!

Doh!

Brad Spangler • December 26, 2005 1:32 PM

Bruce, it would be damned hard to report back if it earns someone a one-way trip to the lush tropical resort of Guantanamo Bay.

I’d much rather see a grassroots effort to popularize use of PGP/GPG. While the NSA could probably decrypt any one message, it would be impractical for them to decrypt everything going between everybody. It’s perfectly legal to encrypt your email (for now, anyway) and it’s a positive, empowering step to merely assert your own right to privacy, rather than meekly begging for it.

Anonymous • December 26, 2005 1:34 PM

Seems like a great way to waste the time of inteligence gathering agents who might otherwise be collecting useful information.

boomer • December 26, 2005 1:36 PM

Illegal? What country do you live in, cuz you don’t live in the USA. We should do this; or better yet built automated systems to do this, distribute the workload out amongst the millions of internet-connected computers and overload the NSA’s data mining operation…

Juergen • December 26, 2005 1:43 PM

Just a little note: The email address shouldn’t read “tu-harburg”, it should be “tu-hamburg”.

Israel Torres • December 26, 2005 2:19 PM

One interesting aspect of this entry is that it doesn’t stop at e-mail. You’d be surprised as to how “smart” this type of reconnaissance has become. Take a second to think about the interfacing – why would an alleged machine built for efficiency even bother using common client interfaces to inspect information? “It” wouldn’t.

Israel Torres

complich8 • December 26, 2005 2:20 PM

If anyone tries this and gets positive results, I’d be curious to know what user-agent string the webserver saw.

I would have to doubt that a live person would inspect every email — even suspicious ones — that floats by and click on the links in it. Further, if they did, I’d have to think that’d be a huge security liability, given the previous post about known-exploitable browser exposure. That’d be setting the agency up for some vicious counter-intelligence operations, at very least.

raouf • December 26, 2005 2:53 PM

Bad idea.
“Intelligence” gathering agencies do not care about having thousands of false positives, all they want is not having a single false negative.
At this point in time they have the means to implement the brute force approach (the great vacuum cleaner).
Current data mining tools are based on Baysian filters and neural network. These methods do not have the notions of causality or inference, they only flag a pattern without any indication as to why this pattern is relevant.
As a result an entry is made into someone’s secret file which will live on forever.
Time and again there were cases in this country and others where someone’s life is ruined based on these secret uncontested entries.

ben • December 26, 2005 2:54 PM

it seems to me that this is more along the lines of “how to get the NSA to pay attention to you.” Unless you’re dealing extensively with “terrorists” or people known to associate with them, chances are infinitesimal that your email is getting seen. Doing what you specify here doesn’t determine whether you’re being watched, it only increases your chances.

Besides, don’t you all listen to Air America? It’s Kerry, Sheehan, and Jabba the Hutt… er, Michael Moore that are getting watched. Come ON, people!

Nils Kalchhauser • December 26, 2005 3:05 PM

“I would have to doubt that a live person would inspect every email”

I very much doubt that too, but: a live person would most likely realize that the mails are generated automatically anyway. except you really write up some intelligible messages..

Tobias Weisserth • December 26, 2005 3:55 PM

@Brad:

“While the NSA could probably decrypt any one message, it would be impractical for them to decrypt everything going between everybody.”

I doubt that. Given that the keys are trustworthy (fingerprint comparison via phone etc.) and the keys are large enough I doubt the NSA has enough CPU cycles to “break the code” while I am still alive.

If they really want something they’ll get a warrant. Or simply break into your house. That’s much easier.

regards,
Tobias

nimp • December 26, 2005 4:09 PM

I experienced another different approach: create a “security” software, submit it to the “tools” page of securityfocus.com, and look at the logs of your web server.
You will find a lot of addresses of international agencies, even see that several colleagues in the same agency download your tool at 10 minutes interval (informed by an internal mail?).
Military should use an AOL address when they download sensitive tools, instead of their .mil connection…

Neighborcat • December 26, 2005 4:40 PM

Wouldn’t this method have a tremendous number of false positives? What keeps your URL from being accessed by mistakes or random search engnes? Are you expecting the vist to your site to trace back to Smith@spook.gov?

Once the NSA adapts to the possibility that a subject may be using this technique, I suggest it will provide a high rate of false negatives as well.

NC

Antonio • December 26, 2005 4:41 PM

@ Tobias

MAYBE, the NSA has technology/science unknown to the public that does give them the needed cpu cycles to break PGP encryption with large keys.

Truth is, we will never know about this! So, I think it’s useless to care too much about it, unless you’re doing something pretty nasty! 🙂

peachpuff • December 26, 2005 5:13 PM

“But I think that risk is pretty low, actually. If people actually do this, please report back. I’m very curious.”

Tell me, too. I also think it’s safe and very interesting, but don’t want to risk doing it myself.

Dan Holzman • December 26, 2005 5:51 PM

“Seems like a great way to waste the time of inteligence gathering agents who might otherwise be collecting useful information.”

Nonsense. If the NSA isn’t monitoring your e-mail, which they should not be, they won’t see the message and their time will be spent doing what they’re supposed to me.

Conversely, if the NSA is monitoring your e-mail, they’re already wasting the time of intelligence gathering agents.

Joe Patterson • December 26, 2005 6:46 PM

If I were to follow steps 1-4 and start getting hits in step 5, that would mean that my e-mail was being monitored. Maybe it’s being monitored by the NSA. Maybe it’s being monitored by hotmail. Maybe it’s being monitored by Rediffmail.com. Maybe it’s being monitored by someone else. Maybe it’s being monitored by the latest virus which has somehow managed to infect my machine. Each of these is possible. I wouldn’t even bet the probabilities of each individually are particularly infinitesimal. In the aggregate, their probabilities, well, aggregate. I’d certainly want to know if any were true. But I’d also really want to know which was true.

Of course, I’d like to think that I could figure out which was true by source address. But I’d guess that the URL would get checked by some random node in the monitor’s bazillion node botnet, and I don’t know if I’d be all that surprised if that botnet belonged to some virus writer, Microsoft, or the NSA.

Mark El-Wakil • December 26, 2005 7:04 PM

Quick Q:

The articles I’ve read so far about the NSA and the net have had to do with them monitoring “Internet Traffic” and not necessarily emails.

Is the fear here that the NSA is intercepting email traffic between two points? If so, wouldn’t an established TLS connection solve that problem?

Otherwise, is the fear that places like Hotmail, Yahoo, etc are giving the NSA access to these email accounts?

Just wondering.

Spence • December 26, 2005 7:05 PM

Well, the thing is: Every major search-engine has (publicly written about) connections with security agencies – which is logical and not a bad thing in itself (it all depends on the type and depth of the connection, which of course you don’t read about in your daily newspaper).

So, if any agency wanted to check out a link, I doubt it would be people manually surfing the sites fromo their workplace with their IP. That’s a bit of a ridiculous assumption. The more obvious way, would be to feed urls to the searchbots from search-engines, and take a look at the cached pages.

Then there’s also the public proxies which some people like to claim are in fact set up by strawmen with the aim to filter and search the traffic that goes through. If that is true (which doesn’t sounds unreasonable), than that would be another way to fetch the info for such interesting urls.

Ari Heikkinen • December 26, 2005 8:00 PM

Considering how idiotic anything dealing with terrorism is these days remember that if you do that and someone actually intercepts it (as unlikely as it might be) they’ll then have written evidence for use in court against you claiming you’re a terrorist.

Richard Schwartz • December 26, 2005 9:17 PM

@Dan: re “if the NSA is monitoring your e-mail, they’re already wasting the time of intelligence gathering agents”.

First of all, let’s not pretend that we know whether or not there’s any content analysis being done. Given the likelihoood that bad guys use strong encryption, I think it’s wise to conclude that the vacuum-cleaner approach doesn’t even look at content on the first pass. But that’s just my assumption.

Let’s also, however, not deny that network pattern analysis is real and potentially useful as an intelligence tool. The research on inferring relationships from communication patterns goes back at least to Norbert Weiner, and you can bet that the NSA is on top of it. Legal or not, there’s almost certainly value there. The NSA absolutely has the smarts to know what’s a misallocation of effort and what isn’t.

As for whether or not doing intercepts for the purpose of analyzing communication patterns is legal without warrants, here’s a link to a paper that sheds some light on it, written by Susan Landau of Sun Microsystems:

http://research.sun.com/people/slandau/crypto_2004.pdf

Apart from the fact that she’s my cousin, I’ll mention that Susan has plenty of credentials as an expert on this subject — but if you read the paper and/or check her home page that will be readily apparent.

I’ve excerpted the relevant part of the paper over on my own blog for anyone who wants to just cut to the chase:

http://www.rhs.com/web/blog/poweroftheschwartz.nsf/d6plinks/RSCZ-6KE6ZT

I haven’t chatted with my cousin about this yet — between the holidays and the fact that she’s probably rather busy dealing with questions about this very matter from some very serious people, I’ve figured I should put it off a bit.

Stop Hurting America • December 26, 2005 9:39 PM

“MAYBE, the NSA has technology/science unknown to the public that does give them the needed cpu cycles to break PGP encryption with large keys.”

I’m sure that all their systems are windows 98 and run Internet Explorer 4… I’m sure they are not ‘Scyld’ at all….

Just don’t associate with Terrorists! You should be fine… oh wait… what determines a terrorist again?

another_bruce • December 26, 2005 10:28 PM

@bruce schneier
thinking of getting “applied cryptography”, noticed 2nd edition was published 1996, wondering if there’s a 3rd edition around the corner (2006) or is that what there is for now?
regarding your suggestion that people send themselves international email with provocative phrases to monitor the monitors: as with so many other things, e.g., putting your hand between the bars to pet the tiger or going over niagara falls in a barrel, i’d be very curious to see what happens when you do it but i’m afraid i can’t work it into my to-do list anytime soon.
my momma used to say “trouble gonna find you anyways, don’t you go out looking for it.”

koreyel • December 26, 2005 10:38 PM

Schneier’s experiment assumes, as do many of the posts up above, that the US Govt is capable of bringing into being some sort of monitoring software of a superior nature.

Pshaw!

Where have you folks been the last 5 years?

You really believe that the same government that blundered us into Iraq and then blundered up Iraq is capable of pulling off a supercalifragilisticexpialidoceous software project?

Crap.

If you want to get spooked: Think Katrina-response folks.
That’s your government in action: WYSIWYG

Only naifs believe that this blundering federal government is capable of monitoring and decrypting the web on a grand scale.

limulus • December 26, 2005 11:26 PM

“Only naifs believe that this blundering federal government is capable of monitoring and decrypting the web on a grand scale.”

You’re right, they can’t. But that hasn’t stopped them from trying. Echelon is well documented. Go look it up on wikipedia.

Jed Davis • December 26, 2005 11:51 PM

@Michael Ash:

The virus scanner doesn’t have to be all that sophisticated: the open-source ClamAV has an option for retrieving the contents of URLs mentioned in a mail message, though for a variety of reasons it’s off by default.

Nick Lancaster • December 27, 2005 12:14 AM

@koreyei

It’s not Bruce Schneier’s experiment. It was proposed by Richard M. Smith.

As to a blundering federal government trying to decrypt the web, that’s precisely the kind of pointless exercise in data collection that an incompetent government would believe an effective measure against terrorism. In those same five years you cited, they’ve proposed things like ‘truck drivers reporting possible terrorists’ and other security foolishness like CAPPS.

Is it technically feasible? Perhaps not. But when has that ever stopped the clueless from trying it?

sorcerer • December 27, 2005 12:42 AM

I would bet they have the technology to do most of what people are talking about here.
I have seen and worked on some of the hardware and software that is available commercially and to put it bluntly… it all depends on how much money you want to throw at it.
All in all if you aren’t doing something wrong, why worry about it… The govt doesn’t have time to waste on frivilous (sp) email that probably 99.9% of people send out…
Also like one of the people said earlier… it is all automated and probably until you break over some threshold… you won’t even be worried about from the NSA… who knows, if you break over some other threshold, that is probably ignored also (as a fake)… The NSA has got some pretty bright people there….
I would also say “be careful when you play with fire, you might just get burned”

Christian Kaiser • December 27, 2005 2:24 AM

Interesting, that these “14 points” don’t mention my favorite: “don’t be logged in as an admin on your machine unless you REALLY NEED these rights!”.

In addition with the c’t script “machmichadmin” (xlated: “makemeadmin”), which you can use to give yourself temporarily admin rights for installation purposes, it’s not even inconvenient any more.

Still the best is the mentioned VMWare guest which will revert after each session.

Christian

follow me • December 27, 2005 4:07 AM

…but is not email insecure ‘by definition’?

It should be clear to anyone that it is as confidential as a post card or an open letter that can deliberately be read by anyone in the chain from sender to receiver. You should not use this for sensitive information. The real problem is that so many people are still not aware of this. You cannot shout out a secret and then complain that someone unauthorized heard it. Seems to be we are still living in the information stoneage. My suggestion is to do the log file trick with an encrypted email and watch out for hits. This would be the equivalent of someone breaking a sealed letter and a real privacy compromise…

ARL • December 27, 2005 7:22 AM

For those who did not get it in the original: The URL target should have no links from other pages so that bots will not find it.

The best way would bet to give it a cryptographicly generated name so that there would be little chance of an accidental hit on it while being able to show which email triggered the visit.

I would avoid a lot of the keyword tricks as my bet is they have become known as decoys. Just send the messages to international addresses and see what happens.

Anonymous • December 27, 2005 8:12 AM

One word. NikSun.
http://www.niksun.com/

I’ve seen this thing in action and it’s truely frightening. According to NikSun, their product replaced the FBI’s Carnivore/DCS 1000 and is now in use with them and several other unnamed intelligence agencies.

Jim • December 27, 2005 10:35 AM

Two questions:

There has still been no answer now how the US would be able to monitor email. This is not like the wireless communications that echelon captures, it would require access on the part of the NSA to many major backbones on the internet, obviously with the knowledge of the companies owning these.

At least as far as I know, if anyone else can think of a way to do this, let me know. If I am correct, then this would require the knowledge of the companies, and I’m sure it would be common knowledge by know, too many people would have have to be in the know.

Second, if the message is sent from an SMTP server overseas as he suggests, and then is delivered to a mail server overseas, as he suggests, explain to me why the NSA is not supposed to monitor this?

Jay M. • December 27, 2005 10:51 AM

Hey great idea, distract our limited resources! I’ll bet you morons would be the first ones to complain we didn’t stop it. Then the “official” memos will come out in the NYSlimes and the public will be outraged that we had emails but couldn’t read them in time b/c we were flooded by a bunch of idiots playing games.

Who needs terrorists, we have sufficient dumbasses here who can defeat America without even realizing it.

BTW clowns, they do, and anyone with a functional brain knows they can, do, and have for a long time. Wake up, stop being chickenlittles, do the right thing, and go back to your normal boring lives.

MM • December 27, 2005 11:55 AM

ben: Please point out the AAR show, and date, during which it was said that only people like Moore and Sheehan are being eavesdropped on.

Probitas • December 27, 2005 12:39 PM

“None of the suggestions (which are Richard M. Smith’s and not Bruce Schneier’s) would appear to be illegal, unless you link to or state credible plans for an actual attack.”

I dunno, but a government which feels that half the Bill of Rights doesn’t apply to them might, just might, view this as hindering an official investigation. Anything you do which diverts their resources from finding what they are really looking for is likely to piss them off. So the question is, do you really want to piss off this particular group of people. I don’t.

Kaa • December 27, 2005 3:14 PM

Note, Richard Smith didn’t say “your Web server”. He said “server that you have access to its server logs”.

I think it’s a good exercise for our grey-hatted friends… 🙂

Nick Lancaster • December 27, 2005 4:20 PM

@Jay M.

The point is not to call folks morons.

If I am pointing out a flaw in the security procedures of my country, I am not a criminal.

Any mass-collection program such as that theorized in this thread, needs to have some means of sifting the gold from the dross, and there’s a lot of dross.

If you honestly believe monolithic security schemes are effective at fighting terrorism, think of it in terms of ‘six degrees of separation’ … if we’re all no more than six degrees apart from any given person in the world, a good chunk of us could be construed as valid suspects. (Mohammed Atta reads Bruce’s blog. He comments under a psuedonym. Anyone who ever responded to him is now a suspect.)

It’s an oversimplification, but it illustrates the nature of the problem for folks who think bulk surveillance, including the ‘I’m not doing anything wrong, so what?’ crowd, is the answer.

winsnomore • December 27, 2005 5:29 PM

google proudly snoops your mail, so do others .. why not nsa 🙂

It appears akin to standing on street corner and pointing water gun at passersby … or say moon them ..

not a bright experiment .. little doubt of outcome, great chance of getting hurt and hurting others.

Pat Cahalan • December 27, 2005 10:22 PM

create a “security” software, submit it to the “tools” page of securityfocus.com, and look at the logs of your web server.

On that note, it would be interesting to know if Bruce has access to the download page log info for PasswordSafe, and if so, what the logs look like. Might be enough material for a doctoral dissertation in human-computer security 🙂

Mike Lee • December 28, 2005 6:44 PM

The hysteria over this is just one more reason why civil libertarianism is becoming more and more ridiculous in the eyes of the average American. Running around and yelling “The sky is falling!” over every real or imagined minor infringement of some procedural right is making most people tune out those of us who care about this kind of thing.

Bruce, your suggestion that we play pranks on the NSA lands you square in the middle of the kiddie table this year. I hope my father-in-law doesn’t see this post. He’d never stop hooting about it. On this issue, you really do sound just like a spoiled teenager huffing, “You’re not the boss of me!”

Ari Heikkinen • December 28, 2005 8:46 PM

“Interesting, that these “14 points” don’t mention my favorite: “don’t be logged in as an admin on your machine unless you REALLY NEED these rights!”

Yeah right, do that when about of 99% of the software you use don’t work on anything else but admin. That if any is bad design (I gave lots of efford for it but then eventually gave up and reinstalled everyhing as admin).

Michael B • December 28, 2005 9:54 PM

I doubt it works that way.

Assuming they do intercept your email and find it interesting, my guess is that the honeypot URL would get added to their things-to-snoop-on. When someone else pulls that page off the wire, they link it with your email.

Besides, it’s more useful for them to see WHO looks up the page and what they got out of it.

Michael B • December 28, 2005 9:58 PM

@ Jim

“There has still been no answer now how the US would be able to monitor email. This is not like the wireless communications that echelon captures, it would require access on the part of the NSA to many major backbones on the internet, obviously with the knowledge of the companies owning these.”

Imagine what kind of competitive advantage you could gain by getting in bed with the NSA…

Nick Lancaster • December 29, 2005 2:35 AM

@ Mike:

It’s NOT Bruce’s suggestion.

Bruce is citing Richard M. Smith, and the link to Smith’s article is provided in the entry.

To report it otherwise is to misrepresent the facts.

Mike Lee • December 29, 2005 11:52 AM

@Nick

Fine, Nick wins the nit war.

It is not Bruce’s suggestion. It is Bruce’s suggestion that people follow Richard’s suggestion.

And, a preemptive strike before Nick’s next nit war: yes, Bruce is suggesting, not just reporting, in same way I’d be suggesting if I did a blog post that said: “Here’s an interesting new way to build a pipe bomb. Maybe the thing will blow up in your face, but I think the risk of that is pretty low. If anybody actually tries this, I’d be interested to know the results.”

Roy Owens • December 29, 2005 2:11 PM

In the news in the last day, there were reports of NSA putting cookies on people’s computers to track their Internet activity. This apparently is illegal.

Nick Lancaster • December 29, 2005 2:19 PM

@ Mike:

At some point, most adults become responsible for their own actions.

No matter what Bruce says, the decision to spoof the NSA is up to the individual, unless this is the Cult of Bruce and we’ve all ceded our critical thinking and free will to him.

I only pointed out the nit, because you were the 2nd or 3rd person to begin a rant with, ‘Bruce’s suggestion …’

Peter • December 30, 2005 4:01 AM

Bruce,

You’re the kind of person that sees placing a prank call to the ambulance to see if it really gets there on time as an interesting idea, right?

Todd Jonz • December 30, 2005 2:51 PM

Anonymous writes:

Seems like a great way to waste the time of
inteligence gathering agents who might
otherwise be collecting useful information.

So is monitoring my phone calls or e-mail.

Nick Lancaster • December 30, 2005 4:13 PM

@ Peter:

Most of us would be interested if the ambulance really does get there in time WITHOUT having any desire to falsify emergency calls.

That Bruce is interested in the outcome does not automatically imply that he is advocating Richard Smith’s suggestions.

@ Anonymous:

“Seems like a great way to waste the time …”

The problem with bulk-surveillance programs is that it just doesn’t make sense. It’s like checking sheep to find the wolf; unless the wolf is, in fact, wearing sheep’s clothing, you’re wasting your time. You may even lose a sheep or two if the wolf understand you’re busy looking in the wrong place.

Yet the Bush Administration is big on promoting how much we need to fear terrorists, that they’re here, there, and everywhere, hiding among us.

Consider that, in truth, very little changed after 9/11. America lost none of its manufacturing capability, military strength, or other critical assets (which is not to say it wasn’t a horrible tragedy). Yet most of our political decisions have ceded initiative to the terrorists and are rooted in fear-based perceptions of what they can (and intend to) do.

It’s almost like killing cats as witches’ familiars, which in turn allowed the rats to breed, which in turn allowed the fleas carrying the Plague to spread …

Bruce Schneier • December 30, 2005 5:03 PM

“You’re the kind of person that sees placing a prank call to the ambulance to see if it really gets there on time as an interesting idea, right?”

Not really.

John A. Babb • January 1, 2006 7:06 PM

Hey, just the voice of reason (?) here… Let’s say you put up this honeypot and the NSA poked and probed (at least it seemed like they did to you). Then what? Will the results of this experiment prove anything? Will it change your preconceived notion of what the NSA does? Will you confront them so that they break down and confess to the Washington Post? So…. what’s the point? I’m clueless as to what you will accomplish.

cuteogre • January 1, 2006 10:45 PM

Why is everyone so afraid/worried about NSA spying on you? Do you have anything to hide? If not, then just leave them alone and let them do the work of protecting the citizens.

If, for instance, their monitoring had worked and prevented the 9/11 attacks from occuring, would you have opposed them from monitoring terrorist’s conversations?

Doing this stupid test and placing false information in your emails just wastes valuable resources of the government who is trying to protect you. It’s like spamming or making fun of the 911 emergency number – it draws resources away from other legitimate cases and people will die from it sooner or later.

yogaboy • January 2, 2006 7:34 AM

I feel that perhaps I’m echoing/merging other comments on here so apologies for that in advance.

It would make more sense (to me) to send encrypted/unencrypted emails full of normal, boring stuff and THEN see if the url is visited?? I’m not bothered if they’re spying on people who talk about making bombs or killing people – I’m worried about them looking at normal email conversations (eg mine!).

One • January 2, 2006 11:07 AM

@yogaboy

The people who talk about bombs and killing people do so, just like we are here, amongst the general population of emails etc. How else are they going to get to it but by sifting through all emails and pages, etc…

The truth is one shouldn’t be worried about anything if one has nothing to hide. Since most of this is probably automated (way too many emails to sift through) there are two ways of looking at it 1)your information will probably never be of any real interest and won’t raise enough flags unless you ARE a terrorist, 2)since it is automated, there is a risk of you being flagged by accident, the machine having no judging capacity to speak of, but that upon confirmation the live agents checking the info would probably catch up on this rather quickly…

But what is the great fear? That the NSA will read your secret chocolate mousse recipe, and perhaps sell it to the competition? Sure, conceivably, the NSA could abuse its powers, but just like the cop on the beat or any other authority figure you give power too. I doubt the guys on the NSA have the time or inclination to go through what they know to be crap e-mails and look for information that is irrelevent to their task.

Remember that the security agencies bungled 9-11, but were also VERY hampered by the Bush administration and many other politicians who weren’t too happy at the idea that their oil sweethearts were being investigated. I am more of the opinion that 9-11 was not so much an intelligence failure, so much as a failure or refusal to act on intelligence. Every security agency in the western world worth a damn gave the US warning, days before… We’re to believe that the NSA, which is far superior by their competitor’s own accounts, couldn’t see it?

Check out PNAC and it’s Rebuilding America’s Defenses, which argues for American imperialism, basically, based on Brezjinsky’s New Security Strategy for a New American Century. They saw “catalytic” need of a new pearl harbour…

yogaboy • January 2, 2006 12:23 PM

@One

I accept your point that the NSA will have to “sift” through the general population of emails, but that doesn’t tell me if

a) they try to open all encrypted mail, regardless of who the sender/recipient(s) are.
b) whether they are gathering other non-“terror” related material

Aside from that, I strongly disagree with the argument (made several times on this thread) that “one shouldn’t be worried about anything if one has nothing to hide”. Because…

i) I want to keep certain things private. Simple as that – so should I be worried???
ii) More importantly, authorities/governments etc are not always reasonable in who they pick to make an enemy of. Words like McCarthy, Kosovo, Nazi, Jew all come to mind quickly without any mental effort, and yet all recall situations where certain groups of people have been unreasonably persecuted by authorities.

If the argument for the NSA to be able to read private correspondence is the “greater good”, then I can think of several much better and far more obvious ways to help people more directly and for less money – and these aren’t being put into practice, therefore I am suspicious.

Nick Lancaster • January 2, 2006 6:04 PM

@cuteogre:

Let me know when you’d like to send me a copy of your bank and credit card statements. After all, you’re not doing anything WRONG, are you?

It’s not that any given person is hiding or not hiding information; it is the manner in which information may be construed or taken out of context, and judgments made at levels beyond the law.

Just as it’s not the wiretapping, but the implications of such powers in the hands of a political rival that makes it unacceptable, if anything you do can be misconstrued, then the ‘nothing to hide’ rationale is flawed. Even today, we have ‘banned books’ – sometimes, for nothing more significant than the use of the word, ‘witch’ (as with Madeleine L’Engle’s ‘Wrinkle in Time’ books).

No Such Agency • January 3, 2006 4:43 AM

Journalist and former NSA employee Wayne Madsen coverage of NSA scandals:

http://www.waynemadsenreport.com/nsa-archives.htm

“911 disaster …has all the hallmarks of yet another Bush family treasonous action against the United States of America, an action the U.S. intelligence community was PREVENTED from stopping.”

Also see Complete 9/11 Timeline from
Center for Cooperative Research
http://www.cooperativeresearch.org
an impeccable database of mainstream media articles showing how “the attacks” were allowed to happen

more surveillance of the public would not have stopped this

Read 1984 by George Orwell or watch Terry Gilliam’s film BRAZIL to see where this is headed.

Cullen Jennings • January 3, 2006 5:20 PM

It seems to me that an organization monitoring the communications would not want to access the URL but would instead watch for patterns of who else accessed the URL. I would love to see the results of this experiment but I would guess that any monitoring / datamining was mostly passive.

Raul del Angelo • January 3, 2006 8:41 PM

Before you decide to see if you can attract the attention of the NSA try some less dangerous persuits. You might experiment on the ability of AIDS to be infectious, or simply see if heroin is difficult to stop.
In the climate of the USA it’s foolish to put yourself in harms way. Perhaps you don’t recall the case of the religous person who told his parishioners to return to the mid-east to defend their country. He’s doing life.

Don’t stick your head up to see if they will shoot. They will, and you will have made youself the target.

JT • January 4, 2006 9:56 AM

Thanks to all for the interesting views – all posted thanks to our right to do so without fear of negative repercussions. Thanks to the founders and defenders of this country for making it all possible. After all, the founders had “been there, done that” and knew what it was like to fear for their lives because of comments made.
I won’t bore you with another slippery slope argument about our civil liberties, but to those of you who argue that there is nothing to fear if you are doing nothing wrong, remember just how easy it is to slip off the peak of that slope. Even those who have the best intentions and claim that what they do is in the best interest of the nation sometimes lose the big picture perspective.
It’s up to folks like you and me to keep our government on the straight and narrow. Don’t let the work of our ancestors be in vain – if you take this discussion back to its roots I think you’ll find that it’s all about some very basic rights.

Anonymous Me • January 4, 2006 6:52 PM

I haven’t read all the comments due to the high quantity, but a thought crossed my mind.

Ignoring the talk about PGP encryption, there was mention about time wasting. I’d imagine that the few extra unencrypted messages a few people would generate would be insignifigant in comparison to the volume of spam that would have to be sifted through (presuming that spam is analysed for hidden messages).

gdi • January 4, 2006 9:36 PM

pretty sure they would find a charge for you if you fooled them well enough … wasting police time, public nuisance … or perhaps one of the many secret new terror laws…

and the nsa is far from the only body interested in sniffing passing packets, so until they did charge you, you would never be sure it was them.

Anonymous • January 5, 2006 7:26 PM

ben: Please point out the AAR show, and date, during which it was said that only people like Moore and Sheehan are being eavesdropped on.

First, please point out where I said “only” anywhere.

Second: Sorry for not keeping notes; it was the Randi Rhodes show, it was a substitute host, and it was somewhere between 19 and 23 December.

ecnfrk • January 6, 2006 1:14 PM

I’m somewhat surprised noone has yet suggested resourceful Jihadists might try a “honeypot in reverse” scheme: in essence, set up overseas accounts that can be linked to addresses they believe to be on US govt agency watchlists, then use those accounts to generate traffic to websites, bulletin boards, e-mail accounts, blogs, etc of US residents, corporations, media outlets (Fox News), churches and charities. If they were particularly perverse in their selection of targets, they might even get some prominent chicken-hawks and/or right-wing religious nut-cases scrutinized as “persons of interest” by the feds.

Kraut from Hamburg • January 9, 2006 9:04 AM

Another poster said it’s supposed to be ‘tu-hamburg’ instead of ‘tu-harburg’. That’s wrong.

I studied in Hamburg and while the normal Universität has the domain “uni-hamburg.de” the Technische Universität in Hamburg is a seperate legal entity and is called “TU Harburg” (Harburg is a district of Hamburg on the other side of the river Elbe).

So the address in the article is correct (At least regarding the domain. The address has to be verified by somebody else).

James • January 16, 2006 6:46 PM

@Bruce & Richard Smith

I like the suggestions here on the forum of sending encrypted mail (that was the first thing I thought of when I read the story). Seems to me that besides the sniff-the-snooper approach, it would be useful as a general test of an encryption technology.

For example: If you want to know if someone (NSA, KGB, big-brother, etc.) has the ability to break PGP encryption, simply encrypt (and send) a message (or millions of messages) including some hot keywords and an obscured link. Then monitor the server logs and see if the link is hit. If you get a hit on the URL, you know SOMEONE can break that encryption.

You could even hold a contest of sorts. Encrypt the same juicy message (each with a slightly different URL) using several of your favorite encryption technologies (AES, 3DES, BlowFish, etc.) and send them all at once. The web server log would provide a timestamp for the order in which the encryption was broken.

Of course, this assumes that big-brother is dumb enough to follow a web link and not access the page via FTP, etc. using a secret court order to the hosting company. Or, to send a hacker out to hack your hosting account password (or the root password) and access the files that way. Either of these would leave no log trail that you could see.

A more subtle way to test this is to send encrypted HTML formatted email with an image link, then monitor to see if the linked image file is accessed. This is still susceptible to the court-order or hacking attack mentioned above, but that might be more work than they were willing to go through just for an image.

Of course, if the terrorists had any sense at all, they would be sending messages as graphics instead of text. It would significantly increase the work that any monitor would have to go through. Type up a message in your favorite editor, take a screen-shot using any off-the-shelf screen capture program, then encrypt the resulting image and send that. Now the monitor not only has to decrypt the message, then they have to read the message visually rather than by computer automation (assuming you make it non-OCR-able using an odd font, overlaid lines, etc.).

Echelon and similar “giant vacuum??? technologies only work because the criminals are even dumber than the government (hard as that might be to imagine). If the likes of Bruce or any of the people who have posted to this blog got into the criminal business, the authorities would be totally out-classed and overwhelmed.

Thanks,

  • James

basketball • January 30, 2006 1:35 PM

Don’t you think that this will deter the NSA from actually finding a terrorist and doing thier job to protect us. I agree them reading our emails is wrong, however I also don’t think that thier job of protecting the American citiizens is overstepping thier bounds. This blog and the suggestions you state, will merely decrease thier effectiveness in finding the real terrorists. I guess you didn’t lose anyone in the 9/11 attacks.

420 • January 30, 2006 4:08 PM

I just hope they dont start monitoring me and my pothead friends.We talk alot about smokeing weed and the newest bongs on the market.Most of us are disabled and smoke for medical reasons,so back off and set our tunnels free.Viva Mexico

Asmodai • January 30, 2006 4:53 PM

The NSA are just a bunch of flunkies who have nothing better to do than snoop on other people’s privacy rights. They just do it just to get their rocks off.

[xfg] • January 30, 2006 7:33 PM

we’d rather put it this way:::

regarding terrorism or financial resources involved in fighting terrorism: we can make further more good with bare hands than the evil they can do to us.

regarding agencies: we can generate more internet traffic and write more email either encrypted or not, than they can read or decrypt with “unlimited resources”.

we evolve. they adapt.

never underestimate humans capability to survive and their need of freedom.

Brad • January 30, 2006 10:20 PM

I think you are actually encouraging people to do something that circumvents the process that is already overwhelmed by the sheer volume of mail that is already out there. I support the President’s attempt to get the terrorists. Why undermine the very system set up to protect us?

Stonebow • January 30, 2006 10:21 PM

Gee,
it would be a little goofy on how anyone may want to bait themself for a trap..on creating a pissing email to ensure if it was being monitored by NSA. Beside, looking at these guys in their Color uniforms at my footstep would make me go pissed. But beyond of all, It would be very interesting to see how it would have worked if someone would have tried such thing.

Former KGB Member • January 30, 2006 10:43 PM

Wise Up Guys. The NSA can do whatever they like with unlimited resources. Look at the colourful picture they have built of AQ for you Americans. And you continue to consume it religiously, without question, on the whole. Thanks – Boris S.H.R.

Moderate extremists (aren't we all?) • January 30, 2006 11:30 PM

See David Brin’s book, The Transparent Society. Except with respect to financial accounts and physical security information, lack of privacy should (theoretically) present few real problems. The key is that in a transparent society the actions of no individual, organization or government entity can be exempted from transparency. The watchers must be watched and held accountable. To my knowledge, there is no sufficient, impartial watcher-watching function in the US government.

Average citizens can participate in a jury that can send a fellow citizen to death row. Average citizens should be able–once found trustworthy,duly sworn in and informed on procedures (parallel with jury member preparation)–to monitor and rule on whether the watchers are operating within their charters.

Shawn • January 30, 2006 11:44 PM

Their collection system gathers emails that raise X amount of flags (via keywords, destination/source addresses, previous flaggings etc). These are then saved on their database, the ones with the most flags are read first by a group of people who’s job it is to sift out the garbage from potential hits to the system. Those emails that are deemed “Potential Threats” are given another flag for review by higher ranking personnel, and also all e-mails going to and from that address and the recepient’s address receive an automatic higher alert flag appended to them.

They do not have the opportunity to read ALL of the flagged mail, as their database fills up with the useless garbage most of us send, periodically this database is purged, and potentially useful and life-saving information is sent into the bit-bucket.

Once your e-mail is determined to be of a nonhostile nature, you have warning flags removed from you and a flag is set stating that you had at one time had raised flags but they were dismissed, putting you slightly higher up on the watch-dog list than joebob with his first flagging/reading performed on him.

Those that are suspicious are archived on backup devices and stored in case they are needed later.

Be relieved that its simply too overwhelming for all of the e-mails that get flagged to be read by human personnel. BUT this little trick would increase the traffic and the likelyhood that a potentially damning piece of evidence that could save the lives of thousands would be purged with the trash because some low level NSA personnel was busy sifting through millions of your garbage false-positive emails that you intentionally sent.

rob • January 31, 2006 12:45 AM

Why you even post this up is rediculous. Stop wasting your own tax money by having NSA workers check out your stupid links and emails. Get a life. We already know they snoop, WHO GIVES A RAT ASS. if you don’t have anything to hide, then you don’t have anything to be affraid of.

Raghunathputra • January 31, 2006 1:16 AM

If you don’t have anything to hide, then youdon’t have anything to be affraid of.

Shawn • January 31, 2006 4:57 AM

Thats not entirely true… Someone who is doing the reading of flagged e-mails for EXAMPLE (Not the only case, just one of the scary ones) Could potentially read an e-mail that got flagged that has bank account information, or some other piece of VITAL information that you put in an e-mail with the assumption that its a safe secure system to use and use it to perform identity theft. Just ONE example.

Anonymous • January 31, 2006 9:10 AM

The problem with using the Smith approach to see if we’re being monitored is that in our daily life we don’t send hundreds of thousands of “controversial” e-mails. The logic is the same as recommending you walk into a bank with a hood on to see if the police are interested in you.

Oriel • January 31, 2006 9:19 AM

Why would I care whether the NSA or any other government organization is reading my e-mail? I think the danger only exists for those who are doing something illegal.

Of course, we Caribbeans are not so anxious about privacy as Americans are.

HFDWG • January 31, 2006 9:33 AM

Personally, I lead a normal life. This means I have family attachments and I don’t want other people to known when are their most vulnerable moments.

I go out of my home. I don’t want house thieves to know when that is.

I take money out of the bank. I would rather muggers weren’t able to target me at those moments.

I take showers. I don’t want pictures of my naked belly posted up on the internet.

I have sex. I don’t want videos of my partners posted for other people to watch.

I use a credit card. I would rather people didn’t know the PIN number.

I have money (though not that much). I don’t want my children kidnapped and killed in order to make me hand it over by people who know exact amount that I have.

I have lots of things to hide. @Oriel @Raghunathputra; whats wrong with you? Are you not normal? Do you not care about your relatives and how they feel, or even their lives?

Agent86 • January 31, 2006 12:22 PM

Gee,

I know a few people who have numbers tatooed on their arms…..They had nothing to hide….Right?

Just because your not paranoid, doesn’t mean they arent after you! And dont cry to me when they take someone you love to the camps!

Shawn • January 31, 2006 3:56 PM

Hardly, When someone has the power/capacity to spy on your every day comings and goings (Such as e-mail communications which can contain dang near ANYTHING) then it IS reason to become worried, because you NEVER know when they are doing it… Orson well’s 1984 anyone?

Yeah, my point exactly.

Idealist • January 31, 2006 5:14 PM

30 days is more then enough for this test to produce results that someone could post here. Therefore one of four situations is taking place.

  1. Nobody has done what Schneier suggested.
  2. The gov’s system is not advanced enough to do what the privacy advocates are saying.
  3. The gov’s system is advanced enough to pick out the social engineering as a false positive.
  4. People are being prevented from posting the results.

People, if you don’t know what occam’s razor is, then I suggest you read it. wikipedia has a great description.

Tory • January 31, 2006 6:25 PM

I believe the “test” would be a good idea. As inferred by the ref’s to George Orwell’s 1984, “Big Brother” will (and IS) watching. Is this just simple paranoia? I believe it’s more simple prudence. I believe in an individuals right to privacy. Even to the extent of making it “difficult” to capture the “terrorists living among us.” I have no way of confirming that my emails are being “snooped” but I don’t doubt that if I was to write something to friends (or an enemy) that caught the snoopers attention, I would draw unnecessary investigation upon myself and family. This belief alone is enough to cause me to shiver and research into crypto-technologies. I feel the original constitution of the USA allowed for an individuals privacy and the right to feel secure in their home. Just as I believe in the right to keep and bear arms to protect my family and property and to hunt for food. It should be a basic right of all to expect privacy. Make them get court orders showing proof of probable cause!

Jon doe • February 3, 2006 3:22 AM

The only way to win is to not play…Wargames. Why play or try to put yourself in danger if you cannot win. The government is on our side. Let them find the terrorists. Their job depends on “US” If you are not a terrorist then why try to beat the system? Our government is working on the problems, and will eventually find the answers. The people are the asset in this country, we do, we say and we vote. The vote is the “ONLY” way we can really “PLAY” the game….why play the game to fail? To try to fail seems Anti-American, Our laws will eventually weed out the threats, new laws “will” be passed soon on what you do across the internet. Freedom has many costs, but does not ever take away our personal ideals. In the end, do you think our government is against us, why would it be…since people are the basis of the Constitution of The United States? I am Jon Doe, an American Citizen..do you know me?,I am very close to you…

Taneli Huuskonen • February 5, 2006 10:05 AM

@Robert:

Chyba Pan Robert sie mylil. To po prostu forum dyskusyjne zwiazane z blogiem pana Schneier o bezpieczenstwie. Dyskusje tocza sie po angielsku (jak widac), a ktokolwiek moze brac udzial bez rejestracji.

(Telling Robert he’s probably mistaken about this site. I feel it’s nicer to do so than to simply ignore him.)

Tumbleweed • February 17, 2006 12:55 PM

I think terrorists are clever enough to post personal ads in small town papers with secret code words.( IE :”go ahead with attack”) Do they need the internet, phone, or ? After all, we never even caught the Anthrax person, and we had letters.

I thank you for the information, Mr. Schneier however, because, this Bushco clan loves to keep us all paranoid, so they can make more money. I suppose it is possible that some guy in India (nothing negative implied about India) with his belt way up around his chest could be reading my emails to see if my “Anti -Bush” letters are a real threat to national security. I put nothing past Bushco, and the need to play emperor.

Harbinger • February 22, 2006 2:33 PM

When you can show me where the right to privacy is written in the Constitution or the Bill of Rights, I’ll no longer consider this an idiotic idea.

Until then, anyone attempting this disruptive stunt in a time of war only has the right to share responsibility when a terrorist nuke turns an American city into a smoking hole.

Me • March 22, 2006 12:22 PM

“Until then, anyone attempting this disruptive stunt in a time of war only has the right to share responsibility when a terrorist nuke turns an American city into a smoking hole.”

we are not in a war. they may call it a “war on terrorism” but congress never declared war, only our president did(behind closed doors) I figure if he wasted 2.8 billion of our tax dollars($2,000/tax payer) we should see what they are using it on.

Me • March 22, 2006 12:23 PM

“Until then, anyone attempting this disruptive stunt in a time of war only has the right to share responsibility when a terrorist nuke turns an American city into a smoking hole.”

we are not in a war. they may call it a “war on terrorism” but congress never declared war, only our president did(behind closed doors) I figure if he wasted 2.8 billion of our tax dollars($2,000/tax payer) we should see what they are using it on.

Roger • March 22, 2006 9:46 PM

@Me:
I haven’t been following this thread, but I just noticed your post on “100 Latest Comments” and couldn’t help pointing out that your arithmetic is way off, unless there are only 1.4 million tax payers in the USA. Since it’s more like 100 times that, I think you probably meant $20/tax payer

Anon • May 9, 2006 8:08 AM

“The truth is one shouldn’t be worried about anything if one has nothing to hide.”

Yeah, and anyone who isn’t Jewish has nothing to worry about. And when they came for me there was no one left.

Fact is, everyone has something to hide. Everyone has a secret they’d rather keep private. Even benign information (like an e-mail password) counts as something worth hiding.

dirk • October 29, 2006 1:53 PM

Well, say 2,000 people do this… is the NSA REALLY going to be able to kidnap 2,000 people?, or we could have 100,000 people use this technique and if they arrested all those people then it would be noticed BIG time. And of course you don’t HAVE to use AES/ROT-X016….. —_______— damnit, ever heard of HAND WRITTEN code?. You can make it VERY powerful too 🙂

no math involved….

Reckoning • February 12, 2007 7:47 PM

NSA and all other snooping bodies can and will do whatever they want to whoever they want. It’s a bold individual that baits them. I for one prefer to live under the radar with the intention of re-locating to another country if this one becomes unlivable. The profound ignorance of the population on this and other subjects proves to me that we’re headed in that direction.

Anonymous • May 12, 2007 5:54 AM

I care if the NSA is snooping on everyone en mass, and you should too.

If you’re not a person of interest to them, why are they snooping on your e-mail? I don’t enjoy the climate of fear where everyone is a suspect, and we shouldn’t stand for it.

Why should the NSA be snooping on people’s e-mails without a warrant? They shouldn’t. The whole point, I think, is to find out if they are. I think it is highly likely that they are, however. Just look at the AT&T case, and you’ll get some idea of just what is going on. If anyone thinks the other major ISPs are not doing the same, I’d venture a guess that you’re completely wrong.

And I’m NOT doing anything wrong, so why do I need to be under surveillance? I don’t!

The NSA or whomever else having thier “time wasted” by this is a fallacy. They choose to engage in this kind of crap, so they are the ones wasting their own time if anyone is wasting anyone’s time. If I were to do what is suggested, and NSA decides it’s worth going after, that is something THEY decided on. On top of that, they’re criminals if they don’t get a warrant first. These are the kind of activities the Stasi, the Gestapo and KGB engaged in. It is a mark of rampant tyranny. In my mind, one of the reasons America was so revered throughout the world is because this kind of thing is supposed to be disallowed.

Further, the NSA and every other faction of the government’s job is to “preserve, protect and defend” and/or “support and defend the Constitution of the United States against all enemies, foreign and domestic”, if I’m not mistaken.

Their job is not necessarily to “protect America”; it is to protect and uphold America’s values (those in the Constitution and Bill of Rights). Those values include getting warrant for this kind of activity.

Baldy • September 11, 2007 2:32 AM

Anonymous –

Great post! The level of indoctrination among the majority of posters here is simply shocking. I’ll take the rule of law BASED on the CONSTITUTION over the rule of the lawless any time. The lawless want US to live by THEIR unconstitutional rules. In other words, we, the people, become serfs. Freedom exists when the government fears the people.

Still PO • November 4, 2007 6:32 AM

Wheather it is Bruce’s, Richard’s or moron Nick’s suggestion, the point is, this website is posted and it is waisting everyone’s time. I agree with Mike Lee. They are all contributing to waisting the NSA’s time.

And “Most adults become responsible for their action.” quote by Nick, what lawyers handbook did you get that out of? That is usually a quote by a hyprocrite who is tryng to justify his own actions. Nick, where did park your brains on this one. This is a waste of time and subject should be closed.

odda • February 23, 2008 9:40 AM

I feel like someone is intercepting all my e-mail accounts. Up in the address bar upon sign in. The last few letters numbers etc end with =flase. What is that. I also went into email a couple of times/more and emails I had never seen were already opened? There is noone in my home but me! Is there an explanation for this and how do I stop it? I am not a Teksavvy person and have no clue what to do. Thanks

ifergane • June 4, 2008 9:13 AM

Just a little comment the NSA is not looking at all your emails. They have a computer that does and when the computer / system finds key words such as allah/ bomb /terorist it is saved on files and then rated from 1 – 10 the danger lvl , then if a high lvl is rated a NSA employee will look at it and see if it means anything….\

NSA has better things to do than look at your love letters.

vincent • August 4, 2008 3:13 AM

All could just be a trigger for paranoia or its true and would never be confirmed, to keep it a secret or like this site of yours, collect data of who interested about NSA.

vincent • August 4, 2008 3:16 AM

“The NSA knows how most if not all things work” are these the kinds of unconfirmed beliefs settling in our heads?

vincent • August 4, 2008 3:20 AM

There are some operations that should be done and should not be explained to the people, when you get in the NSA’S shoes you’ll understand that. I believe they are not that evil.

Freedom is greater • June 7, 2013 2:01 AM

Well, this discussion has new context in 2013, huh? I wonder if some of these commenters feel differently today. This expiriment is more relevant now than ever. It is perfectly legal, and within the rights of a citizen as protected by the first ammendment- and yet everyone here (including myself) is too fearful to do it. That tells us something about the status if our liberty, but I don’t know how to phrase it.

David Brooks • June 7, 2013 2:10 PM

Freedom is greater—

It would be interesting if any of old commentators revisited this thread.

What is even more troubling than the NSA having full access to every phone record, who we call, and for how long, plus all our email & texts, is that the FBI apparently has access to it all also as part of the same PRISM program.

And as I was reading the proposed experiment I considered it, but yeah, I don’t want to be on the secret “no-fly” list, or worse.

Food for Thought • June 20, 2013 2:21 PM

Maybe others posted this already, but I didn’t have hours to read all the comments. Just wanted to post this info:

The big problem isn’t that an actual person is sitting behind a computer at the NSA (FBI, Nat. Intel., Homeland Sec., etc. etc.) and actually READING the content (although that would be a major violation of the Constitution). No, that would take tens of thousands of people, or more, to do that.

What is being done (and not good for any of us) is all the data is STORED for later use. When something “triggers” a hit, THEN, that data is looked into by an actual person. According to sources, this is done via a “strict” process of procedures….how “strict” or IF they actually follow procedure is unknown b/c this info is kept from us.

Problem with all of this data collection is that search parameters can be screwed up by analysts, or even the program itself may glitch. Not to mention, the policy is to use 2 “skips” back to gather data from the original source. (Meaning, if Bob gets email from Crazy Guy, and it triggers the system, then all of Bob’s contacts and the contacts of all of Bobs’ contacts get lumped together in the system.)

Other disturbing elements: the FISA courts (which supposedly “protect” citizens’ rights) are completely secret and sealed….no way to appeal as far as I know. No way to get information about how or what data is collected on any 1 person.
Also, due to the large amount of data being collected (REGARDLESS if an analyst actually looks into it), the data is there and can be manipulated if someone really wanted to. Anyone with the technical know-how can splice different videos, emails, recordings, text messages, etc. together into whatever that person wants it to be. That may be “conspiratorial”, but nonetheless very feasible with the technology today.
And if it actually happens (or happened), how would the average person ever know since it’s all under secrecy due to “national intelligence”?

Lots of unnecessary secrecy. Also, the very approach that government has is fundamentally wrong…they approach the problem of terrorism/crime by classifying EVERYONE as terrorists/criminals or POTENTIAL terrorists/criminals. A better approach is to go after individuals or individual groups based upon EVIDENCE, which is the idea that favors a Constitutional path.

Just my 2 cents. 😉

Wael • June 20, 2013 2:41 PM

@ Food for Thought

the data is there and can be manipulated if someone really wanted to. Anyone with the technical know-how can splice different videos, emails, recordings, text messages, etc. together into whatever that person wants it to be. That may be “conspiratorial”, but nonetheless very feasible with the technology today.

I am not sure this aspect was brought up in this discussion. I also thought of this vulnerability. The information collected can be manipulated either after collection and storage or before. Suppose someone clones a SIM card and texts some colorfully chosen messages to a profile-fitting figure… Information is secret, and “evidence” is collected. The potential is there for one to be framed without the ability to defend one’s self…

Leave a comment

Login

Allowed HTML <a href="URL"> • <em> <cite> <i> • <strong> <b> • <sub> <sup> • <ul> <ol> <li> • <blockquote> <pre> Markdown Extra syntax via https://michelf.ca/projects/php-markdown/extra/

Sidebar photo of Bruce Schneier by Joe MacInnis.