[HN Gopher] Swiss spy chief exits after reports of row over CIA-...
       ___________________________________________________________________
        
       Swiss spy chief exits after reports of row over CIA-linked firm
        
       Author : Lammy
       Score  : 163 points
       Date   : 2021-05-13 07:30 UTC (15 hours ago)
        
 (HTM) web link (www.reuters.com)
 (TXT) w3m dump (www.reuters.com)
        
       | Krasnol wrote:
       | Oh somehow I expected it to be Threema GmbH but it's still just
       | old, plain Crypto AG.
        
         | rnestler wrote:
         | I'm not sure if this is a joke or a legitimate concern about
         | Threema. Care to elaborate?
        
           | giuolioN wrote:
           | from Threema own homepage:
           | 
           | "100% Swiss Made"
           | 
           | "Threema is a true Swiss company hosting its own servers in
           | Switzerland."
           | 
           | After Omnisec AG and Crypto AG, how is anyone falling for
           | that cliche again...
        
             | soziawa wrote:
             | This looks more like it is supposed to mean not Silicon
             | Valley, which is on point with the rest of their marketing
             | and what is written about them.
             | 
             | > Threema, die <<Antithese des Silicon Valley-Modells>>
             | 
             | https://www.srf.ch/news/wirtschaft/whatsapp-alternative-
             | thre...
        
             | aero-glide2 wrote:
             | Reminds me of protonmail too huh
        
             | dbrgn wrote:
             | In contrast to Omnisec and Crypto AG with their security by
             | obscurity, the Threema apps are fully open source with
             | reproducible builds: https://threema.ch/en/open-source/
        
               | giuolioN wrote:
               | 1. Only the client apps are open source, not the server
               | side.
               | 
               | 2. https://en.wikipedia.org/wiki/Underhanded_C_Contest
        
               | soziawa wrote:
               | > 1. Only the client apps are open source, not the server
               | side.
               | 
               | This shouldn't matter since you can't check what they are
               | running anyways.
               | 
               | > 2. https://en.wikipedia.org/wiki/Underhanded_C_Contest
               | 
               | This is true for any software. What is the point here?
        
               | giuolioN wrote:
               | My point is that selling encryption software as "secure"
               | is a difficult position, since nobody can really
               | guarantee the security, even with open source code.
               | 
               | Therefore the decision to choose a particular "secure"
               | software relies 50% on sound cryptographic practices, and
               | 50% on reputation. Yes, reputation.
               | 
               | Just like I wouldn't use a NSA "secure random" algorithm
               | [1], or a product that advertises 32768 bit key
               | encryption, I wouldn't use a product that advertises
               | "100% pure Swiss security" on its home page. It's a
               | negative reputation signal.
               | 
               | [1] https://en.wikipedia.org/wiki/Dual_EC_DRBG
        
               | soziawa wrote:
               | Fair enough, but it looks like you are misquoting them.
               | They never say anything about "100% pure Swiss security".
               | 
               | Their messaging seems to revolve much more around an anti
               | Silicon Valley proposition where you could substitute
               | Swiss for European.
               | 
               | Is Switzerland actually known to screw these kinds of
               | things up more than other countries?
        
               | gruez wrote:
               | So software coming out of Switzerland should be written
               | off completely?
        
               | polack wrote:
               | No, it should be treated as software coming from any
               | other country.
               | 
               | At this point it's just silly to brand your security
               | product as Swiss made in hopes of looking more legit. In
               | a sense I see it negative, just like some companies brand
               | their products with buzzwords such as AI and blockchain
               | for no good reason other then to look cool. Makes me
               | suspicious.
        
               | cedex12 wrote:
               | I think to the swiss market, branding it as 100% swiss is
               | both reasonable, and a positive point. So, not silly.
               | 
               | And for the international market, probably "swiss" is
               | mostly to be understood as "not american/russian/chinese"
        
               | giuolioN wrote:
               | Good question. I don't know. Personally, a company that
               | (1) works on secure encryption and (2) advertises "100%
               | pure Swiss" is a negative signal.
        
               | type0 wrote:
               | Proton mail does that, not so sure about the negative
               | signal but there is some merit of using a Swiss company
               | as a honeypot.
        
       | greatgib wrote:
       | It is crazy that the only consequence for I'm is to by fired.
       | 
       | I would have hoped that he be sent to justice for treason charges
       | or at least for "nefarious incompetence".
        
         | hutzlibu wrote:
         | "According to a Swiss parliamentary investigation, "Swiss
         | intelligence service were aware of and benefited from the Zug-
         | based firm Crypto AG's involvement in the US-led spying""
         | 
         | https://en.wikipedia.org/wiki/Crypto_AG
        
         | gccs wrote:
         | The government does not persecute itself. That is how it is
         | able to continuously break the law.
        
           | bobthepanda wrote:
           | Government persecuting former officials is a tricky problem,
           | because it's hard to strike a balance between
           | 
           | * government officials should be held accountable for
           | legitimate issues of legality
           | 
           | * government officials should not be totally paralyzed by
           | fear of being on the wrong side of the law
           | 
           | * government officials should not be targeted for prosecution
           | by vindictive successors just based on disagreement
        
             | dragonwriter wrote:
             | Government prosecuting citizens is a tricky problem
             | because:
             | 
             | * citizens should be held accountable for legitimate issues
             | of legality
             | 
             | * citizens should not be totally paralyzed by fear of being
             | on the wrong side of the law
             | 
             | * citizens should not be targeted for prosecution by
             | vindictive bureaucrats just based on disagreement
             | 
             | None of these issues, however, are _particular_ to citizens
             | who happen to also be government officials at the time of
             | the alleged incident provoking the prosecution.
        
           | dragonwriter wrote:
           | > The government does not persecute itself
           | 
           | Government isn't supposed to _persecute_ anybody.
           | 
           | ( _Prosecute_ is a different issue.)
        
         | comboy wrote:
         | I would guess that for CIA operations, it's pretty non-trivial
         | to prove something. On paper everything probably looked neat,
         | and they likely have some basic set of rules that prevents
         | stuff like discussing treason on twitter from happening. But I
         | agree and NBD should be clever too.
        
       | frankfrankfrank wrote:
       | The real news here is the crumbling facade of neutrality and
       | trust that the Swiss have for a while now been allowing to
       | crumble and run right through their fingers. They are playing
       | with fire in many ways, especially since much of their soft
       | defences have also eroded.
        
         | boomboomsubban wrote:
         | Switzerland has long been something of a playground for spies
         | because of it's neutrality. Their intelligence agency basically
         | ignoring what US and German spies were doing won't change the
         | opinion of those in power, and the public opinion of their
         | neutrality has already been tainted by Nazi gold.
        
         | soziawa wrote:
         | > The real news here is the crumbling facade of neutrality and
         | trust that the Swiss have for a while now been allowing to
         | crumble and run right through their fingers.
         | 
         | What else except the Crypto AG case is there? And if it is just
         | Crypto AG it seems folish to assume that a company is good just
         | because it originated in a certain country. But Switzerland
         | still seems like a fairly easy country to deal with.
        
           | kodah wrote:
           | Rather than rehash all this here, there are a lot of posts
           | about ProtonMail and the foundational claims they make about
           | being a company operated out of Switzerland. I'd suggest
           | reading those critiques. The process of becoming a
           | surveillance state is a slow one, you don't just wake up with
           | government operated/connected cameras on every corner.
           | 
           | Apparently rehashing is what we want to do. Here's some
           | links:
           | 
           | Switzerland's laws are the foundation of ProtonMail:
           | https://protonmail.com/blog/switzerland/
           | 
           | ProtonMail must comply with Swiss law, regardless of what
           | people think, and as Switzerland progressively becomes
           | surveillance state it will have to comply more:
           | https://www.securityweek.com/protonmail-accused-
           | voluntarily-...
           | 
           | This post on Reddit sums up, fairly well, what I usually hear
           | from privacy interested users of ProtonMail: https://www.redd
           | it.com/r/ProtonMail/comments/49u8vy/protonma...
           | 
           | For some more direct points: https://privacy-
           | watchdog.io/truth-about-protonmail/
           | 
           | While it may not be immediately obvious, if you follow each
           | of these points they connect back to compliance in some way
        
             | soziawa wrote:
             | > Rather than rehash all this here, there are a lot of
             | posts about ProtonMail and the foundational claims they
             | make about being a company operated out of Switzerland. I'd
             | suggest reading those critiques.
             | 
             | Looking at the top ten posts on HN about ProtonMail does
             | not give any such articles or top comments. So at least a
             | link would be nice.
             | 
             | > The process of becoming a surveillance state is a slow
             | one, you don't just wake up with government
             | operated/connected cameras on every corner.
             | 
             | Can you give any indication that this is more of an issue
             | in Switzerland compared to other countries?
             | 
             | This is very vague and looks like it is more of a critique
             | of ProtonMail instead of Switzerland as a whole.
        
               | kodah wrote:
               | I'm a paying ProtonMail user, so no, not really a
               | critique of ProtonMail.
               | 
               | Switzerland's laws are the foundation of ProtonMail:
               | https://protonmail.com/blog/switzerland/
               | 
               | ProtonMail _must_ comply with Swiss law, regardless of
               | what people think, and as Switzerland progressively
               | becomes surveillance state it will have to comply more:
               | https://www.securityweek.com/protonmail-accused-
               | voluntarily-...
               | 
               | This post on Reddit sums up, fairly well, what I usually
               | hear from privacy interested users of ProtonMail: https:/
               | /www.reddit.com/r/ProtonMail/comments/49u8vy/protonma...
               | 
               | For some more direct points: https://privacy-
               | watchdog.io/truth-about-protonmail/
               | 
               | While it may not be immediately obvious, if you follow
               | each of these points they connect back to compliance in
               | some way.
        
           | dillondoyle wrote:
           | Banking secrecy
        
       | aritmo wrote:
       | This is bad for the image of Switzerland. How can you trust them
       | with security sensitive issues ever again?
        
         | capableweb wrote:
         | I think you're overreacting. If the Snowden leaks thought us
         | anything, is that countries can spy on other countries and
         | their own citizens and eventually most people will forget about
         | it.
         | 
         | Same with this story. Eventually, people will forget about it
         | ever happening, and everyone will have the same view of
         | Switzerland as they had before.
        
         | anamexis wrote:
         | Why would you have trusted them before?
        
           | soziawa wrote:
           | Why trust anyone ever?
        
       | FridayoLeary wrote:
       | I was surprised to learn Switzerland even had a spy agency.
        
       | FreshFries wrote:
       | "Oh the consequences of my own actions!" -- Jean-Philippe Gaudin,
       | most likely.
       | 
       | I am proud that he has been removed from his position. The
       | initial reaction of my beloved government to this case was not so
       | strong and open as I had hoped, but this is at least a "clear"
       | statement that his betrayal is not tolerated / swept under the
       | carpet.
       | 
       | Now let's hope that this is the end of the drama that "Swiss
       | encryption" has been exposed to and the brand "Swiss neutrality"
       | does not suffer more.
        
         | z3ncyberpunk wrote:
         | How are the Swiss neutral? Chaotic neutral? They are some of
         | the biggest, corrupt money launderers known the world over?
        
       | markus_zhang wrote:
       | Guess it's sort of post cold war operation gladio
        
         | croes wrote:
         | Gladio and Echelon are almost forgotten, even Snowden's
         | revelations lose effect.
        
           | markus_zhang wrote:
           | I guess intelligence and military intelligence live in their
           | own worlds and are above the laymen's world. Back in the 70s
           | and 80s even most politicians didn't know about Gladio,
           | regardless of their political stand (left or right). If you
           | are not proved to be one of them, you won't even hear about
           | it.
        
       | natmaka wrote:
       | This is a very old and well-known case
       | https://en.wikipedia.org/wiki/Crypto_AG
        
         | himinlomax wrote:
         | Yes, I was surprised when it resurfaced as news recently,
         | having learned about it last millennium. I'm still not clear
         | about what's new here (apart from the Swiss politics angle).
        
           | boomboomsubban wrote:
           | The political angle is pretty significant, it's basically
           | stating the Swiss intelligence agencies were more loyal to
           | the CIA and BND than their own government.
        
             | himinlomax wrote:
             | Yeah, sure, but why is it coming up 25 years later?
        
               | makomk wrote:
               | As I understand it, one of the things that was only
               | discovered recently is that the Swiss intelligence
               | services knew about this and kept their own government in
               | the dark.
        
             | 1cvmask wrote:
             | There is no jail time for such a "crime".
        
               | boomboomsubban wrote:
               | No, but it's reasonable to expect the Swiss government
               | won't happily continue employing you.
        
               | [deleted]
        
           | makomk wrote:
           | What's new is that (amongst other things) evidence has come
           | to light proving that they were literally owned by the CIA
           | for most of their operational lifetime
        
         | dredmorbius wrote:
         | The story was broken in 2015, though only the bare outlines
         | were disclosed then. A much fuller disclosure came a year ago.
         | I would doubt that the general public is aware of it at all.
         | 
         | Dismissing this as "old" and "well known" seems highly
         | inaccurate.
        
           | morsch wrote:
           | Oh, it's way older than that. Here's a story from 1996:
           | https://www.spiegel.de/politik/wer-ist-der-befugte-
           | vierte-a-...
        
             | natmaka wrote:
             | Way, way older. At least 10 years.
             | 
             | See https://en.wikipedia.org/wiki/Crypto_AG#Compromised_mac
             | hines
             | 
             | Excerpt:
             | 
             | Crypto AG had already earlier been accused of rigging its
             | machines in collusion with intelligence agencies ((...))
             | Suspicions of this collusion were aroused in 1986
        
             | dredmorbius wrote:
             | _Suspected_ , as early as 1986. Confirmed via memo in 2015,
             | exposed in 2020.
             | 
             | Degrees of proof and documentation differ among these.
             | 
             | And this still fails to establish the "well-known" aspect.
        
       ___________________________________________________________________
       (page generated 2021-05-13 23:03 UTC)