actorartathleteauthorbizcrimecrosspostcustomerservicedirectoredufoodgaminghealthjournalistmedicalmilmodpostmunimusicnewsworthynonprofitotherphilpolretailscispecialisedspecializedtechtourismtravelunique

I am Joseph Bonneau, 2013 NSA award winner for "Best Cybersecurity Paper". AMA!

Jul 27th 2013 by jbonneau_201307 • 24 Questions • 2652 Points

I won an award, I blogged about my opinions on the NSA, and I'm happy to take questions.

See: http://www.reddit.com/r/technology/comments/1j6fbm/google_engineer_wins_nsa_award_then_says_nsa/. Moving here for ease of QA. My original post: http://www.lightbluetouchpaper.org/2013/07/19/nsa-award-for-best-scientific-cybersecurity-paper/

Proof that this is me: http://imgur.com/832My77

EDITED TO ADD: Thanks so much everybody everybody for the questions, support and gold. I really appreciate it. This came up randomly in the middle of my day off to move apartments and I'm now hopelessly delayed packing and need dinner, but totally worth it!

Please everybody if you are able to, donate to the Electronic Frontier Foundation (https://www.eff.org/) and subscribe to their blog, they've been doing the most on this issue for years.

EDITED AGAIN: You can follow me on Twitter (@josephbonneau). I intend to tweet more often.

Q:

Did attending change your opinion of NSA at all?

A:

Not about the politics, but it was a good reminder that the NSA is full of decent people who aren't too different from the engineers anywhere else. They have a job to do and they're doing their best, and it actually stood out how much people working there do care about the rules and formal processes they have in place, unlike academia where people hate following rules. I think the main changes that need to happen are political, and changing FISA courts, and probably replacing some of the NSA leadership, but I can respect most of the people working at the NSA.


Q:

Thank you for bringing a rational interpretation of our situation to the proverbial table; what are some of your plans/objectives for the immediate future?

A:

Career-wise I have lots of interesting projects to work on at Google, perhaps I'll try to become a professor in the future. I enjoy research and teaching.

Life-wise I want to finish a half-Ironman this fall and get certified as an EMT.


Q:

I'd like to encourage you to go beyond EMT-B and obtain an EMT-P. It's a great personal challenge, and it really is knowledge that is applicable the rest of your life.

Thanks for the AMA!

A:

Thanks for the tip! I'm just getting started though so one step at a time. I'm hoping to do a WEMT/EMT-B first


Q:

Isn't this in many ways more worrying? If there's some hidden evil person then you can boot them. If, on the other hand, negative outcomes are just an emergent property of that many people trying to do the right thing in their small sub-universe of that bureaucracy, isn't that a lot harder to change?

A:

I agree that it's disturbing on a philosophical level. We're far from the first people to be having this discussion, search for "The Banality of Evil" and all of the subsequent literary discourse. I should say preemptively the NSA's surveillance is not in any way comparable to the crimes of Nazis, of course.

I disagree that this makes things harder to change though. This is why I have some hope that if we change the rules, and demand real oversight and limits on collection, the NSA (or some successor organization) can change in accordance with what we want as a democratic society.


Q:

What do you think the outcome of the NSA scandal will be in the end?

A:

My fear is that it will be treated as a normal "scandal", they'll fire 1 or 2 NSA executives, and none of the laws will change. I hope this becomes a well-known cautionary tale and is a constant reminder for future politicians that we don't want to go down this path, essentially an anti-9/11.


Q:

What do you think is the biggest obstacle in the way of ending the NSA's surveillance?

A:

Secrecy and lack of oversight. What we don't know is still the most dangerous thing here. If we get to the point where much more is publicly known about the scale of the NSA's operations, I expect there will be more pressure to scale it back.


Q:

You mentioned that you interacted with many people who legitimately believed their work at the NSA was right. How did they react when you presented some of the arguments against it? (unconstitutionality, specifically)

A:

NSA employees can't talk about this kind of thing at all so you don't get to directly have that conversation unfortunately. Perhaps it's different behind closed doors in the employee break room, but even then I doubt it's discussed a whole lot.


Q:

Hi there, thanks for the AMA. I've followed the NSA stuff just on headlines, so I think my knowledge of it would roughly fall around the average American's. If you don't mind, can you explain to me what the worry is with their collection of data? Is it the method they are using, or just the potential abuse, or what exactly?

A:

The biggest worry is that we don't know what's being collected, how long it's being stored, and what limitations there are on its use (or abuse). We know just enough to know we should be very concerned, but we don't really know enough to have a public debate about if the amount collected is "reasonable."

A second, very important issue is economic. The US is fortunate to be home to most of the largest web companies. That's a tremendous economic resource, but we'll kill the golden goose if other countries think US corporations can't be trusted with their data due to the local government, particularly when the law provides virtually no protection from eavesdroppping for foreigner's data held by US companies. Can we honestly tell people in other countries that they should trust all of their data with US companies?


Q:

The "golden goose" comment is a very important consideration, which is not reflected in the press at all. As far as I know, you are the first one who mentioned it.

Demoralizing the public spirit will also have a long lasting economical effect

A:

Not my point originally, this is a reasonably common thought in the valley. Slate did run it to their credit: http://www.slate.com/blogs/moneybox/2013/06/07/prism_tech_exports_will_nsa_revelations_block_american_companies_abroad.html

Agreed the media needs to pick up on this more.


Q:

How exactly does the NSA process all the data for all of us who are techno illiterate

A:

I don't have any inside knowledge about the NSA, but I imagine it's not too far away from how companies like Google, Yahoo, Facebook, Amazon, Microsoft store exabytes of data from webcrawls, email, etc. and make it available and searchable to users around the world on demand. It's actually all stored on millions of pretty-ordinary computers packed into special data center rooms with special cooling. Think a high-tech version of the room at the end of Raiders of the Lost Ark, that just seems to go on forever. Companies are very secretive of their data center setups, as is the NSA no doubt. Google has made some photos publicly available: http://www.google.com/about/datacenters/

You can learn much more about the software if you're interested. Read up on things like the Hadoop project, the best-known open source software. Basically Hadoop lets computer programmers access data stored on millions of computers as if it were all stored on one massive computer, without worrying about most of the details.


Q:

Google is secretive about its datacentres, yes. Not all companies are. http://www.opencompute.org/

(I work for FB.)

A:

Fair point, this is a good step by Facebook. I was thinking mostly of Google and Amazon in terms of data center secrecy.


A:

Interestingly, I interviewed at Palantir when I was graduating from Stanford and had the opportunity to be an early employee. Quite a few classmates did go work there and did quite well financially. I went to Cryptography Research instead because I was more interested in cryptography.


Q:

What do you feel is the best/most persuasive argument for maintaining the NSA as it is, and why do you disagree with it?

A:

The public argument I've seen is basically "this has protected us from lots of threats that you don't even know about and we can't tell you about or else we'd lose the ability to protect you from them" http://www.usatoday.com/story/news/nation/2013/06/18/nsa-surveillance-secret-programs-terror-plots/2434193/

I reject that argument because we have no way to tell if it's even falsifiable. We can't even have an argument about if the NSA's surveillance is an acceptable tradeoff for the security they provide, since we don't know what security they provide or even really what they're collecting (though we have some leaks on that).

It's important to realize secrecy is the #1 problem here. We can't debate surveillance properly without addressing that first.


Q:

Will Americans reach a point where change is made? Or do you think nothing major will come of anything?

A:

It's very hard to predict which direction society will change, though history shows we often underestimate the scale of changes that are possible. One of my favorite books is King Leopold's Ghost, which describes conditions in the Congo Free State barely over 100 years ago. The human rights violations are unfathomable today, yet changing them at the time was a crazy idea.

I hope this is one of those things that my kids will be amazed I'm old enough to have lived through because it seems so archaic, the way I'm amazed my parents lived through desegregation. Can we change it in 5-10 years? I don't know.


Q:

Finally on time for an AMA. What was your first reaction after being notified of your award? Did you immediately decide how to proceed?

A:

I actually thought it was a prank email or scam. It came from a strange address and was oddly written. The headers all checked out though.

Then it was a mix of emotions. That awkward moment when your research wins an award from an organisation you have deep misgivings about.


Q:

If you'd have another job, what would it be?

A:

Outside of computer science completely? Probably writing trivia questions and reading/hosting pub trivia. I did some of that as a student in England and I loved it.


Q:

Do NSA workers realize the danger of metadata collection?

What the what? Hello Reddit Gold! (obligatory edit)

Thanks!

A:

Well, they obviously realize the tremendous value of this data. I would guess most workers either don't think about the ethics much and leave that to higher-ups who have deemed it legal, or think it's a necessary trade-off to accomplish their organizational mission. This is all speculation though. People who work at the NSA, even ex-employees, never discuss this.


Q:

What's the best way to keep our information safe from these types of entities. Do you feel there needs to be a balance between security and privacy?

A:

There are technical tools to provide end-to-end encryption, which is what it takes. You can use PGP to encrypt your important communication if you want. Honestly the crypto community hasn't made these tools usable enough for the average person, which is a big failure that we need to work on. CryptoCat is an attempt to enable encrypted chat which is usable for everybody with no software installation, though it's not bullet-proof from a security standpoint. If you can install a mobile app, go with TextSecure/RedPhone or SilentCircle.

And not to plug my employer, but the Chrome development team (including some non-Google people, since it's an open-source project) has been leading the way on SSL/TLS security. There are a number of advanced features like key pinning that are important. Firefox is close behind on crypto quality. Avoid IE-they have not implemented HSTS years after Chrome and FF did (http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security).

EDITED TO ADD: Download HTTPS Everywhere for Chrome or Firefox to significantly increase the number of websites that you'll access over an encrypted channel. If you need anonymity, use Tor. The Tor Browser Bundle includes HTTPS Everywhere, that's about the best you can get right now.


Q:

What do you think the Computer Security landscape will look like in the next 20 years? Your paper was about passwords, do you think text passwords will be replaced or augmented?

A:

Augmented, not completely replaced. People have been claiming they're a year away from replacement for over a decade. Passwords surviving is a safe bet.


Q:

is censoring porn from the internet completely and utterly impossible?

A:

Today, completely censoring anything from the Internet that there is a very high public demand for is impossible. Porn falls into that category.

Censorship doesn't require making things impossible to access though, only difficult enough that most people will give up. That's why I'm very dismayed by the recently announced UK plan to have opt-out porn filtering at the ISP level. Opt-out censorship can be pretty effective.


Q:

What was this award for, exactly?

By this I of course mean to ask your career history in as much detail as you can be bothered to express.

A:

It was not a career award, just an award for a paper I wrote last year during my time as PhD student. You can probably find my resume online if you search for it. I did a BS and MS at Stanford, worked for a small company called Cryptography Research, did my PhD at the University of Cambridge (England), and now work at Google.


Q:

Do you fear that you'll be targeted for your opinions?

A:

Targeted by whom? There are thousands of writers who have said it all much better than I have.


Q:

What do you think will happen after saying NSA should be abolished?

A:

Nothing, honestly. It's just my opinion and it was easy enough to say. If it moves the discussion 0.0001% further, that's fantastic.

When people like Jimmy Carter are speaking up, that's a much bigger deal. Lots of journalists are pushing to get the story out, and organizations like the EFF are pushing the fight in court. That's where the real action is.

Personally, I'll try to keep doing research and working on technical solutions. I've done some work with CryptoCat and I hope to do some more in the future to make end-to-end encrypted chat more secure and easy to use, for example.


Q:

Okay, I'm gonna try and ask a question that hasn't been asked. The NSA collecting and storing data is obviously unacceptable to many Americans, and yourself, and I preface this by saying I am not attacking Google, and I staunch supporter. But why exactly are you worried about the NSA collecting all this data, with Google maintaining an equal or superior stash of information on people?

A:

Two important differences between data collection by government agencies vs. companies in general:

(a) You can opt-out of using any one company's products/services, though there's criticism that this can be too hard to do for some web services, at least it's there and can improve. You usually can't opt-out of government surveillance. (b) There are privacy laws that apply to private companies, particularly in the EU. Companies do have to reveal what they collect and are limited in a number of ways. They're not perfect laws, but they provide vastly more oversight than is available over intelligence agencies..