Forgot your password?

Comment: Re:HIPAA violations? (Score 1) 569

by tgd (#46411531) Attached to: Ask Slashdot: Does Your Employer Perform HTTPS MITM Attacks On Employees?

If they do decrypt personal traffic, would they be responsible for any medical data they intercept, thus triggering HIPAA?

Note: this is a gross oversimplification, but accurate relative to this story and what you're asking ...

HIPAA has to do with patient data, not medical data. If you're not a patient of the company doing the deep inspection, then there's no issue, and there's still no issue if you signed an appropriate HIPAA waiver, even if you ARE a patient and the company in question IS a hospital. If you go to HealthVault or some other site with *your* health records in it, and they are decrypting it, that's not HIPAA in the sense you're talking about.

Hell, even if they were shuffling the SSL traffic to a cloud service hosted by a 3rd party to do the scanning, AND you were a patient, AND the 3rd party was decrypting the data, that is just fine as long as the right paperwork is in place between the two companies.

Comment: Update (Score 1) 15

by JohnnyComeLately (#46339111) Attached to: Annual check in

I've been laid off 3 times since my last real update here on /. Also, volunteered for Afghanistan 3 times, and deployed those 3 times to various organizations. Still married here, have a second kid now, a girl. I don't post their names on line (or pics) so I'll just say older boy and younger girl :) I'm working now in Saint Louis but looking to get back to San Diego for work. Starting to get tired of working for government/military circles because of constant funding pressures, but I earn an exceptional income due to my experience, education, training, etc. It's funny you posted this as I just stopped in to see if an old friend was on here. DexterPexter I think was her name. She has a EE and ME background, worked robotics and last I heard went to work for a "three-letter agency" on unmanned sensors.

Glad you found RUU Wuvv here :) I made friends gaming on XBOX Live who later found me here (very similar alias) and so it was funny comparing posts, interests, etc.

Comment: So far /. is at 3% reading comprehension rate (Score 2) 72

by JohnnyComeLately (#46338875) Attached to: New iOS Keylogging Vulnerability Discovered
35 messages on this thread as I read it, and only ONE says in any detail anything that shows the issue and what the vulnerability has as an underlying assumption. Here it is for those who did read the article (RTFA), you have to install a rogue app. So, someone who's breaking the ToS (not being rogue) has to put an app out, then you have to install it, and then it's scraping inputs. This isn't a security vulnerability as most responses on here opine about. My car has a gas pedal. Does the ECM for engine management have a "security vulnerability," because I can press hard on the right pedal and do 180mph (illegal by federal law)?? No. It's functioning as designed. Press hard on gas, go faster. App installed and running in background, can accept device inputs. For example, have a GPS app? It is allowing inputs from other applications (e.g. you can listen to music on the GPS app I have without kicking out to Music app) and inputs (buttons).

Nothing significant to see here. Yeah, more restrictions from Apple development guidelines coming due to asshats being asshats. *sigh*

Comment: Re:since when is the FBI a spy agency? (Score 1) 324

by JohnnyComeLately (#46327369) Attached to: Schneier: Break Up the NSA

There's an internal process to report, and then there are multiple agencies (Inspector General, to name one) who investigate. So there's an internal and external mechanism to investigate illegal usage. Just like any organization that employs humans, there are those who can and will have a lapse. Sometimes it's intentional, sometimes not. For the times it's happened, they've been investigated, and then the appropriate action take against those who have broken the law. These are words spoken directly by Letitia Long, the NGA Director. I'm not in the NSA but she (Director Long) is aware of the investigations and then briefed the results (which I've read). I know there's a certain element here on Slashdot that will always see Dragons and "Lack of evidence of a conspiracy confirm there is a conspiracy," however your question seems sincere so it's all I can offer. Let's pose this question the other way around: Most of the Intelligence Community are former military. They are your typical, "By the book," kind of people who operate in most cases by the letter of the law, or "Technical Order." (Quoting my Air Force background). If there was truly illegal activity rampant, and this was an abuse going on frequently, do you really think it would just be a high school drop out (Snowden) to bring this to light? Given my time in and out of uniform, I can assure you there'd be a lot of pissed off former military who'd love to sound off on something as bad as the pro-Snowden's would like to make this sound. Take for example, "Veteran's For Peace" against the current war. You just don't see it here.

Although I think Obama and the Democratic party are not ones I would normally agree with, I have respect for their position and authority. The President called for an investigation of the NSA programs Snowden leaked. His comments are found here but to skip to the end he says, "The Review Group turned up no indication that this database has been intentionally abused. And I believe it is important that the capability that this program is designed to meet is preserved." And, to appease those who still are skeptical, they're increasing public release of information, increased oversight, and ending the government holding bulk metadata. This last one is curious to me because I've listened to the NSA Director explain why they approached it from the technical perspective, and I've been a telecom engineer, and so I understand why they did it like they did. So, I'm a bit uncertain how they're handing it off and still, as Obama states, "preserves the capabilities we need without the government holding this bulk meta-data." I'm sure very smart people will figure out legal, technical and other means to meet the capability while following our laws.

Hope that helped. And, repeating what I said in another branch... I'm no longer replying to this thread since it (as I figured) devolved to personal attacks (not by you) and the volume of replies. Your reply came in before my self-induced cut off, but I'm just now getting caught back up on personal emails.

Comment: Re:Author doesn't understand the NSA (Score 1) 324

by JohnnyComeLately (#46306209) Attached to: Schneier: Break Up the NSA

I think you're blending two issues into one, or you and I aren't agreeing on the same terms being used. The less than 60 number is in response to the question: How many Americans do the NSA actually spy on? The size of the facility and cooling you're talking about deals with how much data is cataloged. I used this analogy in another thread, and so I'll reuse it here. If you drive down the road, and the cops are watching traffic with a radar gun, while they eat donuts, talk about their nightlife, etc, then you are not being acted upon. If you want to call this "spying," then you and I can't have a discussion using similar terms. Now, if the cops watch YOU come out of your house, and then put a gun on YOU and watch YOU drive to work, then this is active, and you can call this spying.

Hence, there are only less than 60 people where there's an NSA analyst looking at YOUR data, and then passing it to the FBI, or a number of other interested parties in domestic intelligence. Using as loose of an analogy as I believe you're using for "greater than 60" and power/cooling/ etc, then you'd have to say your State's Transportation department is spying on you. The Federal Government's DOT is spying on you. The phone companies are spying on you because I can tell you first hand I was part of the group that moved data about your cell phone use from a maintenance server to another server, which RF engineers then used to measure cell tower performance parameters. There are engineers who looked at your data specifically if you dropped calls often. If Sprint PCS does this and it's not spying, but yet when an NSA analyst looks at this when you've called a believed terrorist (who is overseas) a dozen times, then we can't really talk using the same terms. If you think both are spying, same.


by JohnnyComeLately (#46306037) Attached to: Schneier: Break Up the NSA

I'm quoting the Director of the NSA nearly word for word how the system operates, and how the data is used. If he's lying, then he's on public record and there are Intelligence committees in the US Senate and House which will call him to task for lying to either the public (the news piece I'm quoting from) or them (the House or Senate). If you'd like to test the validity of how I've characterized the data collection, methods, analysis and use, then go to CBS.com and bring up 60 Minutes. They have a very good "Intro to the NSA."

If they want to go to a 3 step, then I'm sure no one inside the NSA will really care. There are no NSA teams prosecuting you for terrorism. There are no NSA Team 6's kicking down doors. They follow the POTUS intent for foreign policy and then collect the data to support his ability to make informed decisions. If you think the same analysis is given to John Q Public calling K-mart on his Verizon cell phone, as a Defense Minister in Syria using Skype to call a Russian arms dealer, then you're mistaken about the mission, intent and operations of the NSA. So you can see that the data they scroll through might show you're calling dad on Skype, unless your dad, from his basement in Milwalkee, is moonlighting selling arms to Syria, your data is ignored. Since this is Slashdot and a car analogy is obligatory: If you drive down a road where a policeman has his radar running: Are your police now "spying" on you? Is the metadata that dangerous and prone to misuse? There are many towns across the US now where the patrol cars have 4-6 cameras scanning every plate on every car it can that passes. I'm personally actually more concerned about that than the NSA.

Again quoting, the metadata NSA is using that has everyone in an uproar is: Date - Time - Originating Number - Destination Number. Now think about the scope of that data. Petabytes. Imagine if you're the tin-foil hat type that a computer pops you calling a Kmart in Damascus just as it does Muhammad called Hazziim. Can you imagine the thousands of people who'd have to cull through all those false-positives? It's not going to happen. I think this is part of the problem with "There's dragons in there!!" when people don't think their paranoia through to fruition. NSA would be hiring day and night if they honestly were spying on not only every America, but every American who makes an overseas call. There's be a permanent posting on USAJobs.Gov for "Data Analyst."

We just have a different definition of corruption. Unfortunately, most who scream the loudest against it have the least access to what we're discussing: Intelligence-related docs. It's just as easy for someone to accuse a government worker of being blind, as it is for someone with clearance to say those without access to what's really being done are ignorant. Most people really have no idea what Snowden has released. They've read press articles about it. They have listened to people opine who got 3rd hand accounts of what MIGHT be happening, and then formed their own opinion. Unfortunately, I can't give you specifics on why it's not corrupt. President Obama has ordered a review. If they agree it's corrupt, he will change his guidance on intelligence collection, Congress will change what they fund (or not fund), and the process will change. If you don't agree, you have a course of action: Do not re-elect the Congressmen who sit on those Intelligence Committees, or get involved with the Judicial Branch's process of Constitutional review.

Comment: Re:Author doesn't understand the NSA (Score 1) 324

by JohnnyComeLately (#46305739) Attached to: Schneier: Break Up the NSA

No. Unless those companies have overseas areas that become associated with threats to Western countries. Create an app to solve a problem, NSA will care less. Create an app to target US military bases in _____, and you'll become a probable place of interest to a number of three-letter agencies.

Yes, if you get into intelligence you will go through a very regular polygraph test, which looks for any unauthorized use, and now other regular reviews of your personal finances, etc. Why you did it is irrelevent (personal gain, ideological, or jilted boyfriend) as you get your badge pulled, and walked to the door.

Agreed. And this is where your legislative oversight comes into play. When "intelligence agencies," first were formed, there was 0 oversight. Most senators didn't even know the organizations existed. Then, there were issues. Oversight began, but only senior senators on secret committees knew. Then there were issues, and the Committees became public record with more Senators brought in. Then there were issues, and their budget and senior leaders were routinely brought before legislators to explain themselves. I'm hoping the takeaway isn't "See!! We can never trust them!!" and more, "Yes there will always be that 1 or 2%, and the system adjusts to reduce the risk of a repeated abuse." Just as we will always having Mannings, Snowden's and other spies who hurt their country, we will also have good men and women who try to take the pieces, put them back together and make things better.

I'm not in the NSA but I'm sure they just want the President's intentions and Federal Law to be clear and to move past this. The problem with this, just as it was with Federalized Healthcare and a 1000 other government issues, is a public understanding. Ignorance, fear, hate and such all go hand in hand. If you believe the NSA is this big evil thing, and people feed you enough ignorance to keep you scared, then it never gets better. This is why we will never get rid of tin foil sales for those who make them into hats. Being more serious, I'm sure the pendulum will swing back. NSA will lose capability to politically make people feel better. Then in about 7-15 years we will have another spectacular attack on US soil that the intelligence community will be able to point out, "We lost our capability to see that coming when we started ignoring all metadata that MIGHT be a US citizen." And then, smart men and women will decide if we made the right choices during these times and adjust.

Comment: Re:Author doesn't understand the NSA (Score 1) 324

by JohnnyComeLately (#46305625) Attached to: Schneier: Break Up the NSA
I assume you drive to work every day. Just as the local Department of Transportation observes traffic flowing, the NSA is watching data flowing. If it's you driving to work, or a terrorist driving to a drop point, they have no idea until there's a correllation. It's just random people driving by. It's hard to call that "Spying." Spying implies you are a target. The NSA doesn't care about John Q Public in the US. Their mission lies elsewhere and there's not enough manning to "spy" on Americans. Petabytes of data (spying or not) is useless unless a person can look at it. Back to my example, let's say the drop point has just been visited by a known terrorist. Yes, in the process of looking at the data of the terrorist driving through Main and Grand Street, there will be you 3 cars ahead. No one will care about your travels. Now, if you start popping up at the same time and multiple locations as the terrorist...you might get a 2nd look (by the FBI... not the NSA). Are you equally as irritated the Department of Transportation is "Spying" on you? I would like to warn you that DoT is more progressive with their use of their spy data. They envision spy data being networked so that the spy network can tell you theres traffic ahead. Think of it, your car will become a part of one of the largest spy organizations of the world with more data processing capability than the entire nation had during WW2. Use your powers for good.

Comment: Re:since when is the FBI a spy agency? (Score 2, Insightful) 324

by JohnnyComeLately (#46304279) Attached to: Schneier: Break Up the NSA
I understand your point. Only problem then becomes, "OK now what?" Following your scenario, let's say they start tracking you stateside, after you've made an international call to known or suspected threats overseas. Their systems aren't set up to intercept your calls. It's metadata only. So, they collect reams and reams of your phone calls to mom, the store, work, co-workers, and one or two known threats. Now what? They don't have jurisdiction to go to a FISA court, and a judge would laugh them out of the room with, "We know he made 100 phone calls to Abdullah Muhammad," for probable cause for anything. Now, if we're talking about CIA and FBI, then you have a great point. Domestic spies would be handled by the CIA and FBI, where information sharing becomes an issue. However, NSA is not domestic, and to be honest, doesn't care what Americans are doing stateside. Now, an American flies to Syria for "spiritual training," and you've crossed into their domain of interest.

Comment: Re:Author doesn't understand the NSA (Score 3, Interesting) 324

by JohnnyComeLately (#46304197) Attached to: Schneier: Break Up the NSA

What initiates the process is your act of calling internationally, and correllating to a known or suspected threat. 99.999% of us will never "accidentally" call anyone the NSA is interested in. Have you made a call and accidentally gotten the German president? Also, there are literally millions of calls. The only thing that gets an analyst looking at your specific call is multiple calls. You'd have to call President Joachim Gauck quite a few times in my ficiticous scenario. The very same thing would happen with the DEA if you called a drug dealer the next street over. "Roving wiretaps," is the term for what would catch you. "Opps, wrong number" and you're not very likely to get a surprise visit at home. Call 5-10 times asking, "for the suff," and you might come home to guests.

Also, in this specific case I believe you're trying to make, the NSA surveillence tip isn't admissible in court. If you've read an intel document, a large number state at the very beginning in no uncertain terms, "This information is not to be used in a court of law or for any judicial purposes." (I'm paraphrasing). It's on the FBI to investigate, find probable cause, get a prosecutor to agree, find a judge to agree, and then charge you. Whether it's the NSA seeing your metadata linking your phone call to a Taliban bomb-making expert in Syria, or a NYPD officer seeing, as he performs a walking patrol, large tubs of liquid in your car's backseat, leading to multiple triggers and a remote receiver, while parked at a shopping mall during Christmas season, is there really a difference? No. Before you say, "Well my car is in a public place," remember your international call crosses the same legal threshold. If you absolutely want to be unspied upon while calling your TB bombmaker by the NSA, then fly him stateside so it's a domestic phone call. This assumes the guy isn't already on a no-fly and being monitored, so good luck. Back on point, governments watch other governments. Part of this is agencies with specific missions.

The NSA is in charge of monitoring overseas communications. They are within the Legislative Branch's oversight and follow federal laws on what they can look for, how they look, etc. If you don't want to know what threats are overseas, then write your Senator and Representatives. As you draft that email, keep in mind thousands were saved during WWII by the fact we broke German encyption. 9/11 was missed because there was no system at the time to catch the two Al Quida operatives in San Diego who were calling their AQ handler overseas, and there was no process for the NSA to tip the FBI that there's two phone numbers in the US who are calling a known bomb maker overseas. If you think it's bad to catch this, mail the letter (or hit "Send" on the E-mail, "Submit" on the website submission).

Comment: Re:Yes. (Score 1) 421

by JohnnyComeLately (#46303901) Attached to: Ask Slashdot: Should I Get Google Glass?

Upskirt shots and it'd be "hard to know?"

"Hey, why's that guy with really weird looking glasses down on the ground looking up next to that lady in a skirt?"
"Oh, he probably just dropped a contact lens."
"But he's wearing glasses."
"Oh, good point. That is weird. Maybe we should help him look, she's probably going commando too."

Comment: Re:since when is the FBI a spy agency? (Score 2) 324

by JohnnyComeLately (#46303731) Attached to: Schneier: Break Up the NSA
Which is exactly how it's organized. The NSA is spying on overseas comms. When it links to a date/time placed/received call stateside, they hand that information to the FBI, and say, "This phone number in the US is talking to some very bad people overseas." The FBI then starts the investigation.

Comment: Author doesn't understand the NSA (Score 4, Insightful) 324

by JohnnyComeLately (#46303711) Attached to: Schneier: Break Up the NSA
This is akin to a guy who has flown on an aircraft thinking he knows how to run an airline. "The NSA should hand off to the FBI spying on Americans." They do. NSA does not investigate domestic nor Americans unless specifically given a court order to do so (which is less than 60 Americans in the entire US as of December 2013). If the NSA stumbles upon metadata that links an American, or domestic entity tied to overseas terrorism (which is what they're lookin for), they hand off the metadata (phone number called, date/time stamp of call) and say to the FBI, "Whoever this is, is talking to terrorists overseas." Then the FBI runs with it.

CyberCommand, a command I'm very familiar with as prior-Air Force, doesn't have a reason to take over what the NSA does. The author of this article really doesn't know what he's talking about.
