Librems outside USA

So it is now well known that NSA was adding spyware to the cisco export from US to other countries hardware (switches etc), probably without cisco knowing this. The machines were opened and after modification were again packaged with factory seals. I read this here:
https://puri.sm/posts/why-freedom-is-essential-to-security-and-privacy/
and the links therein.

The obvious question is this: Since Purism sells to EU only from US (maybe with the exception of Germany) how do we know that the laptops or phones have not been
modified by NSA? Now or in the future. I think Purism must find a way to answer this. And if it is not possible to answer, then there must be a retailer in EU were products go directly from factory to EU.

Please comment!

2 Likes

Purism is at least thinking about this problem.

It’s a very challenging one to tackle, though, so I’m not sure how quickly you can expect a resolution.

Let me just say that retailer in EU won’t solve the issue - the goods may already be backdoored before they reach the retailer.

Purism publishes a warrant canary. That is the best we can ever hope for.

From https://puri.sm/warrant-canary/

  1. We have not placed any backdoors into our hardware, and we have not complied with any requests to do so.
  2. We have not complied with any National Security Letters or FISA court orders regarding our hardware.
  3. We have not been subject to any gag order by a FISA court regarding our hardware.

If we cannot trust their word that they have not added backdoors, we can’t trust anybody. We must check the hardware with an electron microscope ourselves.

We trust purism. We do not trust NSA.

When considering nation state intelligence agencies as a threat, you have to assume if you are doing something that they don’t like, if they target you specifically they will be successful. They have the time, money, technology and highly trained personnel to get to you. Being a specific target of a nation state is not a position anyone wants to be in, avoid it if at all possible.

But you basically have three controls you can implement as a defense that might work if you are just generally targeted.

  1. A high resolution CAT scan of the phone can reveal altered or added components. It would be swell if Purism could create a baseline scan for comparison.
  2. Flashing the phone on delivery and installing the OS yourself, might be enough to remove spyware installed in transit.
  3. By far the best option is to hand pick up the hardware from Purism offices and manually take it back to your home country. If you can keep the chain of custody in transit this is the only real way to know you got a clean phone from Purism.
1 Like

Well that is not how I see it. If a state agency wants to search my house they must get a warrant and I will get notified (probably). But to search my digital life without a warrant or my permission seems unacceptable to me. Mathematics (and cryptography) is not developed for NSA. It is developed for the people. They (NSA or similar) must be defeated in their game, although I have nothing to hide. It is a matter of principles. Not of an attempt to hide guilt.

2 Likes

I didn’t mean to imply an absence of constitutionality and due process is acceptable. Just that individuals and most groups can’t compete with nation states. If you have no reason for nation states to target you there is an acceptable degree of privacy you can achieve, it’s just a lot of effort right now. Hopefully the librem5 will lower that effort to achieve reasonable privacy quite a bit.

2 Likes

Don’t use that phrase. Ever. It’s a way of twisting words which authoritarians use to try and exert control, by attempting to force you on to the defensive. The more important question is rather whether they (whoever they might be) have the right to look - which is almost always no. Privacy is a fundamental human right and a core part of anyone’s individuality. Saying that you have nothing to hide is basically saying that you have no existence of your own, that your sole purpose is to serve your lord and that you are basically property with no private thoughts or things of your own.

7 Likes

Your are 100% correct. Thank you for this remark.

2 Likes

Not sure what the charge is for overseas shipping.

Where I am overseas, they charge an extremely high tax rate on imported electronics. Customs process is a real SOB. So I placed my order through Grabr.

People travelling to your location will place an order for goods online, the funds are held in Escrow, until the person delivers it to you. People travelling use it to make a quick buck on their trip.

there’s a saying in my country: “if you put an expensive metal door at the entrance you put a target on yourself”

personally i don’t believe in such statements because metal doors happen to just isolate sounds better so why would NSA or any other government inteligence agency believe that buying a FLOSS device is the same as having something to hide. maybe i do, maybe i don’t. it’s the same line everyone keeps using for proprietary black-box computers - you don’t know if the “cat is dead or alive” inside because you are prevented to do so but you are EXPECTED to TRUST that it is “alive”.

that beeing said i do understand that in THEIR line of work they do deal with REAL threats and that the SYSTEM is built in such a way that it CAN - if need be - bring the hammer down. i also think that preemptively they just prefer to induce fear in EACH and EVERYONE of us so that it is easier for them to do their job.

I have no FEAR. I only KNOW that what the CIA, NSA and other government intelligence agency (the ones of my own country included) are doing is in contra of the interest of the normal people and of the peoples. It’s not having fear, but not trusting them.

1 Like

if you do or not - i believe that fear is not incompatible with freedom but it takes finnese to apply POWER in a way that doesn’t contravene FREEDOM. *proprietary DOES contravene freedom because it takes away exactly that which is most important - seeing HOW something is built - thus taking away the posibility of improving it and creating waste in the process.

Just get a will call option. Not that hard… Let the customers decide how much of a travel expense they’re willing to rack up to get a computer.

1 Like

that beeing said i do understand that in THEIR line of work they do deal with REAL threats and that the SYSTEM is built in such a way that it CAN - if need be - bring the hammer down. i also think that preemptively they just prefer to induce fear in EACH and EVERYONE of us so that it is easier for them to do their job.

That implies that they’re at all successful in what they supposedly do. All you need to become a real threat is a gun and a mask, I don’t see the FBI doing anything to stop our regular mass shootings in the US. Not to mention the chances of actually dying in a terrorist attack, domestic or foreign, is less likely than winning the lotto. The “REAL threats” you talk about are just an over-hyped excuse for more funding. The only people they protect are themselves. Everything else is a facade. They don’t care how many citizens, aliens or foreigners are killed, they care about maintaining their grip on power.

1 Like

they just prefer to induce fear in EACH and EVERYONE of us so

Who is that? It’s great what purism is doing and has it occurred to you that some of their customers work in enforcement? Some of which who are genuinely disturbed by what they see going on around them and for that reason are buying/rooting for this phone to succeed too? This phone is not ‘just for activists’ any more than it’s ‘just for tech geeks’.

Please don’t gate keep in general and especially don’t gate keep consumer products.

Also, wasn’t this thread about Librems outside the USA?, because we’ve got real problems you likely haven’t even heard of (i.e. Thousands of bystanders caught in Toronto police sweep of cellphone data)

i’ll bump and link to the nothing-to-hide-documentary-about-surveilance-and-you here for those who missed it.

Purism publish 2 news about Made in USA Librem Key


  1. Does it mean that Purism now cooperate with NSA?
  2. USA have a many restriction to export of cryptography. How does it affect to cryptography strong of Purism products?
    https://en.wikipedia.org/wiki/Export_of_cryptography_from_the_United_States