10 ms·

Anecdotal, and old now: I worked with an ex-NSA agent when I worked at a big bank who worked out of a some of middle east offices in early 2000s. He talked abo

Anecdotal, and old now: I worked with an ex-NSA agent when I worked at a big bank who worked out of a some of middle east offices in early 2000s. He talked about how new agents often struggle with the size of data (even then) but most good agents work immediately to look at the lack of normal data. Criminals/targets have their own signal of data and by filtering traditional data patterns you're left with a smaller dataset of the targets you're there to find. He used the same patterns to find financial white collar cheaters in bank data. (example: phones off during day, on from 1am-5am then shut off again, no facebook browsing at all, etc.)

WarOnPrivacy 3y ago
I accept your anecdote at face value. Therefore this gets an 'ooof' from me. > Criminals/targets have their own signal of data and by filtering traditional data patterns you're left with a smaller dataset of the targets you're there to find. (example: ... no facebook browsing at all)
- trabant00 3y ago
  It's just one filter. Exlude this, exclude that, exclude all that is normal to find and what is left is some edge cases that might contain something interesting. That is how I navigate linux logs when I don't know what I am searching for: grep -v x | grep -v y | grep -v z | etc It does not mean if you don't browse Facebook you are suspect
  - marcosdumay 3y ago
    > It does not mean if you don't browse Facebook you are suspect That's exactly what it means. If you meant the suspicion is low, yeah it is, it's suspicion nonetheless.
criley2 3y ago
This isn't surprising, I feel like it's been common knowledge. I maintain a token social media presence precisely because I feel it would look weird/suspicious not to. It's like hiding $500 in a dummy wallet in your underwear drawer, if someone finds it, they think they found your stash and they move on without tearing the rest of the place apart. Same reason why I let Google hoard many of my photos. It's the low hanging fruit that makes creating a presence easy. Folks aren't going to look beyond the curtain because they expect the curtain to be there and be all that's there. It's only when you leave the curtain wide open being a digital nomad of sorts that anyone looking has to look deep to find anything at all. In a way, maintaining token controlled usage of these services is more anonymous than avoiding them, which is wild.
- MonaroVXR 3y ago
  Absolutely the same for me, but for the police or NSA or whatever, it's for the people that don't believe that I have the right skills... "Oh well you're a computer nerd, nerd don't sport" kind of thing
- Aerbil313 3y ago
  > maintaining token controlled usage of these services is more anonymous than avoiding them, which is wild. Very insightful, thanks. Still, seems a bit overkill, since I believe there are legitimate people out there who are not using any social media, etc.
  - jccc 3y ago
    Yes but I think the point is even in that case anyone snooping would be drawn deeper to find something.
- bhpm 3y ago
  It depends on who you are trying to be anonymous from. I don’t spend much time trying to hide from the NSA. I care more about being targeted for advertisement or having my insurance premiums raised because of some naughty behavior. These are more impactful on my day to day life.
- jstarfish 3y ago
  > It's like hiding $500 in a dummy wallet in your underwear drawer, if someone finds it, they think they found your stash and they move on without tearing the rest of the place apart. This is one of the silliest things I've read in a while. Maybe it will stop your junkie kids from pawning your shit but there are no "rules" to burglary otherwise. We were burgled just last week. Despite stealing a single large high-ticket item ($2000) it wasn't enough to stop them from stealing random garbage and glass and metal jewelry the kids made at summer camp. They took everything they could carry.
  - criley2 3y ago
    Regardless of the rest of your comment, you brought up a great point about how bait can work really effectively. Instead of stealing real jewelry, they stole obvious fakes. I understand that that might sentimentally be worse to you, but it demonstrates how effectively you can counter burglary through baiting, which of course is the very point you claim isn't true. I'll consider bait jewelry as well, and try to increase the size and weight of the bait to make it difficult to carry more. That's good advice.
hilbert42 3y ago
"example: phones off during day, on from 1am-5am then shut off again, no facebook browsing at all, etc." So if one uses an old fashioned feature phone without internet then one automatically becomes a target. Similarly, I have a smartphone but no Facebook account so I must be a target. Well good luck to them I'm pretty boring.
- georgyo 3y ago
  If you had a cell phone that was only on between 1am and 5am, that would be mighty suspicious. And believe it or not, not having a Facebook account does cast a shadow which makes you more interesting and mysterious. Why don't you want to telegraph your entire social graph to the world? What are you hiding?! But in all seriousness, none of these are making you a target of anything by itself. If you are _already_ a target then they make you an interesting outlier that needs deeper investigation. If you want to be boring in data it has look like other data. Sometimes being absent entirely in data is interesting.
  - pocketarc 3y ago
    > Why don't you want to telegraph your entire social graph to the world? What are you hiding?! I remember in the earlier days, 10+ years ago, that was -exactly- how people looked at me whenever I said I don't have a Facebook account. I'm glad most people are out of that mindset, at least, even if it makes me seem like a target.
    - wolf89618 3y ago
      There is more of a fragmentation of social media networks now than before. More corporations are trying to enter that business I guess. In effect, this makes it less of a chock to say that you don't use Facebook, because you could easily be using another platform. So given that you don't use Facebook there is a lower probablitiy that you are avoiding social media entirely, hence less drama.
  - ethbr1 3y ago
    "Target" is likely inflaming some people here. To use the neutral -- it makes you an outlier or ab-normal (different than normal). Being separated from an average profile doesn't mean you are anything. It's exclusionary, not inclusionary. Which other groups you fall into (privacy-concerned techies, terrorists, aficionados of pistachio ice cream, etc.) would require inclusionary signals. And absent living off the grid, you're likely not going to mask exclusionary signals, simply by virtue of most people creating them 24/7. That's a lot of "side work" to artificially keep up with.
sidewndr46 3y ago
This is known as the absence of evidence is the evidence. It might work when you aren't subject to any laws but no court in North America should ever allow such a thing to be presented to anyone.
- TheFreim 3y ago
  They aren't using the lack of evidence as evidence itself, they're using abnormalities to narrow down where to search for actual evidence.
- helsinkiandrew 3y ago
  It's not evidence its intelligence. If you're looking for someone who took possession of a bomb, or who traded on insider information then you would use the list to look a little closer for evidence.
- jandrese 3y ago
  The NSA isn’t the police. Also, the police are t going to charge you with “insufficient social media use”, it is just one of the filters they use to comb through the massive data load. Not using Facebook is fine. Not using Facebook, using Crypto currency, having multiple phones, unexplained income, lots of calls to foreign numbers, trips to countries not commonly visited by tourists, associations with known criminals/terrorists, and so on raises your profile and makes them take a second look at you. Any one or two hits probably doesn’t get you out of the noise, but a person who hits on more than that starts looking suspicious.
  - dhosek 3y ago
    You just reminded me of my interview for my Trusted Traveler in 2020 when I forgot about a trip to Morocco when listing my international travel. The way the interviewer raised it, I thought I was going to be sent to Guantanamo.
  - RetpolineDrama 3y ago
    > Not using Facebook, using Crypto currency, having multiple phones, unexplained income Every mobile developer (with test phones) who owns some crypto with a wife who runs an Etsy shop is sweating now.
evilduck 3y ago
Phones off during the day and on during evening hours would describe the behaviors of NSA employees who aren't allowed to carrying phones into their office, are less likely to share or participate with their personal details on social media and is a workforce comprised disproportionately of people with unique quirks like odd sleeping habits. I'm sure that's not lost on them either, but their signals they seek could be finding other intelligence agents and not criminals.
- AlwaysRock 3y ago
  Wouldnt NSA/any government employees be exactly the type of person Spies are interested in keeping tabs on? Intelligence agents/spies from other countries, or opposing countries, are criminals to us.
- dhosek 3y ago
  I’m sure that this is merely a first-pass filter and not a case of arrest warrants being automatically issued based on usage (although I’m sure that will come soon enough).
  - ethbr1 3y ago
    Exactly. The value of simply windowing your search set by a few orders of magnitude, with low false negatives, is underappreciated. Getting from 100,000,000 to 10,000 (0.01%) makes other subsequent methods viable, including "have a person follow them," that wouldn't be on the full set.
- RetpolineDrama 3y ago
  > Phones off during the day and on during evening hours would describe the behaviors of NSA employees He did say they were looking for criminals, no?
- wil421 3y ago
  Not true. I know folks who worked at an aircraft manufacturer with similar requirements and classifications. They had a locker they would put it in somewhere. Some people would grab them at lunch, leave, and put them back. They said it was because of the camera on phones.
ianhawes 3y ago
Minor nitpick but the NSA does not employ agents, but rather analysts and (sometimes) operators. "Agents" in the IC sense are people that do your bidding, i.e. recruiting someone to insert a USB drive into a target device.
- Bajeezus 3y ago
  You're still incorrect. Those are "assets", the term "agent" isn't formally used anywhere in the IC
  - retrac 3y ago
    The whole "CIA agent" probably comes from "special agent" which is the title for US police investigators, who sometimes do work undercover, mostly on domestic policing matters. The CIA does have special agents, but it's mostly a desk job, and they are definitely not the clandestine operatives of the pop culture idea. (Most US federal agencies have special agents - even NASA has a little Office of the Inspector General.)
    - jstarfish 3y ago
      The FBI (and even the IRS) uses "agents" so I assume people extrapolated use of the term to all three-letter agencies.
      - Arrath 3y ago
        Random aside, but ATF field personnel used to be 'Inspectors' and we had a pretty good working relationship during annual inspections and so on. Sometime in the Post-9/11 era they transitioned to 'Investigators' and the majority of them got a big stick up their rear ends and it has become a trying, adversarial relationship every time they come out.
  - throwaway29812 3y ago
    A case officer still runs agents.
- 3y ago
creshal 3y ago
Germany has been doing this since 1979, when mainframes were used to "find terrorists" – i.e., grab a bunch of companies' billing data, and filter for people who were "suspicious" by paying their bills in cash and couldn't be cross-referenced with other government databases, to find people who were (allegedly, surely) using fake identities. Highly illegal, and put about 18,000 innocent people in the crosshairs of police investigations, but it's for The Greater Good, so nobody ever got punished for it, and today it's done by police agencies for such world-shaking crimes as speeding tickets, participation in legal demonstrations, and substance abuse.
- lifestyleguru 3y ago
  Meantime their former Chancellor moved straight to executive role in Gazprom. Germans - "looks legit nothing to see here, ve must catch all copyright violations and public media fee debtors".
  - FirmwareBurner 3y ago
    Also Wirecard fraud happened underneath the noses of the authorities who were provided proof from journalists and they still couldn't see it.
    - gmerc 3y ago
      The wirecard people were Russian intelligence and had access to the highest level of politics. Nothing to see here. The head of the Constitutional Protection Agency (BfV) turned out to be a right wing radical who is hanging out with Neonazis and "Reichsbuergers". Nothing to see here His second in command was present at a meeting to plan the deportation of "not pure germans" last year. Nothing to see here.
      - lifestyleguru 3y ago
        Keine sorgen, Sie schaffen das. Das alles. Pre-pandemic dispute in Germany was absolutely toxic. Raising concern about any from the above was impossible. Being "concerned" was a straight way to be called "concerned citizen" ie. "Reichsbuerger". That was then, now I don't know either care. > His second in command was present at a meeting to plan the deportation I hope the meeting was not held in Wannsee.
PH95VuimJjqBqy 3y ago
this is why I've always rejected the notion that everyone should put all their data out there so as to overwhelm those trying to collect everything. Your data is forever and banking on there never being an effective solution (effective does not mean perfection here) doesn't seem like a good gamble.
phpisthebest 3y ago
>>no facebook browsing at all So I am now a target of the NSA..... I despise Facebook and all other social media. Though I do have a lurker account on Twitter now that Elon fixed it from the authoritarians that use to run the platform. Never post though
- throwaway29812 3y ago
  > Though I do have a lurker account on Twitter now that Elon fixed it from the authoritarians that use to run the platform. He made it more conservative friendly which is why you like it now. "Free speech" was just a cover story. https://www.vice.com/en/article/5d948x/x-purges-prominent-journalists-leftists-with-no-explanation https://www.vice.com/en/article/5d948x/x-purges-prominent-jo...
- EasyMark 3y ago
  lol I wonder if the fact I basically stopped all social media activity last year except some reddit and HN checking in set off alarms lol. It was more about personal life improvement rather than anything nefarious
- mdhb 3y ago
  Why do people get so horny pretending they are targets of state surveillance. It’s an astonishing mix of ignorance and narcissism all rolled up into one.
  - smoldesu 3y ago
    Because all first-world citizens are effectively targets of state surveillance? The narcissistic "but I'M a target" shtick is pretty funny, but I'd wager you're just as foolish if you think those people "pretend" to be compromised.
    - deleted 3y ago
      [deleted]
more_corn 3y ago
I saw a talk at defcon about tracking Bitcoin wallets. Apparently use of a Bitcoin atm gets you flagged instantly.

WarOnPrivacy 3y ago

I accept your anecdote at face value. Therefore this gets an 'ooof' from me. > Criminals/targets have their own signal of data and by filtering traditional data patterns you're left with a smaller dataset of the targets you're there to find. (example: ... no facebook browsing at all)

trabant00 3y ago
It's just one filter. Exlude this, exclude that, exclude all that is normal to find and what is left is some edge cases that might contain something interesting. That is how I navigate linux logs when I don't know what I am searching for: grep -v x | grep -v y | grep -v z | etc It does not mean if you don't browse Facebook you are suspect
- marcosdumay 3y ago
  > It does not mean if you don't browse Facebook you are suspect That's exactly what it means. If you meant the suspicion is low, yeah it is, it's suspicion nonetheless.

criley2 3y ago

This isn't surprising, I feel like it's been common knowledge. I maintain a token social media presence precisely because I feel it would look weird/suspicious not to. It's like hiding $500 in a dummy wallet in your underwear drawer, if someone finds it, they think they found your stash and they move on without tearing the rest of the place apart. Same reason why I let Google hoard many of my photos. It's the low hanging fruit that makes creating a presence easy. Folks aren't going to look beyond the curtain because they expect the curtain to be there and be all that's there. It's only when you leave the curtain wide open being a digital nomad of sorts that anyone looking has to look deep to find anything at all. In a way, maintaining token controlled usage of these services is more anonymous than avoiding them, which is wild.

MonaroVXR 3y ago
Absolutely the same for me, but for the police or NSA or whatever, it's for the people that don't believe that I have the right skills... "Oh well you're a computer nerd, nerd don't sport" kind of thing
Aerbil313 3y ago
> maintaining token controlled usage of these services is more anonymous than avoiding them, which is wild. Very insightful, thanks. Still, seems a bit overkill, since I believe there are legitimate people out there who are not using any social media, etc.
- jccc 3y ago
  Yes but I think the point is even in that case anyone snooping would be drawn deeper to find something.
bhpm 3y ago
It depends on who you are trying to be anonymous from. I don’t spend much time trying to hide from the NSA. I care more about being targeted for advertisement or having my insurance premiums raised because of some naughty behavior. These are more impactful on my day to day life.
jstarfish 3y ago
> It's like hiding $500 in a dummy wallet in your underwear drawer, if someone finds it, they think they found your stash and they move on without tearing the rest of the place apart. This is one of the silliest things I've read in a while. Maybe it will stop your junkie kids from pawning your shit but there are no "rules" to burglary otherwise. We were burgled just last week. Despite stealing a single large high-ticket item ($2000) it wasn't enough to stop them from stealing random garbage and glass and metal jewelry the kids made at summer camp. They took everything they could carry.
- criley2 3y ago
  Regardless of the rest of your comment, you brought up a great point about how bait can work really effectively. Instead of stealing real jewelry, they stole obvious fakes. I understand that that might sentimentally be worse to you, but it demonstrates how effectively you can counter burglary through baiting, which of course is the very point you claim isn't true. I'll consider bait jewelry as well, and try to increase the size and weight of the bait to make it difficult to carry more. That's good advice.

hilbert42 3y ago

"example: phones off during day, on from 1am-5am then shut off again, no facebook browsing at all, etc." So if one uses an old fashioned feature phone without internet then one automatically becomes a target. Similarly, I have a smartphone but no Facebook account so I must be a target. Well good luck to them I'm pretty boring.

georgyo 3y ago
If you had a cell phone that was only on between 1am and 5am, that would be mighty suspicious. And believe it or not, not having a Facebook account does cast a shadow which makes you more interesting and mysterious. Why don't you want to telegraph your entire social graph to the world? What are you hiding?! But in all seriousness, none of these are making you a target of anything by itself. If you are _already_ a target then they make you an interesting outlier that needs deeper investigation. If you want to be boring in data it has look like other data. Sometimes being absent entirely in data is interesting.
- pocketarc 3y ago
  > Why don't you want to telegraph your entire social graph to the world? What are you hiding?! I remember in the earlier days, 10+ years ago, that was -exactly- how people looked at me whenever I said I don't have a Facebook account. I'm glad most people are out of that mindset, at least, even if it makes me seem like a target.
  - wolf89618 3y ago
    There is more of a fragmentation of social media networks now than before. More corporations are trying to enter that business I guess. In effect, this makes it less of a chock to say that you don't use Facebook, because you could easily be using another platform. So given that you don't use Facebook there is a lower probablitiy that you are avoiding social media entirely, hence less drama.
- ethbr1 3y ago
  "Target" is likely inflaming some people here. To use the neutral -- it makes you an outlier or ab-normal (different than normal). Being separated from an average profile doesn't mean you are anything. It's exclusionary, not inclusionary. Which other groups you fall into (privacy-concerned techies, terrorists, aficionados of pistachio ice cream, etc.) would require inclusionary signals. And absent living off the grid, you're likely not going to mask exclusionary signals, simply by virtue of most people creating them 24/7. That's a lot of "side work" to artificially keep up with.

sidewndr46 3y ago

This is known as the absence of evidence is the evidence. It might work when you aren't subject to any laws but no court in North America should ever allow such a thing to be presented to anyone.

TheFreim 3y ago
They aren't using the lack of evidence as evidence itself, they're using abnormalities to narrow down where to search for actual evidence.
helsinkiandrew 3y ago
It's not evidence its intelligence. If you're looking for someone who took possession of a bomb, or who traded on insider information then you would use the list to look a little closer for evidence.
jandrese 3y ago
The NSA isn’t the police. Also, the police are t going to charge you with “insufficient social media use”, it is just one of the filters they use to comb through the massive data load. Not using Facebook is fine. Not using Facebook, using Crypto currency, having multiple phones, unexplained income, lots of calls to foreign numbers, trips to countries not commonly visited by tourists, associations with known criminals/terrorists, and so on raises your profile and makes them take a second look at you. Any one or two hits probably doesn’t get you out of the noise, but a person who hits on more than that starts looking suspicious.
- dhosek 3y ago
  You just reminded me of my interview for my Trusted Traveler in 2020 when I forgot about a trip to Morocco when listing my international travel. The way the interviewer raised it, I thought I was going to be sent to Guantanamo.
- RetpolineDrama 3y ago
  > Not using Facebook, using Crypto currency, having multiple phones, unexplained income Every mobile developer (with test phones) who owns some crypto with a wife who runs an Etsy shop is sweating now.

evilduck 3y ago

Phones off during the day and on during evening hours would describe the behaviors of NSA employees who aren't allowed to carrying phones into their office, are less likely to share or participate with their personal details on social media and is a workforce comprised disproportionately of people with unique quirks like odd sleeping habits. I'm sure that's not lost on them either, but their signals they seek could be finding other intelligence agents and not criminals.

AlwaysRock 3y ago
Wouldnt NSA/any government employees be exactly the type of person Spies are interested in keeping tabs on? Intelligence agents/spies from other countries, or opposing countries, are criminals to us.
dhosek 3y ago
I’m sure that this is merely a first-pass filter and not a case of arrest warrants being automatically issued based on usage (although I’m sure that will come soon enough).
- ethbr1 3y ago
  Exactly. The value of simply windowing your search set by a few orders of magnitude, with low false negatives, is underappreciated. Getting from 100,000,000 to 10,000 (0.01%) makes other subsequent methods viable, including "have a person follow them," that wouldn't be on the full set.
RetpolineDrama 3y ago
> Phones off during the day and on during evening hours would describe the behaviors of NSA employees He did say they were looking for criminals, no?
wil421 3y ago
Not true. I know folks who worked at an aircraft manufacturer with similar requirements and classifications. They had a locker they would put it in somewhere. Some people would grab them at lunch, leave, and put them back. They said it was because of the camera on phones.

ianhawes 3y ago

Minor nitpick but the NSA does not employ agents, but rather analysts and (sometimes) operators. "Agents" in the IC sense are people that do your bidding, i.e. recruiting someone to insert a USB drive into a target device.

Bajeezus 3y ago
You're still incorrect. Those are "assets", the term "agent" isn't formally used anywhere in the IC
- retrac 3y ago
  The whole "CIA agent" probably comes from "special agent" which is the title for US police investigators, who sometimes do work undercover, mostly on domestic policing matters. The CIA does have special agents, but it's mostly a desk job, and they are definitely not the clandestine operatives of the pop culture idea. (Most US federal agencies have special agents - even NASA has a little Office of the Inspector General.)
  - jstarfish 3y ago
    The FBI (and even the IRS) uses "agents" so I assume people extrapolated use of the term to all three-letter agencies.
    - Arrath 3y ago
      Random aside, but ATF field personnel used to be 'Inspectors' and we had a pretty good working relationship during annual inspections and so on. Sometime in the Post-9/11 era they transitioned to 'Investigators' and the majority of them got a big stick up their rear ends and it has become a trying, adversarial relationship every time they come out.
- throwaway29812 3y ago
  A case officer still runs agents.
3y ago

creshal 3y ago

Germany has been doing this since 1979, when mainframes were used to "find terrorists" – i.e., grab a bunch of companies' billing data, and filter for people who were "suspicious" by paying their bills in cash and couldn't be cross-referenced with other government databases, to find people who were (allegedly, surely) using fake identities. Highly illegal, and put about 18,000 innocent people in the crosshairs of police investigations, but it's for The Greater Good, so nobody ever got punished for it, and today it's done by police agencies for such world-shaking crimes as speeding tickets, participation in legal demonstrations, and substance abuse.

lifestyleguru 3y ago
Meantime their former Chancellor moved straight to executive role in Gazprom. Germans - "looks legit nothing to see here, ve must catch all copyright violations and public media fee debtors".
- FirmwareBurner 3y ago
  Also Wirecard fraud happened underneath the noses of the authorities who were provided proof from journalists and they still couldn't see it.
  - gmerc 3y ago
    The wirecard people were Russian intelligence and had access to the highest level of politics. Nothing to see here. The head of the Constitutional Protection Agency (BfV) turned out to be a right wing radical who is hanging out with Neonazis and "Reichsbuergers". Nothing to see here His second in command was present at a meeting to plan the deportation of "not pure germans" last year. Nothing to see here.
    - lifestyleguru 3y ago
      Keine sorgen, Sie schaffen das. Das alles. Pre-pandemic dispute in Germany was absolutely toxic. Raising concern about any from the above was impossible. Being "concerned" was a straight way to be called "concerned citizen" ie. "Reichsbuerger". That was then, now I don't know either care. > His second in command was present at a meeting to plan the deportation I hope the meeting was not held in Wannsee.

PH95VuimJjqBqy 3y ago

this is why I've always rejected the notion that everyone should put all their data out there so as to overwhelm those trying to collect everything. Your data is forever and banking on there never being an effective solution (effective does not mean perfection here) doesn't seem like a good gamble.

phpisthebest 3y ago

>>no facebook browsing at all So I am now a target of the NSA..... I despise Facebook and all other social media. Though I do have a lurker account on Twitter now that Elon fixed it from the authoritarians that use to run the platform. Never post though

throwaway29812 3y ago
> Though I do have a lurker account on Twitter now that Elon fixed it from the authoritarians that use to run the platform. He made it more conservative friendly which is why you like it now. "Free speech" was just a cover story. https://www.vice.com/en/article/5d948x/x-purges-prominent-journalists-leftists-with-no-explanation https://www.vice.com/en/article/5d948x/x-purges-prominent-jo...
EasyMark 3y ago
lol I wonder if the fact I basically stopped all social media activity last year except some reddit and HN checking in set off alarms lol. It was more about personal life improvement rather than anything nefarious
mdhb 3y ago
Why do people get so horny pretending they are targets of state surveillance. It’s an astonishing mix of ignorance and narcissism all rolled up into one.
- smoldesu 3y ago
  Because all first-world citizens are effectively targets of state surveillance? The narcissistic "but I'M a target" shtick is pretty funny, but I'd wager you're just as foolish if you think those people "pretend" to be compromised.
  - deleted 3y ago
    [deleted]

more_corn 3y ago

I saw a talk at defcon about tracking Bitcoin wallets. Apparently use of a Bitcoin atm gets you flagged instantly.