Information-Age Law Enforcement Techniques

This is an interesting blog post:

Buried inside a recent United Nations Office on Drugs and Crime report titled Use of Internet for Terrorist Purposes one can carve out details and examples of law enforcement electronic surveillance techniques that are normally kept secret.

[…]

Point 280: International members of the guerilla group Revolutionary Armed Forces of Colombia (FARC) communicated with their counterparts hiding messages inside images with steganography and sending the emails disguised as spam, deleting Internet browsing cache afterwards to make sure that the authorities would not get hold of the data. Spanish and Colombian authorities cooperated to break the encryption keys and successfully deciphered the messages.

[…]

Point 198: It explains how an investigator can circumvent Truecrypt plausible deniability feature (hidden container), advising computer forensics investigators to take into consideration during the computer analysis to check if there is any missing volume of data.

[…]

Point 210: Explains how Remote Administration Trojans (RATs) can be introduced into a suspects computer to collect data or control his computer and it makes reference to hardware and software keyloggers as well as packet sniffers.

There’s more at the above link. Here’s the final report.

Tags: , , , , ,

Posted on December 19, 2012 at 6:47 AM • 30 Comments

Comments

Peter A. • December 19, 2012 7:00 AM

The report does not reveal how the forensic examiner can “check if there is any missing volume of data”.

Is having some free space on disk a crime now?

Paul Renault • December 19, 2012 7:37 AM

I wonder if there’s a report somewhere titled: “The use of the Highway System for terrorist purposes”.

Ryan • December 19, 2012 8:13 AM

Peter,

Yes and no. One of the key aspects of using hidden volumes is that if the dummy volume doesn’t have significant changes over time but the overall volume (dummy + real) does, you can determine with high probability that the dummy one is, in fact, a dummy one. A volume from some previous versions of TrueCrypt could even be analyzed based upon snapshots of the volume over time without needing access to the dummy drive at all to determine the existence of a dummy and hidden one. TrueCrypt provides a run-down of the security precautions to follow in order to ensure adequate plausible deniability here. One of the most basic protections you can do is to ensure that you use the dummy volume regularly (easiest for a system/partition one) whenever you don’t need the added security so as to keep the entire file system changing regularly and unpredictably.

Peter A. • December 19, 2012 9:00 AM

@Ryan: I know the precautions for using a hidden volume. I just wonder what “missing volume of data” the report refers to.

Danny Moules • December 19, 2012 10:59 AM

@matt

They probably used a weak key, implemented the algorithm wrong or leaked key information somehow. AES doesn’t need to be fundamentally flawed for people to implement it badly enough that implementation can be broken. Personally around 95% of the implementations I see have fatal flaws in them.

Captain Obvious • December 19, 2012 11:13 AM

@Paul

Terrorists will often be found driving Weapons of Mass (1.5-4T) Destruction on the Highway System. They use this nefarious Highway System to efficiently acheive their transportation goals to further their terroristic agendas. All users of said Highway System should be suspect and monitored closely.

trucrypt • December 19, 2012 11:30 AM

Using deniability = 6 or 24 months in jail:
198. […] For example, a setting of TruCrypt [sic], a common free encryption tool, allows a suspect to encrypt a hard drive and create two passwords: one for the “clean” drive and the other containing the incriminating material. This can be circumvented by ensuring that the forensic examination of the hard drive takes into consideration whether there is any “missing volume” of data. Additionally, offences of this nature are usually summary offences, which carry maximum penalties of six months imprisonment. In the United Kingdom, however, when the case involves national security issues, the maximum penalty increases to two years of imprisonment.

trucrypt • December 19, 2012 11:41 AM

374. […] Electronic investigative techniques included the use of wiretaps of audio conversations between the defendants and listening devices planted in vehicles and the house […]
In the case of Gelowicz, the alleged ringleader of the group, […] had protected data on his computer using encryption, which forensic experts tried without success to decrypt and access. Gelowicz eventually supplied the encryption key, but investigators found only traces of shredded data.

trucrypt • December 19, 2012 11:45 AM

  1. […] The Onion Router may be used to protect the anonymity of users by automatically rerouting Internet activity via a network of proxy servers in order to mask its original source. Rerouting network traffic via multiple proxy servers, potentially located in different jurisdictions, increases the degree of difficulty of accurately identifying the originator of a transmission.

I wonder if all of this is accurate of if they only want the terrorists to use TOR because they built so much TOR nodes (the same for all other conclusions of this document).

loll • December 19, 2012 11:46 AM

interesting read. why do people keep using security through obscurity by hiding msgs in spam and pictures. just use pgp

uk residents now just upload tiny tc and LUKS containers to dropbox like sites through tor using live cd o/s and avoid evidence of encryption alltogether. that said 2yrs for obstruction for not providing your password sounds a whole lot better than life if you do. reminds me of when maksik of ukraine hacker fame was rubber hosed in a turkish prison under secret service orders to give up his passwords. if he followed the ira counter interrogation ‘green book’ and said nothing he would be free instead of doing 30yrs for carding

MoJo • December 19, 2012 11:52 AM

The claim that hidden TrueCrypt volumes can be detected is, I think, optimistic. At best the police could state they have some suspicion, but in a court of law it would need to be proven beyond reasonable doubt.

Besides which as the paper notes the maximum penalty for refusing to hand over your keys is two years, or six months in some cases. If you were a terrorist or paedophile you would definitely take that over giving the police evidence of your actual crimes.

NobodySpecial • December 19, 2012 11:57 AM

@loll > why do people keep using security through obscurity by hiding msgs in spam and pictures. just use pgp

Police chief: this drug suspect in Columbia keeps communicating encrypted messages to a person in Spain. Should we investigate the person in Spain?

Police chief: 1000s of people in Columbia are receiving the same spam email as people in Spain – should we investigate all of them?

NobodySpecial • December 19, 2012 12:13 PM

@mojo – these laws are of course only used against terrorist and child-pornographers.

So simply bring the person to court, tell the jury that they are a terrorist (skin colour=brown) or a child-pornographer (skin colour==white).
If they are innocent why don’t they hand over the passwd?

And then just rely on the ‘common-sense’ of the jury to bring in the correct verdict. Together with advanced knowledge the average judge has of unused block marking in NTFS secondary streams

loll • December 19, 2012 1:58 PM

@nobodyspecial instead the feds found and read the intel which makes their job much easier. they could have pgp ascii armored their msgs then hidden it in the viagra pics or even better have the guy in spain use tor to retrive from alt.binaries.msgs or tormail

spy agencies and LE know all about fake spam, steg, hiding msgs in pics, its the oldest trick in the book.

@mojo tc containers are easy to find on any wear leveling device like usb sticks. reg disc drive would be nothing but false positives

Clive Robinson • December 19, 2012 3:42 PM

@ truecrypt,

Rerouting network traffic via multiple proxy servers potentially located in different jurisdictions increases the degree of difficulty of accurately identifying the originator of a transmission

If only that were true…

The topology of the Internet is quite odd for a whole host of reasons history/politics/technology one thing it realy does not do is follow jurisdictional boundries (the exception being countries with what we would consider the more represive forms of government).

Just routing through a bunch of nodes that are in different juresdictions could end up with all link level traffic going through the same Internet node. Thus making surveillance quite easy.

If you have a look at the main WASP nations that form the consortia that has evolved from the BRUSA AgreementB then examine the actual physical network cabling then you will find that these countries sit conveniently on the major Internet routes and nodes…

Also due to latency and efficiency issues TOR is very susceptible to traffic analysis. The joke of it is that it probably makes the identifing of “people of interest” considerably easier.

And as one person has noted above when you are not 100% open and transparent you just make the prosecutions life so easy as they can use iinuendo (four horsmen of the internet) to have a jury convict you. The idea of “beyond reasonable doubt” went out befor court officials heated their hands near the fires they burned heritics and the like for public entertainment and political control.

Paeniteo • December 19, 2012 5:16 PM

@A: “in which court system?”

Pretty much every court system requires to prove guilt “beyond reasonable doubt” in criminal cases. Very elementary stuff.
The UK (which has this “hand-over-your-keys”-law) is no exception here. The only case I am aware of where someone was convicted because of not decrypting data was one where the fact that encrypted data existed was not doubted by anyone (i.e., deniability was not considered at all).
Disclaimer: IANAL, particularly not in UK.

However, if you mean to talk about “allmighty secret police” or “corrupt courts” style scenarios where “beyond reasonable doubt” is no issue, no amount of plausible deniability will help you there. The interrogator won’t believe your denials anyway, no matter how plausible or even truthful they may be.
In those scenarios, you would be screwed, no matter what.

Figureitout • December 19, 2012 5:37 PM

@Paul Renault
–Not exactly the title you’re looking for, but very(1) close(2).

UNODC stated one purpose/use for a tool w/ the lump-all term of “terrorism”; what about unjustified surveillance? What are they going to do about that? I guess since a tool can be perverted the ITU should limit who and how someone can use it from the outset; and we should all go to the BMV-equivalent to get a license to use the internet after having agreed to certain conditions.

tool • December 20, 2012 3:44 AM

On topic, but not within PDF:

“I’d worry about a Tempest virus that polled a personal computer’s
CD-ROM drive to pulse the motor as a signalling method:

  • Modern high-speed CD-ROM drive motors are both acoustically and
    electrically noisy, giving you two attack methods for the price of one;
  • Laptop computer users without CRTs, and the PC users that can afford
    large LCD screens instead of CRTs, often have CD-ROM drives;
  • Users are getting quite used to sitting patiently while their
    CD-ROM drives grind away for no visibly obvious reason (but
    that’s quite enough about the widespread installs of software from
    Microsoft CD-ROMs that prompted Kuhn’s investigation in the first place.)”

http://catless.ncl.ac.uk/Risks/19.60.html#subj9

Clive Robinson • December 20, 2012 4:23 AM

@ Bob T,

Why not just use a WWI code book and a carrier pigeon

Shsh stop revealing UK State Secrets as jokes 😉

Don’t you know GCHQ wants everyone to think pencil&paper ciphers are the way to go?, Do you realise you could just have wrecked their entire master plan for whole sale Internet surveillance?

Why do you think they’ve been saying that pencil and paper message is unbreakable? it’s to convince people they don’t need this NSA sponsored backdoor called AES just like that DES thing before it. They want you to think you need to Playfair and use proper BRITISH pencil and paper ciphers, if you think it’s secure you will use it badly to their advantage…

[Disclaimer : “Just kidding folks”, for those who might have thought I’d been sniffing the anti-freeze and taken leave of my senses such as they are 🙂 ]

Clive Robinson • December 20, 2012 5:14 AM

@ Tool,

I’d worry about a Tempest virus that polled a personal computer’ personal computer’ CD-ROM drive…

Yes and the hard drive and in some PC’s the cooling fans as well are under CPU control.

You can also do it with PC’s where the CPU does not control the fan, but the hardware has a simple thermal sensor to control it’s speed. You do this by simply having a process that uses power expensive instructions in tight loops, thus raising the CPU temprature (it’s one of the side channels I was considering a long time ago when thinking about how the temp inside the case changed various things including the CPU clock XTAL frequency).

The change in sound side channel is one of the first identified problems with Quantum Key Distribution. Basicaly the bod who came up with the idea whilst first testing the idea could tell the state of “Alice’s polarizer” simply by the amount of noise it made…

The CD-ROM motor idea I’d heard befor but could not remember where till I followed your link.

Dr Lloyd Wood has worked with the UK’s Surrey Uni, the European Space Agency and Americas NASA and one or two other places as part of his work for Surrey Satellite Technology Ltd. He has been involved with CLEO (Cisco router in Low Earth Orbit) and other work on what’s being called “The Space Internet”.

Of interest is his work on Delay and Disruption Tolerant Networks (DTN). It’s not been said “publicaly” as far as I’m aware but the work has aspects that are important to anonymity networks such as TOR.

You can read more on Dr Wood’s DTN work etc at,

http://personal.ee.surrey.ac.uk/Personal/L.Wood/dtn/

The UK occupies an odd position in the “Space Race” it is the only nation who having put a satellite into space then stopped further space rocket development (the Black Knight launch platform was considerably safer and more economic than the then US and CCCP systems). The UK has however continued in the Space Game and is perhaps the leading designers of payloads for scientific and industrial satellites (it probably is on military sats as well but nobody who knows for sure is telling 😉

wkwillis • December 21, 2012 6:30 PM

I’ve considered spam to be steganographic message channels for governments to communicate with spies for a long time
I figured that that was why they didn’t shut down the spam generators.
When will knowledge of this be sufficiently general that the public will shut down the government spam regime?
I would cheerfully pay one dollar a month to send 1000 messages a month, which is cheap for me, tolerable for governments, and expensive for spammers.
But the government is soon going to be cutting police budgets, so this isn’t going to be happening anytime soon.

Bill Stewart • December 21, 2012 11:33 PM

Spam – Are you saying that some of that spam really is from a corrupt official Nigerian trying to move money into your country?

TrueCrypt – the trick is that the encrypted volume takes up X MB on your disk, but the dummy volume you reveal to the police only takes Y MB, with Y significantly less than X, with enough difference that you suspect there’s something still hidden.

The one that surprised me was the “CIA+Saudi had to stop running their honeypot when they realized it was being used to plan attacks on US troops in Iraq.” Duh? I thought that was the kind of material you really wanted to find, since the enemies can always find another communication method to plan attacks, but this way you’d know all their plans before they attack, and can block or disrupt them.

neill • December 27, 2012 11:16 AM

RE truecrypt – we need 3 passwords

1 – full normal user access
2 – minimal access to boring data to satisfy hostile investigator, enough to stop torture etc
3 – destruction of data
.

Leave a comment

Login

Allowed HTML <a href="URL"> • <em> <cite> <i> • <strong> <b> • <sub> <sup> • <ul> <ol> <li> • <blockquote> <pre> Markdown Extra syntax via https://michelf.ca/projects/php-markdown/extra/

Sidebar photo of Bruce Schneier by Joe MacInnis.