DEF CON 22 - Zoz - Don't Fuck It Up!

Our friend Zoz of Defcon fame has a talk about NSA spying that enumerates and gives details to some of the ways that the NSA can 'see' you. [VIDEO]

> leaves their cellphones at home while committing crimes, using burner phones for any contact they need during that time That's getting a lot harder to do in practice. OPSEC is hard when you have to care about stuff like overlapping usage of the burner so the movement logs of the regular phone stopping don't correlate with when the burner starts moving. Zoz gave a great overview[1] of modern cellphone OPSEC at DEFCON 22. [1] [VIDEO]

There's another good talk on more general opsec from Defcon a few years ago called "Don't fuck it up". [VIDEO]

That would create very conspicuous network exit/entry points at the office. According to Zoz's DEFCON 22 talk[1] about modern OPSEC, these are specifically targeted by various agencies, so I'm sure Facebook finds entry/exit data points just as interesting. [1] (warning: strong language) [VIDEO]

OPSEC in the age of mass surveillance is incredibly hard. Zoz gave[1] has a very good overview of modern OPSEC. Staying anonymous requires an attention to detail that most people probably cannot do. The hindsight bias is realizing how serious the situation might be and the level of OPSEC that is required. When the torrent site was first created the risk level wasn't known and most people didn't understand how hard it is to avoid the ubiquitous sensors of the surveillance-industriual-complex. Yes, more people probably should have assumed this level of risk much earlier, but that's easy to say now when we know names like Prism and XKEYSCORE. [1] (note: contains rude/strong language) [VIDEO]

Dan Geer, CISO at In-Q-Tel , on[1] why this is patently incorrect: > Your digital exhaust is unique hence it identifies. Pooling everyone's digital exhaust also characterizes how you differ from normal. Privacy used to be proportional to that which it is impossible to observe or that which can be observed but not identified. No more -- what is today observable and identifiable kills both privacy as impossible-to-observe and privacy as impossible-to-identify, so what might be an alternative? [...] Privacy will be [...] the effective capacity to misrepresent yourself. > Misrepresentation is using disinformation to frustrate data fusion on the part of whomever it is that is watching you. Some of it can be low-tech, such as misrepresentation by paying your therapist in cash under an assumed name. Misrepresentation means arming yourself not at Walmart but in living rooms. Misrepresentation means swapping affinity cards at random with like-minded folks. Misrepresentation means keeping an inventory of misconfigured webservers to proxy through. Misrepresentation means putting a motor-generator between you and the Smart Grid. Misrepresentation means using Tor for no reason at all. Misrepresentation means hiding in plain sight when there is nowhere else to hide. Misrepresentation means having not one digital identity that you cherish, burnish, and protect, but having as many as you can. Your fused identity is not a question unless you work to make it be. Lest you think that this is a p

skype had this already before ms. ms opened skype up to government ages ago so this doesn't mean much of anything, there are backdoors. [VIDEO]

> you're only fucked if your OPSEC is weak The problem is that actually implementing not-weak OPSEC is much harder than most people understand (even those with technical backgrounds). For example, is your "secret" activity on TOR easily tied to your non-secret activity from a search of network entry/exit times (i.e. "secret" activity is the complement "non-secret" activity)? I recommend Zoz's DEFCON talk, "Don't Fuck It Up!"[1], for a very good overview of how hard OPSEC has become. [1] [VIDEO]

According to Zoz in his excellent DEFCON 22 talk "Don't Fuck It Up!"[1] on the difficulties of OPSEC, this type of correlation has been in use for years. >[2] Matching entry / exit point – we know specifically they look for that, so don’t match the last use and first use of phones, overlap it. [1] [VIDEO] [2] [LINK]

> if police work becomes effectively impossible It hasn't. That's a lie. Police/etc have far more resources available to them than they've had at any point in history. The trail of digital exhaust we leave behind is only increasing, which makes OPSEC much harder [1]. End to end encryption doesn't prevent metadata analysis[2], network usage/timing analysis (e.g. [3]), or investigation of the massive amount of data that isn't end to end encrypted.. [1] [VIDEO] [2] The NSA admits[4] metadata tells them far more than the message contents. [3] [LINK] edit: [4] "We kill people based on metadata" [LINK]

I'm always reminded of Zoz's awesome talk "Don't Fuck It Up!"[0]. There's a ton of sketchy shit you can unfortunately (or fortunately depending on who you are) do online but not getting caught is still a non-trivial task. Successfully hiding is dependent upon the people who you're trying to hide from and your sophistication in hiding. [0] [VIDEO]

Or, as Zoz explained in his DEFCON 22 talk "Don't Fuck It Up!"[1], OPSEC is really REALLY hard . Even people that have the necessary technical background are human and make mistakes. To stay secure in the "dark web" you need to never make a mistake and e.g. forget to turn on your VPN/Tor before logging in somewhere important. I doubt anybody - even people that made the "best" life decisions - could do this successfully without a LOT of very specific, very technical training. >> "OPSEC is a 24/7 job." >> "... a lot of OPSEC fails ... [from] the folly of only using privacy tools when you’re up to no good." >> "For example, investigators could look at who went and downloaded the Tor Browser Bundle right before the bomb threat got called in; or look at everyone who connected to a known Tor entry node at that time, or who accessed the Tor directory servers. [...] no compromise of Tor necessary." [1] [VIDEO]

An informative comic would be great. I have unsuccessfully tried to create a video game mechanic (ludonarrative) that demonstrates how data aggregation can be exploited. Giving people a little bit of personal experience on the other side trying to [ab]use data could be a very effective teaching tool. I suspect most people (including, as you mentioned, most technical people!) have never really thought about how personal data might be used as a weapon . The amazing game "Papers, Please" demonstrated that a game based around an educational ludonarrative is not only possible, but can also be be relatively popular. Unfortunately, just like drawing, video game design is difficult. > you need to be Jason Bourne -levels of vigilant to not create a trackable fingerprint online. As Zoz said, "Don't Fuck It Up!"[1]. Any type of OPSEC has become extremely difficult . Even technically knowledgeable people that risk consequences of failure far worse than being tracked by Google screw up their OPSEC. [1] [VIDEO]