According to Google Translate:

> Booking has never encountered espionage before. The company isn't really looking for it either. As long as it doesn't cause any hindrance, it won't cost you any money. The unspoken consensus among specialists within the company is: we suspect that intelligence services are watching, but as long as we don't see them, we don't worry.

What should make me believe that they don't have the same approach towards black hat hackers which are silently farming their data?

>> black hat hackers

How are foreign intelligence services not black hats? They are stealing data in order to use it for any number of non-nice things. Not selling the data on the dark web doesn't bleach their hats.

They are definitely black hats. Intelligence services operating in foreign countries (physically or digitally) are by definition criminals, in that they are breaking the local laws where they are operating / accessing.

That they are doing it for a 'good cause' (often debatable) is somewhat irrelevant, that is a risk/reward calculation that the country/agency/spy needs to make themselves.

If a a friendly country of the Dutch government wants to access records of a Dutch company (Booking.com), there are numerous legal methods to access this data. What's instead happening is that the CIA hacks NL companies and the Dutch RIVM hacks American ones and they share information/metadata with each other so that they can make and end-run around the legal constraints of both nations.

>the CIA hacks NL companies and the Dutch RIVM hacks American ones and they share information/metadata

The AIVD is the Dutch intelligence service, the RIVM is the public health institute. I don't think even the most out-there of Dutch conspiracy theorists have accused the RIVM of hacking American companies on behalf of the CIA...

Haha your are absolutely correct. Of course they are much more prominent in the news at the moment and my mind totally slipped.

Yeah but if you want to fly under the radar...

> That they are doing it for a 'good cause' (often debatable)

I would not count their fascist agenda a good cause. Inciting wars, performing illegal wars, putsching socialistic leaders neither, ...

> they are definitely black hats

Both intelligence agencies and cyber-criminals can be considered threats, but they are quite different. Intel agencies would present a serious threat to confidentiality, but are very unlikely to threaten the integrity & availability of business systems.

Illegal activities done with good intention (and usually outcome) is what the term greyhat is for. It would be fair to argue that's the correct term here for government agency hackers but personally I don't have strong enough stance on the subject to say either way.

The examples of the 'good guy' spies carrying out 'bad intention' activities are legion, and so the conclusion that trusting any covert intelligence organization is a good idea is extremely flawed.

I was mostly responding to this.

> They are definitely black hats.

There's a fair argument to be made that they're grey hat. On the whole though I agree with you and you shouldn't give blanket trust to people performing these kinds of activities. I would just assign a bit different value to a black hat activity (illegal and/or harmful and only beneficial by accident if at all) vs grey hat activity (illegal and potentially harmful but attempting to be beneficial)

Would Russia hacking a US election for example count as greyhat?

Unless you truly believe that interfering with the results of a free election is for the better of the participants of that election, no that's a black hat activity. There's nuance here since you have to think about perspective, no one is a villain in their own eyes, but personally I find the most useful perspective for the kind of hat to be from the victim.

This line of thinking comes from buying into the narrative that America (and west) is by definition good and so their activities are fine no matter what. They hack and steal data, we are ok with it. It's extremely dangerous.

If intelligence agencies are after you you’ve got way bigger problems than some fraudsters using your data for financial scams. It’s the same reason smart lock hacks don’t scare me… Anyone who is exploiting technology to gain physical access to my physical body is going to get me, regardless if I get hacked or not (e.g. thugs could just kick my door in, or wait outside and launch an ambush).

Even if a smart lock used ROT13 encryption, the easiest way to defeat it is still probably a mechanical attack. The state of mechanical security is a whole new level of weak.

The previous owners of my house dropped several hundred dollars on a Medeco lock.

Keys are a pain in the ass to replace, and there is literally a set of 3 windows within reach in the porch that could be opened trivially.

The biggest feature of any lock is breaking into a locked house is a felony for the perp.

My boss once bought a really expensive lock with a magnetic key. He was going on about how it was unpickable. When the key was forgotten one time, we found it could be opened by sticking scissors in and turning.

I'm not sure what the moral is. Your comment reminded me of this story.

My house has one sided locks all over it. Kids are constantly locking themselves out of rooms / bathrooms. We use dry spaghetti to unlock them. Keep a few above door frame.

Leaves guests bewildered when they come to stay.

I remember watching a Saturday Morning Cartoon of the 1966 animated version of the Incredible Hulk, where the evil mad scientist build this amazingly secure super-duper fancy high-tech Hulk-Proof Door that he was sure there was no way the Hulk could possibly open.

So the Hulk just knocked a hole in his stone castle wall next to the door, and walked into the lab.

https://www.youtube.com/watch?v=VuPYrRRNQkE

I hope at least the garage door, doors, and all your windows have 'circuit breaker'-style sensors (inside the window frame) that trigger the alarm when is activated.

Long time ago I had to upgrade my whole bloody alarm system of my old house because I wanted to insure a watch.

And if you ever accidentally lock yourself out, it's going to be a PITA. There's one good think about Kwiksets -- you don't always need to call a locksmith if you lock yourself out :)

Someone could easily get into my house in 20m with a reciprocating saw. The lock is only there to make it marginally more annoying to break in.

I would assume most are hackers for hire. Just because their customers are goverments doesn't change the fact they're selling their wares and data found.

Domestic intelligence services are also black hats. It isn't a matter of them not being black hats but about what they can get away with.

Right, they should pay for it from a data broker like everyone else.

> as long as we don't see them, we don't worry

If we don't know they exist... do they really exist?

Brilliant

How could allowing random countries to spy on your customers not be considered a hindrance?

Don't you think this would cost you future customers?

Not really?

I mean, this is probably a subset of "I don't have anything to hide, so why do I care about privacy?" But I just went to California on vacation, and, sure, I'll tell the CIA all about it if they want to know.

And I'm one of the people who understands why privacy is important. (Or maybe, based on my previous paragraph, you'll conclude that I'm not, I just think I am.)

I don't know. It just... doesn't feel that intrusive, for some reason. Maybe because for international travel, I already have to use my passport, so they already know. (Yes, maybe it's a different "they"...) Maybe because there's already a "do not fly" list, so somebody's hitting that database every time I try to book a flight, and it wouldn't be that hard for them to log the queries against it. I don't know. But as I said, at least to me, this one doesn't feel that intrusive... and I can't really rationally explain why.

Maybe it's arrogance to assume that most people are no more paranoid than I am. But I think that means that most people probably aren't going to avoid booking.com because of this.

There are many other state actors who can do this, and they wouldn't necessarily have good intentions. Wouldn't it be great if you could use it to identify which PEP (politically exposed person) is using booking.com to cheat on their partner, and use this as leverage to drive through certain political decisions ?

I agree most people aren't going to avoid booking.com, but that doesn't justify leaving your system vulnerable to advanced hackers

I don't think anyone assumes the booking for their next family vacation or business trip can't be tracked. They use their credit card and their telephone number at least

As for losing the customer base of drug kingpins and wanted terrorists, they're probably OK with losing them

You are assuming that the only black hat hackers are "trustworthy" Americans. There are a list of countries where selling on any of the collected data on the black market would either be condoned or actively pursued to maximise disruption. Would you be happy for a database of holidays to be sold to a crime ring to select their next best target for a burglary ?

Or more realistically, would you be happy for such state actors to identify PEPs (politically exposed person) who are potentially cheating on their partners and use this as leverage to drive through certain political decisions?

There is no such thing as a vulnerability that can only be abused by the good "guys"

That might be a reasonable expectation, that the government of the country whose company you use to book a hotel would know what you're doing.

But that's not this.

Booking.com is a Dutch company. The spy was American. And not even authorized by the US nor the Netherlands either.

Booking.com is kind of a Dutch company, at least the .com division, but it's actually owned by a American parent, "Booking Holdings", based in Norwalk, Connecticut.

They sold themselves to Priceline because Europe doesn't seem capable of funding startups.

True, too bad Klarna, Spotify, Snyk, Glovo, N26, eToro and more simply doesn't exist because they couldn't find funding :(

> As for losing the customer base of drug kingpins and wanted terrorists, they're probably OK with losing them

This is just the "nothing to hide" argument in reverse.

Sounds pragmatic, I wonder when this approach will backfire though.

I bet the attitude would have been very different had spying been done by China, Russia, Israel, or even the Netherlands itself.

It would have turned into one of the hundreds of articles about Russian, Chinese, Iranian, Ukrainian, North Korean, etc. hackers meant to solidify people's world view that we have a "good side" and a "bad side" of the world. The reality is that we have a "bad side" and a "worse side" but that's a hard pill to swallow for the regular person. Hence the deluge of articles meant to "straighten up" the view.

You’re mistakenly assuming that everyone sees intelligence services as bad, because as much as many people are concerned, “an enemy of an enemy is a friend.”

Nah - it is assuming they should be seen as bad actors and we would all be better off if they were all shoved feet first through a wood chipper but alas there is a tragic lack of identified targets, chippers, and people to shove them in.

We might get a couple or ten good years out of that, but it would leave an ecological void in human affairs to be filled in by bad actors. "Better the devil we know" is an unfortunately potent argument supporting the West's intelligence community.

Better legislation to restrain their abusive tendencies, and an endless global push for human rights, liberty, and human well-being is a solid long view, I think.

In as far as news editors and journalists believe this, they have lost their way.

Depends on whether they see it as competition. Given their market share, I don't believe they do. They're aimed at a western market.

They are quite active in Asia including China.

Lol you'd be suprised. Recently one large dutch newspaper published a scathing report published by CapGemini (large consultancy in NL) that researched the security setup at the largest telco in NL (KPN). They found that Huawei was able to listen, read and do pretty much anything they'd like with the data. But this was quickly swept beneath the rug. So no, I am pretty confident that the attitude wouldn't be different if either of those state actors seem to be responsible.

Here's a link: https://www.volkskrant.nl/nieuws-achtergrond/huawei-kon-alle...

You can circumvent the paywall by disabling javascript.

Archived version: https://archive.md/z3t8O

Note that it uncritically accepts report from 2009 which according to company was meant to be risk modeling exercise. Authors outright dismiss everything either KPL or CapGemini has to say themselves and does not even try presenting mitigations that presumably have been put in place, changes in infrastructure since 2009 and other more contemporary reports.

Bert Hubert publicized this event a year ago. And he is one of the most influential bloggers in Europe.

The problem is muuuuch larger.

For every newspaper article that covers actual US espionage, I can show you ten that speculate on the potential of espionage by Huawei and other Chinese companies.

I think we in western europe are kind of embarrased by US surveillance and the fact that we cannot do anything about it.

That is why we try to ignore it and not talk about it.

As an example, Belgium gave up its root CA in favor of Digicert-privided certificates. We could have avoided that.

If they become aware of espionage, are they not still obliged to report it under article 33 of the GDPR?

https://gdpr-info.eu/art-33-gdpr/

This is nonsense. Source: I have been working in the cyber security department of a major Dutch bank.

If US Gov espionage were discovered, would customers be notified - including ID'ng US Gov as the infiltrator?

If not, wouldn't that show deference to US Gov's interests (even indirectly)?

This is one of those interesting lines of argument where you position yourself so that you can't possibly be proven wrong. No one can prove you wrong when you claim that anyone with knowledge from the other side should be immediately discredited.

You mention sources, but if you discredit the first-party source out of the gate, what sources are even left? Documents from the bank created by the people you discredit?

(I take no position either way, I'm just commenting because your comment amuses me.)

I have been working there. I don't work there anymore. But I doubt that whatever I say could change your opinion, you seem to have your mind already made up.

Proof?