Irreal

The EFF has a list of ten steps you can take to protect yourself from surveillance. There’s nothing there that will come as news to the always informed Irreal reader but it’s a nice summary and worth passing on to some of your less informed friends and family.

Most of the steps are easy and something that everyone should be doing. To me, the hardest part is encrypting all your communications. The problem there is your interlocutors. It’s easy for us geeks to use GPG/PGP and some sort of secure chat but when we want to talk to Aunt Millie (or, really, most of our friends) we’re out of luck because all of that crypto stuff is too hard for them. The crucial need is for someone to figure out a way to get everyone using GPG. It’s a hard problem but I’m sure that riches and glory await the person who solves it. This is why I find the Dark Mail Alliance that I wrote about a couple of days ago such a hopeful development. They may or may not succeed but at least the problem is being worked on.

Here’s some rare good news from the NSA front: the Lavabit and Silent Circle teams have joined forces to form the Dark Mail Alliance. There are quite a few stories on the Internet about the alliance and what they are trying to achieve. They haven’t released the technical details yet but as far as I can tell the aim is to make email encryption transparent and also hide as much of the metadata as possible.

The protocol and associated software will be released as open source software so that anyone can use it. The more ambitious goal is to get the heavy hitters to sign up. They’d like providers like Google and Yahoo to use the system. Their ultimate goal is to have 50% of email traffic flowing through Dark Mail in 3 years. That seems ambitious to me but I sure hope they succeed.

Every time you read about email security in the press—even in the technical press—you are always warned about how difficult it is to set up PGP/GPG. That’s mostly nonsense, I think, but it is true that Aunt Millie isn’t going to bother because it’s too mysterious and too much trouble. Who’s going to spy on poor old Aunt Millie, after all? So the real hurdle to getting secure email is to make the encryption completely transparent. If Aunt Millie has to do anything extra it simply isn’t going to happen.

The Guardian, which has done almost all the heavy lifting on the ongoing NSA story, has an excellent recapitulation of the story so far and what it means for us. The page is interactive and has snippets of video interviews with several people involved in or knowledgeable of the story.

Although The Guardian has been merciless in their coverage of the scandal, the recapitulation is very even handed and gives voice to both sides: those who support the NSA and its activities and those that deplore them. They also include many of the (previously published) source documents. If you’re at all interested in the NSA story but not obsessive about following it like, ahem, some people this is a great summary. On the other hand, if, like me, you’re one of those obsessive folks, you won’t want to skip it either.