I hope he's doing well. He's made some (IMHO) poor choices, but I would probably not have done any better. So I cannot criticize him for that.
My only question is about the veracity of the data he's released, which to anybody who's had any actual exposure to secret documents, look like briefing documents rather than technical ones which would all be explicitly labelled with the appropriate secret stamp on each and every page. Yet there's no such thing on any document that I've seen.
It's been years since I had my clearance, so things might have changed. But the documents still depict things in generalities, it's not the type of document that would or could be used to design, let alone implement, the type of system that's described. They look like briefing slides with few details, like those presented to people who need a technical overview.
My main concern has been that people without the technical knowledge to interpret these documents have conflated the capabilities laid down in them.
As more information has come out, my first assessments were pretty close. Strong encryption is safe, but you'd better use public domain sources. E-Mail is unsafe unless you use a known safe server, even if it's encrypted. And then, server logs can still give NSA your e-mail meta-data even if they cannot crack the strong encryption. (They cannot, no matter what some people say.)
All Web services are inherently insecure, but we've known that for a very long time. Secure Web services are subject to the honesty of the provider. It's pretty damned sure that banks do not provide back doors. Nor likely does Amazon or any other large business whose livelihood depends on the secure integrity of their data. However, some will sell visit statistics to outside interests (while keeping financial info secure). Google does this, as likely does other non-pay sites.
Much of this information may be available to NSA if they want it (emphasis on "may" and "want" -- just because they can does not mean they are). Just don't assume Web is secure.
It's difficult to tease out the particulars of what is and what is not being gathered in these documents. There is little specificity. That's why I pay attention to people who I trust. Bruce Schneier is top of the heap in that regard. Phil Zimmermann of PGP fame is another. I trust them more than idle DU speculation.
Keep buggering on, people.
= new reply since forum marked as read
