IE like Crypto AG:
In 2020, it was revealed that the Swiss company, Crypto AG, which provided secure communications services to ~120 governments throughout the 20th century, was secretly ran by the CIA and West German Intelligence. The CIA and later NSA were able to read encrypted communications for many countries such as Saudi Arabia, Iran, Italy, Indonesia, Iraq, Libya, Jordan and South Korea.
Proxies and VPNs seem like the most obvious targets. They mostly prey on people who don’t understand the technical workings thereof (had my mom ask if she needed to get a VPN bc firefox opened on ad for theirs, claiming it enhanced privacy), and serve little benefit to people who are doing the kind of illegal activities that make governments take notice. They serve as a single point of compromise for anyone, and they work worldwide so that all your traffic can be monitored even when you’re on a different ISP/in a different country. It’s like the perfect MITM, and people are even willing to pay to have themselves monitored.
The truth is that at best they benefit people who only don’t want their network-provider watching, but don’t care who else may be. It’s the perfect setup for a 3-letter agency to just sit and monitor everything anyone does, waiting for someone who’s just a little too careless to access illegal content thinking they’re anonymous.
They are perfect for torrenting though. The kind of activity 3 letter agencies don’t want their spying to be disturbed for.
they benefit people who only don’t want their network-provider watching, but don’t care who else may be.
Just FYI: It’s not the network provide we have to worry about in my country. That is specific to the USA I believe.
Here they have “headhunters” that make a contract with a rights holder, torrent a file, write down the IP of someone who uploads a video to them, then legally request the name to the IP and send an invoice for about $2000. No three warnings or anything. And they are very good at sending legal officials to impound any of your valuable stuff in case you don’t pay.
Even other “illegal” activity like calling Israel an apartheid regime or supporting palestine or insulting your head of state might get you flagged by a three letter agency, but they won’t use official legal channels. There is a protection of the herd with VPN.
Of course, nobody is going to have evidence here, if there was any the cover would be lifted. But one can guess chances here:
Proton: “Unlikely”… but there is a but. They never cater for the ultimate privacy and they make typical blunders of a company wanted to growth really fast. Now, that they want to be a behemoth in Privacy makes it more vulnerable to requests from law enforcement. Also, law enforcement and intelligence agencies have it easier to penetrate within Proton massive headcount growth.
Tuta: “Very Unlikely”. The people behind started very young and had a sustainable growth. The people are very visible (unlike Crypto AG) so least likely to be working for an “agency”.
Mullvad: “Very Unlikely”. I think their story is similar to Tuta (haven´t followed it that much though).
GrapheneOS: “Very Unlikely”. But in the last year I have raised some minor concerns, but I haven change my rating yet…
/e/: “Very Unlikely”. I know the dude behind for 2 decades, he wouldn´t. However, /e/ never claimed full privacy and from the beginning says he would comply 100% with “lawful” requests, but it is not a honeypot, not that would make much difference to an intelligence agency if they wanted it.
Signal: “Potentially”… yes, yes… audited, solid privacy code… but still does not make sense to me many aspects; financially solvent from day one, the extreme unquestioned massive and vast support from launching till today… if i have to bet in all of these providers, this platform would have been my take as potential compromised one. I still use it to communicate with family since I trust better than WhatsApp, but I would not use it for critical journalistic info.
Signal requires to use phone number, which in many countries is legally required to be tied to your personal identity. Like the SMS provider must have a copy of your id card. You’re basically naked to the CIA when using Signal. Even if not like in the US they presumably mass collect SIM and location correlations for ID. For the life of me I do not understand how anyone can promote that shit.
So the “honeypot” of Signal is that the mainstream promotes it as IF it was a privacy focused app when it’s very glaringly obviously is not. So the effect is that it prevents market space and attention for other apps actually focused on privacy without requiring ID to sign up. It’s a bit like introducing sterile insects to prevent the spread of unwanted pests (= actually secure communication).
