FISA Spying And You. And Us.

I got a chuckle out of the outrage over the revelation that various three-letter agencies are vacuuming up all of the electronic data they can get their hands on, which is essentially all of it. It isn’t news. That particular whistle was blown years ago. No one outside of a handful of civil libertarians cared. Now, a handful of civil libertarians and about a half dozen other people care. But it’s officially news now.

I have lots to say about how that kind of thing, that dragnet style of information collection which can, does, and will continue to result in the egregious loss of freedom. The mentally deficient will be entrapped, and innocents of all stripes will be imprisoned — circumstantial evidence is a real bitch. That’s why we have the Innocence Project and various lesser known variants of it. Innocents do go to prison. All the time.

I have lots to say about it, but I won’t say it now. Instead, what I’d like to say is just this: Encrypt everything you send or receive across the internet, always. Everything. Always.

Why? If you’ve nothing to hide, don’t break the law, don’t even talk about breaking the law, why would you do that? Because it makes it harder for the spooks. If everyone, or at least a critical mass of us did this, it would slow them down enough that they’d have to be somewhat more selective about which data they trawl. It takes a lot more processing power to decrypt an email message than to simply analyze it, and it takes a helluva lot more processing power to decrypt it if you don’t have the encryption keys. Sure, they can do it — there are specialized massively parallel computers that are designed just for this purpose, and the three-letters have them. Heck, private sector bad guys have them, too, as the economies of scale bring down the cost of that cool hardware. BUT: Life is easier for the lot of them as long as we only encrypt those things that we consider sensitive. The presence of encryption itself tells the spies which stuff is interesting. If we encrypt everything, the presence of encryption will mean far less than it does now. They’ll have to decrypt random chit-chat and my favorite chicken recipes, too.

The flood of data is already unmanageable for them, but they can pick out which bits are most interesting by spotting patterns. That’s what data mining is all about, after all. Occasionally encrypting a message just proves that the message contains sensitive information. Encrypting everything indicates nothing except that you’re (a) security conscious, and (b) possibly, though not certainly, peacefully protesting the egregious practices of the surveillance state.

Advertisements

3 thoughts on “FISA Spying And You. And Us.

    1. happierheathen Post author

      For email and general purpose encryption I use and recommend GnuPG (http://gnupg.org). There are Mac and Windows versions as well as the native Linux version of it. You should also use the TLS/SSL connections that most mail service providers offer, rather than the wide open plaintext versions — look for things like POP3S (also known as SPOP) and IMAPS, rather than POP3 and IMAP (without the big S in the name). For sending, the Submission protocol (that runs on port 587, usually) quite often volunteers to allow you to upgrade to an encrypted connection via the STARTTLS command. Many modern mail clients support that via an option entitled something similar to “use encryption if possible” or some such.

      For web browsing, the HTTPSEverywhere plugin for Firefox is pretty handy. It’ll automagically switch you to TLS/SSL (HTTPS) if it knows that the site you’re visiting presents the same content in the secure channel that it does in the open one. In other cases, if you know a site works just fine over HTTPS you can just update your bookmarks and go.

      If you do file transfers to/from remote servers, the protocols sftp and scp are good. Both are actually SSH (Secure SHell) utilities. FTPS is okay, but I’d rather that FTP just go ahead and die now as it’s never had any business being on a public network. Wrapping it all up in TLS is good, but from the server side why would I want to install an FTP server when I’ve already got an SSH server to work with?

      If you do instant messaging/chat, encryption might be available as a built-in in your chat client, or as a plugin for it. I don’t do that stuff any more because being too available just means I get too many interruptions, but when I used Pidgin it had encryption support in it. I don’t recall just now if I installed that stuff as plugins or if it was already there.

      Reply

Leave a Reply

Please log in using one of these methods to post your comment:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s