Schneier on Security

Roger • August 13, 2015 11:31 AM

I was going to make a bunch of comments, but I see that parkrrrr has already covered a few of them. Here’s a few more though:

1. In what follows, I will assume that Muller is indeed both the email writer and one of the kidnappers. There seems to be clear evidence that the email writer either was one of the kidnappers, or at least had access to them. The case against Muller also seems pretty strong, but it isn’t yet proven. It will certainly serve as a working hypothesis; but if you want to think of yourself as a security analyst, you need to get into mental habits such as keeping in mind what things are proven, what are probable, and what is merely assumption.
2. Given that Muller and the email writer are both members of the same gang, it is immediately clear that a large part of the emails are definite falsehoods, and much of the rest is highly dubious. This shouldn’t be at all surprising as it is well known that professional criminals are liars: generally self-serving liars, and often well-practiced liars. Indeed, if you read the emails whilst playing “spot the lies”, it is apparent that Muller isn’t even all that good at lying. Most of his lies fit some patterns that are pretty common for criminals communicating with law enforcement; more on that in a moment.
3. What is more surprising is that here on a security blog some people still seem to be treating so many statements from the email as being credible. I guess this won’t make me any friends, but really, I say this to be helpful: if you didn’t spot that Muller’s email was a load of eyewash, you need to wise up. Technical security is important too, but most security failures come down to simple human dishonesty. To be an effective security practitioner you don’t necessarily need to be a human lie detector, but you pretty much do need to be able to spot eyewash this bad. In fact, it’ll be a great help in your personal life, too…
4. @Nicholas weaver: ” its really hard to mix lies with truth in such a way that the lies can’t be verified but the truth can”. Umm, no it is not. In fact it is pretty much Lying 101. When small children first start lying at around 4 years of age, they tell very simple lies that don’t understand the ways a listener might try to diagnose their lies. As soon as they become mature enough to start to see things from the listener’s point of view, and construct lies that are harder to detect, mixing lies and truth is one of the most basic techniques. The clever thing to do is to tell the truth about everything that is verifiable, and tell lies only about the key points that must be confused. Muller wasn’t that smart.
5. “onions within onions” is a tautology that butchers the metaphor. It is a very small point, but someone put this phrase up as proof that Muller (or his partner) is a clever fellow who couldn’t possibly make a blunder. In fact it does the opposite, and shows him as someone who — while by no means an idiot — is not nearly as clever as he thinks.
6. Now to examine a specific lie. (I could do a dozen of these, but this margin is too small…) The email author states that the kidnappers deliberately learned military jargon in order to frighten their victims with their apparent professionalism. Now given that Muller was one of the kidnappers, we know this is a lie; in fact Muller was an ex-marine and already knew his military jargon. On the other hand, it would be trivial for the police to confirm with the victims that military jargon had been used. Hence we must conclude that military jargon was used in front of the victims, and the kidnappers went out of their way to provide a false explanation for this. Why? Obviously, they belatedly realized that they had left a clue about Muller’s background, and so they want to muddy the waters.
7. Seen in this light, it can be seen that a lot of the email consists of what are probably red herrings in a belated attempt to compensate for a blundered crime scene that was replete with clues:
   • Why bother with the irrelevant and dull detail of how the gang first heard of the abandoned naval facilities on Mare Island? Again, because they didn’t want the police to consider that they knew about Mare Island from the military.
   • What about the tall tale about wetsuits and hairs collected from neighbors? Neither victim noticed a wetsuit, even when being manhandled, and the evidence turned up at Muller’s house makes this seem rather unlikely. But it sows the ground for a handy defense in court if the police did turn up some of their DNA at the victims’ residence.
   • Why steal the drugs from the homes of other victims, when the affidavit indicates that the drug in question was merely Nyquil, a common over-the-counter medicine of little street value? Perhaps because they actually bought it at the local druggist, and don’t want the police checking there.
8. Not all of it is simple muddying of clues. He is also laying the grounds for a light sentence by showing his remorse — something that Muller’s subsequent actions show to be pure baloney.
9. Oh, that’s enough. Off to bed.