THAT'S RIGHT, it's time for WHICH IS MORE LIKELY?!
[intro music]
Today on Which is More Likely?, we're looking at a replacement Lenovo Thinkpad keyboard that was shipped to Alexandria, Virginia, instead of Seattle, Washington. What a blunder! [slide whistle sound effect]
Now put your thinking caps on and ponder, WHICH IS MORE LIKELY?!
• The largest intelligence agency on the planet, recently outed by Snowden's leaked documents for operating a multi-decade worldwide dragnet that secretly gathered communications on hundreds of millions of people, was too incompetent to have the US Postal Service display tracking information that hides the fact they're modifying a laptop keyboard in order to somehow spy on a Tor developer.
ORRRRRRRRRR!
• The third-party seller who uses Amazon to accept orders screwed up and gave Amazon the wrong tracking number.
That's all we have time for on today's episode of Which is More Likely? Don't change the channel! Up next is a BRAND NEW episode of Godwin's Law and Order! Good night from Hollywood!
Oh, I like this game. Let's play again: WHICH IS MORE LIKELY?!
* The world's largest online retailer that does $54M in sales per day has a bug in its procurement system that randomly transposes tracking codes.
ORRRRRRRR!
* The intelligence agency whose massive scope and pervasive operational shortcomings were recently exposed by one low-level operative had a slip-up in applying a well-publicized tactic to an obviously high value target.
On the other hand, what's great about your way of putting it is that it juxtaposes your belief in the all encompassing nature of the NSA's programs with your incredulity that such a program might have been applied specifically here. I also like the part where the NSA is guarded by the Catch-22 "it wasn't them, because if it was, you'd never know", such that that there's no scenario in which you could be convinced that the NSA did anything.
And yet again, maybe it's time to stop thinking of the NSA as some far-off abstraction and start thinking about it is an actual thing that affects our daily lives.
Maybe this is Amazon/USPS's shipping version of the warrant canary? If Apple does it...
Imagine that we're not in the US for a second and that this were a journalist? Would your opinion of what happened change?
It would have to be a mis-delivery at least instead of a "wrong tracking number". How likely is it that Amazon would ship something from a CA warehouse and it take more than 2 days to get to Seattle? Also keep in mind that USPS does Saturday delivery.
Also, nice defense of the NSA, but keep in mind this is the same intelligence agency that gave pretty much unfettered document access to independent contractor Systems Administrators.
You are either stupid or subversive. By now we all know Keith Alexander’s view of hackers (socially disabled, semi-autistic kids sitting behind a laptop at 4 a.m. wearing a batman suit and gloves) and his view on technical matters is equal with Comodo’s [2] leader. As for NSA having skilled personnel??? Sure - some of them are skilled - but they don’t take decisions[1]. The stupid guys do (again, K. Alexander is an excellent reference for incompetence add to that that he is a lier[3] and you’ ve got an explosive mix).
NOTE: In “War and Peace” - Tolstoy’s masterpiece - there’s a Russian officer (Prince Andrey IIRC) who realizes the insane tragedy of human history: While the Prussian and Russian army coalition (hundreds of thousands of men, with families and lives left behind…) is about to face the fiercest opponent of their era (Napoleon, is a legend among Russian military officials) the two Generals (Prussian and Russian) are fighting and sabotaging each other about who is going to lead the battle… Until it’s too late. They both get easily crashed, without putting up a fight.
So you can play naive, stupid, stunned or cunning all you like but human history is FULL of stupid people in position of power.
> The third-party seller who uses Amazon to accept orders screwed up and gave Amazon the wrong tracking number.
This should be easy to find out. Check if the tracking number on the website differs from what's printed on the package itself, and if so what the tracking for it looks like.
You are asking which is more likely. I.e. is the probability of compromise higher than 50% ?
I'd say the the probability is less than that. But I think even risks with lower than half probability are worth worrying about.
The obvious explanation here is that the USPS fucked up. As the tweet says, you'd think the NSA program would be more subtle. Further, there isn't much in the way of intelligence presence in Alexandria. So what's more likely: that the NSA does this program in a secret location that's still right next to all the non-secret stuff, and they can't cover up the tracking data, or that the USPS accidentally sent a package to the wrong place?
Edit: I want to emphasize how incredibly stupid the article is when analyzing the tracking data. Key quote:
"From Dulles, it moved another four times around the military and intelligence belt in suburban Washington DC, finally landing in Alexandria at 11:03 am on January 23."
First of all, there is nothing significant to Dulles. It's the largest airport in the area, and this makes it the arrival point for any packages coming in by air. 90% of my packages have a "Dulles, VA" tracking entry on them by the time they get to me.
Second, it didn't move "four times". It went from Dulles to a carrier facility in Alexandria, then it went out for delivery and got delivered. That's two moves. And how many times do you expect it to move? That's how air-based package delivery works. It goes to an airport. Then it goes to a local sorting facility. Then it goes out for delivery.
Third, the phrase "military and intelligence belt" is ridiculous. Especially so when the only two locations involved are Dulles and Alexandria, neither of which has much in the way of either military nor intelligence.
The article tries way too hard to make its case, and uses a great deal of purple prose to state what comes down to, "the package got delivered to Alexandria, VA which is close to a lot of government agencies". That would actually be more convincing than the insanity they wrote, although still not very convincing. But at least it would be honest.
At this point aren't we all just guessing? Reading this thread I'm surprised how strongly many folks I respect (like you - viva FQ&A!) are insisting this could not be an NSA screw up. The truth is we don't know, so why rush to conclusions (even benign conclusions) instead of waiting to learn more?
And imagine if you were Andrea and you develop software that dissidents around the world depend on with their life, while also knowing the NSA has simultaneously tried to weaken it. If the laptop does get rerouted to her with an apology from USPS and you were her, are you saying you wouldn't hesitate even a little before accepting it and transferring your data onto it?
Ultimately, I think that's the real story here. The biggest problem with having a government that watches its citizens isn't the watching per se, it's the loss of trust.
When I read the headline, and the comments here before reading the article, I was expecting to see tracking data that went from the seller to the buyer with a mysterious stop near the NSA.
Then I read the article. The tacking data shows a delivery to a destination near the NSA.
Does anyone here seriously think that the mechanism the NSA uses if they want to tamper with a laptop on the way to simply change the destination address to be the NSA? And that no one has noticed this before?
If they are intercepting and modifying domestic shipments, the mechanism would be something that is executed AT the shipping carrier facilities or possibly during the final delivery, and would be completely transparent to outside observers, including both the sender and the receiver of the package.
Watch the "Modern Marvels" episode on package delivery for a look at how the automated package movement systems work at the major hubs, and you'll see how a package could be diverted for special treatment and then re-inserted into the system transparently, with most workers at the facility having no idea something special is going on.
The best chance at detecting this from outside would probably be to look at next day delivery orders on items that would be the most time consuming to modify, to see if those are more likely to miss their delivery deadline. The idea is that with such a tight schedule, the chances are higher than an interception will blow the delivery schedule. For items ordered with two day or longer shipment, the delay in modifying the item could be made up by upgrading it to one day delivery in the system when it is re-inserted. That's why observing one day delivery items is the best bet.
>Does anyone here seriously think that the mechanism the NSA uses if they want to tamper with a laptop on the way to simply change the destination address to be the NSA? And that no one has noticed this before?
No that doesn't pass the giggle test. If it has anything at all to do with the NSA, it's a blunder.
As much as I'd like to believe that they did mess up the interception reporting (if they really do interception like that), I've seen enough crazy tracking reports that I wouldn't be surprised if it was just a stupid mistake.
Just googling for "funny delivery tracking route" for example will give you things like:
ITT, people who have never been to DC. Dulles is one of the main airports everything flys into for DC. As for as I know, it is the biggest.
Dulles has a lot of government contractors and big companies in the area, but that's about it.
What would be suspicious is if it went from Dulles to Langley, from Langley to Ft. Meade, from Ft. Meade to Quantico, and from Quantico to Alexandria....but Dulles to Alexandria is really standard.
edit: It isn't like it got back on a plane and went back to Seattle to be delivered to this girl. It looks like they straight delivered it to the wrong city. The government has pretty good OpSec when it comes to things like this. You think they would straight up route her package through Ft. Meade if they were planning to install malware on her computer?
Yep, the last few lines of the package tracking could have come from about 90% of the packages I had delivered to my house in the past few years, until I moved out of Alexandria.
I hope this was not posted before the keyboard arrived. Should be easy enough to have it taken apart by an expert and see if anything is fishy (and to check if tracking numbers match).
All this speculation about what any TLA's may or may not have done seems fruitless to me. If the keyboard seems legitimately suspect, send it to someone to do a teardown or plug it in and capture communications, and find out. That way we'll learn something concrete, and not reinforce this 'NSA of doooooom' crowd mentality.
I'm inclined to believe that this is a mistake - "extraordinary claims require extraordinary evidence" and all that.
...However, since hypothetically this could happen, how could it be prevented? Would there be some unbreakable way for a manufacturer to tell you if the keyboard had been tampered with?
I was thinking of those silver foils that are now put over a lot of food items so that crazies can't put stuff in them in the supermarket. I appreciate wrapping it in plastic probably wouldn't be enough to defeat the security services, but you get the idea.
Why would the NSA fuck with a TOR developer, when the federal government contributes a great deal of TOR code and actually runs exit nodes as a matter of research?
Why wouldn't they? At the very least a TOR developer might find themselves in the same room with interesting people.
> when the federal government contributes a great deal of TOR code
The US gov isn't a single monolithic entity with a singular purpose and every person working in lock-step.
> and actually runs exit nodes as a matter of research?
I wouldn't trust a gov't run TOR node. It may be fine for dissidents in uninteresting countries, but not for anyone who wants to keep their privacy safe from the US gov't.
Bugs in software are so uncommon these days that I always assume any malfunctions are due to government interference. A human making a mistake while programming or using a computer? Not bloody likely. The government trying to infect my laptop with malware contained in a replacement keyboard? That's the only possible explanation!
Every PC comes with malware already installed by most manufacturers. (Yes, if I have to spend time removing bloated stuff it's malware, I don't care if it's an "antivirus demo" or something like that)
Now, if it's a hardware detail, this is more interesting.
Not all malware can be removed the way you remove that antivirus demo. From the Der Spiegel article[1]:
> Take, for example, when they intercept shipping deliveries. If a target person, agency or company orders a new computer or related accessories, for example, TAO can divert the shipping delivery to its own secret workshops. The NSA calls this method interdiction. At these so-called "load stations," agents carefully open the package in order to load malware onto the electronics, or even install hardware components that can provide backdoor access for the intelligence agencies. All subsequent steps can then be conducted from the comfort of a remote computer.
Naturally, if they also load a keyboard logger or whatever, no amount of formatting that new laptop would help.
What about changing your BIOS to intercept keystrokes? Or hacking the hard drive firmware, so they would have the master key for your encrypted disk next time you cross the border? A lot more effective than any other software-based solution.
A few years ago we'd say this is all crazy conspiracy theory. Nowadays this this is just NSA's business as usual tactics [1].
[+] [-] rwg|12 years ago|reply
[wild audience applause]
THAT'S RIGHT, it's time for WHICH IS MORE LIKELY?!
[intro music]
Today on Which is More Likely?, we're looking at a replacement Lenovo Thinkpad keyboard that was shipped to Alexandria, Virginia, instead of Seattle, Washington. What a blunder! [slide whistle sound effect]
Now put your thinking caps on and ponder, WHICH IS MORE LIKELY?!
• The largest intelligence agency on the planet, recently outed by Snowden's leaked documents for operating a multi-decade worldwide dragnet that secretly gathered communications on hundreds of millions of people, was too incompetent to have the US Postal Service display tracking information that hides the fact they're modifying a laptop keyboard in order to somehow spy on a Tor developer.
ORRRRRRRRRR!
• The third-party seller who uses Amazon to accept orders screwed up and gave Amazon the wrong tracking number.
That's all we have time for on today's episode of Which is More Likely? Don't change the channel! Up next is a BRAND NEW episode of Godwin's Law and Order! Good night from Hollywood!
[outro music]
[+] [-] icambron|12 years ago|reply
* The world's largest online retailer that does $54M in sales per day has a bug in its procurement system that randomly transposes tracking codes.
ORRRRRRRR!
* The intelligence agency whose massive scope and pervasive operational shortcomings were recently exposed by one low-level operative had a slip-up in applying a well-publicized tactic to an obviously high value target.
On the other hand, what's great about your way of putting it is that it juxtaposes your belief in the all encompassing nature of the NSA's programs with your incredulity that such a program might have been applied specifically here. I also like the part where the NSA is guarded by the Catch-22 "it wasn't them, because if it was, you'd never know", such that that there's no scenario in which you could be convinced that the NSA did anything.
And yet again, maybe it's time to stop thinking of the NSA as some far-off abstraction and start thinking about it is an actual thing that affects our daily lives.
[+] [-] busterarm|12 years ago|reply
Imagine that we're not in the US for a second and that this were a journalist? Would your opinion of what happened change?
It would have to be a mis-delivery at least instead of a "wrong tracking number". How likely is it that Amazon would ship something from a CA warehouse and it take more than 2 days to get to Seattle? Also keep in mind that USPS does Saturday delivery.
Also, nice defense of the NSA, but keep in mind this is the same intelligence agency that gave pretty much unfettered document access to independent contractor Systems Administrators.
[+] [-] atmosx|12 years ago|reply
NOTE: In “War and Peace” - Tolstoy’s masterpiece - there’s a Russian officer (Prince Andrey IIRC) who realizes the insane tragedy of human history: While the Prussian and Russian army coalition (hundreds of thousands of men, with families and lives left behind…) is about to face the fiercest opponent of their era (Napoleon, is a legend among Russian military officials) the two Generals (Prussian and Russian) are fighting and sabotaging each other about who is going to lead the battle… Until it’s too late. They both get easily crashed, without putting up a fight.
So you can play naive, stupid, stunned or cunning all you like but human history is FULL of stupid people in position of power.
[1] Quora: “Does the NSA have better engineers than Facebook or Google?”: http://www.quora.com/Engineering-in-Silicon-Valley/Does-the-...
[2] “BlackHat USA 2011: SSL And The Future Of Authenticity”: http://www.youtube.com/watch?v=Z7Wl2FW2TcA&feature=youtu.be
[3] “K. Alexander lies to congress” - http://www.globalresearch.ca/nsa-chief-lies-to-congress/5339...
[+] [-] mverwijs|12 years ago|reply
Seemed funny then, too.
[+] [-] milsorgen|12 years ago|reply
[+] [-] SideburnsOfDoom|12 years ago|reply
[+] [-] mindslight|12 years ago|reply
This should be easy to find out. Check if the tracking number on the website differs from what's printed on the package itself, and if so what the tracking for it looks like.
[+] [-] im3w1l|12 years ago|reply
[+] [-] scythe|12 years ago|reply
It's science time. Ideas are tested by experiment.
Have other NSA-intercepted laptops displayed this sort of diversion in USPS tracking? Is this the only case of its kind?
[+] [-] unknown|12 years ago|reply
[deleted]
[+] [-] unknown|12 years ago|reply
[deleted]
[+] [-] mikeash|12 years ago|reply
Edit: I want to emphasize how incredibly stupid the article is when analyzing the tracking data. Key quote:
"From Dulles, it moved another four times around the military and intelligence belt in suburban Washington DC, finally landing in Alexandria at 11:03 am on January 23."
First of all, there is nothing significant to Dulles. It's the largest airport in the area, and this makes it the arrival point for any packages coming in by air. 90% of my packages have a "Dulles, VA" tracking entry on them by the time they get to me.
Second, it didn't move "four times". It went from Dulles to a carrier facility in Alexandria, then it went out for delivery and got delivered. That's two moves. And how many times do you expect it to move? That's how air-based package delivery works. It goes to an airport. Then it goes to a local sorting facility. Then it goes out for delivery.
Third, the phrase "military and intelligence belt" is ridiculous. Especially so when the only two locations involved are Dulles and Alexandria, neither of which has much in the way of either military nor intelligence.
The article tries way too hard to make its case, and uses a great deal of purple prose to state what comes down to, "the package got delivered to Alexandria, VA which is close to a lot of government agencies". That would actually be more convincing than the insanity they wrote, although still not very convincing. But at least it would be honest.
[+] [-] skue|12 years ago|reply
And imagine if you were Andrea and you develop software that dissidents around the world depend on with their life, while also knowing the NSA has simultaneously tried to weaken it. If the laptop does get rerouted to her with an apology from USPS and you were her, are you saying you wouldn't hesitate even a little before accepting it and transferring your data onto it?
Ultimately, I think that's the real story here. The biggest problem with having a government that watches its citizens isn't the watching per se, it's the loss of trust.
[+] [-] chmars|12 years ago|reply
[+] [-] NN88|12 years ago|reply
ARE YOU SERIOUS?
Come.
On.
[+] [-] tzs|12 years ago|reply
Then I read the article. The tacking data shows a delivery to a destination near the NSA.
Does anyone here seriously think that the mechanism the NSA uses if they want to tamper with a laptop on the way to simply change the destination address to be the NSA? And that no one has noticed this before?
If they are intercepting and modifying domestic shipments, the mechanism would be something that is executed AT the shipping carrier facilities or possibly during the final delivery, and would be completely transparent to outside observers, including both the sender and the receiver of the package.
Watch the "Modern Marvels" episode on package delivery for a look at how the automated package movement systems work at the major hubs, and you'll see how a package could be diverted for special treatment and then re-inserted into the system transparently, with most workers at the facility having no idea something special is going on.
The best chance at detecting this from outside would probably be to look at next day delivery orders on items that would be the most time consuming to modify, to see if those are more likely to miss their delivery deadline. The idea is that with such a tight schedule, the chances are higher than an interception will blow the delivery schedule. For items ordered with two day or longer shipment, the delay in modifying the item could be made up by upgrading it to one day delivery in the system when it is re-inserted. That's why observing one day delivery items is the best bet.
[+] [-] fnordfnordfnord|12 years ago|reply
No that doesn't pass the giggle test. If it has anything at all to do with the NSA, it's a blunder.
[+] [-] kevinchen|12 years ago|reply
[+] [-] viraptor|12 years ago|reply
Just googling for "funny delivery tracking route" for example will give you things like:
- 4 times over the ocean - http://i696.photobucket.com/albums/vv325/oneupmanship34/Fg0e...
- let's send it to Canada, 3 times - http://i30.photobucket.com/albums/c325/duffer987/UPSFTD_zps6...
- Germany, HK, Germany, HK, ... - http://laforge.gnumonks.org/fun/dhl-hk-leipzig-hk-leipzig-hk...
Getting a strange route within one country is probably an improvement compared to those...
[+] [-] theboss|12 years ago|reply
Dulles has a lot of government contractors and big companies in the area, but that's about it.
What would be suspicious is if it went from Dulles to Langley, from Langley to Ft. Meade, from Ft. Meade to Quantico, and from Quantico to Alexandria....but Dulles to Alexandria is really standard.
edit: It isn't like it got back on a plane and went back to Seattle to be delivered to this girl. It looks like they straight delivered it to the wrong city. The government has pretty good OpSec when it comes to things like this. You think they would straight up route her package through Ft. Meade if they were planning to install malware on her computer?
[+] [-] mikeash|12 years ago|reply
[+] [-] unknown|12 years ago|reply
[deleted]
[+] [-] jhgg|12 years ago|reply
[+] [-] linuxhansl|12 years ago|reply
The point is that there is now speculation (and in fact a, albeit remote, possibility) that this could have been the reason.
The loss of trust in the Government is what makes this a story.
[+] [-] fnordfnordfnord|12 years ago|reply
[+] [-] ghughes|12 years ago|reply
[+] [-] slashdotaccount|12 years ago|reply
[+] [-] DangerousPie|12 years ago|reply
[+] [-] kriro|12 years ago|reply
If it was posted before...why would you do that.
[+] [-] polack|12 years ago|reply
[+] [-] EricBurnett|12 years ago|reply
[+] [-] NN88|12 years ago|reply
Do you all expect to see "SECRET NSA WAREHOUSE" on the packing slip?
[+] [-] peterwoo|12 years ago|reply
http://en.wikipedia.org/wiki/Betteridge%27s_law_of_headlines
[+] [-] unknown|12 years ago|reply
[deleted]
[+] [-] blowski|12 years ago|reply
...However, since hypothetically this could happen, how could it be prevented? Would there be some unbreakable way for a manufacturer to tell you if the keyboard had been tampered with?
I was thinking of those silver foils that are now put over a lot of food items so that crazies can't put stuff in them in the supermarket. I appreciate wrapping it in plastic probably wouldn't be enough to defeat the security services, but you get the idea.
[+] [-] VonGuard|12 years ago|reply
[+] [-] fnordfnordfnord|12 years ago|reply
Why wouldn't they? At the very least a TOR developer might find themselves in the same room with interesting people.
> when the federal government contributes a great deal of TOR code
The US gov isn't a single monolithic entity with a singular purpose and every person working in lock-step.
> and actually runs exit nodes as a matter of research?
I wouldn't trust a gov't run TOR node. It may be fine for dissidents in uninteresting countries, but not for anyone who wants to keep their privacy safe from the US gov't.
[+] [-] Smegger|12 years ago|reply
[deleted]
[+] [-] jrockway|12 years ago|reply
[+] [-] maerF0x0|12 years ago|reply
[+] [-] raverbashing|12 years ago|reply
Every PC comes with malware already installed by most manufacturers. (Yes, if I have to spend time removing bloated stuff it's malware, I don't care if it's an "antivirus demo" or something like that)
Now, if it's a hardware detail, this is more interesting.
[+] [-] trauco|12 years ago|reply
> Take, for example, when they intercept shipping deliveries. If a target person, agency or company orders a new computer or related accessories, for example, TAO can divert the shipping delivery to its own secret workshops. The NSA calls this method interdiction. At these so-called "load stations," agents carefully open the package in order to load malware onto the electronics, or even install hardware components that can provide backdoor access for the intelligence agencies. All subsequent steps can then be conducted from the comfort of a remote computer.
Naturally, if they also load a keyboard logger or whatever, no amount of formatting that new laptop would help.
[1] http://www.spiegel.de/international/world/the-nsa-uses-power...
[+] [-] guiambros|12 years ago|reply
A few years ago we'd say this is all crazy conspiracy theory. Nowadays this this is just NSA's business as usual tactics [1].
[1] http://news.cnet.com/8301-1009_3-57616334-83/nsa-reportedly-...
[+] [-] yuhong|12 years ago|reply
I don't like this, there is a reason there are different terms.
[+] [-] brianbarker|12 years ago|reply