Cybersecurity as Realpolitik by Dan Geer presented at Black Hat USA 2014

> Obfuscation may be our best digital weapon. From Dan Geer's talk "Cybersecurity as Realpolitik" (which everyone should hear[1]/read[2]): >> There are so many technologies now that power observation and identification of the individual at a distance. They may not yet be in your pocket or on your dashboard or embedded in all your smoke detectors, but that is only a matter of time. Your digital exhaust is unique hence it identifies. Pooling everyone's digital exhaust also characterizes how you differ from normal. Privacy used to be proportional to that which it is impossible to observe or that which can be observed but not identified. No more -- what is today observable and identifiable kills both privacy as impossible-to-observe and privacy as impossible-to-identify, so what might be an alternative? If you are an optimist or an apparatchik, then your answer will tend toward rules of data procedure administered by a government you trust or control. If you are a pessimist or a hacker/maker, then your answer will tend towards the operational, and your definition of a state of privacy will be my definition: the effective capacity to misrepresent yourself . >> Misrepresentation is using disinformation to frustrate data fusion on the part of whomever it is that is watching you. Some of it can be low-tech, such as misrepresentation by paying your therapist in cash under an assumed name. Misrepresentation means arming yourself not at Walmart but in living rooms. Misrepresentation mea

Y Not - Adventures in Functional Programming by Jim Weirich link The Coming Civil War over General Purpose Computing by Cory Doctorow link Cybersecurity as Realpolitik by Dan Geer ▶ this video link

Dan Geer at his important talk at Black Hat: The central dynamic internal to government is, and always has been, that the only way for either the Executive or the Legislature to control the many sub-units of government is by way of how much money they can hand out. [...] Suppose, however, that surveillance becomes too cheap to meter, that is to say too cheap to limit through budgetary processes. Does that lessen the power of the Legislature more, or the power of the Executive more? I think that ever-cheaper surveillance substantially changes the balance of power in favor of the Executive and away from the Legislature. While President Obama was referring to something else when he said "I've Got A Pen And I've Got A Phone," he was speaking to exactly this idea -- things that need no appropriations are outside the system of checks and balances. ▶ this video link While Congress has been occupied with infighting and stupid political theater, the Executive branch has been taking a lot of their power. Is it "making war" when Congress is clearly abdicating their responsibilities? It has certainly done more damage to the country than any army has ever accomplished.

All it takes is metadata . The "digital exhaust" we leave behind is extremely revealing. I usually use COTRAVELER as my example of how just a few data points (without any PII) can reveal a LOT about your social interactions, but browser history is another powerful data source. I believe this is why Dan Geer, in his incredible talk last year[1], suggested that "privacy" should now be defined as "the effective capacity to misrepresent yourself". To avoid exactly the type of analysis, you need the capability to misrepresent yourself, and you need to regularly be in the habit of use use that capability. Misrepresentation is using disinformation to frustrate data fusion on the part of whomever it is that is watching you. Some of it can be low-tech, such as misrepresentation by paying your therapist in cash under an assumed name. Misrepresentation means arming yourself not at Walmart but in living rooms. Misrepresentation means swapping affinity cards at random with like-minded folks. Misrepresentation means keeping an inventory of misconfigured webservers to proxy through. Misrepresentation means putting a motor-generator between you and the Smart Grid. Misrepresentation means using Tor for no reason at all. Misrepresentation means hiding in plain sight when there is nowhere else to hide. Misrepresentation means having not one digital identity that you cherish, burnish, and protect, but having as many as you can. [1] ▶ this video link

> technology is going to make mass surveillance relatively easy > a la Gestapo In 2013 Tom Scott made an incredibly prescient sketch of our grim surveillance-state future. It absolutely terrifying . link It's terrifying because it's the power of Stasi-style informants modernized into a simple Uber-like app. No more scary clandestine meetings, now you can inform on your friends, family, and neighbors with one click from the comfort of your own home. Similar to the "social credit" system, Tom's "Oversight" could work, because they both efficiently incentivize close peers against each other. "You should stop spending time with your friend John. I heard him talking like a dissident recently... that could damage your Social Credit rating!" > enters with their phone Which is exactly why I follow Dan Geer's advice[1] and don't carry around a tracking device. He's been trying to warn us for years[2], and we still aren't listening[3]. [1] link [2] ▶ this video (transcript: link ) [3] link (transcript: link )

From your other posts you seem to have a very good sense of social responsibility, so I'm surprised at this comment. Multiple identities are incredibly important to anybody in a minority that is threatened by their local mainstream culture. Black people in may areas (even today), gay or lesbian people in many parts of the world, and trans people just about anywhere[1] are some obvious examples. There are numerous others, which bring varying amounts of risk if exposed publicly. These people are often forced to put on a facade when in public, to avoid the risk of being fired (only a few of these are protected classes), beaten, or even killed. The internet has created a space where these people can be themselves... as long as it doesn't connect back to their real name and identity. Yes, leaving a job is a good way to avoid a bigoted manager, but that isn't an option for everybody. Your boss isn't the only threat, either: it wasn't that long ago that being openly gay could get you lynched in some areas. This comes down to the basic concept of privacy. I recommend Dan Geer's definition[2] of privacy in light of modern technology: Privacy used to be proportional to that which it is impossible to observe or that which can be observed but not identified. No more -- what is today observable and identifiable kills both privacy as impossible-to-observe and privacy as impossible-to-identify, so what might be an alternative? If you are an optimist or an apparatchik, then your answer will

Dan Geer (CISO at In-Q-Tel, the CIA’s private investment arm) gave a BlackHat talk that advocated for this, among other things. ▶ this video

> Obfuscation may be our best digital weapon. From Dan Geer's portentous talk "Cybersecurity as Realpolitik" [1][2]: >> Privacy used to be proportional to that which it is impossible to observe or that which can be observed but not identified. No more -- what is today observable and identifiable kills both privacy as impossible-to-observe and privacy as impossible-to-identify, so what might be an alternative? If you are an optimist or an apparatchik, then your answer will tend toward rules of data procedure administered by a government you trust or control. If you are a pessimist or a hacker/maker, then your answer will tend towards the operational, and your definition of a state of privacy will be my definition: the effective capacity to misrepresent yourself . [1] ▶ this video [2] link

> What regulation are people proposing that would prevent compilation and sale of this kind of data Liability! (with the option of avoiding that liability by explicitly not allowing yourself access to content/personal-data, aka a common carrier ) As Dan Geer said in my previous [2] (section 2, "Net neutrality"): Hello, Uncle Sam here. You can charge whatever you like based on the contents of what you are carrying, but you are responsible for that content if it is hurtful; inspecting brings with it a responsibility for what you learn. -or- You can enjoy common carrier protections at all times, but you can neither inspect nor act on the contents of what you are carrying and can only charge for carriage itself. Bits are bits. Choose wisely. No refunds or exchanges at this window. While he was talking about ISP spying, the general principle can be adapted easily. Inspection (or building databases of the results of other people's inspections) must be tied to liability for the problems and negative externalities produced by that inspection (or database). Obviously this is a high-level description that ignores the messy details that are important in any actual plan. There is room for negotiation and modification. The goal is to create a situation that disincentives creating tomorrow's problems, just like we do for other types of hazardous technology. Data and spyware needs to be seen as toxic that requires special handling, storage, and disposal procedures. > This is very informativ

That's is more or less the model I intended. Specifically, I was referring to one of Dan Geer's extremely important recommendations in "Cybersecurity as Realpolitik"[1]. [1] ▶ this video ( link )

More ground is lost in the cold[1] civil war[2] for control of the General Purpose Computer. I hope that everyone choosing to centralize computing power likes the future they are creating. [1] ▶ this video (sec. 10 - link ) [2] link

> users in general Blaming users is part of the problem. Yes, they vote with their wallet, but their vote is usually made in ignorance and is often mislead by companies that are so used to dissembling and exaggerating they call such antisocial behavior "best practice". That said, it is true that this is largely a problem with the economic incentives. Capitalism optimizes for businesses that are financially efficient, so the business that sells the lowest quality product they can get away with is "successful". This becomes even worse in software, where quality is harder to see directly. Even the people that write software can have a hard time evaluating "quality". The solution for this situation is simple, but it's basically taboo to talk about it: liability . If you sell software, you need to be liable for any damage it causes when "used normally". For a decent sketch of how this might look, see Dan Geer's explanation[1]. There may be other ways to implement liability. I suggest that the software industry should find a way to implement this as soon as possible, if they want any say in what "liability" means. Yes, this will raise development costs; spending more for better development practices was the goal . [1] ▶ this video