Irreal

Bruce Schneier has an interesting post on setting up an air gap computer. It seems simple: just never connect your computer to the Internet. The problem is a completely isolated computer isn’t much use unless all you want to do is play Reversi or solitaire. To get any useful work done you need to move files onto and off of the computer.

At first glance it’s hard to see how a “normal” person would even need such a thing. But once Schneier became involved in the analysis of the Snowden documents he needed to isolate and protect them. When the need presents itself, you have to consider how best to protect yourself and your data.

Schneier began by buying a new laptop from a big box store and taking it to a friend’s house to download the software he needed. After that he never connected it to the Internet again. Still, there is the need to transfer data to and from the machine. It’s not nearly as easy as it seems.

Follow the link the see how Schneier handles the problem. The real meat in the post is in the comments. Almost everyone said, “Yikes! You’re using Windows? You should be using Linux.” That’s probably good advice but not too helpful. The other comments represent some useful advice. It’s a fairly long post with a lot of comments but it’s definitely worthwhile if you have to do something similar.

The New Yorker has a nice article on the Lavabit back story and current status. It recounts the details of the negotiations between Lavabit and the government. It’s pretty clear that the government was disingenuous about their demands. Armed with a subpoena for the metadata on a single account, they insisted that Lavabit’s owner, Ledar Levison, turn over his SSL keys thereby giving the FBI the ability to monitor all traffic in and out of the site. It’s not clear that the judge, in particular, really understood the issues and what the government was actually demanding.

Levison remarks that even without Snowden as the proximate cause, the government would sooner or later have come after Lavabit because it represented a gap in their intelligence—in their desired ability to monitor all communications. Right now Levison is fighting in the Fourth Circuit Court the government’s right to make such demands. One can only hope he prevails but it’s hard to be sanguine about his chances.

Late Breaking: Lavabit is apparently going to make a Fourth Amendment argument to the court. The idea is that Lavabit’s 40,000 customers who aren’t named Snowden are having their Fourth Amendment right to be secure in their privacy without probable cause and a particularized warrant violated. As the NSA and the FISA courts have demonstrated, the government doesn’t much care about the fourth amendment; they just shout “Look! Terrorists.” and charge ahead. So, again, it’s hard to be hopeful about the outcome.

A common reaction to the NSA disclosures has been, “Meh, it’s just metadata.” Unfortunately, the issues are perceived as being overly technical and as a result it is difficult to explain to the man-in-the-street, let alone your Aunt Millie, how the collection of metadata is a threat and why everyone should care.

As Bruce Schneier has pointed out, lot of people have effectively demolished the argument that metadata collection needn’t concern us but the arguments are subtle and hard to convey succinctly. Schneier comes to the rescue with a pithier argument: metadata equals surveillance.

He says suppose you hire a detective to eavesdrop on someone by planting bugs and tapping the target’s phone. The fruit of that endeavor would be the details of the target’s communications. That’s the data.

Now suppose that the detective instead followed the target around and discovered what he did, where he went, who he talked to, and what he purchased. That’s the metadata. What the detective is doing in the second case is surveilling the target. The difference between the detective and the government is that the government is putting everyone under surveillance. That’s something that should concern every citizen.