Schneier on Security

Clive Robinson • June 17, 2017 11:34 PM

@ gordo,

“Evidence” is apparently not requisite.

As far as I can tell that is true of all Intel Reports, and why I treat them or their –political– product with a great deal of caution. It’s not just cognative bias, peer preasure, group think and a whole truck load of similar bias you need to be cautious of. The intel game is fundementally one of Smoke, Mirrors and Red flags, all done to deceive others to protect secrets, and an analyst no matter how unbiased is always acting on at best impartial knowledge. You only have to go back to the cold war to see how far off US estimates of Soviet capabilities were compared to the now available Soviet production and other records.

Thus all intel reports based on oposition free will human activity are in effect hypothesises based on axioms (assumptions viewed as truths). Which is why where possible, I run an anti-hypothesis based on my own knowledge and experience.

The first thing we know is that no matter how omnipresent and omnipotent the likes of various SigInt agencies appear or wish to appear the reality is they are not even fractionaly close.

If you want a current popular entertainment analogy they are like the “undead vampires” that can only go where they are invited or alowed, and they only get your life blood if you allow them, their only advantages being fear and persistence, where those –methods– fail them they need living agents –sources– to act for them, to “open doors” as it were.

The reality is the SigInt chosen “methods” or signals capabilities are quite limited and very much rely on the lack of knowledge or mistakes of those they seek to surveill. Where their targets are more knowledgeable and carefull the SigInt agencies job rapidly becomes very resource intensive for often very little gain.

Thus their job of “join the dots” is played where they have very few dots they can join if any, near the target of interest. Like most resource limited entities the agencies have an over riding need to minimize resource usage. That is they want to appear “efficient”. For longer than this blog or it’s preceding newsletter has been around I’ve been making a point about the seesaw nature of “Efficiency -v- Security”. That is in the general case the more you have of of one the less you have of the other. The same applies with “Efficiency -v- Intel”, which can give a significant advantage to an entity with a desire to keep secret it’s activities by hiding from sight or behind a false front to misdirect those who wish to uncover the activities.

As I’ve also pointed out SigInt has distinct limitations, which is why you also need humint. That is whilst you might know an electronic data source, you can not know for certain via technical means the data sink. The simple case is “the broadcast model” you have a powerfull transmitter covering a vast area in which there can be from zero to many receivers. Whilst some receivers can be found by electronic means by no means all can. But even where they can it requires specialised equipment that has to be very very close to the receiver, and only when it is opperating. Thus if a receiver can be mobile and your finding resources are limited you have no way of knowing the locations of an unknown number of receivers.

The same applies in networked systems, you may know the data source and be able to see the traffic leaving it and at various nodes along a path to what appears to be a data sink. But can you actually verify that what you think is the data sink is what you think it is and more importantly that the data has not been tapped / teed off at some point along the data path. Without going into the tedious details the answer is no you can not.

Further we have good reason to belive that other members of the Intelligence Community carry out false/red flag activities. Whereby the look to make attacks look like a third party to gain an advantage of some kind.

When you start to consider how easy this can be, as well as playing to other peoples confirmation biases it becomes easy to see why atribution can be difficult and accurate attribution impossible.

Thus when technical “methods” are unreliable you have to go for boots on the ground “sources” or HumInt. The problem is that is also unreliable. As we saw with the ex MI6 man who took money from both the Republicans and Democrats to get dirt on Donald Trump, if you do not excercise extream caution your source / agent will give you not what you want, but what they think you want to hear. Hence the “Pros Pee on the bed” story, that realy can not be verified one way or the other, but on balance is unlikely (after all having been “entertained” that way where do you sleep?.. and who pays for the clean up etc).

Thus “facts” in Intel Reports are very unlikely to be anything close to what most would consider guesses, let alone evidence.

Which is why you should always ask the simple questions of “Could this be Faked, and how difficult would it be to do?” and the answers with technology is almost always “Yes” and “Easy”…

Clive Robinson • June 19, 2017 1:03 AM

@ tyr,

… religious zealots who wanted to rethrone a Tsar

I don’t know where they thought they would get one from… As Leon As Trotsky pointed out, “The Tsar’s family was a victim of the principles that form the very axis of monarchy: dynastic inheritance”. Thus their deths were assured, especially as outside of Russia the Romanov’s were still regarded in all ways as the heads of state.

We now know where the bodies are, all but two are buried in the reburied in the Peter and Paul Cathedral in Saint Petersburg their identitoes having being confirmed by DNA. The grave of the other two children was not discovered untill 2007 and for what appears to be politicaly inspired behaviour instigated by the Roman Orthodox Church to deny who they are, their remains are kept in a state repository “pending further DNA tests”.

So the religious zelotry contiues to this day (for more earthly reasons(.