Schneier on Security

Clive Robinson • October 10, 2011 2:29 PM

@ Marc, Pat Cahalan,

“…unencrypted video feed…”

This bit of news is several years old, the story at the time is a drone spotted some turban wearing type sitting behind a rise with a laptop on his lap looking at the live feed which got relayed back through the drone and produced one of those “1970 TV Special effects”.

If the story is true or not I have no idea but certainly the feeds are unencrypted and you can pick them up with less than 500USD of equipment and software.

And this is what I was refering to over on the Friday Squid page, when indicating that the design of the drones was “not secure” because the project emphasis was getting “drones on target” for field evaluation. Unfortunatly they kind of missed out on the next few project steps as they then went to live combat field testing.

Now there are several questions about encrypting or not encrypting the video feeds. In a tactical situation encryption is not going to add a loapart from less reliability and a false sense of security (you don’t need to see the feed to know it’s time to “duck and kiss your tail feathers” just hearing the carrier is sufficient for that.

So to make any encryption worth while you would have to encrypt both the base band signal (video) and the RF (carrier) via the likes of Spread Spectrum.

Think back ten or so years to what the state of the Joint Tactical Radio Systems and how unreliable they were (and still are for that matter) and the size and weight of the “secret equipment” required to use it.

Now think of one of the original intended purposes of the drones which was “online tactical intel to engaged front line troops” and ask do you realy want them toting large heavy secret equipment around whilst under direct enemy fire?

Clive Robinson • October 11, 2011 9:58 AM

@ RobertT,

“If you’ve got a solution to this problem, than there are a lot of interested parties…”

Oh I’ve a number of solutions all right but as it involves sensible resourcing as a primary requirment the conversation stops at that point.

The crux of the issue is the politics of resources which always equates to “spending” and that is a “dirty word up on the hill” unless certain people are being lubricated by pork grease.

With regards “detectability” by those on the ground I agree SS is only a partial solution that is not aging as well as one might expect. The solution is to lower the energy at their antenna to below the noise floor. If you look at it purely as energy then there are only two solutions,

1, Reduce the energy radiated from the drone.
2, Confine the energy to radiate in a different direction.

Both of these are limited in the scope of what can be achieved due to the base band bandwidth and the distance ratio of drone to blue and red forces.

The simplest first thought being a narow beam width low power X-band or above signal up to another plane or satellite. Obviously the first problem with this is the weight/size of the tracking equipment in the drone needed to keep the beam pointing where it should be. Then there are a whole load of secondary and tertiary problems.

Thus put simply “detectability of the energy” needed for the video due to baseband bandwidth is going to be an issue when it comes to energy radiated. Importantly the red forces are almost always likley to be closer to the drone than blue forces when it is used so there is the very real possability that the energy signiture from the drone cannot be “put in the noise floor” with realtime video.

So logicaly the next thing to look at is how to reduce the baseband bandwidth. Although we have progressed a long way in video compression it has almost always been at the cost of CPU cycles which have energy, size and weight issues of their own which were considerably more significant 20years ago.

Even today in a new “intel drone” design you would still be looking at a significant increase in energy, size and weight compared to many other parts of a drones electronics. However in a “stand off drone” used as a weapons platform this is considerably less of a consideration.

All this is before the consideration of the actual electronics in use. As you note the product cycles for comercial products are at best 3years, whilst for military products 3years puts it at best into the first set of field tests.

Thus even today I suspect drone designers would look at reducing the energy, weight and size, and accept the loss in arguable security in favour of increased functionality on target.

But what are the reasons they don’t encompass more contemporarie commercial equipment?

The reasons are actually more political than technical. You can see this by going through the options the military could consider.

One solution is to “roll your own” but as we have discussed before this is not realistic due to the level of investment required.

Another solution is bulk buy in the parts and stick them on a shelf untill required. However this requires a sensible inventory control policy and system, which lets be honest no military forces and few commercial organisations have ever managed on even a short time frame but over 20 years… forget it.

There is however a third option which is “standardise the interfaces”. That is you just except that various bits of a system will need to be “upgraded due to obsolescence” during the life cycle of the system, and build it into the design.

This is one of the bits everybody forgets to talk about when using COST designs, because they are normally far to intent on showing cost savings.

However it needs carefull functional decomposition of the system and my previous experiance in the mil domain design sugest this is an area that they could considerably improve in.

The fourth option is “go fully comercial” that is assume your enemy is far from equal and that their ability to compete on the intel side is minimal. From this perspective, all you do is “ruggedize” ordinary commercial systems such that it will be more likley to survive battle field conditions.

We have already seen this with the likes of hand held GPS systems, and most manufactures would (providing the order is of sufficient size) be happy to provide more physicaly robust systems as there is actually a small but significant commercial requirment for such systems. The cost involved is usually that of enclosure re-tooling, which is usually around 0.5M USD, which is quite reasonable for +10K parts.

However there is still the “security” aspect to consider, and this is where the politics start, and it brings the military up against law enforcment when looking at commercial products.

From the military perspective putting high level security in comercial communications systems will have little impact on their intel functioning, mainly because apart from very high level circuits simple traffic analysis provides the bulk of their tactical SigInt (that is message content is mainly irrelevant compared to knowledge of endpoint location and traffic volume).

However politicaly LEO’s don’t want mil level security in commercial equipment as their expressed view is unfettered access to electronic communications content being “vital to law enforcment”. It’s bullshit as both crime and the LEO’s have always been successful without mil grade security and will continue to do so irrespective of what level of secure products are available. This is because the simple fact is LEO’s use humint not sigint to persue by far the majority of their cases, and will continue to do so.

However from a political viewpoint LEO’s have an entrenched position against anything other than the most feeble of communications security and will fight any proposal to provide high level security. Mostly this is a “give us more resources” stance than a genuine problem, but they will play it out as long as they can. Likewise the military can likewise use the “LEO position” to argue for more resources…

So neither side is realy interested in resolving the issue…

Clive Robinson • October 11, 2011 7:30 PM

@ moz,

“For once (and I know this is dangerous) I’m going to disagree with Clive”

If you are a US citizen you have the legal right to do so (as for other jurisdictions check your statutes, either way feel free 8)

That said…

“The encryption doesn’t have to be perfect to be useful.”

I agree with this statment to a certain extent but only in this particular set of circumstances…

However the military doctrine in the past has assumed equal if not more skilled cryptographas on the red side, and that the crypto should be good for a known period of time.

The conservative military aproach in the past has thus been to treat all non front line comms as though they may be carrying high level traffic (to obviate the Field Marshal in the troop transport plane scenario). This viewpoint originated in WWII where low level weather and dockyard ciphers provided entries into higher level ciphers due to the same plaintext traffic being encrypted in several ciphers.

What makes a difference in the Iraq and Afghanistan conflicts is the “technology gap”. However this not to say the gap cannot be bridged by other Nations who then pass on the methods.

And this brings into play the “little knowledge is a dangerous thing” and “false sense of security” rules of thumb.

People chatting on a known to be insecure line will be very circumspect about what they say. However they tend to be fairly free in what they say if they belive they are on a secure line….

Thus from the military perspective it is always preferable to go for high security at all points except for front line comms, simply to stop slips by use of insecure lower level ciphers, which the users believe incorrectly to be secure.

However the modern world has advanced in so many ways in the last 70 years that the use of what would have been “high level” ciphers back then is effectivly mandatory these days just to ensure a return on IP.

The changes over the last ten or so years has enabled high level encryption (AES etc) to be used inquite small energy efficient packages in the commercial sector, however not so the military, they are still playing “Chatche up”.