This weekly roundup thread is intended for all culture war posts. 'Culture war' is vaguely defined, but it basically means controversial issues that fall along set tribal lines. Arguments over culture war issues generate a lot of heat and little light, and few deeply entrenched people ever change their minds. This thread is for voicing opinions and analyzing the state of the discussion while trying to optimize for light over heat.
Optimistically, we think that engaging with people you disagree with is worth your time, and so is being nice! Pessimistically, there are many dynamics that can lead discussions on Culture War topics to become unproductive. There's a human tendency to divide along tribal lines, praising your ingroup and vilifying your outgroup - and if you think you find it easy to criticize your ingroup, then it may be that your outgroup is not who you think it is. Extremists with opposing positions can feed off each other, highlighting each other's worst points to justify their own angry rhetoric, which becomes in turn a new example of bad behavior for the other side to highlight.
We would like to avoid these negative dynamics. Accordingly, we ask that you do not use this thread for waging the Culture War. Examples of waging the Culture War:
-
Shaming.
-
Attempting to 'build consensus' or enforce ideological conformity.
-
Making sweeping generalizations to vilify a group you dislike.
-
Recruiting for a cause.
-
Posting links that could be summarized as 'Boo outgroup!' Basically, if your content is 'Can you believe what Those People did this week?' then you should either refrain from posting, or do some very patient work to contextualize and/or steel-man the relevant viewpoint.
In general, you should argue to understand, not to win. This thread is not territory to be claimed by one group or another; indeed, the aim is to have many different viewpoints represented here. Thus, we also ask that you follow some guidelines:
-
Speak plainly. Avoid sarcasm and mockery. When disagreeing with someone, state your objections explicitly.
-
Be as precise and charitable as you can. Don't paraphrase unflatteringly.
-
Don't imply that someone said something they did not say, even if you think it follows from what they said.
-
Write like everyone is reading and you want them to be included in the discussion.
On an ad hoc basis, the mods will try to compile a list of the best posts/comments from the previous week, posted in Quality Contribution threads and archived at /r/TheThread. You may nominate a comment for this list by clicking on 'report' at the bottom of the post and typing 'Actually a quality contribution' as the report reason.
Jump in the discussion.
No email address required.
Notes -
Not really his problem if he didn't have a clearance. The SECDEF shouldn't be sending out classified stuff over Signal; they shouldn't be doing government business over Signal at all, for that matter; the comparisons to Hillary are reasonable here. It appears the person who set up the group (Michael Waltz) intended it to be for unclassified discussion, but trying to discuss the same thing at one level of detail via an easy-to-use unclassified system and at another via a pain-in-the-butt classified system never works.
So what should they use? Slack? Google Messenger? Facebook messenger? AIM? Does the USG have its own private, secured messaging app? TBH, Signal actually seems like the best option if you need to have a group discussion with people all over the world and with conflicting schedules.
I mean...I'm open to alternatives, but what are they?
I’m confident they have one. I’d guess Teams.
Still no bueno for classified information, but if what Gabbard says is true, this chat was perfectly innocent on that front. :)
It is indeed Teams, which is another reason there will never be any prosecution.
Prosecutor: And is it true that you used Signal, a non-government communications method, to set up a group chat at the very highest levels:
Waltz: Yes
Defense Attorney : Mr. Waltz, what is the official government communications method for the Department of Defense
Waltz: Microsoft Teams Chat
Defense Attorney: Your honor, defense moves to dismiss with prejudice.
Prosecutor: Err, um, err... no objections
More options
Context Copy link
More options
Context Copy link
Are you kidding? The official, encrypted, auto-record keeping email system the government has used for the last 40 years.
The one they undoubtedly can't access from their private iPhones, because allowing that would be an obvious, glaring security flaw.
So they should have used email to decide to bomb Yemen and that would have been acceptable? Too slow, for starters.
I'm not really sure what the actual offense is here. I think it's accidentally adding an unrecognized phone number to a chat group, others think it's using the chat group in the first place.
More options
Context Copy link
Are you seriously proposing that people use e-mail for instant messaging? What is this, 1993?
“Security” is just a jobs programme for people who couldn’t get into the real police. They did it this way and what happened? Did the heavens fall down? No. Quod erat demonstrandum.
So the argument we're going with is "OPSEC is for suckers who can't even make it into... the police?" Uninspired trolling.
Yes. Emails are messages, and they are instant. Easy to lock down access, easy to encrypt with code 100% under your control. Decentralized, robust, fail-safe. Add rudimentary mailing lists if you need your "groups" organized, done. Millions of people have conducted complex discussions like that for decades.
How many planes did the Houthis manage to shoot down due to this “failure of OPSEC”? Zero. Therefore, the level of OPSEC that you want them to deploy is evidently unnecessary. OPSEC is not reducing military casualties; all it’s doing is giving “security personnel” a paycheck, and conferring no actual military advantage.
This is OPSEC’s “The emperor has no clothes” moment. All OPSEC’s recommendations were disregarded, and nothing bad happened. This proves that OPSEC is stupid, not that its violators are stupid.
I would also like to point out that anyone who condemns this “security breach” without in the same breath condemning Hillary’s e-mail server is double-standards-ing HARD. It’s OK when Dems do it?
Have you noticed that America's adversaries are not all nomadic camel herders with temporary access to Iranian missiles?
When the top ranks of the US government all conduct their business using some app on their private phones (as I assume they all do, the carelessness to invite a journalist by accident suggests group creation on signal is an every day rote task for them), it's basically guaranteed that foreign adversaries have access to much of that information.
At the very least Israel has enough expertise (via NSO Group's Pegasus) to have rootkit access to arbitrary smartphones. I'm 100% confident China has similar capabilities, and Russia and Iran might not be far behind (snatching the physical phone is always a realistic low-tech option, though). I have low trust in the EUs capabilities, but honestly, they might just be able to buy the tech as SAS. iOS and Android are extremely vulnerable, period.
And this is absolutely catastrophic, even if not a single aircraft is shot down - ever. Imagine going into negotiations with an adversary that knows your true goals and what arguments support them, and what pain points you want to mitigate.
Of course not! She was grilled for months on that, and for many good reasons. Might have cost her the election, even (probably not).
“Basically” seems to be doing a tremendous amount of work in this sentence. You’re constructing an entire catastrophic narrative from one piece of evidence where nothing catastrophic happened. Here’s an alternative take that fits the evidence just as well: when they’re discussing adversaries who have more hacking capability than stone-age Yemenis, they stick to more secure channels.
If this had been discussing China or Israel I would be more sympathetic to your concerns, but it’s bombing a group of people who have never seen a computer in their lives, not bombing 1337 h4X0rz. The Pareto frontier of convenience vs. security is placed in a very different location when Yemen is your foe vs. when China is your foe.
This is not how institutional OPSEC works. You need everybody to follow the rules, always. You can't just back-door your own system for "low-threat" scenarios, and have your users decide for themselves what "low-threat" is.
Ad-hoc decisions about the technological threat of a specific actor by people not qualified to do so leads to own-goals like Trump accidentally leaking the US spy satellite capabilities on Twitter. Sure, he was "only" talking about Iran, but the very same satellites also cross over China.
More options
Context Copy link
More options
Context Copy link
More options
Context Copy link
More options
Context Copy link
More options
Context Copy link
More options
Context Copy link
More options
Context Copy link
I am sure there are internal secure messaging apps both on the classified side and the unclassified side. They might be terrible however.
More options
Context Copy link
More options
Context Copy link
So Waltz set it up for interfacing for unclassified stuff like with journalists and forgot about it. So-and-so made a group chat, so-and-so invited so-and-so, and next thing ya know Jeffrey Goldberg is the only journalist in a Signal chat with the nation's leadership as they plan a military action?
This appears like a level of brazen, incompetent comfort that suggests to me they're probably using Signal for all sorts of coordination. Of which the only reasonable thing I can land* on is: other forms of communication are suspected compromised and they have an immediate need. But it's much easier for me to believe a sloppy disregard for procedure is commonplace.
Now that the US's rivals know this, how possible is it for them to compromise Signal's servers for some Man in the Middle breach? Is it true that even the Signal company themselves can't read user comms?
Signal is e2e encrypted so this isn't an issue.
More options
Context Copy link
More options
Context Copy link
While agree there must be some level of incompetence or just a screw-up, I really don't see which of the various chat apps would be better than Signal. AFAIK, it's the most secure almost to the point of being a problem for things like FOIA, as once the app is deleted all the message history is gone.
Anyway, I"m not sure I agree with the 'bad ops-sec' here and tend toward 'if you message the wrong person, you can't claw it back.'
What a happy coincidence.
More options
Context Copy link
If you are unsure of this despite the fact this article exists, then what do you consider an example of bad OPSEC?
If there is no inhouse Signal equivalent, then it's about 20 years past due. I bet there is and I bet it sucks and that's why they use Signal.
Wiping message history without recording keeping is a problem, because all text messages about official acts from federal agencies must be preserved. I guess politicians across the spectrum have decided this is not actually an important accountability feature in democracy nor are historical records important enough to bother. Fair enough.
Sorry, 'ops-sec' is not the correct term. the 'Ops-sec' was the failure. I think I meant something similar but specifically with the technology...Tech-sec or something.
Signal is the correct app to use if you're going to do these things--at least from what's on tap.
I think people are shocked that they didn't all assemble int he 'war room' to make the weighty decision to drop some bombs. The halcyon days of Dr. Strangelove are over, my friends.
I wonder if we'll even remember this happened in 3.75 years. Things are so whackadoodle, I can't tell if this is actually a scandal or not. Seems...not?
More options
Context Copy link
If there's an inhouse Signal equivalent would it be cleared for use on your garden-variety cell phone?
(Anyway yes I bet it sucks either way).
I have a bit of a rant about this but TLDR;
More options
Context Copy link
More options
Context Copy link
More options
Context Copy link
The boring answer is that "the official channels" require badging through a few locked doors to log into a desktop computer in a windowless room to check email, which isn't very responsive if you're trying to move very quickly across several tiers of organization.
That is a poor excuse, but it seems the most likely one to me. Either that or concern about opsec was minimal given the adversary's technical prowess, but that also strikes me as a poor excuse.
More options
Context Copy link
More options
Context Copy link
More options
Context Copy link