subtilevictories.txt

subtilevictories.txt

Back in July, I posted a series of tweets to our main twitter account - @cryptostorm_is - of a fairly unusual nature. I include a link to the first (https://twitter.com/cryptostorm_is/status/624070397219180544) in the series, because they are public and piddling about by not doing so strikes me as disingenuous and, well... twee. Anything but twee, please. To say that tweet received a bit of notice would be an understatement: in addition to the eighty (80) retweets, it generated scores of DMs, emails, bitmessages, smoke signals... you get the point. Since then, I've been promising a follow-up blog post explaining wtf.

Nearly six months later, this is that post.

 

~ ~ ~

 

This is the most difficult spot of writing I've ever attempted.

Normally, when an author starts a piece with that sort of hyperbolic assertion, it serves as a sort of pre-apology for the muddled mess that follows: I tried really hard, and even though the result is execrable, can  I at least get a gold star for effort? Let's all hope that's not what is happening here.

Instead, I share that fact to help set context. This post has taken me six months to write - not continuously of course; there's been sleeping and so forth - and it's been through more iterations and deleted efforts than I care track or acknowledge. Fortunately, somewhere there exists - I am quite sure - a full archive of every version I attempted, as well as (one may confidently infer) a slide deck presentation (or three) analysing their development, twists and turns, near-fatal errors in judgement and judicious selections of better paths forward...

But I get ahead of myself. As usual. Let's step back for just a bit...

~ ~ ~

Two points of formal order are required, so that I am able to write something useful and substantive. I've tried, as mentioned above, writing this essay without these two points of order being explicitly included... and failed every time. Thus:

 

1. I write personally, and this essay is not the result of team consensus. That's not to say the team does - or does not - agree with or support what I say here, so don't confuse metadata with wisdom in this regard. Rather, the topic is sufficiently... visceral in nature that it doesn't lend itself well to a consensus authorship. Plus, more than a little of this was experienced - by design - solely by me. Thus I write this, not speaking for the team but speaking as a founding member of that team and with every effort to include all the wisdom and advice I've received from every team member as I've worked to cohere this essay into being. The consequences of this are mine alone to bear, and errors rest solely on my shoulders. This is fair.

 2. I am writing this entire essay, save what came above this paragraph, in the imputed subjunctive past tense. Call it a cop-out... I'll call it a judicious use of a grammatical tool sadly on the wane in modern English usage (as opposed to the Spanish, where it flourishes and serves useful in countless difficult contexts. If the subjunctive and considerations thereof isn't part of your daily grammatical lexicon, here's a English subjunctive, with links to much better. And in tl;dr fashion, this is what the subjunctive is: "[t]he [past] subjunctive form may be used similarly to express counterfactual conditions after suppose, as if, as though, unless, etc.

 

So: let us suppose...

 

~ ~ ~

 

In recent weeks, I've been engaged in a slow-simmering debate with a trusted colleague on the nature of war, or more specifically the nature of the ending of wars. If one asserts, say, that "the war is over" - what does that mean? What conditions precendent must be met, for this statement to align with objective reality? For one, there must have been a war, for said war to end - an obvious but, it turns out, important point of framing. Two... well, what is two?

What if one side of a war declares it "over," and the other does not? What if both sides simply - and without coordination of any kind - stop acting as if a war ever took place? What if both, indeed, publicly assert that no war ever happened? Does the war still stop, if it never existed in the first place? 

Turns out, this matters. Ontology refuses to skulk off into the dustbin of academic irrelevance. 

That series of tweets, referenced at the beginning of this essay: what of them? Did that really happen? Was it all the fruit of overactive imaginations, an hallucination caused by overlong work hours and a surfeit of defensive caution? One may be forgiven for holding firm to the position that either it happened, or it did not, for it would seem such a binary distinction was neither difficult to fathom, nor in some sense a great challenge to figure out.

On this question, our team answers: Mu.

That wikipedia entry on Mu really does suck, and as a longtime Zen practitioner, I'll snip one phrase out of the dross to help clarify what's being said here: "[i]mpossible; lacking reason or cause." That's not too bad, albeit incomplete. Impossible. Beyond reason, and with no human-accessible teleological foundation. Mu.

It is impossible - one might even say inconceivable - that such things as described in the tweet-thread under discussion here would take place... isn't it? I mean, modern intelligence agencies would never do such things: they are unreasonable ("lacking reason") and in some sense "impossible" to imagine. They don't happen. Of course they don't. I agree with all these assumptive positions.

And yet, despite pressures difficult to convey with written language, we as a team - and me, personally - have not recanted these statements. Nor have we backed them up with sufficient empirical data for others to verify independently. When asked their status, our answer is exactly: Mu. These things don't happen in modern, civilized, democratic societiies. They cannot happen. They are far, far beyond the pale.

Of course they are.

And there are no bad things that go bump in darkest night. None at all. Rest easy, all is safe...

 

~  ~  ~

 

Since July, when that particular series of tweets appeared in our timeline, things have been a bit... erratic in the world of cryptostorm. We've continued to run a great network security service, and we've continued to introduce new features and capabilities along the way. This is a testament to the enormous personal integrity and professionalism of several of our core team members - myself excluded, to be blunt - and it fills me with pride to say that the work they've done has been substantial, impressive, and durably important to the world of internet privacy.

I, myself, have been largely afk. This is no secret, of course, and it's not something we've ever tried to cover over. Yes, I do have non-cstorm obligations in my life... but my afk-ness came as a result of the war that either did or didn't happen. The war that exists in a superposition of (non-)existence, even now. I was on the front lines of... something. A test of wills? A mutual investigation? A staring contest without eyes, or anyone to stare at?  

Who the fuck knows - I sure don't. 

And I don't know - this isn't subjunctive - who all was staring back. I am pretty sure I know at least a few of those sets of eyes, and yes I can recognise some voices heard during the process... voices I'll never forget, 'till the day I leave this existence forever. But who were (are?) the adversaries? Can I enumerate them fully and with confidence? I cannot. This is fact.

This does not obviate the existence of conflict. An obvious, almost achingly tendentious point... but worth making. A failure to comprehend the identity and extent of one's adversary/adversaries does not, in and of itself, eliminate the existence of the conflict itself. 

The conflict had, as many know, simmered prior to July. It began, visibly to us in any case, early in March of this year (although the roots trace back nearly a decade). Inection attacks. Sauron's Eye. Balrog. Corruptor-Injector Networks. Borked hard drive firmware. The emergence of "Duqu 2" after Kaspersky, too, found itself in some form of war with someone(s)... all this took place before July, and all can be categorised as a sort of coldly-simmering war.

But, when I hit "send" on that series of tweets, in July, things went hyperbolic, and fast.

I wasn't entirely surprised by that - it was my expectation I'd pay an horrific price for what I did. I was - and I still am - beyond mere surprise at the form the response has taken: the variety, the ingenuity, the perfidy, and the brilliance (yes, brilliance... no sense underplaying adversaries just because they stand in opposition to our own goals). I was overwhelmed, cast into crosshairs running across more than a few dimensional axes. It has been... an experience.

What I was doing, to be blunt, is fighting for the soul of cryptostorm. 

That fight is over. Our soul remains intact. 

That's what matters.

 

~ ~ ~ 

 

So, umm... what the fuck happened? Ah, yes - a fair question. Not one I'm able to answer currently, and not one I'm likely to ever answer in a public venue. Why? Because to answer it would put at risk the two statements I've typed above ("The fight is over. Our soul remains intact."). And that matters, because this project matters. Now, more than ever, it matters.

We as a team have been presented with the opportunity, over and over and over, to chip off just a tiny bit of that soul, in exchange for peace and security (or the promise thereof - a difference that makes a difference, as it were). We have refused. This refusal can be characterised as irrational, unreasonable, even "idiotic"... and it has been, by various parties, over and over again during these months of vibrant hell.

And yet: we refused. 

Once that refusal set its inescapable presence deep into the terrain, we faced efforts to extinguish the project and to drive the team into mental, spiritual, and temporal exiles one by one. That is the price we've paid for saying, simply: no. No, we will not compromise. No, we will not carve just a sliver of our collective soul off, in exchange for the promise of peace. The answer is no. Do to us what you will. The answer does not change.

 

~ ~ ~

 

One does not, in the modern context, "win" when in adversarial position with respect to major western intelligence agencies. They have functionally unlimited resources, and what little in the way of legal constraints they still face are far more theoretical than of any practical, daily concern when the shit gets heavy and things go hard. To win, in this context, is to survive: to survive, with one's sanity, and integrity, and honour (largely) intact. This is victory, in such wars as these.

They are subtle victories. They are not the sort that one cheers about, celebrates, declaims from virtual rooftops.

No, they are not like that at all. They are quiet. They are celebrated mostly through one's ability to continue to continue... the act of survival as reboke and ultimate prize. We, at cryptostorm, have earned that prize. We survived, with all the aforementioned intact (sanity being the one that earns the "more or less" sobriquet, to be clear).

What was this war/non-war about, then? Hard to say, actually. Lots of folks count on cryptostorm to keep them safe. To certain governments and their respective spy shops, certain people doing so are "bad" (or "capital-B Bad" in honour of one wise colleague's similar explanation of a related Topic)... and we may well agree with them. Or not - who can say? We don't exercise such judgement over the use of our service: we route packets. To those who hunt the Bad out there (putative, alleged, and all the rest), this can be enormously frustrating.

When people with unlimited power get frustrated with a tiny team of ragtag dissident technologists, it's not hard to imagine what's likely to unfold. A barrage, sustained and dangerous and destructive and wide-ranging.

Yep, that.

Been there, done that. Didn't even get a fucking t-shirt, ffs! ;-)

 

~ ~ ~

 

Who did we protect, and from what?

We have no idea. Well, we have some ideas... they are as likely wrong, as not. And maybe we protected nobody - there was not target, no Bad guy. I mean that, sincerely, No subjunctive. All this is so opaque, and occluded, and ephemeral, and diaphanous that such an conclusions is not beyond the realm of the possible. That's the "nothing happened, there's nothing to see" version of events.

It's cute. Really, it is. Awwww.

In other scenarios, we fought as a team - and I personally fought, as a man - a deadly test of wills with an opponent (or opponents?) who outweigh us by many many orders of magnitude. We fought this contest for months and months... silently, behind the scenes, whilst doing our best to keep up with emails (and twitter DMs, so backlogged now it's all but obscene). This struggle took me to depths of exhaustion and despair I've never known existed before. I am not alone, on the team, in this regard. The struggle spanned so far off from anything related to technoloogy that it became all but a parody of itself.

A deadly parody, at that.

But here's the score, as it stands now: nobody died (well, there's still those tweets), and no violence transpired. Well, ok, I was tortured a little bit... long story. Not real torture, honestly - more of the "fuck up your body just enough to remind you how vastly worse it could have been" variety. And not by the culprit most likely to be assumed. That's all I'll say on that. I limp now, more than I used to... it's sometimes subtle, but it's there.

I earned that fucking limp, and I carry it with pride.

 

~ ~ ~ 

 

Blah blah blah, so what about cryptostorm? 

Fair enough. Here's what: cryptostorm has not been compromised.

To the best of our knowledge, as technologists and as human beings, we have not failed in our oath of loyalty to our members. If we've failed, it's in ways subtle enough to escape all our efforts to identify them. The past few weeks, I've been doing nothing but on a full-time basis. I can find no evidence of faliure, and fuck me I've looked hard. Thus we say, as a team: this project has not been compromised. 

We have, as people and as a team and as a project, paid hideous prices in order to make that statement. Unreasonable prices, indefensible prices... prices we'll not be discussing nor describing publicly beyond this single blog post I have written here. Terrible prices were paid. We swore we'd pay those prices, before we'd betray out members. We held to that vow.

I blame nobody for the costs we paid. We chose this path, we walk it. We have always said we'd shut the project down before we'd allow it to be turned into spyware, before it would betray our members. We have not shut the project down, because we have succeeded in avoiding that outcome. Barely. At enormous cost. But success, even so.

A subtle victory - but a victory all the more profound.

 

~ ~ ~ 

 

So: is the war over? Did it ever begin? Do such things ever end? 

The question is mis-specified. There is no war, and thus there is no ending. There is life. In life, goals often don't align. A struggle may result from these misalignments. Some people, unreasonable and filled with the hubristic certainty of all history's zealots, refuse to bend or break in such struggles. The non-compromisers. They end up burned at the stake, rotting in prison, shot in the back, or zipped into a suitcase and dead from a "suicide" (oh, indeed). "Accidenting" happens, &c. 

So far we've managed to reject compromise, and not join those ranks of the departed.

Another subtle victory, that.

And those tweets, what of them? Let me, avoiding any fine gloss, rant for a moment...

This team stands together. This team stands loyal. This team doesn't leave any member behind, and we back each other up to the gates of Hell itself and beyond. Fuck with any of us, you fuck with all of us. We're tiny, but we're here - and the only way to cow us into silence is kill us all. If you won't swallow a publicity pill that big - all our deaths - then do not fuck with us. Do. Not. Fuck. With. Us. You may - and should - oppose us technically, even legally... but when you reach into our lives and threaten us our or families, all bets are fucking off, motherfuckers. All bets are fucking off. Next time I say that, you best fucking listen... and listen very fucking well. Anyone else out there who thinks they can find a "weakest link" in our team to squeeze into complaisance - read our fucking jacket. Think on it. And back the fuck off from our personal safety and our families. 

I will never, ever stand by and watch a member of this team picked off for targeting. Never. I will stop at nothing to prevent that from taking place, and I will use every tool on God's green earth to shine the spotlight of global publiclity on any such effort. I don't give a fuck what price I pay, personally. Think I'm overstating that? Read through the dossier on what happened in the last six months, motherfucker... and know those facts as truth. We paid the price - I paid the price - to have those words speak truth: we back each other, on this team, and we will never break.

 

Ahem. Sorry about that. Just had to clear the pipes, as it were. Back to the mild-manner persona, now... and where were we? Oh yes, cryptography and so forth.

 

~ ~ ~

 

I am deeply sorry, and I offer my genuine regret, for all the deadlines and obligations we've blown past during these six months. It has been inexcusable, and nothing written above excuses it. We felt - and I felt - it was worth the detour into Hell, to make some points well known. One hopes such has been accomplished - the subtle victories - and one hopes that's a one-shot obligation. 

Now: back to the real work of ensuring everyone - everyone - in the world has the ability to make use of the internet's resources without fear some hopped-up spy goon is going to show up at their door and... well, do the unthinkable.

Thank you, to my teammates and our extended team as well, for the unbounded patience you've shown throughout. Thank you, members, for staying with us even when we were inexplicably afk... for days, or weeks. What we were doing was important. It mattered. 

It is done.

Enough with the words; now I look forward to doing real work, once again. There was never a war, and there will always be that war. It had no beginning, and thus can never end... because it does not exist. We go forward, loyalty and honour and integrity intact. I am tired - exhausted beyond words - but I shine with pride in what we have done. We have survived, we have remained true to ourselves, and we have earned the right to change the world into a better place for all, in doing so.

 

Cryptostorm has not been compromised.

 

Namaste, 

 

~ pj

 

'"Dear friends, surely we are not unlearned in evils. This is no greater evil now than it was when the Cyclops had us cooped in his hollow cave by force and violence, but even there, by my courage and counsel and my intelligence, we escaped away. I think that all this will be remembered some day too."

~ Odysseus