Librems outside USA


#1

So it is now well known that NSA was adding spyware to the cisco export from US to other countries hardware (switches etc), probably without cisco knowing this. The machines were opened and after modification were again packaged with factory seals. I read this here:
https://puri.sm/posts/why-freedom-is-essential-to-security-and-privacy/
and the links therein.

The obvious question is this: Since Purism sells to EU only from US (maybe with the exception of Germany) how do we know that the laptops or phones have not been
modified by NSA? Now or in the future. I think Purism must find a way to answer this. And if it is not possible to answer, then there must be a retailer in EU were products go directly from factory to EU.

Please comment!


#2

Purism is at least thinking about this problem.

It’s a very challenging one to tackle, though, so I’m not sure how quickly you can expect a resolution.


#3

Let me just say that retailer in EU won’t solve the issue - the goods may already be backdoored before they reach the retailer.


#4

Purism publishes a warrant canary. That is the best we can ever hope for.

From https://puri.sm/warrant-canary/

  1. We have not placed any backdoors into our hardware, and we have not complied with any requests to do so.
  2. We have not complied with any National Security Letters or FISA court orders regarding our hardware.
  3. We have not been subject to any gag order by a FISA court regarding our hardware.

#5

If we cannot trust their word that they have not added backdoors, we can’t trust anybody. We must check the hardware with an electron microscope ourselves.


#6

We trust purism. We do not trust NSA.


#7

When considering nation state intelligence agencies as a threat, you have to assume if you are doing something that they don’t like, if they target you specifically they will be successful. They have the time, money, technology and highly trained personnel to get to you. Being a specific target of a nation state is not a position anyone wants to be in, avoid it if at all possible.

But you basically have three controls you can implement as a defense that might work if you are just generally targeted.

  1. A high resolution CAT scan of the phone can reveal altered or added components. It would be swell if Purism could create a baseline scan for comparison.
  2. Flashing the phone on delivery and installing the OS yourself, might be enough to remove spyware installed in transit.
  3. By far the best option is to hand pick up the hardware from Purism offices and manually take it back to your home country. If you can keep the chain of custody in transit this is the only real way to know you got a clean phone from Purism.

#8

Well that is not how I see it. If a state agency wants to search my house they must get a warrant and I will get notified (probably). But to search my digital life without a warrant or my permission seems unacceptable to me. Mathematics (and cryptography) is not developed for NSA. It is developed for the people. They (NSA or similar) must be defeated in their game, although I have nothing to hide. It is a matter of principles. Not of an attempt to hide guilt.


#9

I didn’t mean to imply an absence of constitutionality and due process is acceptable. Just that individuals and most groups can’t compete with nation states. If you have no reason for nation states to target you there is an acceptable degree of privacy you can achieve, it’s just a lot of effort right now. Hopefully the librem5 will lower that effort to achieve reasonable privacy quite a bit.


#10

Don’t use that phrase. Ever. It’s a way of twisting words which authoritarians use to try and exert control, by attempting to force you on to the defensive. The more important question is rather whether they (whoever they might be) have the right to look - which is almost always no. Privacy is a fundamental human right and a core part of anyone’s individuality. Saying that you have nothing to hide is basically saying that you have no existence of your own, that your sole purpose is to serve your lord and that you are basically property with no private thoughts or things of your own.


#11

Your are 100% correct. Thank you for this remark.


#12

Not sure what the charge is for overseas shipping.

Where I am overseas, they charge an extremely high tax rate on imported electronics. Customs process is a real SOB. So I placed my order through Grabr.

People travelling to your location will place an order for goods online, the funds are held in Escrow, until the person delivers it to you. People travelling use it to make a quick buck on their trip.