Technology is Making Life Harder for Spies

An article from The Economist makes a point that I have been thinking about for a while: the modern technology makes life harder for spies, not easier. It used to be the technology favored spycraft—think James Bond gadgets—but more and more, technology favors spycatchers. The ubiquitous collection of personal data makes it harder to maintain a false identity, ubiquitous eavesdropping makes it harder to communicate securely, the prevalence of cameras makes it harder to not be seen, and so on.

I think this an example of the general tendency of modern information and communications technology to increase power in proportion to existing power. So while technology makes the lone spy more effective, it makes an institutional counterspy organization much more powerful.

Tags: , , ,

Posted on July 26, 2010 at 6:12 AM • 31 Comments

Comments

Mike B • July 26, 2010 6:54 AM

Who needs spies when your targets will blog about (or Wikileak) everything you’d ever want to know. In a world where information is opaque, old school spies are necessary and successful. In a world where information is accessible, well, you can do that job remotely.

Graham • July 26, 2010 7:04 AM

“The ubiquitous collection of personal data” may make it harder to maintain a false identity, but it also possibly means that people will trust the data rather than question things. This means that if you can get a false identity into this “collection of personal data” you are more likely to get away with it – it’s in the database so it must be true…

Likewise, with the amount of surveillance in the world these days, it’s possible people will assume that you will be on camera, and so if the spy can find somewhere that isn’t on camera they might be less likely to be randomly discovered…

David Harmon • July 26, 2010 7:35 AM

Of course, it also makes institutional spying organizations — as opposed to those “lone spies” — much more powerful! Especially those with the backing of a major government, and a huge tech base of their own. (Not giving any initials here… but you know who I’m talking about.)

Richard Steven Hack • July 26, 2010 7:38 AM

I disagree. I think it depends on the spy, on who he is spying for, and how he spies. Not all spies are the same, let alone someone who might be spying on his own hook and not, as William S. Burroughs once said, “trailing wires back to Moscow Central.”

While there is some truth to the notion that power begets more power and that technology in general can enable that, I think it’s an over-simplification to say that holds everywhere.

Otherwise the US would be winning in Afghanistan – and we aren’t. There are always limits to power, and certain powers that can neutralize other powers. Power is relative.

Roger • July 26, 2010 7:58 AM

Some interesting ideas there, and there certainly is something to it. However, several of the author’s remarks suggest that his ideas about spies mainly come from movies, not real spycraft. For example:

… that involves moving around inconspicuously, usually under false identities, …

Actually only a small minority of spies use false identities. Most actual spies are personnel employed by the target nation or organisation, and perforce must use their real identities. Their agent handlers are personnel from an intelligence agency who recruit and liaise with the spies. Agent handlers are often diplomatic personnel operating under the cover of a diplomatic immunity. Even if they are “illegals” with no legal protection, they do not necessarily use a false identity.

… and handing over and receiving money by undetectable means.

Hmmm? Credit cards may be extremely popular (more so in the USA than anywhere else), but most businesses still accept cash. In my country, the trend may even be finally reversing; hotels used to be the most intractable when it came to paying in cash, but one hotel chain has recently started giving a cash discount.

For those that get caught, the consequences can be catastrophic.

I would suggest that at least for those spying against Western countries, the consequences have rarely been milder. A bunch of Russian “illegals” were caught, and their penalty was to be … sent home to a heroes’ welcome?! Twenty five years ago that would at least mean condemnation to a life of mediocre food and lousy fashion after having sipped from the cup of capitalism, but nowadays it’s no punishment at all.

… mobile phones … putting the bits in a fridge … If two people being followed both take this unusual precaution near the same location at the same time, even the most dull-witted watcher may infer that a clandestine meeting is afoot.

This both misunderstands how spies operate, and also is logically inconsistent with itself. It is logically inconsistent with itself because if the spies put their phones in the fridge before attending a clandestine meeting, then the shut-down of the phones does not occur at the same location nor particularly close in time (unless the spy and his agent are neighbours, and meet in their apartment lobby, which doesn’t seem like a good idea.)

It also assumes that spies pass information to their agents by face-to-face clandestine meetings. In fact it was recognised long before mobile phones that such meetings were extremely dangerous and should be avoided if at all possible, and spycraft includes several techniques for avoiding them.

Creating false identities used to be easy: an intelligence officer setting off on a job would take a scuffed passport, a wallet with a couple of credit cards, a driving licence and some family snaps. In a world based on atoms, cracking that was hard.

The methods described are what a conman or PI might have used. Even half a century ago, intelligence agencies went to considerably greater care in constructing false identities. For example, “Gordon Lonsdale” — the “legend” or false identity built for Soviet agent Konon Molody — was under preparation for at least 16 YEARS before Molody began running a spy ring with it.

… A pristine mobile phone number is suspicious

This is nonsense. New mobile phone accounts are being opened all the time, ergo at any given time there are a large number of “pristine” mobile numbers that are completely innocent.

… , but no Facebook account).

Is this perhaps written by an under-26 year old? Worldwide, fewer than 7% of people have a Facebook account. The USA has some of the highest Facebook saturation at around 34% – in other words, at least two out of three Americans do NOT have Facebook accounts. (It is actually higher than that because some of those accounts are inactive, or duplicates.) This is far, far too high to attribute any significance whatsoever to not having a Facebook account.

In the under-26 demographic, not having a Facebook account is much more significant — but still too weak to be much use without a lot of other supporting data.

… Biometric passports are making matters worse. If you have once entered the United States as a foreigner, your fingerprints and that name are linked for ever in the government’s computers.

Apart from, of course, the approximately 12 million illegal immigrants currently in the USA who somehow got in without even owning a passport. Plus, as we have noted, most spies are not foreigners and most agents operate under their own identities.

… Stealing a tourist’s passport and changing the photo (a tactic favoured by Israel’s Mossad) is no longer easy: in future the biometric data on the chip will need to check out too. …

As has been noted again and again on this blog, most identity documents in false names are official government issue documents, issued by corrupt officials. They are real documents; there is no alteration to make, and no forgery to detect.

Morten • July 26, 2010 8:12 AM

@Roger: +1 for quite a bit of reality there… 🙂 Your next-to-last point is actually quite important here: are corrupt officials ONLY going to issue IDs or can they think of any more uses for all that data that they have? Insert/Update/Delete permissions can be extremely valuable when used “right”.

S • July 26, 2010 9:41 AM

@ Bf Skinner

The answer is that a world without secrets is an illusion. And a world without secrets of the weak is only benefitting the powerful and ressourceful.

The article is wrong in the sense that power moves to bad organisations instead of bad individuals. We have seen it before and it will also lead to concentration of power and the corruption of power.

Tomasz Wegrzanowski • July 26, 2010 9:58 AM

We hear about spies who failed due to technology. We don’t hear about those who avoided failure thanks to technology.

It might be little more than availability bias at work here.

spaceman spiff • July 26, 2010 10:07 AM

The best secrets are ones hidden in plain sight, which means that data mining tools will become more and more critical in days to come, for both “spies” and “counter spies”. Let the race begin (or continue at least)!

Clive Robinson • July 26, 2010 10:37 AM

The authors third sentance gives away a gaping hole in their knowledge.

“Finicky miniature cameras and tape recorders have given way to pinhead-sized gadgets, powered remotely.”

The simple fact is that even pinhead sized trancducers (gadgets) when active, powered remotly or not either emit energy or absorb it in charecteristic ways. Which means they can be detected.

It’s a consiquence of the basic laws of physics.

Each technology “forward step” in minturisation etc is accompanied by a similar sized step that keeps things more or less in balance at all times.

Accept for one thing… the ultimate limitation on Spy-v-Spy is resources both human and fiscal.

Currently there is only so much data a human can crunch through in 8hx5dx52w and it is not exactly a secret that the likes of the NSA have more data than even they can crunch through in a meaningfull way.

The question then boils down to how much “assistance” can technology give to a human analyst and at what price. That is what is the limitation of technology as a force multiplier and how is it changing with time.

paul • July 26, 2010 11:15 AM

What is your spy trying to do? What this may signal is a trend away from the use of longterm assets whose identities and lives are treasures to be protected, toward single-use contractors who aren’t around long enough for good correlations, or who can be retired to a safe job after they’ve become visible.

Thumb drives and broadband connections also mean that you can pass way more information in a single episode. 92,000 documents in paper form would weigh somewhere north of 200 kilos.

Steve • July 26, 2010 11:44 AM

One of the article’s comments says it all –

(J. Kemp)—The most beneficial use of modern surveillance technology in the Western world would be the permitting of all citizens to utilize such technology to collect any and all information they wish about the activities of government.

Happytyper • July 26, 2010 11:58 AM

Hopefully, it will make life harder for warmongers and lying abusers of all kind, too.

Gina Lollobrigida • July 26, 2010 12:31 PM

@Graham

I tend to agree that it makes it easier to create a believable false identity.

ted • July 26, 2010 1:35 PM

“The days of the “illegal”, living for many years in a foreign country under a near-foolproof false identity, are drawing to a close.”

Maybe someone ought to tell the millions of illegal immigrants in the US.

Koray • July 26, 2010 4:23 PM

I don’t understand why Bruce thinks technology makes life harder for spies at all since he always says attacks always get better. Mountains of surveillance data is hard to analyze.

Thanks to Roger for the reality check.

If I remember a recent post correctly, there’s this question mark on the value of acts of espionage in the first place. How do you know you didn’t get disinformation? Transmitting it back home is a secondary issue.

To me the most lucrative form is industrial espionage and insider trading. I bet none of that is made any more difficult.

Essentia • July 26, 2010 5:46 PM

As noted above and I think both main points:

Mis-Information/Mis-Direction may become a major industry…

If you successfully manufacture a false identity in the digital universe, it will be accepted without question.

Jay • July 26, 2010 7:19 PM

@Greg, S:

Perhaps it’s better to think of the half-life of secrets. After all, this is a cryptographer’s blog… where data is “secured” when its value is less than the cost of breaking it.

Value of secret military plans the day before an attack?
Value of secret military plans the day after an attack?

All secrets will get exposed sooner or later; the question is how much they’re worth when that happens…

D M • July 26, 2010 7:52 PM

All you’re arguing is that technology advances both sides of the game. It’s still a hard game to play. Show some quantitative results or make more specific estimates as to the advantages of both sides. Again, you just state that “it’s easier for the counter-spy” because they can “watch ubiquitously.” I would argue that that is as different as apples and oranges. Spy gets telephone to communicate, anti-spy gets wire tap, spy gets crypto, ant-spy gets decryption. It’s an arms race, always will be.

Clive Robinson • July 27, 2010 3:23 AM

@ Paul,

“Thumb drives and broadband connections also mean that you can pass way more information in a single episode. 92,000 documents in paper form would weigh somewhere north of 200 kilos”

If you are refering to what I think (wikileaks) it has been indicated that the method used was “CD-R’s of music”. Which may well be true, the systems where effectivly “airgaped” rulling out broadband, and coalition forces have got a tads nervous about thumb drives since they started turnining up on market trader stalls with unencrypted TS and above on them…

That said there is still the question of the claimed 1/4Million documents taken and the 92K going up on wikileaks, why just 1/3 the claimed number going up on wikileaks…

Personaly I don’t think wikileakes has had the time to go through even a few thousand one page documents so far let alone just over 90,000…

Which raises the question of what data can be distiled out of them, not just about “methods and sources” but about analysis bias etc and possibly which “contractors” have been used to do it…

Sean • July 27, 2010 1:08 PM

Easier to manufacture false identities or corrupt current identities with false information.

Never underestimate the ability of data spew to hide covert information in plain sight.

As with all things, it just changes things. Those who adapt will keep doing the same old things in a new manner…

Tony H. • July 27, 2010 3:03 PM

The level of comment spam seems to have been creeping up lately, e.g. just in this thread the ones at July 26, 2010 1:01 PM and July 27, 2010 2:21 AM.

Brandon Keim • July 27, 2010 8:51 PM

Isn’t the necessary corollary to “[technology] makes an institutional counterspy organization much more powerful,” that it makes an institutional spy organization supremely powerful?

Imperfect Citizen • July 28, 2010 6:38 AM

Great discussion and links. So even with all the technology, fraud and deception are still possible. And both the spy and the counter spy organization can be deceived with technology. It seems like the counter spy org could be more easily deceived. You could have someone in a non government cooperating contractor position who can manipulate signal intelligence to cover for someone or misdirect to another. Would that increase in technology and participants increase the opportunity for dangerous insiders? Contractor fraud?

jacob1898 • July 28, 2010 11:36 AM

@clive. minicameras and energy can be detected, ok. They can be detected with an led flashlight more easily. You simply bounce the light off the ccd. Just as you can kill a camera with a laser pointer.

The spy is not as likely to be caught as outed by his superiors/burros. The russian spys were probably caught by intel on the russian agencies, not anything they did. I think that has been the case for many years. It is just a real world scenario and info fact. Just like if you hide guns very well from authorities (N.O. case in point), they are not likely to find all of them. Your blabbing cousin is more likely to give up the goods from bragging. The spy agency talks to people and we look at the communications. Correct? The odds that someone picked up wireless comms of the recent russian spies is nil. We recently caught “terrorists” because they took the pictures/video to photo business. Smart detective work? No, stupid agents of change. 😉

Angel One • August 2, 2010 9:58 AM

Tech also makes remote spying easier (meaning over the internet), so there is going to be less in person spying, and more cyber-spying/espionage going forward.

thecoldspy • August 3, 2010 10:16 AM

(Who needs spies when your targets will blog about (or Wikileak) everything you’d ever want to know.)

Don’t forget the adage that there are known knowns and known unknowns. Plus you have to factor in all the credibility issues with the WikiLeaks site and its inability to distinguish between real information or disinformation or even misinformation disguised as real information. Reliability wise, no one can really trust Wikileaks. It is good for those who don’t know or don’t really care to know, or those who want to believe that there is in fact a rogue site that delivers freedom to the masses, but in hindsight those that do know realize that appearances can be deceiving, and in many cases often are.

(Of course, it also makes institutional spying organizations — as opposed to those “lone spies” — much more powerful! )

Not really. Again though as Richard Hack has pointed out, it depends on what the spy is doing, who he is working for, and what type of spying he is involved in.

(Of course, it also makes institutional spying organizations — as opposed to those “lone spies” — much more powerful! )

Good points. However what if the reality is that the reason we are not winning is because we always need to be at war, and more to the point, living in a state of fear and us against them so that the powers that be obtain more power as time goes on? If we suddenly won, then we lose the need to fear, then those in power start losing their grip on it because the people will say we have won so now it’s time for power gained to be given back. Therefore, ergo, we will always be at war with Eastasia.

(Hmmm? Credit cards may be extremely popular (more so in the USA than anywhere else), but most businesses still accept cash. In my country, the trend may even be finally reversing; hotels used to be the most intractable when it came to paying in cash, but one hotel chain has recently started giving a cash discount.)

In most developed countries cash is a thing of the past. It is something you may use from time to time to obtain small goods and services, but try walking into a large store or even a smaller one and buying something real expensive with cash. It just draws attention to you when you work that way. There are so many other methods for payment these days that cash seems almost as if it is a trap. Of course e-money or credits can also be the same. But for now there are plenty of options to use to get paid. I could name at least 10 right now, and all are being used for various illicit purposes as well as normal transactions. So why use cash when all it does is draw attention to you?

(I would suggest that at least for those spying against Western countries, the consequences have rarely been milder. A bunch of Russian “illegals” were caught, and their penalty was to be … sent home to a heroes’ welcome?! Twenty five years ago that would at least mean condemnation to a life of mediocre food and lousy fashion after having sipped from the cup of capitalism, but nowadays it’s no punishment at all.)

In the case of these illegals, no, they got off light. However I think also that is a media illusion. The response when they arrived home was tepid at best. And since they failed almost from the beginning, it seems as if all that happened was that they enriched themselves, had a good life, and did very little work that mattered. And that is just reading the open source information out there on them. It seems as if many of them spent most of their time getting huge sums of money and then complaining about who was to keep real estate properties that were purchased with cash being paid them for duties any lab rat could have performed. I think in reality, and regardless of how Putin addressed them in the media, that eventually they will all pay a price down the road for their failure. Russians do not like failure in such areas, and as such, I think eventually they will all suffer for that failure. Of course that is just an opinion. If they are continued to be rewarded, then the business has truly gone down hill.

(It also assumes that spies pass information to their agents by face-to-face clandestine meetings. In fact it was recognised long before mobile phones that such meetings were extremely dangerous and should be avoided if at all possible, and spycraft includes several techniques for avoiding them.)

Dead Drops are still used, and are the preferred method. However with large email accounts now available to anyone, you can grab one using a proxy, leave huge amounts of data on them in draft form, never sending it in an email, and having the handler pick it up using the same methods, whereby he then deletes it after pickup and moves on towards payment using any preferred e-money payment or prepaid card method available to them. Why even use mobile phones? They are just tracking devices anyway.

(This is nonsense. New mobile phone accounts are being opened all the time, ergo at any given time there are a large number of “pristine” mobile numbers that are completely innocent.)

At least in the USA they are trying to force identity checks at the prepaid phone level. Of course it would be very easy to fool some random sales clerk with a decently made ID, as they hardly glance at them anyway. And are usually not even trained to know which is real or which is fake, or even knowing what neighboring states ID’s look like or even what far away states ID’s look like. This requirement is just for fooling stupid criminals who have no way to make professional ID’s or to even get them and making them fearful of acting. And this is not even being used in most places at this very point in time.

(In the under-26 demographic, not having a Facebook account is much more significant — but still too weak to be much use without a lot of other supporting data.)

Facebook can be used to build a background just as much as it can be used to build a network of normal people a spy needs to use later on. You can network with sales people in phone kiosks to get by the ID issues. You can network with people who work at the DMV’s around the country. Then when you need a quick ID they already know you and will be more pliable when you are trying to get a covering id. You can network with utility people, with landlords and or real estate people. Matter of fact, FB can be a great utility for the spy on the go.

(Apart from, of course, the approximately 12 million illegal immigrants currently in the USA who somehow got in without even owning a passport. )

I agree here. It is not that hard to travel. If you really need to, there are many methods that work and can be done with a minimum of hassle.

(As has been noted again and again on this blog, most identity documents in false names are official government issue documents, issued by corrupt officials. They are real documents; there is no alteration to make, and no forgery to detect.)

While I agree a bit, I disagree on one point; ID’s are easily made today with corresponding real info or cloned information on them. I could then just as easily become someone else who I pick at random, just as easily as I could become you. And it would all look very real and be indistinguishable from what many term, real.

(I don’t understand why Bruce thinks technology makes life harder for spies at all since he always says attacks always get better. Mountains of surveillance data is hard to analyze.)

With the advent of even more powerful computing this data can be analyzed more quickly now. The problem is that one never knows when one is a target, so to be safe, always act as if everything you do is being monitored to some degree, or at least will be as you pick up and leave or close down. And in some cases before you are able to leave. Technology has ratcheted up the paranoia factor by miles. What used to be hard, say going to a dead drop and exchanging information, has now become even harder when doing it using technology.

One never knows when one is under the watchful eye of someone else. And since one always operates as if one is being watched, everything done becomes a potential mistake later on that one eventually has to deal with.

(If I remember a recent post correctly, there’s this question mark on the value of acts of espionage in the first place. How do you know you didn’t get disinformation?)

This has always been a problem, which is why you have CI departments. Disinformation has been a part of the business since its inception.

(To me the most lucrative form is industrial espionage and insider trading. I bet none of that is made any more difficult.)

You are right, However it is much more difficult today than it was in the past due to the vast amounts of data that can be utilized to show what has been going on between parties. Connecting the dots is getting easier due to technology and its advances. Even today a small team can now analyze in months what used to take a huge roomful of agents 4 or 5 years to go through.

(Mis-Information/Mis-Direction may become a major industry…)

It already is a major industry, which is why we have brand protection companies springing up everywhere you look.

(If you successfully manufacture a false identity in the digital universe, it will be accepted without question. )

Depends on who uses it and how they use it in the real world as for how long that will stand up to scrutiny..

(Spy gets telephone to communicate, anti-spy gets wire tap, spy gets crypto, ant-spy gets decryption. It’s an arms race, always will be.)

Which is why everyone is allowed to stay in business. As with any other business, there is always a ying and yang to keep everyone happy. Those that buy the tech to stay ahead, and those that sell the tech to keep them ahead. Then those who sell the back doors to others to block them from staying ahead or believing in what they own to stay ahead for very long, which then sends everyone back to square one buying more gear that lasts 2 or 3 months at best before one must go back and do it all over again.

(Tech also makes remote spying easier (meaning over the internet), so there is going to be less in person spying, and more cyber-spying/espionage going forward.)

That is the exact point of where we are today.

Leave a comment

Login

Allowed HTML <a href="URL"> • <em> <cite> <i> • <strong> <b> • <sub> <sup> • <ul> <ol> <li> • <blockquote> <pre> Markdown Extra syntax via https://michelf.ca/projects/php-markdown/extra/

Sidebar photo of Bruce Schneier by Joe MacInnis.