News Orgs & Activists: Onionize Your Sites Against Censorship

I'd like to make a suggestion for a possible future brainstorming session at an NYC Tor meetup:

It is not inappropriate for brainstorming sessions to be more ambitious than codefests, and in that spirit:

When we think about how USG or another government might try to coerce a backdoor into Tor and other software which uses strong cryptography, we usually think of USG serving an NSL letter with an eternal gag order and a threat of indefinite imprisonment in a coffin-sized "black site" prison cell. But USG or another government could also try to coerce hardware providers into putting a backdoor into hardware, which could be difficult to defend against by technical means available to Tor Project devs, since "bare hardware" trumps even a "hardened" OS such as Tails. Is there anything we can do, technically and/or socially, to make it harder for a government to get away with coercing a chip maker in this way?

Another nightmare scenario, all too plausible in some parts of the world, involves "security authorities" with coercive access to the "command center" ("Head End System") of an "urban smart grid" to send commands to a specific smart meter which degrades or even shuts off the power to a particular household which the authorities wish to target. For example, power variations could perhaps be used to confirm that someone whom a sophisticated intelligence agency already knows is currently using Tor (because they saw recent connections to a Directory Authority) is the particular Tor user who is viewing particular content at the other end of a particular Tor circuit the spooks are watching. Or the cyberwarriors might wish to damage or destroy a targeted PC while it is in use. It is clear that many, even most, governments are eager to do such things, differing only in how they define "objectionable" on-line activity.

In some countries, a single command center controls the power grid of numerous cities, possibly even cities in different countries. It is widely agreed that the Russian government has cyberattacked the Ukraine power grid, shutting much of it down on at least two occasions. It may alarm US citizens to learn that Mosenergo, the Moscow power utility, uses a grid build by Landis+Gyr, as do numerous US cities. So the Russian government hardly need exert itself to obtain manuals and the actual gear which should be useful for developing cyberattacks on the US grid. Apparently in recognition of the increasing danger of such cyberstrikes, the Pentagon just announced it will retaliate with nuclear weapons against any attack on "critical infrastructure", which the DHS says includes power grids.

Snowden leaks suggest that GCHQ is very proud of a "computer network action" (cyberwar action) which appears to involve PLC (power line carrier) communications, in which commands are sent over a power line to suitable gear, which apparently can be used to obtain cryptographic keys. Because some smart grids apparently use PLC communications to send data from individual meters up to command center and to send commands down to the meters, this scheme may involve obtaining keys needed for GCHQ to take control of a power grid.

But could US or RU coerce makers of laptop and smart phone batteries to quietly introduce PLC (power line carrier) communication modules which could potentially enable "security authorities" with coercive access to "smart grid" "command centers" (such as the Landis+Gyr command center in Kansas City, MO) to take control of batteries as they are being charged in a "targeted" household? Or to coerce makers of UPS (uninterruptible power supply) gear to include modules which can act on PLC commands to behave abnormally, damaging phones and other electronic equipment in a targeted household?

In the US, "red" elements of the US federal government have recently been caught demanding lists of all households in certain "blue" cities which happen to be occupied by families with Hispanic surnames. Using their coercive access to utility records, it would then be very easy for them to add to these lists the unique machine ID of the smart meter which the utility has installed in each targeted household. (Malicious shutoff commands would be addressed by this unique machine ID.) This suggests that the future of genocide might begin with a government forcing "smart utilities" to selectively shut off power, water, and POTS/mobile phone service to a targeted ethnic group, or members of an oppositional political party.

IMO we should be thinking about how we can possibly try to prevent such horrid scenarios from ever being realized. It seems pretty clear that some governments have the intent, so we must try to ensure that they lack the capacity.

Is it possible that in future, OONI volunteers might be provided with suitable software which could possibly detect that suspicious PLC commands are being sent over a household power line? This might provide early warnings that some government is preparing for an attack on targeted individuals, or even a genocide against some targeted group of citizens.