Confidentiality Versus Anonymity

The Intercept has started a bit of a shit storm by pointing out that iMessage doesn’t encrypt metadata:

APPLE PROMISES THAT your iMessage conversations are safe and out of reach from anyone other than you and your friends. But according to a document obtained by The Intercept, your blue-bubbled texts do leave behind a log of which phone numbers you are poised to contact and shares this (and other potentially sensitive metadata) with law enforcement when compelled by court order.

Every time you type a number into your iPhone for a text conversation, the Messages app contacts Apple servers to determine whether to route a given message over the ubiquitous SMS system, represented in the app by those déclassé green text bubbles, or over Apple’s proprietary and more secure messaging network, represented by pleasant blue bubbles, according to the document. Apple records each query in which your phone calls home to see who’s in the iMessage system and who’s not.

Is this an affront to privacy? Is Apple showing bad faith in its promise to deliver a more security communication system? No and no. The issue at hand here is that Apple has promised confidentiality but hasn’t promised anonymity, which are two different things.

Confidentiality means that a communication isn’t accessible to unauthorized parties. In other words what was communicated is secret. Anonymity means that the parties communicating are secret. A confidential message isn’t necessarily anonymous and an anonymous message isn’t necessarily confidential.

iMessage and other secure communication applications such as WhatsApp and Signal use an identifier that are tied to your real-life persona, your phone number. Using phone numbers as identifiers allows these apps to easily scan your contacts list to see who does and doesn’t have the application. While they do keep what is being communicated secret they make no attempt to keep who is communicating secret.

Tor, on the other hand, attempts to provide anonymity but doesn’t necessarily provide confidentiality. With the exception of hidden services, every website you access through Tor goes through an exit node. Unless the site you’re accessing utilizes Transport Layer Security (TLS) the contents of the site are accessible to the exit node operator. On Tor the content being communicated isn’t necessarily confidential but the parties communicating are.

Applications such as Ricochet attempt (I use this qualifier because Ricochet is still experimental) to provide both confidentiality and anonymity. Not only are the communications themselves kept secret but the parties who are communicating is also kept secret. But since Ricochet users are anonymous be default the application can’t go through your contacts list and automatically inform you who does and doesn’t have the application.

There’s nothing sinister afoot here. Apple, WhatsApp, and Signal never claimed to deliver anonymity. Even if they didn’t use phone numbers as identifiers they still wouldn’t deliver anonymity since they make no attempt to conceal your IP address. Everybody that is freaking out about this is freaking out about the fact that Apple isn’t providing something it never claimed to provide.

There are no magic bullets. Before choosing the right tool for the job you need to develop a threat model. Unless you know what you are guarding against you can’t effectively guard against it. Confidentiality works well to protect against certain types of snoops. Law enforcers wanting to dig through the contents of messages to find evidence of illegal activities and advertisers wanting the same but to acquire information to better sell your products are threats where confidentiality is important but anonymity may not be required. Law enforcers wanting to create a social graph so it can target friends of specific individuals and censors wanting to learn who is putting out unapproved material are threats where anonymity is important but confidentiality may not be required. On the other hand, depending on your threat model, all of the above may be threats where confidentiality and anonymity are required.

Know your threats and know your tools. Make sure your tools address your threats. But don’t get upset because a tool doesn’t address your threat when it never claimed to do so.

Looks Can Be Deceiving

Saturday evening there was a multiple stabbing incident at the St. Cloud Center here in Minnesota. Although tragic there are some lessons that can be learned these kinds of situations and this incident is no different:

In a media briefing after midnight Sunday, St. Cloud police chief William Blair Anderson said an off-duty officer from another jurisdiction confronted and killed the suspect. He said the suspect — who was dressed in a private security uniform — reportedly asked at least one victim whether they were Muslim before assaulting them, and referred to Allah during the attacks.

Here lies our most important lesson. The attacker was dressed in a security uniform. This probably allowed him to get close to his victims without raising any red flags, which is important if you’re relying a knife. So the lesson here is that not everybody is exactly as they appear. Just because somebody is dressed like a cop or a security guard doesn’t mean they actually are one. Don’t let your guard down just because somebody is in a specific uniform.

One of my friends pointed out another lesson to be learned from this:

The mall remained on lockdown after the incident, but authorities expected those remaining inside to be released early Sunday. Photos and video of the mall taken hours after the incident showed groups of shoppers waiting to be released, including some huddled together near a food court entrance.

The officers trapped people inside the mall with the attacker. When the police arrived it wasn’t yet known if there were multiple attackers so the mall goers were potentially locked in a building with multiple people meaning to cause them harm. Being confined in an area with an unknown number of assailants is not a good place to be. If you hear that there’s an attacker in the building find the nearest fire exit and go through it. If you’re luck the police won’t see you leave. If you’re unlucky they’ll catch you but in that case you’ll likely be held in the back of a squad car, which is still a safer place than being confined in an area with and unknown number of potential assailants.

Keep your guard up when you’re out and about. Listen to your gut instinct. If that little voice in the back of your head is telling you something is wrong then you should listen to it. We’ve all been doing this human thing for our entire lives so we’re pretty good at subconsciously reading very subtle signs from one another. Anybody can put on any uniform they please but a uniform isn’t going to conceal all those subtle signs we use to judge one another’s intentions. If that voice is telling you the approaching security guard means you harm take heed and book it.

Be aware of all the potential exits. Fire exits are especially good in these kinds of situations because they usually trip a fire alarm. If it’s an audible alarm it will alert other people in the building to get out. If it’s a silent alarm it will still involve a response from the local authorities.

Finally, have a plan to defend yourself if escape isn’t an option. I recommend that people carry a firearm because they give you the best fighting chance. But even if you’re not willing or are unable to carry a firearm you should have some defensive response that you’ve trained thoroughly enough to be instinctual. Be it martial arts, mace, a baton, or even a knife. While you might not win a violent encounter even if you have a means of self-defense, you will certainly lose one if your response is to freeze up.

TANSTAAFL

One of the most important things for anybody to know is that there ain’t no such thing as a free lunch. Everything comes at a cost, even “free” things. Consider public Wi-Fi networks. Companies seemingly provide free Wi-Fi to customers as a courtesy. But those free Wi-Fi networks are revenue generator:

According to an article, which mall officials say they co-wrote, “while being an attractive guest feature, the (Wi-Fi) service simultaneously provides the mall with enough data to fill digital warehouses with information about what people do both online and in the real world while on the property.”

“This type of tracking can happen at any business, any location, any place that there’s any Wi-Fi networks,” Schulte said.

He explained that when your phone connects to Wi-Fi, it’s actually exchanging information with the network.

“You’re telling the Mall of America when you go to the mall, what door you go in, what stores you visit, what level you’re on, as well as what you’re doing on your phone.”

Asked if that means that mall officials could potentially know about it if someone logs onto Facebook while using the mall’s Wi-Fi network, Shulte answered, “Absolutely they know that you’re going to Facebook.”

This is the same paradigm used by websites that rely on ad networks for revenue. Instead of charging the user directly the provider simply snoops on the user and sells the information it collects to advertisers. In this way the advertiser becomes the customer and the user becomes the product.

I recommend against using public Wi-Fi networks. If you have to use one I recommend doing so through a Virtual Private Network (VPN). A VPN encrypts your traffic from your device to the VPN provider’s server. That means your data isn’t visible to the local Wi-Fi network and therefore cannot be snooped on by local network surveillance. Tor can work to a lesser extent in that you can conceal traffic that can be run through the Tor network but it’s not as effective in this case since most systems, with the exception of specially designed operating systems such as Tails, don’t route all traffic through Tor.

Whenever anybody offers you something for free you should try to figure out what the catch is because there is one.

Don’t Talk to Police

I know that it’s been said again and again but it bears periodic repetition: don’t talk to the police. Period.

Someday soon, when you least expect it, a police officer may receive mistaken information from a confused eyewitness or a liar, or circum­stantial evidence that helps persuade him that you might be guilty of a very serious crime. When confronted with police officers and other government agents who suddenly arrive with a bunch of questions, most innocent people mistakenly think to themselves, “Why not talk? I haven’t done anything. I have nothing to hide. What could pos­sibly go wrong?”

Well, among other things, you could end up confessing to a crime you didn’t commit. The problem of false confessions is not an urban legend. It is a documented fact. Indeed, research suggests that the innocent may be more susceptible than the culpable to deceptive police interrogation tactics, because they tragically assume that somehow “truth and justice will prevail” later even if they falsely admit their guilt. Nobody knows for sure how often innocent people make false confessions, but as Circuit Judge Alex Kozinski recently observed, “Innocent interrogation subjects confess with surprising frequency.”

People still mistakenly believe that the police are the good guys and that cooperating with them can only be beneficial if you’re an innocent person. In reality police are not the good guys, they’re the revenue generators for the State. Their goal of raising revenue can only be realized by charging people with crimes. So long as wealth can be expropriated it doesn’t matter to the State whether the person hauled in actually perpetrated the crime or not.

A false confession is just as good as a truthful confession to the police. Either one achieves their goal of raising revenue. That means any belief you have in justice prevailing is wrongly held.

When an officer wants to question you about something you should immediately shut up and lawyer up. Most politicians are lawyers and they have crafted the system to benefit lawyers. The downside is that you’re basically stuck handing money to lawyers if you’re accused of a crime. The upside is that a lawyer knows the ins and outs of the system far better than most police officers and can therefore provide you with decent protection (assuming they’re not incompetent). A lawyer, for example, knows what to say without confessing you were guilty of a crime. They also know the rules regarding admissible evidence and whether or not the police have a case without a confession. You (and me), as a layperson, are likely to naive about the legal system that you don’t even know what you don’t know. And that ignorance can land you in a cage for a crime you didn’t commit.

Have a Plan to Kill Everybody You Meet

Carrying a firearm is akin to wearing a seatbelt. You don’t know if you’re ever going to need it but it’s far better to have it and not need it than need it and not have it. There’s no way to predict when you’ll get into an automobile accident and there is no way to predict where or when you’ll be attacked or by whom.

This story highlights that:

Police say 53-year-old Michael Leroy Deyo and the victim worked together at the same Goodwill store since Deyo was hired in June.

On that Thursday afternoon, Deyo invited the victim to the barbecue, but when she arrived she was the only one there. Deyo told her it was going to be a surprise party, according to the criminal complaint.

The victim said they ate and talked, and after they were done eating Deyo said he was going to check the apartment unit across the hall, where he said the party was taking place.

He then asked the victim if she wanted to check the room with him, and she agreed. She said there was no one in the room, the lights were off and it appeared to be a utility room.

The woman said she “did not feel right about the situation” and grabbed her purse to leave. When she opened the door, Deyo grabbed her and forced her back into the apartment, putting his hand over her mouth, according to the criminal complaint.

The victim struggled with Deyo, kicking him in the groin and punching him. She said she grabbed a glass coffee pot and hit him in the head with it, according to the charges.

The victim said Deyo pinned her to the ground and said, “Stop screaming or I’ll kill you.” The victim said she was afraid she was going to die, so she became quiet while he kissed her.

A barbecue a coworker invited you to is generally not the kind of situation where you would expect to have to defend yourself but it can be. James Mattis was the one who said, “Be polite, be professional, but have a plan to kill everybody you meet.” It’s solid advice so long as you follow the spirit of it rather than take it literally. You don’t need to develop a detailed plan for killing everybody you meet but it’s smart to have a strategy as your default if someone tries to attack you and train in until it becomes almost instinctual. That way if you’re taken by surprise you will have an automatic go-to strategy to defend yourself. While a default strategy is a personal decision I strongly suggest carrying a firearm so your default strategy address armed assailants.

You can’t predict when or where, or by whom you may be attacked but you can have a plan of action that will increase your odds of survival.

Have a Plan

Several people have asked me about my thoughts regarding the rioting in Milwaukee. Truth be told, I’m only superficially aware of what happened. I know the police shot somebody, which was the spark that lit this fire but I haven’t had time to learn the details surrounding the shooting.

I will say this though. You should have a plan of action in case civil unrest developers in your area. Be it hunkering down and defending your home or evacuating to someplace safe, you should have a plan of what you will do if worst comes to worst. Then you should have a backup plan in case your primary plan fails.

Buying Guns on the Black and Grey Markets

Gun rights activists are riled up since it looks like we’ll be under a Hillary regime for the next four years (strangely enough, they don’t seem to be worried about Trump even though he has historically been a friend of gun control). As a service I like to provide practical solutions to problems. The Conscious Resistance is putting together a three part guide on buying weapons on the black and grey markets:

Buying firearms is a potentially risky endeavor. If you are reading this article at the original source, you probably already understand that there is a defacto registration system in place on the federal level. This is not supposed to be the case, but most people wouldn’t doubt the inability of the federal government to let go of a voluntary data collection system that by law requires a purge after 24 hours, especially regarding something as potentially dangerous to their power structure as firearms in the hands of ordinary citizens.

The first part, which is the only part posted so far, just explains some of the things to avoid when privately purchasing a firearm. But guides like this will likely become more valuable as the State continues to tighten its grip on society. While the laws may shift more against gun owners at some point that doesn’t mean gun owners will actually be restricted. Laws are only shackles insomuch as you allow them to be. A prohibition against buying a firearms is meaningless on the black market.

Politically there is no way for gun owners to win this election. Both presidential nominees have a history of opposing gun rights. But there are still things gun owners can do to protect their right to self-defense. Focusing on those efforts will offer far greater returns in the long run than getting the slightly less anti-gun president elected.

Minnesota’s LGBT Gun Rights Group Received Some Good Press

Are you gay, lesbian, bisexual, or transgender (LGBT)? Do you also like guns? Do you often find that your LGBT friends aren’t very enthusiastic about your interest in firearms? Do you often find that your gun friends aren’t very enthusiastic about your sexual orientation or identity? You can finally enjoy the best of both worlds because the Twin Cities has its own Pink Pistols chapter:

If you’re gay, it sometimes can be difficult to tell friends that you’re also a gun owner.

Mark Steiger describes it as “coming out of the gun safe.”

If you’re for both gay rights and gun rights, Steiger runs an organization you might want to join.

He’s head of the Twin Cities chapter of the Pink Pistols, a shooting group open to people of any sexual orientation that encourages gun ownership among the gay, lesbian, bisexual and transgender community.

It’s part social group, part gun-safety education provider and part advocacy organization devoted to preserving the rights of gays to protect themselves with firearms if necessary.

Making the gun owner community more inclusive is something I’ve touched on before. At one point the gun owner community was stereotyped as being a bunch of middle aged overweight white guys. That image is changing, especially as many of the old curmudgeon social conservatives die off. I greatly appreciate groups such as the Pink Pistols. They’re expanding the ranks of gun owners, which is always good in my book. More specifically they’re bringing people into the community that face higher than average rates of violence because there are still a lot of bigoted assholes out there who want to hurt them, which means they absolutely need a means of self-defense.

If you’re a member of the LGBT community, or just a friend, join them for one of their events.

Carry Permit Applications Spike in Florida

While gun control advocates are always quick to tell people they need to be more vulnerable, common sense seems to reign supreme. It’s not uncommon in the wake of a mass shooting for carry permit applications to spike. The most recent mass shooting in Orlando is a prime example of this:

Thousands of Floridians are looking to take personal safety into their own hands after the massacre at an Orlando nightclub last month.

In May, the Florida Department of Agriculture distributed more than 20,000 applications to people interested in a concealed weapon permit or other firearm license. That number jumped to more than 36,000 in June, according to recently released numbers.

The applications are either sent by mail or downloaded from the department’s website.

One of the reasons mass shootings are so frightening to the average person is because they demonstrate just how helpless unarmed individuals are against an armed individual. Gun control advocates, unwilling to face that fear, pray to their god, the State, to make all the bad things go away. People willing to face that fear take matters to mitigate their risks in case they find themselves in such a position. A byproduct of this practical attitude is that the general public becomes less vulnerable as more people within it are able to resist armed attackers.

Yes, Permit Holders Do Stop Mass Shootings

An awful lot of mass shootings occur in gun-free zones. While correlation doesn’t prove causality it can indicate a trend. When gun rights activists point this correlation out the other side of the aisle is quick to claim that no mass shootings have been stopped by permit holders so the correlation is irrelevant. It’s a false argument that can only be made because when a permit holder shops a mass shooter the event doesn’t turn into a mass shooting. But permit holders are out there and they do stop bad people with guns planning to shoot a lot of people:

LYMAN, SC (FOX Carolina) – Deputies with Spartanburg County said a man faces multiple attempted murder charges after opening fire outside a nightclub early Sunday morning.

The shooting happened around 3:30 a.m. at Playoffz nightclub on Inman Road in Lyman.

Deputies said 32-year-old Jody Ray Thompson pulled out a gun after getting into an argument with another man and fired several rounds toward a crowd that had gathered out in front of the club.

“His rounds struck three victims, and almost struck a fourth victim, who in self-defense, pulled his own weapon and fired, striking Thompson in the leg,” Lt. Kevin Bobo said.

Bobo said the man who shot Thompson has a valid concealed weapons permit, cooperated with investigators, and won’t be facing any charges.

What this story shows is the concept of defense in depth. Police officers were apparently elsewhere when the shooting start, which isn’t unusual as they can’t be everywhere at once. Had the shooter been left to his own devises would have likely shot far more people. However, his spree was cut short because there was an additional layer of defense. An average person with the capacity for force necessary to fight back fought back and in so doing probably saved several lives.