Bruce Schneier | |||||||||||||||
Schneier on SecurityA blog covering security and security technology. « Stupid People Purchase Fake Concert Tickets | Main | Billions Wasted on Anti-Terrorism Security » June 2, 2005Deep Throat TradecraftThe politics is certainly interesting, but I am impressed with Felt's tradecraft. Read Bob Woodward's description of how he would arrange secret meetings with Felt. I tried to call Felt, but he wouldn't take the call. I tried his home in Virginia and had no better luck. So one night I showed up at his Fairfax home. It was a plain-vanilla, perfectly kept, everything-in-its-place suburban house. His manner made me nervous. He said no more phone calls, no more visits to his home, nothing in the open. Posted on June 2, 2005 at 4:31 PM • 27 Comments • View Blog Reactions To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter. Even with this being the digital-age a lot of these countersurveillance techniques are still taught and used today. Basically if you want to keep it secret : 1. you don't tell anyone Israel Torres Posted by: Israel Torres at June 2, 2005 4:58 PM It's before my time, but it sounds like Felt had a lot of experience running agents who wouldn't have had any formal training (e.g. foreign agents) . At any rate, certainly there will always be a place for low-tech operations. You can't master any skill without mastering basic principles. Posted by: Francois Kashy at June 2, 2005 6:49 PM Reminds me of a quote from somewhere: Posted by: Dylan at June 2, 2005 9:59 PM Well, I'm glad Felt did not follow the old rule of thumb about killing the person one tells the secret to. Posted by: dave at June 3, 2005 2:55 AM Using the back stairs only when going to a secret meeting - is that a good security measure? If your building is not being watched, then it doesn't matter whether you do it. If only the front of your building is being watched, then the observer never realises you left, and you win big. But if the back is also being watched, then the observer knows that you're going to a secret meeting. So you lose big, because he can concentrate his resources on following your taxis only when you're doing something interesting. It's probably more expensive to watch both sides of the building, but if the attacker ever figures out what you're doing, he doesn't have to watch both sides - only the back. I would be uncomfortable with relying on the attacker believing that you the front door is the only way you ever leave the building, especially if you think (as Woodward did) there might be an FBI surveillance post overlooking the back! Posted by: Anonymous at June 3, 2005 4:22 AM Killing anyone knowing the secret is not necessarily the 'best' choice, as in most countries homicides are investigated quite thoroughly and with perseverance (murder doesn't prescribe). Even more so if the victim is a public figure, such as a journalist who just uncovered a huge scandal. You might eliminate a person who could possibly leak the secret, but you draw a lot more attention and scrutiny to your affairs. Maybe blackmail or threats would be an option. // tinfoil hat on Posted by: T. at June 3, 2005 5:08 AM "Using the back stairs only when going to a secret meeting - is that a good security measure?" I had the same reaction you did. But if you assume that these meetings are very rare, there won't be time for the observer to understand the pattern. And given that it's more likely for the spies to watch the main door only, then it may be a good trade-off. Posted by: Bruce Schneier at June 3, 2005 7:48 AM "Could Felt have had the counterintelligence agents regularly report on the status of my flag and flowerpot? That seems highly unlikely, if not impossible." I don't see why that's so unlikely. I assume that there are many contacts managed using signals such as this. All it takes is a few people doing shifts to tour round all the observation points once or twice each day; if there are enough signal points, then it's a full-time job for an agent (and the observations can easily be disguised as a daily journey such as to/from an office - or perhaps a newspaper or mail round). The agent doesn't have to know the meaning of any of the signals, and dummies can be added to mislead (e.g. the agent is also watching whether some entirely arbitrary persons' flowerpots are moved, or their windows are open or shut, or whatever, but doesn't know which ones are significant). This last point is basically a defence against traffic analysis similar to that used in other forms of communication - keep data flowing, even if it's meaningless, to confuse the enemy and hide the presence of the valuable information. Posted by: Toby at June 3, 2005 8:13 AM On a related topic: Did anyone see those old photos of Felt from his days as the director of the FBI office in Salt Lake City? He looked like a total Jr. G-man geek with that baggy suit & hat on and posing with his snub nosed .38 caliber crime fighter special. I initially thought it was some kind of a joke. A total hoot! Posted by: Kevin McGrath at June 3, 2005 8:30 AM The abstract analyses may have a relatively rare place in considering the particular actions of a master (in fact if not fancy) in one case. It's a very special case, Felt and Woodward. Felt was on his home turf (D.C. counter- espionage) with significant and important powers and resources, operating against opponents about whom he would have known a great deal, in an environment (DC) about which he knew a great deal. Of course that's the story, how much he knew. Posted by: John Pritchard at June 3, 2005 10:24 AM "Using the back stairs only when going to a secret meeting - is that a good security measure?" It wasn't mentioned, but this could work OK if combined it with another activity like taking out a bag of trash, verifying a bike is locked to the post, taking something to a storage shed, etc. Then it'd look like you were simply going for a walk after taking out the trash (or whatever); not an uncommon thing at all. Or simply change habits to leave from the back 30-50% of the time normally. The goal should be to make it part of the routine vs. an exception. Posted by: JohnJ at June 3, 2005 11:32 AM "Or simply change habits to leave from the back 30-50% of the time normally. The goal should be to make it part of the routine vs. an exception." It depends. If you leave from the back half the time, any organization tailing you will definitely have to watch both exits. But if you never leave from the back, then sneaking out for a secret meeting that way is more likely to go unnoticed. You can go around in circles forever second guessing this sort of stuff. Posted by: Bruce Schneier at June 3, 2005 11:59 AM "Using the back stairs only when going to a secret meeting - is that a good security measure?" It'd be a good measure if the surveillance was divvied up into two periods. The first to assemble a list of subject paths, and a second to place resources along those paths. You'd want to maximize return on investment, no point in placing resources in areas the subject never went to. Since Felt was in a position to know exactly what surveillance procedures were likely, I'd be inclined to trust him on designing countermeasures to those procedures. Posted by: Anonymous at June 3, 2005 11:59 AM "Since Felt was in a position to know exactly what surveillance procedures were likely, I'd be inclined to trust him on designing countermeasures to those procedures." Hear hear. Posted by: Bruce Schneier at June 3, 2005 12:04 PM About the back stairs thing. The question is all in how many resources are being devoted to keeping an eye on you, right? If there's one guy whose job it is to keep track of where you go, he probably can't just sit in the lobby of your building all day. So if you always go out the front door, he probably watches the front door from some reasonably inconspicuous place, right? And as others pointed out, Felt had some serious knowledge of what else was going on around there. Maybe he knew the kind of surveilance Woodward was likely to be under. Maybe he knew that the person likely to be trailing Woodward would be more afraid of being detected (and thus ending up as part of the story) than of missing some of Woodward's meetings. --John Posted by: John Kelsey at June 3, 2005 12:04 PM Just to correct Dylan's misquote from above. "Three may keep a secret, if two of them are dead." Assuming Felt knew what surveillance Woodward would be under and designed the security procedures to take accordingly, how effective would they be in general outside of this particular situation? Posted by: Matthew Wharton at June 3, 2005 12:35 PM "Since Felt was in a position to know exactly what surveillance procedures were likely, I'd be inclined to trust him on designing countermeasures to those procedures." I'm no spook by any stretch, but here's my 2 cents. I would assume there's a lot we still don't know. Woodward was probably under surveillance by others, maybe within his own organization, or Felt's, and it's possible Felt fed some red herrings to other parties. It seems to me if Woodward normally used the elevator, and never moved the flower pot, changes in those routines would become fairly obvious signals. It seems like the business with the taxis and the walking was intended to make it 1. more difficult for a tail to predict where the target's going (e.g. which taxi) and 2. easier for Woodward to spot a tail (e.g. if a car trailed the first taxi, and then slowed down to pace him for two blocks, it would be an easy mark). Posted by: Francois Kashy at June 3, 2005 1:02 PM Wikipedia cites Adrian Havill (from "Deep Truth: The Lives of Bob Woodward and Carl Bernstein") as having investigated the details of this meeting protocol and "found them to be factually impossible"... On the other hand, the article seems to indicate that Havill concludes that "Deep Throat" didn't exist at all, which also doesn't seem to be realistic. Posted by: Ron at June 3, 2005 3:56 PM Woodward seems unduly mystified over how Felt could have watched his balcony. i'm not sure what seems so mysterious to him. he admits himself there were several different possibilities; if i were Felt, i would have used as many of them as i could get access to without drawing attention to my efforts, and varied them from day to day so as to not establish a routine. frankly, i'm more impressed with how Felt could get to Woodward's newspaper without it being noticed. watching a balcony seems like a simple thing by comparison. Posted by: Nomen Nescio at June 3, 2005 4:18 PM As for going out the back instead of the front, while reading the article, I thought that was as a security measure against ordinary people becoming curious. How often did Mr. Woodward go out at midnight and not return until early morning? I assume almost never. Going out front, neighbors might notice the odd behavior, and information might reach the wrong people through the grapevine. If the apartment was being watched front and back, going out back at night wouldn't be more suspicious than going out front at night. (Again, assuming Mr. Woodward rarely goes out late at night.) Posted by: Jan Goyvaerts at June 3, 2005 8:19 PM Regarding leaving by the back stairs, let me suggest another possibility: if Felt had an FBI team reporting on the position of the red-flag-flower-pot, he may have wanted to prevent clueing *them* in on it's significance. The balcony sounds like it's visible from the street, where an FBI car would pass by or park, and the team may also have watched the house (through initiative or even just out of casual curiousity) at other times--no sense letting them see Woodward leave by the front door on the same day the pot moved and put two and two together, you never know where that info might wind up. As I understand it, the FBI is a *highly* competitive agency, Felt may have had enemies there, people who might want to curry favor with the new director... Posted by: Vespasian at June 3, 2005 10:53 PM An interesting aside about the newspaper message: http://www.theaustralian.news.com.au/common/story_page/0,5744,15495205%255E1702,00.html Posted by: Simon at June 5, 2005 10:16 PM Why was Felt confident about the degree of surveillance on Woodward? Well, he had only two opponents here: Nixon's Plumbers, and the FBI agents loyal to Director Gray. The FBI can certainly mount an effective surveillance, but Associate Director Felt was in exactly the position to know if they were doing so. He couldn't be sure what Nixon's Plumbers were up to, but they were all of about 5 guys, and if I've got the timing right half of them were in jail at thsi point; it was barely possible for them to mount 24 hr surveillance on one face of a suspect building, impossible to do two. One other possibility might be a rival journalist, but once again, a 24 hr, front-and-back stakeout would be unlikely. How did Felt get at the newspaper? One easy method would be to pay the paperboy. Sure, if someone tumbled to the signalling method, they could follow the paperboy around; but 5 guys are going to have a lot of trouble following a paperboy's entire route every day. Even if you did, marking the page could be made to look like buying a paper. Posted by: Roger at June 6, 2005 11:05 AM John Dean's take on this, including his own opinions on the reliability of some of Felt's statements. Obviously he has is own axe to grind, but it provides an interesting reality check. Posted by: jayh at June 6, 2005 11:57 AM @jayh Posted by: Roger at June 6, 2005 12:18 PM The back-exit routine is to minimize the chances that Woodward is going to be tailed. The tail will know that it's quicker to take the elevator and focus on the lobby. If they ever catch him getting into his taxicab theatrics via the back exit, then he's toast (utterly unusual pattern) but until then this works the best. The cab switching is to extend and complicate the route to detect a tail and hope that once they find out about the back exit Woodward can abandon the routine alltogether. The flower pot is safe. We do move stuff around and as long as it's not isolated (i.e. move a big box some other day for no purpose, etc.) it's hard to give a meaning to. What I am slightly disappointed by is the newspaper trick. They established a secret key and made it too easy to guess (time of day = hands of the clock). I suppose Felt decided after hearing what other stuff Woodward receives daily that it was too much to go through and there was no reason to complicate the procedure for this possibly rare occasion. Posted by: Koray Can at June 6, 2005 4:12 PM The traditional way to deal with meeting times is to have it at an offset from the given time: say, 2 hours and 20 minutes earlier than the time in the message. Perhaps Felt thought that the risk of confusion when using that was not worth the extra secrecy. And that extra secrecy could be quite minimal, given that the attacker probably would not know the meeting place. Posted by: Curt Sampson at June 8, 2005 12:38 AM Post a comment
Powered by Movable Type. Photo at top by Steve Woit.
Schneier.com is a personal website. Opinions expressed are not necessarily those of BT. |
|
Comments