12.16.09
Microsoft Assumes You Too Are a Criminal
“Technological progress is like an axe in the hands of a pathological criminal.”
–Albert Einstein
Summary: Microsoft treats everyone like a criminal with its COFEE software; preventive measures are therefore created
BACK in November we wrote about Microsoft’s COFEE [1, 2], which makes use of diagnostic/forensic antifeatures that Microsoft put in Vista and in Vista 7, right under many people’s noses. After Vista in particular, Windows is a really user-hostile piece of software and after a lot of noise (especially against DRM) people seem to have forgotten about it, much to Microsoft’s delight. They even renamed “Vista”.
In essence, Microsoft has Windows spy on any user by logging his/her actions. What is wrong with all this? Well, it is not there for the user really, thus it’s an antifeature; it’s there to be used against the user.
The danger of COFEE was explained by Bruce Schneier last week (incidentally in response to Eric Schmidt).
Schmidt said:
I think judgment matters. If you have something that you don’t want anyone to know, maybe you shouldn’t be doing it in the first place. If you really need that kind of privacy, the reality is that search engines — including Google — do retain this information for some time and it’s important, for example, that we are all subject in the United States to the Patriot Act and it is possible that all that information could be made available to the authorities.
This, from 2006, is my response:
Privacy protects us from abuses by those in power, even if we’re doing nothing wrong at the time of surveillance.
We do nothing wrong when we make love or go to the bathroom. We are not deliberately hiding anything when we seek out private places for reflection or conversation. We keep private journals, sing in the privacy of the shower, and write letters to secret lovers and then burn them. Privacy is a basic human need.
[...]
For if we are observed in all matters, we are constantly under threat of correction, judgment, criticism, even plagiarism of our own uniqueness. We become children, fettered under watchful eyes, constantly fearful that — either now or in the uncertain future — patterns we leave behind will be brought back to implicate us, by whatever authority has now become focused upon our once-private and innocent acts. We lose our individuality, because everything we do is observable and recordable.
[...]
This is the loss of freedom we face when our privacy is taken from us. This is life in former East Germany, or life in Saddam Hussein’s Iraq. And it’s our future as we allow an ever-intrusive eye into our personal, private lives.
Too many wrongly characterize the debate as “security versus privacy.” The real choice is liberty versus control. Tyranny, whether it arises under threat of foreign physical attack or under constant domestic authoritative scrutiny, is still tyranny. Liberty requires security without intrusion, security plus privacy. Widespread police surveillance is the very definition of a police state. And that’s why we should champion privacy even when we have nothing to hide.
Abuse of power is a true danger to democracy, which is precisely what laws were establish to prevent (e.g. requirement of a search warrant). But Microsoft is turning in all users to authorities/policemen, who can also abuse their power to weaken democratic dissent (here in the UK even pro-environment activists are abused, harassed and sometimes arrested after eavesdropping, despite doing nothing wrong). Microsoft does not make “COFEE-readiness” selective based on prior activity like a criminal record or inclusion in a suspects list.
Software that’s called DECAF has just made its debut and the Microsoft folks write about it.
Two developers have created “Detect and Eliminate Computer Assisted Forensics” (DECAF). The tool tries to stop Microsoft’s Computer Online Forensic Evidence Extractor (COFEE), which helps law enforcement officials grab data from password protected or encrypted sources.
[...]
More specifically, the program deletes COFEE’s temporary files, kills its processes, erases all COFEE logs, disables USB drives, and even contaminates or spoofs a variety of MAC addresses to muddy forensic tracks. It can be told to disable almost every piece of hardware on a machine and delete pre-defined files in the background. The 181KB DECAF program even has a ‘Spill the cofee’ mode in which it simulates COFEE’s presence to give the user an opportunity to test his or her configuration before actually using it. Source code for DECAF has not been made available, since the authors fear it will be reverse engineered, making it unclear what else the tool might be doing and whether or not it is completely safe to use.
This seems like a tool that any activist who is still not using Free software should make use of.
Is it not hysterical that Microsoft pretends that it cares about privacy? Microsoft remains a great threat to democracy. Unlike Google, Microsoft does not ask if you are willing to be spied on and there is no option to opt out, either. This spyware/malware is already preinstalled on most new computers. It’s ‘baked into’ Windows. █
dyfet said,
December 16, 2009 at 12:36 pm
Privacy is ultimately about liberty and security is always about control. Therefore human freedom and any form of mass surveillance, where you exchange privacy for the illusion of security and the efficiency of the state, can never co-exist. The question of reducing humans to children further brings to mind very basic questions of human dignity.
The very idea of proprietary software and this false thing so called “IP”, or more properly, Intellectual Restrictions, is that you can somehow give something to someone and yet also control what they do with it or even what they are permitted to think. This mindset makes it very natural I imagine to also to try and track what other people think and do, which converges well with the needs and philosophy of fascist states and societies. It is socially destructive in the most extreme, and one of the reasons I think the mindset of proprietary software is fundamentally an anti-social one.
Roy Schestowitz Reply:
December 16th, 2009 at 12:44 pm
Some new campaign ought to raise awareness of Windows’ impact on privacy.
Yuhong Bao said,
December 16, 2009 at 9:34 pm
“They even renamed “Vista”.”
Not exactly, but I discussed that one before, and it reminds me of Server 2008 R2, which Ars just reviewed positively.
“which makes use of diagnostic/forensic antifeatures that Microsoft put in Vista and in Vista 7,”
Really? Did MS really put features in Vista/7 specifically for this?