Posts by Matthew Poole
Last ←Newer Page 1 2 3 4 5 Older→ First
-
OnPoint: Ich bin ein Cyberpunk, in reply to Rich of Observationz,
Key distribution, that’s the hard part. Ensuring that you have the public keys of everyone you want to contact and that these haven’t been tampered with.
It’s a hard problem, partly because of the risk of the man-in-the-middle attack (where somebody intercepts your traffic, substitutes the key and encrypts/recrypts your mail). I think the community got a bit hung up on this though – it should be possible to build an infrastructure that’s strong enough and tamper-evident enough to make systematic monitoring very difficult.
Taken care of, unless “they” manage to pull off a full-scale compromise of the PGP PKI. How? Key signing and levels of trust. If I meet Keith in person, verify his identity, and sign his PGP (for simplicity I will just say PGP instead of PGP/GPG) key, I will give it a very high level of validity because I have confirmed absolutely that he is Keith and it is his key. He can then take his signed key and put it onto the public key infrastructure (the PKI), complete with the indicator of the level of trust I have used for the signing. This would also happen with him signing my key and me uploading the signed key. Now, people whose keys I sign can trust that Keith’s key belongs to Keith, because they have confirmed that I am me and my key is mine. And so on, in a great big web of trust, where the further you get from an in-person signed key the lower the trust ranking you assign but also where the cumulative trust in all the upstream signers can sum up to near certainty that a key belongs to a given individual.
Because all the signed keys get uploaded to the PKI, and the original signers have confirmed the original key fingerprints, carrying out some kind of MITM between people who haven’t actually met means secretly subverting the PKI and changing the key fingerprints (which is how one looks up a specific key within the PKI) so that those people will get compromised keys. That subversion also needs to forge all the signatures on the keys, which becomes harder and harder to do as the web grows.
The most efficient way to get a whole lot of trust going on is a key-signing party (HT’ing to I/S instead of linking direct), which can mean a dozen people or more all establish the highest level of trust in each other’s keys, and if those signed keys are all uploaded to multiple PKI servers it’s an enormous job for “them” to subvert all of those keys and all of the cross-signing. Especially if people have signatures from outside the party, so it’s not just a matter of breaking the keys of that small number of people.
-
“SECRET//COMINT//REL TO NZL, AUS, CAN, GBR, USA”. In other words, the selectors were entered into a secret communications intelligence system, and this secret system was considered related to Five Eyes:
umm, not really. It means the request has a classification level of Secret, that its subject relates to communications intelligence (you got that bit right), and that it may be released to the members of Five Eyes.
-
Hard News: So long, and thanks for all…, in reply to BenWilson,
a deal with NZ First, though, which still looks necessary.
Not so much. If Key can manage not to have a cup of tea with Banks just before the election, Winston may well vanish back into political purgatory while his votes are distributed amongst the other parties. NZ First has not polled above 5% since shortly after the election, IIRC.
-
Speaker: Naked Inside the Off-Ramp, in reply to Keir Leslie,
doctrines around evidence, privacy, and the rights and liberties of the subject rather than employment or tort law.
How's that work? Before any of those other doctrines come into play it's necessary to establish if secondment alters the relationship between the party being surveilled and the parties carrying out the surveillance, surely? That's all about agency and employment law. Until it's determined if secondment results in the GCSB personnel who have been seconded becoming agents (in the agency/principal sense) of the requesting agency, how can any questions about those other matters be answered? I mean, it's not unheard of for an appellate ruling to announce that the trial court didn't focus on the correct question and thus reached a conclusion that was complete in itself but wasn't complete on the totality of facts of the case.
That it doesn't even appear to be clear which questions of law would take primacy in a legal examination of the "illegal spying" speaks volumes to the complexity of the area.
-
Hard News: So long, and thanks for all…, in reply to Sam M,
the Greens for me need to translate their stellar poll showings into actual election results.
You mean like having 14 MPs, as the party does currently?
-
Speaker: Naked Inside the Off-Ramp, in reply to Keir Leslie,
The indeterminacy of the law means that all acts are ambiguously legal.
Exactly. The law is not explicitly clear, no matter what some commentators think. My point about principal/agent was that ordinarily secondment alters the relationship between the seconded individual and the organisation to which they are seconded. GCSB officers aren't warranted so they are accorded no specific legal status by virtue of being employees of GCSB, as opposed to, say, police or customs officers. I know it's not a perfect comparison, but in the absence of black-letter law the courts will have to fall back to ordinary civil and employment law concepts.
-
Speaker: Naked Inside the Off-Ramp, in reply to Kyle Matthews,
Allowing them to be seconded to other organisations doesn’t overrule that.
O'rly? My understanding of the law about secondment is that it is far from as black-and-white as you appear to believe. AFAIK, the seconded employee becomes, for the purposes of agency and principal, an agent of the seconding organisation, with whatever authorities are appropriate to their role.
If you can provide a legal authority which says otherwise I'm always open to being corrected, particularly on matters of law. -
Speaker: Naked Inside the Off-Ramp, in reply to Richard Love,
No. Secondment (or co-operating with other agencies) was entirely legal. It is plainly there in the 2003 GCSB act.
What was illegal, regardless of whether on secondment or not, was GCSB agents/resources being used to spy on NZers.
It can't be both. It can't be both legal and illegal. Secondment for the purposes of fulfilling a warrant cannot be both legal and illegal, it's one or the other. Which is it? If NZSIS or NZ Police were the requesting agency, by definition it involved someone on whom GCSB were forbidden to spy because otherwise GCSB would have been doing the work directly.
If I am seconded from my employer to someone else, actions I take are held accountable to the "someone else", not to my employer, though obviously my employment relationship remains with my employer. If I have authority to sign documents as part of the secondment, I'm not signing them as my employer's employee I'm signing them on behalf of the company to which I'm seconded.
-
Speaker: Naked Inside the Off-Ramp, in reply to Rich of Observationz,
Did the other agency (police) have a warrant to intercept (e.g.) Dotcom’s communications?
Dotcom was a clear case of GCSB interception, not secondment. But GCSB acted under the incorrect belief that Dotcom was not a resident, so the police having a warrant (or not) doesn't matter. They absolutely broke the law in that case, and ended up there by not paying attention to the law about immigration status.
As for the other cases, Sir Bruce was quite specific that he needed to see a warrant and a request for specific GCSB personnel (by name) before he would sign off a secondment. -
Speaker: Naked Inside the Off-Ramp, in reply to nzlemming,
No, but he’s also not about to admit to illegality under his command, either.
If seconding personnel to other agencies is illegal, then he already has made that admission. And the argument is being made right now that secondment is illegal.