Schneier on Security

GreenSquirrel • March 22, 2010 9:26 AM

Interesting.

I agree totally with the CIA Station Chief extract you posted here especially:

“it is virtually impossible for clandestine operatives not to leave behind a vast electronic trail”

As for the 11 points the Cold Spy has made, well…. Nonsense. Simply put, its nonsense that appears to have come from the comfort of an armchair expert.

GreenSquirrel • March 22, 2010 9:50 AM

@Bill – I see we took the the same assessment of the Cold Spy 🙂

In more detail, his 11 points arent even 11 points – obviously Cold Spy wants to make use of the Digg effect where numbered lists seem to get much more prominence…

The overarching issue I have with it, and all similar analysis postings, is that we are working from a position of vast ignorance. We have no idea what risks were assessed and tolerated, what other risks were mitigated against and what other constraints the operation was planned under. Its trivial for us to sit at our PC (or Mac for the weirdos) and discuss what we would or wouldnt have done based on our assumptions (normally along the lines of Mossad operators are superhuman, no risk is acceptable, one man can do the job of 20 etc. I blame Bourne for this).

So, of the 11 points:

1 – not a mistake. A best this is an operational decision they may not use again. However it may well be the case that a passport that has “lived” on international travel systems will get less scrutiny than one belonging to an adult who has only just bothered to get it. Even middle eastern countries try to screen out terrorists….

2 – Not really a mistake unless the operational decision had been to hide their faces. That said, if you were at a border control point and someone came through trying to disguise their face, what would you do? (allowing entry is probably low on the list)

3 – How do you know they didnt? We assume they didnt and they may well not have but given the widespread surprise about how well the Dubai police reacted to this and built an evidence pack, its possible they did indeed make that mistake. Its also possible that Mossad (or whoever) accepted this risk and, as others have said, given that not one of the team have been found yet it seems an acceptable risk to me.

4 – not a mistake at all, in fact this is probably fairly good operational practice depending on the goal. If they didnt know where the target would be, they have to make sure they are as flexible as possible so getting several locations is good. This activity did not lead to their plan being compromised and only came to light after they had left the country. Is this a mistake or an operational judgement?

5 – I dont understand why this is a mistake at all, so I might have misread it. I will withold judgement in case someone can explain it a bit better.

6 – I am not sure this is a mistake or significantly differrent from #3. The mistake may well have been to hope that the police would assume natural causes and not investigate and if everything else was built on that these decisions cease to be mistakes. Can an operational decision that has no negative impact on the outcome of the operation be called a mistake? It seems to me that (again assuming Mossad) this is a message that cuts both ways. One country can say “dont do it on our soil” (but if you do, we wont catch you) and the other says “You arent safe anywhere.” Either way its good PR if you are that way inclined.

7 – this is 6 repeated.

8 – If they did this with 11 people I am impressed. Unless that 1 person is Jason Bourne, James Bond or similar, its not possible. Even a street robbery would need more than 1 person. The key is that this is not a street robbery, so unlike a crack addict robber they have to factor lots and lots of things into the equation – not least of which is controlling who is in the vicinity at the time of the attack. A street robber is attacking any person who passes, this is an attack on a specific person. Massive difference and one that needs lots and lots of people.

9 – pretty much contradicts everything else. Why is it harder for a film to fake a car crash than to have one in real life? In real life things just happen, a mugger just stabs their victim. In a staged attack things have to be set up to look real enough without leaving any loose ends. If you go down the cut out, which you then kill route, it gets even more confusing (do you kill the killer, and the killer of the killer’s killer etc). Madness and I have never heard of it happening in real life (*).

10 – how is this a mistake? Not only is more time in country more dangerous (risk of compromise) but how do we know the attacking agency had that much notice? Even once they have the solid intelligence plans have to be made, budgets checked, authority granted etc. Why would more time have led to it being called off? Was the target planning to visit a load of low security countries? (Do any still exist?). It strkes me their plan was reasonably well thought out but everything carries risk.

11 – see 6 again.

Overall, no mistakes. Risks were taken and some of these risks were realised. If this never happened, they wouldnt be risks.

We could argue all day as to if the organisation which did this was right to accept all these risks but we dont know what else they considered.

As anyone who works in security knows even with the best will in the world, with flawless execution sometimes the residual risk happens.

< tinfoil hat > (*) but then I wouldnt… < / tinfoil hat >

GreenSquirrel • March 22, 2010 3:56 PM

@The Cold Spy – thanks for joining in.

“You might think that most of this was armchair, however try going to third world countries where death and assassination is a daily regimen.”

I do and I have done thanks.

However it might be possible to see where the confusion between MOs is now.

“Police said retired Gen Julian Aristides Gonzalez was traveling in a car in the capital, Tegucigalpa, when attackers on a motorcycle opened fire.”

Cant you see how this is a very different situation? Here the attackers are deliberately making an overt power statement through their assassination.

Do you think Dubai is so lawless that this sort of act could be carried out without a MASSIVE police reaction?

Also, how many people did the motorbike attackers have acting as lookouts, providers of weapons, providers of escape routes, vehicle changes etc.

The low cost of assassins and high risk of places like El Salvador and Honduras make them unlikely places for either the target of this particular attack, or the agency belived to have carried it out, to be. Could the same attack be mounted in the US, for example, for the same cost & low risk?

You also conflate the activities of radical, anarchist, gangs with those of state controlled intelligence operators. Using this example the IRA sent a 4 man cell to Gibraltar and would have been devastatingly effective, yet AQ would have used 1 for the same effect – were the IRA wasteful? Even worse, the British security operation in Gibraltar which resulted in the IRA deaths consisted of around 40 people on the ground – not just the few that went in guns blazing.

Sticking with the IRA example, even their “bomb runs” which comprised one or two people in a car loaded with explosives had dozens of support acting as screens, lookouts and the like. And this was while operating on their own territory, in their own cities….. Same with the R.A.F (even though they were insane). To confuse matters more, most of these groups have, as gunmen, people who no longer care about the outcome – if they escape or not, if they go to jail or not. Obviously Mossad wanted its operators back home.

As I said to you previously on this when you identify the tasks that have to be carried out on the ground it quickly becomes unrealistic to mount an attack without swamping the area. Even one made up to be a random act of street violence needs people.

How do you keep surveillance on the target? That alone will churn through 6 – 8 people on a non-aware target. If the target is trained or experienced you double it. Then assuming the decision is to kill how do you keep innocent bystanders / witnesses away? How do you control the target to make sure he will be where you want him in a large city?

Next, as this is a state sponsored op, you add in adminstrative staff, people to make sure hotels are booked and suitable, people to make sure escape routes are clear (including alternates for unforseen circumstances).

Dubai is a police state. Keep that in mind when you judge how their operational plan went down.

“In my book that is and always will be a stupid way to operate. ”

I agree, but this hasnt been done by your book. We have no idea what their risk management strategy was so saying it is doesnt meet up to one you would expect is a bit strange.

GreenSquirrel • March 23, 2010 3:47 AM

@The Cold Spy

I will try to truncate my response to make it a bit more readable.

“I don’t see it that way. However you fail to include the rest of the articles highlighting assassination teams of unknown assailants who have never been captured nor even been revealed as to who was or is behind them. You pick one article out as if to say this is the main premise that I need to debate.”

No, you did that. You extracted an example from the links, so I responded to that. If you thought one of the others was a better example why didnt you use it?

“My view is my own view, and not necessarily the only view, but also a view taken from the standpoint of thinking it through in relation to experiences and readings and research in a third world country during the height of a major constitutional crisis, where death rained down on people on a daily, if not hourly basis.”

This does not describe Dubai. You are making a false analogy here.

“The fact is green, murder happens. And it happens daily everywhere on the globe, with many never aware of what the reasons were for them or who carried the acts out.”

Yes I dont disagree with this. However even more people die of natural causes. A murder will pretty much always result in a police investigation. A murder of a senior Hamas official (even in a “street robbery”) would get no end of resources thrown at it. How would that be a better plan?

“Hard to say, but after careful reading of the act in question itself, he always traveled with bodyguards, but on that very day he decided to go it alone. Why? ”

Well, we will never know. It is nearly always the case that the time a high value target gets taken out is the time they make a slight change to their security posture.

Now we can assume this is pure chance and the lone gun man was fortunate enough to have chosen to attack right at the moment the target was vulnerable. Alternatively its possible that the assassin had detailed surveillance and intelligence, as well as sufficient resources to hand, to react to a mistake by the target with lethal effect.

Its up to you which option you go for.

One assassin on the ground does not have the flexibility to control the situation or take advantage of sudden “synchonicity” that a large team does. Granted too large a team becomes a problem but this is something the mission planners get paid to work out. We cant, from a distance, look at the part of the overall operation and say their numbers were wrong because we think it should have been done in a different way.

“I disagree. There were plenty of places this could have been done outside of Dubai, and I am sure it was thought about being done closer to home, but for some reason a year earlier it was decided to be a hotel termination, else why train in an hotel in Tel Aviv a year prior?”

Unless both of us were sitting in on their planning meetings we will never know why they chose this option. We dont know what their intelligence feeds were telling them or what their assessments were. We can use 20:20 hindsight and say “why didnt they do XYZ” but that kind of assumes they have some psychic powers.

“No I don’t. Today many of these gangs are used more and more for routine assignments. Just look at Mexico, and again HN for how this is being done.”

You are still missing the point. These gangs are not routinely used by national actors to solve problems. If they were, why havent MS-13 been sent to Afghanistan to sort out Usma Bin Hiding?

Who do you think is using these gangs to do nation sponsored work?

Why do you think the use of a gang is more efficient or effective?

“Plus, their work is spread all over the news in Mexico and other places, so we do have facts to back this up, which is why we are now arguing over this anarchy spreading into the United States at the border regions.”

How would you get a Mexican drug gang into Dubai?

“But again, depends on who called the shots and what they decided was the best policy for this operation. In hindsight we can always look back and discuss mistakes, which is why I made my original post.”

You make my point then ignore it. How is it a mistake to have decided how to run the operation?

“Yes, one man and two man teams can eliminate “any” target if enough time is spent on that one target.”

How does a 1 or 2 man team get to spend time on target?

The urban guerilla scenarios have small “hit” groups but, and this is important, have control of the environment and logistic / intelligence support at hand. If you go to a different country to do this you have to bring it with you.

If an attacker wants to kill a certain person on foreign soil, and escape without capture, it needs a large team.

If an attacker wants to kill on foreign soil and escape without capture it needs a smaller team.

If the attacker just wants to kill on foreign soil it needs one person.

“Now you are taking a giant leap of faith in 100 percent identifying who was responsible.”

I said Mossad because it was easier than writing “the organisation or group or national agency involved which may or may not have been Mossad.” Its up to you what you want to read into that.

“I again disagree. that is to say that at times an attack can be carried out on a whim, with very little involvement required on the part of massive sweeps of people involved. ”

Actually this agree with what I have said. If you are carrying out an attack on a whim, it doesnt need a large team. To have a planned attack on a specific person over a specific period, does.

The ironic thing is you again go on to prove my point with the rest of that paragraph.

It depends on lots of things, if you have good intelligence, good control of the terrain, good logistics, good control of bystanders and confidence in the targets activities you can probably send in a single assassin.

How you get that level of control without other people is a totally different question.

“However in the case of hits in HN, scant information is needed on targets, Usually a target can be eliminated on whim upon knowing the targets location, where he hangs his hat during the day or night, and how many people are usually around him and whether they are armed or not.”

All this extra control comes from having lots of people on the ground. Great if you are operating on your own turf, not so great if you have to export it to a different country.

“Many ways as I described above. However, in the case of the Micheletti issue, one man could be placed on the street commonly used that evening to see how things were set up, while two men could have built a truck bomb”

So it takes one person to mount surveillance on a static target on your own territory.

What happens when the target is moving and you need to find out where that “street commonly used” is? How do you gather that information on the target behaviour? How do you do it in a foreign country?

“Think I jest? In earlier times a small group of MS -13 members boarded a bus and wiped out over 28 people to send a message to the President of HN to leave them alone.”

Again, totally different. They were not looking to kill person X, they were looking to kill. There was no need to make sure the target was seperated from innocent bystanders, no need to escape out of the country etc.

This is the point I am making and every one of your examples supports it but you refuse to aknowledge that.

“Mossad is known at times for not caring about collateral damages.”

I thought you told me off for assumingit was Mossad. I am sure that at time they wont care about killing innocent bystanders. This time they did and the team size reflected that decision.

“—How do you control the target to make sure he will be where you want him in a large city?—

In the case I illustrated with Micheletti, it was known he traveled a certain way on a certain street at a certain time at night which was unknown to everyone else but gained by way of monitoring sites talking about him and the crisis.”

This is control. Ifyou have a target who has handed you intelligence on a plate, great, smaller team. If he hasnt, what do you do? Do you give up and go for some one else because this target is too clever to post his activity on the internet?

“And at times your entire operation depends on just that one critical aspect of the plan. How many operations have been called off because of timing issues? Plenty I am sure.”

I agree plenty probably have been. Now if a national actor wants a mission to go ahead, they can mitigate timing issues by swamping the area with operators to increase the control over variables.

See where this is taking us?

“Again you are going to the nth degree here. Granted this makes a good analyst and planner, and I do not deride you for being such an analyst. ”

Ha, ha, so by implication you say I am a poor planner.

Thank you.

“However as I continue to say or defend, a smaller team or even a one man operation could have in fact worked. The fact that you deny this is evidence of you over planning operations.”

I dont deny it could have worked. It is less likely to have worked.

Despite what you might think it takes less planning to send a big team in than it does for one person. A big team can collect their own intelligence, carry out surveillance, has more skills available, has more flexibility to adapt to a changing situation etc.

One man has to plan every tiny detail if he wants to get out.

While I accept that most western nations are becoming more like police states it is not in the same way as Dubai. Even military dictatorships in central / south America are not the same. As Winter said, Dubai sells itself on how well it controls crime. Most military dictatorships (and the UK/US) just control the population…

I know you said your book, but the problem is if they run off a differet play book it isnt a mistake.

“Thank you for your thoughts, armchair as they are lol…Or are they not? See green, no one knows now do they?”

This is the internet, we are all armchair experts and nothing else. If we worked for an intelligence agency we would be busy doing our jobs rather than debating conspiracy theories.

GreenSquirrel • March 23, 2010 2:35 PM

@Clive

“”This is the internet, we are all armchair experts and nothing else.”

It does not mater if it’s the Internet a pub or the planning room of the Mossad/CIA/MI6 et al

Most good ideas come about one of two ways,

1, Brainstorming sessions
2, Quiet Contemplation.

In the end though quiet contemplation be it in an armchair, sitting on the toilet or behind a desk is what turns the skeleton of an idea into a fully fledged beast with a life of it’s own…”

Sorry for any confusion I have caused. I never meant to imply that armchair spymastery was pointless or that intelligence professionals didnt engage in a similar process.

The point I was trying to make is that this being the internet for all anyone else knows we are all overweight 15 year olds who have read a few too many spy books.

We can not take anything anyone says here as authoritative because, well, this is the internet…

I can claim to have been a planning officer for the det in SAMA but it could just as easily be that I am a 12 year old who has read Big Boys Rules. There can be no prior assumption of authority on my, or anyone elses, posts based on claimed experience.

Ideally people would take every posting on its own value – even experts get confused at times – but humans have a tendency to ascribe status and reputational authority. As long as it is based on what is really here, rather than claimed, then it is ok.

Also, it is very different for a group of people involved in an operation, who know what their criteria and constraints are and know what intelligence is available to brainstorm as mission plan. It strikes me as a bit foolhardy for disparate people of varying knowledge and experience to try and reverse engineer that mission plan and judge where the “mistakes where.”

Again, I am sorry I didnt explain myself very well but I will try harder next time.

GreenSquirrel • March 24, 2010 3:35 AM

@ Jon S

” Excpet they now can’t show themselves anywhere outside Israel, and quite possibly most places inside Israel too.”

I concur with jgreco’s response to this. The photos published are far from ones that prevent these people moving around – they are bland, forgettable people. Even if their facial details are sent to every border control point in the world, this will be remarkable ineffective even in just a short time. Yes they may get caught at a crossing but if they wait a while, some else will be the photo of the day.

Equally, the false positive rate of this data is enormous. Two of the people in those pictures look just like people in the office with me now. (worrying, we can only account for the whereabouts of one of them at the time of the assination… I will call the police now…)

It is likely that for a while border crossings will be an issue for people who resemble one of those pictures but, really, what would the border guard have to detain the person for?

Yes they could be questioned, but it strikes me as nearly impossible to prove anything other than the fact they look a bit like an assassin… Its not as if their passports will even have Dubai entry and exit stamps.

I suspect the most they will suffer is a bit of “joking” about how they look just like XYZ and thats it. Just like the people in my office (until I call the police that is, fortunately we take terrorism seriously in this country and they will spend 42 days in a cell trying to prove innocence rather than the other way round….)

As for Isreal suffering, well I am sure it has broken their hearts.

GreenSquirrel • March 24, 2010 4:13 AM

@ The Cold Spy

“I don’t mean to belabor this one well thought out point, but I have seen 15 year old kids run circles technically around 50 year old experienced people.”

It certainly is possible but is far from the norm, or even likely. I’d hazard a guess it is so rare that when ever it does happen it sticks in your memory for a long time.

I would also hazard a guess (I have no evidence and know of no research) that this is more likely in some fields than others, such as areas where technological advancements outpace the value of experience – a 15 year old C# programmer will do better than a 65 year old Cobol programmer if else is equal. But in some areas the converse is true – the best 15 year old in the world simply doesnt have enough time to have encountered as many situations so will do worse in areas which require this than an average 50 year old (but you do get bad 50 year olds as well).

When I was 15 I had read books about being in the Army. It didnt mean I knew how to be a soldier, but I knew what the books said. When I joined the Army I realised that some of it was good and some wasnt, I also realised that no amount of reading equalled the need to sometimes “try” things. The older you are, the more things you can have tried.

“It doesn’t mean they have no value, rather the opposite, it means that at times, “out of the mouth of babes comes wisdom””

In my experience the main thing that comes out of the mouth of babies is vomit, todlers is screaming, young children is playful gibberish and sullen angst from teenagers.

Some of it may be wisdom but it is well hidden.

“Yet, knowlege is power do you not agree? And if so, knowledge in certain fields are a way to say that you have experience doing XYZ. For example, if you apply to ABC company and do an interview with them, they look at what you present as a guide on what you know.”

This supports what I said.

When you apply for a job, you say “I can do ABC,” the company quite rightly dont believe you and interview you. You are judged by how you answer questions and present yourself.

On the internet I can say I spent six years in South Det SAMA and, quite rightly you should all say coughbullshitcough (or words to that effect) and judge everything I say on the basis of what I have said.

The internet is a prime ground for the false authority fallacy in its many forms. Assuming everyone is an armchair expert at best helps (a little) to defend against this.

“Experience is only a guide. You could be the greatest guy in the jungle, but throw you out into the dry desert you could fold up like a toy. Doesn’t mean you are not experienced in the jungle, it just means you haven’t any experience in the desert. ”

Sorry, I dont understand what you are trying to say with this, unless you are just agreeing with me and restating what I have said.

“I think many strategists and corporations are always looking at mistakes made after any given business deal or any operation once concluded to see how they could in fact do it better next time.”

Indeed and, (risking false authority fallacy here!) this is something I regularly get involved in. The key to learn from the actions of others is to analyse them in the correct manner. Dont assume mistakes and dont dismiss their activity because you would have done the whole thing differently.

What learning point is there from the Dubai assassination to say “well, I would have just fired a hellfire missile into his bedroom?” (Yes, silly example to make a point).

Your general points are basically you would have done everything differently so nothing is learned from the available news.

Personally I would say that depending on your organisations risk appetite the mission went quite well so the learning points are minimal and would focus on concealing the method of assassination more. If that had been done better we wouldnt even have this debate.

“Sometimes those outside of the box come up with things those more focused internally do not see.”

I agree. The key part is sometimes. A lot, if not most, of the time people come up with ideas that have already been tried and tested (and failed).

“I think the rationale of your posts show that you do not wish to qualify my statements or even my opinions as decent or worthy of discussion based upon your experience as you posted, as they are too far off the mark for your taste. ”

Not at all.

Not only did I address your 11 points one by one, but on the previous posts about this topic I discussed them in detail.

You may also be aware we are still discussing them even now.

Petulance is even less effective on the internet than it is in real life.

” For example, when you said that transnational criminal groups are not really an issue. I disagree. In Pakistan and Afghanistan opium production is used as a way to support resistance groups and allow them to buy weapons and operate.”

I am not sure I said they werent an issue on a global scale, just that werent something that would have worked here. Again Pakistand and Afghanistan are not Dubai. How many transnational criminal gangs operate in Dubai (discounting the government, the US, etc to deflate the predictable jokes)?

Yes they may smuggle drugs through the streets but it seems it may amaze you how few gang related killings there are in the UAE.

“I have one slight question on the plastic surgery before they left.”

I have no idea about this. I remain unconvinced they would have surgery before or after, they may well have done, but I fail to see the need nor the effectiveness.

“Also, why do we not discuss the missing hallway footage? Was this footage somehow deleted or was the camera disabled? And if disabled by the team, why did they disable that camera only?”

There are a million and one reasons that could explain this – all are more common than any conspiracy theory.

The building I am in at the moment has 47 external CCTV cameras. Last week I reviewed the footage and discovered one had malfunctioned and not recorded for the previous 12 hours. Fortunately, as far as we know it missed nothing. In a similar manner, two years ago my predecessor was investigating a break in and found a (different) camera had failed to record the most crucial evidence.

Now was one a simple fault and the other the work of an attacker? Were both? Were neither?

Technology is not perfect.

“What happened during those crucial moments?”

We may never know.

“And why did they elect to cover that one aspect of the operation up?”

This is what leads me to suspect it was not their doing and may have been nothing more than a simple camera malfunction.

I have no way of knowing and freely admit this is total speculation.

I do however, think that if there is no motive or reason for their actions, they probably didnt do it.