Irreal

Here’s some rare good news from the NSA front: the Lavabit and Silent Circle teams have joined forces to form the Dark Mail Alliance. There are quite a few stories on the Internet about the alliance and what they are trying to achieve. They haven’t released the technical details yet but as far as I can tell the aim is to make email encryption transparent and also hide as much of the metadata as possible.

The protocol and associated software will be released as open source software so that anyone can use it. The more ambitious goal is to get the heavy hitters to sign up. They’d like providers like Google and Yahoo to use the system. Their ultimate goal is to have 50% of email traffic flowing through Dark Mail in 3 years. That seems ambitious to me but I sure hope they succeed.

Every time you read about email security in the press—even in the technical press—you are always warned about how difficult it is to set up PGP/GPG. That’s mostly nonsense, I think, but it is true that Aunt Millie isn’t going to bother because it’s too mysterious and too much trouble. Who’s going to spy on poor old Aunt Millie, after all? So the real hurdle to getting secure email is to make the encryption completely transparent. If Aunt Millie has to do anything extra it simply isn’t going to happen.

The Guardian, which has done almost all the heavy lifting on the ongoing NSA story, has an excellent recapitulation of the story so far and what it means for us. The page is interactive and has snippets of video interviews with several people involved in or knowledgeable of the story.

Although The Guardian has been merciless in their coverage of the scandal, the recapitulation is very even handed and gives voice to both sides: those who support the NSA and its activities and those that deplore them. They also include many of the (previously published) source documents. If you’re at all interested in the NSA story but not obsessive about following it like, ahem, some people this is a great summary. On the other hand, if, like me, you’re one of those obsessive folks, you won’t want to skip it either.

If you’re like me, you probably enjoyed the spectacle of Tom Matzzie live-tweeting an overheard off-the-record conversation between Ex NSA Director Michael Hayden and a reporter. The hilarity was terminated when a colleague of Hayden called him to warn of the eavesdropping.

I snickered at the irony but didn’t think much about it. Now Bruce Schneier remarks that what this really demonstrates is that the government is monitoring the Internet in real time. The tweets, of course, are public so it doesn’t rise to the level of abuse of the NSA’a extra-legal activities but it still shows that those public feeds are being monitored and in real time.

Schneier says that he doesn’t think that this means that the NSA is monitoring the Internet; he believes it more likely that some PR organization assisting the NSA with the Snowden revelations was monitoring social media for names connected to the NSA. I’m not so sanguine but it doesn’t really matter if it was the NSA or some other government-connected entity. The government should have better things to worry about. Getting healthcare.gov running would be a good start.