Paris Terrorists Used Double ROT-13 Encryption

That is, no encryption at all. The Intercept has the story:

Yet news emerging from Paris—as well as evidence from a Belgian ISIS raid in January—suggests that the ISIS terror networks involved were communicating in the clear, and that the data on their smartphones was not encrypted.

European media outlets are reporting that the location of a raid conducted on a suspected safe house Wednesday morning was extracted from a cellphone, apparently belonging to one of the attackers, found in the trash outside the Bataclan concert hall massacre. Le Monde reported that investigators were able to access the data on the phone, including a detailed map of the concert hall and an SMS messaging saying “we’re off; we’re starting.” Police were also able to trace the phone’s movements.

The obvious conclusion:

The reports note that Abdelhamid Abaaoud, the “mastermind” of both the Paris attacks and a thwarted Belgium attack ten months ago, failed to use encryption whatsoever (read: existing capabilities stopped the Belgium attacks and could have stopped the Paris attacks, but didn’t). That’s of course not to say batshit religious cults like ISIS don’t use encryption, and won’t do so going forward. Everybody uses encryption. But the point remains that to use a tragedy to vilify encryption, push for surveillance expansion, and pass backdoor laws that will make everybody less safe—is nearly as gruesome as the attacks themselves.

And what is it about this “mastermind” label? Why do we have to make them smarter than they are?

EDITED TO ADD: More information.

EDITED TO ADD: My previous blog post on this.

Tags: , , , , ,

Posted on November 18, 2015 at 3:35 PM • 149 Comments

Comments

jt • November 18, 2015 4:05 PM

Oh no, the terrorists drove cars, we must immediately ban the use of automobiles! Some of them used buses and trains…ban those too. Ridiculous.

Clive Robinson • November 18, 2015 4:08 PM

I’m not surprised that the final stages just before the attack and during the attack were little more than verbaly obfuscated. By that time OpSec was near irrelevant.

Earlier messages to do face to face and other meetings again needed no encryption just a pre aranged signal word / words, possibly passed through an inocent third party.

Such things are the sort of field craft taught to rhe likes of OBL that would have been taught to others and so on down the line.

The fact that various senior CIA officers want you to think it’s “all snowdens fault” are basicaly telling you lies to stop you enquiring further into how OBL etc learnt the trade craft from them and their Russian equivalents.

All a bit sad really because it is a mater of public record…

However they might also be lying to get those juicy budgetary allocations that their “industrial friends” –who are going to “feather their nests”– are going to get significant wedges of tax dollars from…

Mailman • November 18, 2015 4:20 PM

This shows that access to more data is not the key. The key is to extract meaning intelligence with the vast amounts of data that the authorities already have access to.

Spartanus • November 18, 2015 4:26 PM

ROT-13? Really??? Wow… They really are stupid! Scary to think what smart terrorists could do. But, then again, would smart people even become terrorists?..

JB • November 18, 2015 4:37 PM

The ISIS Mastermind of the attack communicated with his followers via messages encrypted using a series of colored pegs (an accompanying set of smaller black and white pegs serving as the key).

John E. Bredehoft • November 18, 2015 4:45 PM

So, is ROT-52 twice as powerful as ROT-26? 🙂

I’ve seen speculation that some of the carelessness of the perpetrators was possibly due to a belief that they would not survive the attack.

Or perhaps it’s just due to good old dumb crime. I’ve been selling fingerprint identification systems for over twenty years; you’d think that some criminals would learn to wear gloves in that time.

Blaberton • November 18, 2015 4:48 PM

We should also stop naming those individuals because it’s what they want: to “exist” in the society and in the mind of people, to leave their mark in history. They want to be recognized, make a difference (even if it’s in the worst possible way).

For now being a terrorist is a very effective way to become “someone”: you get your name printed in big letters, spoken by thousands of people all over the planet. Nowadays an accomplished terrorist is just like a star!

The media should not name them at all. The authorities should give them randomly chosen numbers to be used instead: “T6513” would be a nice example (where the ‘T’ is for terrorist of course).

I even think that it could be a good thing to deprive those people of their name if they die in a terrorist attack. “T####” would have to be written on their grave…

Since they believe in a life after death it might influence their decision subconsciously. Maybe.

Of course a secure PRNG or even a quantum RNG should be used as we certainly wouldn’t want them to be able to predict their new name by planning their death accordingly!

Steve • November 18, 2015 4:54 PM

This is so anoying:

http://www.cbs.com/shows/48_hours/video/yQ_QCyEYN6yBhhWHmaI3fnY4_4qApTFD/encrypted-messaging-apps-helping-terrorists-go-dark-/

Norah O’Donnell: …How could attacks with this level of coordination and lethality go virtually undetected?
John Miller (NYPD Deputy Commisioner of Intelligence): Norah, what I think you’re seeing here is what FBI Director Jim Comey calls “going dark” and that is, in the, in in kind of the time following the Snowden debate about privacy anbd government overreaching and all of those allegations, a series of apps have come out that are encrypted, that self destruct, set to a timer, that can hold group chats that are completely protected from surveillance for up to 200 people, and the terrorists have found these apps and they’re using it, and, Norah, what I’m talking about is you can walk in the door with a court order from a federal judge, hand it over to the company and say we need to see what’s inside, just like we did after Mumbai, just like we did after 9/11, and they’ll tell you, “we can’t see what’s inside here, we designed it to be uncrackable”, that’s a real challenge.
Norah O’Donnell: Scary.

“virtually undetected” Norah? Miller fed you that question.

Anon Ymous • November 18, 2015 4:58 PM

I am wondering: is it responsible that the media publishes details about terrorists not using encryption or what kind of encryption they might be using?

Won’t this give them pointers about what to do in the future?

Steve • November 18, 2015 5:05 PM

@jt – no one suggests banning cars etc, the point is they’re not using encryption, and the intelligence community is using this attack (and their failure) to push their anti encryption anti privacy agenda. Please raise the level of you’re commentary (the term in rhetoric is false dilemma…back doors or ban cars)

Jarrod Frates • November 18, 2015 5:07 PM

@Blaberton: For single-shooter events such as are most prevalent in the United States, I would agree with you, but the investigation needs as many feeds as it can get from the public, including the need to identify the person that was holding a Syrian passport (which was either stolen or forged). Linking the others to potential accomplices is important for finding out who was involved.

Alex • November 18, 2015 5:26 PM

It’s not that the terrorists are that smart , it’s that big governments (and the people that run them) are that dumb. Government agencies, including intelligence, law enforcement, etc., are political creatures. People are often promoted for who they know, not what they know.

I’ve been part of a few terrorism drills with officials from various agencies in the room. On the screen they’d throw up the structure, their security checkpoints, etc. They’d waste hours about the details of each of these imaginary checkpoints then would become quite pissed when we’d run the terrorist through a side-entrance, have the incident happen outside (often next to) the security checkpoint, NOT use a traditional bomb or gun (there’s plenty of ways to kill/injure), set up a radio jammer, etc. I distinctly remember one of the agency guys pitching a fit saying “the terrorist is supposed to detonate the bomb after going through the checkpoint.” I responded with, “I hope you’ve informed the terrorists of that.”

I’m being 100% serious when I say I’m more afraid of my government than terrorists. More afraid of their incompetence, more afraid of their abuse of power.

Anon Ymous • November 18, 2015 5:32 PM

@ Alex: that is – unfortunately – accurate. All the security measures implemented in airports and the like are a result of corrective action AFTER most attacks. Nobody creative enough to predict new scenarios.
Got a terrorist trying to blow up a plane via a shoe bomb? AFTER the fact start checking shoes too.
It’s mostly security theather.

Steve • November 18, 2015 5:35 PM

@CallMeLateForSupper – yeah I caught Friday night and cringed, but I coudn’t motivate myself to transcribe it ’til today, I have no easy (or free) access to broadcast news transcripts as an ordinary citizen (and without print access should it qualify as journalism?)

Spartanus • November 18, 2015 5:55 PM

I guess it’s rather lucky (if the word “lucky” can be used in a situation like this) that the terrorists in this case were so dumb. This takes the sting, as it were, out of “the other side’s” argument in these Crypto Wars 2.0. Imagine if they HAD actually used encryption: it would not have changed anything in the theoretical reasoning about the merits of encryption, but it would have been made “our” position almost untenable from a “PR” and emotional perspective (especially in France, but then it doesn’t seem like there is going to be any discussion there at all, the National Assembly will vote on a lot of important laws tomorrow).

BlueLightMemory • November 18, 2015 6:02 PM

But wait a second, didn’t Brennen just say that Evile encryption was the reason for the success of the Paris terrorists. This would be an absolutely laughable situation if it wasn’t in reality so sad.

So bascically, Brennen, who is the CIA director, has proven and shown himself to the world to be a complete, incompetent, asshole. Does anyone know if Comey was also blaming encryption for the Paris attacks?

LessThanObvious • November 18, 2015 6:24 PM

They will just use the lack of encryption as a justification as the flip side of the same coin. We found some of them because there was a trashed cell phone with data we could easily harvest. They will just say “OMG thank goodness they didn’t have encryption or we might have lost out on that valuable intelligence”. It has less impact as an argument, but it’s still an argument that can be made.

Martin Walsh • November 18, 2015 6:30 PM

What is the source of this information, that the terrorists used ROT-13? I am unable to locate this in the article cited, nor in other places. There is so much disinformation flying around it’s impossible to determine anything. I will assume you know this somehow, but all the same this assertion only adds to the confusion.

jt • November 18, 2015 6:31 PM

@Steve. No one, except possibly you, is claiming they did not use encryption. All we know for sure is that they communicated at least once in clear text. Absense of proof is not proof of absense. And you want to school me in the use of logic? Please try to raise the level of your commentary. In English the term sarcasm is used to describe the use of irony to convey derision.

rgaff • November 18, 2015 6:32 PM

@Martin Walsh

“Double ROT-13” is a geek joke…. If you apply ROT-13 twice, the second time undoes the first one, you end up with NO ENCRYPTION AT ALL…. It’s a way of saying “plain text”

Dennis • November 18, 2015 6:44 PM

The old say goes, guns don’t kill people, people kill people…

It’s intended use that puts other people at risk. These types of attacks goes way back in religious, ethnic, and socioeconomic roots. Blaming guns and encryption is no more than scapegoating the problem.

Dirk Praet • November 18, 2015 6:44 PM

@ Bruce

That’s of course not to say batshit religious cults like ISIS don’t use encryption,

They’re not batshit religious. They’re actually not religious at all. More like batshit insane.

@ Clive, @ BlueLightMemory

… didn’t Brennen just say that Evile encryption was the reason for the success of the Paris terrorists.

The reality of the US system is that unlike ordinary citizens, LEO’s, government officials and even media are officially allowed to lie to the public. Over here, we call that propaganda, literal translation of which from Latin is “that which is to be propagated”.

Steve • November 18, 2015 6:46 PM

@Martin Walsh – double ROT13 is math/crypto humor. One application of keyless ROT13 “encrypts”, the second application “decrypts” so double ROT13 is the identity map for the message ie. no encryption whatsoever. They didn’t actually use ROT13 or anything. In more detail ROT13 = rotate by 13 places in a 26 letter alphabet, then rotae 13 more places brings all the letters right back to their original

Dennis • November 18, 2015 6:50 PM

@ Dirk Praet

”Over here, we call that propaganda, literal translation of which from Latin is “that which is to be propagated”.”

Interesting that you said propagated.

As the old say goes, governments don’t lie to people, people lie to people…

There’s been a conciousness to study and form memes, lies and/or truths that propagate. People telling people lies they heard. As the lies propagate, they form memes…. but it can work both ways. It’s a bit like the logic layer of networking, except the source and destinations are obscured into oblivion, by design.

Steve • November 18, 2015 6:58 PM

@jt – the title of this blog post claims they did not use encryption and The Intercept is claiming it also. It is far, far, far more likely that they planned within the rented apartments in Paris and Brussels (where there would be no need for encryption logic suggests) And I’m not suggesting that apartment rentals should be banned or that cameras and mics should be installed in every room and building everywhere (which seems where we’re headed if intelligence agencies could have their way – Jeez internet connected tv’s can monitor room conversations now).

Al;ien Jerky • November 18, 2015 7:11 PM

One if by land, Two if by see… we must ban lanterns.

The sparrow flies south if the parrot sees a worm… must ban bad Hollywood movies

Open Sesame… must ban… er… Big Macs?…. (Two all beef patties special sauce lettuce cheese all on a sesame seed bun)

Clive Robinson • November 18, 2015 7:13 PM

@ ALL,

As I said the other day my son was reading Sir Terry Pratchet’s book “Truth” in which one of the protagonists father had a saying,

    A lie is half way around the world before the truth has it’s boots on

Perhaps we should put words in a CIA bods mouth along the lines of,

    Friends, Romans, Cryptographers, lend me your ears, for I come to bury encryption not to praise it. The good men do is oft intered with their bones, so not let it be, with your secrets.

@ Dirk,

The “batshit” comment is not from Bruce but an “anonymous” writer.

Personaly I don’t think that IS are batshit crazy / insane etc, I think that like most psychopaths they are quite rational in their own minds and immoral aims and objectives.

Even batshit crazies can be helped medicaly, psychopaths can not, they can only be “removed from society” how we go about this is another issue, but it should be our primary objective.

Grauhut • November 18, 2015 7:16 PM

@Dirk: “They’re not batshit religious. They’re actually not religious at all. More like batshit insane.”

I think they are religious, but in a perverted form. “Confessions of an ISIS spy” is a good read.

http://www.thedailybeast.com/articles/2015/11/15/confessions-of-an-isis-spy.html

ISIS uses something like the mudja school system the CIA/Pak alliance invented in the Russian-Afghan war in the 80’s. The one that produced the taliban.

Maybe the real crusaders in the middle ages were similar minded and educated.

Steve • November 18, 2015 7:39 PM

@Grauhut – I’m not an historian. Who were the “real” crusaders? It seems Islam spread itself through a large swath of the world by military conquest, through North Africa, Spain, Turkey and Byzantium, Jerusalem, Iran, Afghanistan, India and east. That would seem to fit the definition of a crusade. Were the European Crusaders merely reacting. I’m not in favor of religious conquest of any kind personally or official state religions for that matter.

Nat Mishkin • November 18, 2015 7:56 PM

I’m no fan of backdoors, but with these events and facts can’t one make the case that we’re seeing an example of a case where the more automatic and thorough deployment of encryption in communication devices will have the effect of helping sloppy or unsophisticated attackers? I.e., since not every attacker is careful and smart all of the time (because some amount of care and smartness is required to ensure s/he is communicating securely), more automatic/thorough encryption will to some degree reduce the ability to thwart attackers. Maybe that reduction is too small to worry about (and doesn’t justify the creation of back doors), but it does seem like a point worth noting.

Wael • November 18, 2015 8:12 PM

@Steve,

I’m not an historian. Who were the “real” crusaders? It seems Islam spread itself through a large swath of the world by military conquest

This isn’t true. You need to look at the history. Here is what some notable non-Muslims say about the prophet of Islam and the spread of Islam. The history of the Crusaders and the level of atrocities they committed against Muslims isn’t secret either.

Steve • November 18, 2015 8:35 PM

@Wael – You’re right I do need to look up some history books, but are you saying the Moors didn’t invade Spain and Constantinople wasn’t conquered by the Ottoman Empire or that Qutb-ud-din Aibak, a former slave of Muhammad Ghori, was the first sultan of Delhi and his dynasty conquered large areas of northern India. etc

Steve • November 18, 2015 8:47 PM

quick and dirty from wikipedia:

“By 962 AD, Hindu and Buddhist kingdoms in South Asia were under a wave of raids from Muslim armies from Central Asia and Persia.”

I won’t apologize for Christians, Jews, or Muslims, or the United States or anybody. As for my knowledge of history, (along with science, math etc) there’s more to know than any human mind could contain – gotta go with the blurbs as needed.

Martin Walsh • November 18, 2015 8:55 PM

@rgaff – ‘”Double ROT-13″ is a geek joke’

I am an embedded developer and ROT to me without more information defaults to Rotate-(Right) 13 bits.

OK, so now I know the blog is a joke. Thanks. Sorry I’m so dumb.

Wael • November 18, 2015 9:01 PM

@Steve,

No, I’m saying to study an issue one has to go back a little in time. It’s hard to to look at a short slice in time and come to a sensible conclusion. Call it “root cause anslysis” 🙂

By the way, the other video link I posted (Friday Khutba) the person giving it is not defending Muslims, he is saying there is something wrong with Muslims today and they had better fix it.

Dirk Praet • November 18, 2015 9:14 PM

@ Clive, @ Grauhut

I think that like most psychopaths they are quite rational in their own minds and immoral aims and objectives.

I think we have to differentiate between management and foot soldiers. Like in nazi Germany, there’s no such thing as a one-size-fits-all profile. Those at the top or rapidly making their way there for all practical purposes are most probably psychopaths just like you describe them. Most of the regular foot soldiers IMHO move on from misguided to totally out of control after thorough indoctrination.

Some of them leave for Syria out of genuine feelings of anger for the carnage inflicted by Assad, others are nothing more than petty criminals without any purpose or perspective in life and see an opportunity to finally be on the side of a winning team. But after indoctrination, they all go completely bonkers, convinced that all kafirs have to be wiped from this earth and that they are the instruments of God in charge of this mission. At this point, they’re no longer religious but just drunk with power and batshit insane.

@ Wael

The history of the Crusaders and the level of atrocities they committed against Muslims isn’t secret either.

The crusades were a particularly barbaric and sickening page in Western history. And I completely agree with everything said about the prophet Muhammed in the video you linked too. Which is not to say that some Muslim rulers weren’t particularly shy of a bit of carnage either. One Timur Lang comes to mind, who during his career massacred hundreds of thousands of people from Baghdad over Damascus to Delhi.

Wael • November 18, 2015 9:29 PM

@Dirk,

One Timur Lang comes to mind

Yup. A descendant of Genghis Khan, they say. He has some blood on his hands. Long story, but I’m sure you know it…

tyr • November 18, 2015 10:10 PM

@crusaders

The sacking of Rome by Robert Guiscard made the
Pope anxious to get rid of rambunctious christians.
By proclaiming that anyone who would go to regain
the holy land from the moslems would have all of
their sins forgiven he loosed a wave of human scum
into the middle east. Their first acts were to sack
and butcher two christian cities while Moslems sat
and watched in amazement. It all went downhill from
there. Meanwhile Almidras Allah (the Mongols) were
rolling up everyone in front of them like a rug.
Eventually the Turks took Constantinople because
one of the crusades had attacked and weakened it.
That effectively booted christianity from the area
and sent Columbus and his ilk off to murder brown
folk on another set of continents. End of Crusades
Ottoman Empire, Mongol empire, Russia seat of the
Greek orthodox patriarchy, Jerusalem and the holy
lands of christians firmly in the hands of the Turks.
The pope had solved his Norman problems by wrecking
the hegemony and giving birth to Reformation which
meant Europe had to do its adventuring internally.

Finally in modern times some misguided wag thought he
could bring democracy to an area where Alexander the
pupil of Aristotle with the most overwhelming military
ever seen was unable to. Alexander wasn’t limited by
any modern scruples about collateral damage and public
opinions either and still failed.

If you read history to see what didn’t work you get a
lot clearer idea about what might work. Wearing sheets
and huddling around goat turd fires in a nice fourth
world Caliphate might seem glorious to ISIL but it
only appeals to oppressed teenaged dumbasses who can’t
find a job. Owning a cellphone is not a cure for their
dreams of glory and turning the clock back won’t cure
the problems of modern bureaucrats who want to go back
to the middle ages (no encryption) or teenaged Moslem
nitwits who have seen too many movies.

Comp security is under attack from from both types of
nitwit and is usually disguised as “we must do something”
or people will notice we are hopeless incompetents.

Sean • November 18, 2015 10:12 PM

“Are Tor users really that easy to manipulate?”

Well, most of the Tor evangelists I know tend to have pretty strange, convoluted conspiracy beliefs that fantastically outperform those of the religious people they despise. There does tend to be a certain cult-like flavor about the whole thing, so heck, yeah.

rgaff • November 18, 2015 10:42 PM

@Martin Walsh

You’re close… bit it’s not a bit shift, it’s an alphabetic shift (with wraparound)… see https://en.wikipedia.org/wiki/ROT13 if you want to know all about it. Since it wraps around exactly half way, you do it twice and you get the original back… It’s a joke, because doing something good multiple times should always make it better, not worse, right? If I do it 50 times it should be 50 times better, right? It ends up being a way for the elite in-the-know people to make fun of those not in the know… welcome to the club, you know now (not like we hold our secrets that closely here on this blog anyway) 🙂

Andy • November 18, 2015 11:26 PM

It is far, far, far more likely that they planned within the rented apartments in Paris

France has one year data retention for cell phone metadata and cell tower triangulations. They also have a security service lodged between police and the real spy agencies which has scary excessive capabilities to use this data to keep an eye on French people. I can see that keeping 24h surveillance on 400 known suspects is impossible (properly done it rewuires 20 officials for one suspect).

But with these tech possibilities it should be very easy to tell if a bunch of suspects suddenly have a higher flow of info or actually gang up all in the same cell tower base…

Also regarding the argument that they are religious fanatics of whatever breed… Well as it stands with ISIS few actually are. The force in Syria consists of 70% young, disillusioned Europeans. They were born with French or Belgian passports, integration failed, sometimes petty crime left them with a record. Some were recruited in prison, some in their homes via Internet. But they all took the decision to leave the safety of Europe. For what? For fame maybe. For an adventure maybe. To make a reputation for themselves. Because they were promised a wife, likely. Maybe they actually believe the caliphate state will reign and everyone who got in at Ground floor will be rich. It is hard to tell, there is probably a different explanation for eqch individual. But they generally know jack about the Islam or the Q’uran. They memorized the few verses that allow them to justify their insane cruelty against enemies and the remainder of the population. Sit them in a room with a proper Muslim theological scholar and I am sure he will dismantle their “knowledge” and use of verses in 90 sexonds or less.

Koptic Christian churches were up and standing in Syria for 1600 years. Now they get demolished by ISIS because a bunch of hardcore sociopaths and criminals from Europe goes nuts and makes up for the insignificance they experienced at home by playing omnipotent messengers of God using the worst interpretation of some verses as they see fit. Spreading fear just because they can. The locals mostly hate their guts just like we do, because they stain the religion with their actions…

This is of course also part of the reason why it was eawy for them to pick “juicy” soft targets that maximized body count. And because I haven’t seen it reported in Us news… Paris was dealt a tough deal, but it could have been much worse. Aside from the concert attackers there was a team of three suicide vest bombers that evidently were planning to enter the soccer stadium during the game, supposedly to trigger their charges while standing in the mass of densely packed packed fans in attendance. Those not killed or incapacitated by the blast would have surely created one hell of a panicked stampede, killing even more people by crushing or walking over them. That might easily have doubled or tripled the victim count.

This was a bad one. I am almost certain the Russian airliner downed at the Sinai is on them as well (twice the victims, not even 5% of the news coverage). I am fairly certain that there is more to come, and it stands to reason that they analyse reaction and adjust tactics in a way to bexome more deadly even…

Justin • November 18, 2015 11:54 PM

@ Dwining Commissary, Sean

Re: TOR

They probably just shut a botnet down or something like that.

https://community.rapid7.com/community/infosec/blog/2012/12/06/skynet-a-tor-powered-botnet-straight-from-reddit

http://www.dailydot.com/crime/bank-malware-tor2web/

http://www.welivesecurity.com/2013/07/24/the-rise-of-tor-based-botnets/

It is my impression that the vast majority of traffic on TOR is connections to botnet C&C hidden services and the like. I don’t think it’s unusual for TOR traffic to suddenly halve or fluctuate when a large botnet is moved, decommissioned, or shut down. Then it’ll grow again when some other malware is spread. The TOR people themselves admit to being overwhelmed with botnet traffic.

https://blog.torproject.org/blog/how-to-handle-millions-new-tor-clients

keiner • November 19, 2015 12:33 AM

“Why do we have to make them smarter than they are?”

Just to make the French police and secret service not look TOO dull.
…?

Super Terrorist • November 19, 2015 12:57 AM

Maybe if the spooks were not so busy spying on the general population they would not be overwhelmed by entirely useless information, therefor being free to concentrate on people who are a threat.

Maybe the government should secure it’s own systems.
http://www.itnews.com.au/news/wa-auditors-guess-govt-database-passwords-on-first-attempt-411502

Perhaps they should stop locking up kids who help to catch terrorists.
http://www.itnews.com.au/news/aussie-anon-sentenced-to-three-years-prison-411978

We spent a lot of time handing over locations and identifying servers being used to propagate terrorist material, and the stupid CIA turned around, setup 3 Anon members using entrapment and charged a further number of people for accessing systems without authorization, the same people who helped them take down a major terrorist leader and propaganda merchant. Go shove it CIA, we’ll take down the scum ourselves without bothering to pass on any info to you in future.

Stupid Spook • November 19, 2015 1:09 AM

It’s quite OK for the Government to hack Timor while they try and negotiate to get access to their own gas fields and oil again. Check out how Australia’s territorial waters suddenly go up into Timor’s territory because the Australian government did a secret deal with Indonesia where the Aussies kept their mouths shut when Indonesia invaded and killed a bunch of people including 5 Australian journalists. Australia got a lot of gas out of that deal. It didn’t stop Aussie spooks hacking the Indonesia Presidents phone though(or his wife’s phone and a bunch of ministers).

Now the Australian government is spying on it’s own people and they want to backdoor encryption. Well you know where they can stick that. And just try prying my passwords out of my appalling memory, I can’t even remember my own phone number and I use some pretty funky, long and complex passwords that have even been know to give me problems.

Encryption! Terrorists blow themselves up, you can’t decrypt a phone that has been vaporized and don’t the rest of us deserve to encrypt our stuff to keep us safe from fundamentalist nut jobs? Is that only reserved for Fortune 500 Clubs?

Dr C • November 19, 2015 2:54 AM

The fact that security services let this info slip out us astounding.

That may have well just set up a workshop on how to do it properly…

John • November 19, 2015 3:29 AM

RE: ROT-13

This is the era of Unicode shouldn’t we have upgraded ROT-13 to ROT-557056 by now? 🙂

Gerard van Vooren • November 19, 2015 3:38 AM

@ BlueLightMemory,

So bascically, Brennen, who is the CIA director, has proven and shown himself to the world
to be a complete, incompetent, asshole. Does anyone know if Comey was also blaming
encryption for the Paris attacks?

He also, and I think that is more important, accused Snowden for this. Whether Brennen is incompetent, I don’t know. But manipulative, that’s for sure.

Rob • November 19, 2015 3:49 AM

On the motivation and general state of mind of ISIS, this article in The Atlantic is a long, but interesting read. There are moments when I think the author has a particular axe to grind, but mostly it seems OK.

It doesn’t necessarily mean that they are not psychopaths or ‘brainwashed’ but it might go some way to explain how people get drawn in to the madness.

Clive Robinson • November 19, 2015 3:54 AM

@ Nat Mishkin,

… can’t one make the case that we’re seeing an example of a case where the more automatic and thorough deployment of encryption in communication devices will have the effect of helping sloppy or unsophisticated attackers?

Not realy.

@ ALL,

For those not commiting criminal or espionage acts, “encryption” appears like a “magic talisman” which the authorities perpetuating the “myth” for their on fiduciary advantages (think fraud as that’s what it technicaly is).

There are a number of reasons why somebody committing criminal acts —including terrorism–, espionage and other acts that there are legislitive sanctions for.

1, It’s not deniable.
2, It leaves you as a hostage to others involved.
3, Authorities can use it as a sign of guilt irrespectively.

That is “encryption” realy is realy bad OpSec and other than realy stupid petty criminals buying weed etc anyone with a little experience involved with illicit activies does not use it for communications or archiving.

The likes of the “Internet Criminals” who think their technical chops puts them out of reach of the authorities are deluding them selves, if the authorities want you they will get you even if it’s with charges of tax avoidance as an excuse to get at all your records, rip your home to atoms abuse your relatives and loved ones, threaten your immediate family with having your children jailed or put in care etc etc, they will keep shaking the tree untill something drops. And if nothing does well they can do a deal with another criminal you’ve never had any contact with, and if you beat that then they will repeatedly trash your reputation such that you can not work, get benifits, and if you do they just find another reason to have a go at getting you into court and making you bankrupt. Even if you leave the country they will still persue you with false applications for extradition etc (look up Kim Dotcom as just one example). Put simply once authorities decide you are guilty even if there is not a shread of evidence, then they will make you guilty or drive you to kill yourself. Simply because they can and there are effectively no repcussions for them…

For those that know anything about OpSec in a very hostile environment, using encryption is the equivalent of painting a target on your back, putting a flashing light on your head and madly ringing bells with both hands, all whilst dancing on the grave of a national hero in front of national TV cameras.

Those in charge of national agencies know this, thus they know they are lying when they talk about encryption and going dark, sensible criminals of all flavours have always been dark to them in their communications and archives. The only ones going dark are business they spy on for economic reasons a limited number of journalists and a few petty wanabe techno nerds with fantasies of being criminal masterminds, or innept anarchists, who are tolerated untill some politico wants to beat the “tough on crime” drum.

Steve • November 19, 2015 4:01 AM

NYT Quietly Pulls Article Blaming Encryption in Paris Attacks
http://www.insidesources.com/new-york-times-article-blaming-encryption-paris-attacks/

Also from last friday on my local news with my US Senator:

http://www.wbaltv.com/news/cardin-on-paris-attacks-horrible-tragedy/36446394
11:22 PM EST Nov 13, 2015

Donna Hamilton: u.s. senator ben cardin ranking member of the senate foreign relations committee joins us live by phone. senator, thank you for joining us. such a terrible, terrible night in paris.

Ben Cardin: our prayers go out to the families. our thoughts. this is unthinkable. and obviously a horrible tragedy.

Donna Hamilton: yeah. you know, as former chairman of the senate homeland security committee you’ve been privy to many things. big question how could an attack this of magnitude so well coordinated take place without anyone picking up on that before hand?

Ben Cardin: that is very troublesome and obviously we need to find out more information before we can draw conclusions but this was a coordinated attack in various parts of paris. clearly it took time, coordination, and it’s rather shocking that there was no advance information on this. so obviously that is something that is going to be investigated. we also want to know the ties of the people involved here, which organizations they were part of. and there are still we believe from the information we’ve received terrorists who still are at large. it is still unfolding. it’s not over yet.

Donna Hamilton: absolutely. i know experts say many terrorists made contact on social media but then they moved quickly to encrypted areas where authorities can’t track them. is that a huge problem?

Ben Cardin: absolutely. we also know there’s a lot of foreign fighters that have gone over to the middle east and returned to europe and with the european union they can travel wherever they want to in europe. it presents a real security challenge. there is no question that we — it’s hard to be able to keep in touch with all that could be involved in these types of activities.

Donna Hamilton: all right.

I sure hope Ben isn’t also in favor of travel restrictions between states here in the US…

Interesting • November 19, 2015 4:04 AM

I am having quite the evening listening to all the Islam apologists. It is interesting to me how it is cool to hate on Christians, discuss how backward they are, how they deny evolution and so on. Yet we are to believe Islam is a religion of peace, forward thinking, progressive, and so on. It is rather hysterical.

Winter • November 19, 2015 4:15 AM

@Clive
“For those that know anything about OpSec in a very hostile environment, using encryption is the equivalent of painting a target on your back, putting a flashing light on your head and madly ringing bells with both hands, all whilst dancing on the grave of a national hero in front of national TV cameras.”

But only as long as the rest of the population does not use encryption.

But we all know that the meta-data don’t lie. Who really believes criminals discuss their illegal activities in plain language? The only thing that counts is that you were in contact with “people of interest” at “times of interest”.

The real problem of encryption is that the IC and powers-that-be-want to put surveillance on people who do not engage in anything illegal. The real targets are companies commercial valuable information, whistle blowers, and journalists. And politicians from the opposition, of course.

Wael • November 19, 2015 4:17 AM

@interesting,

This is about people who use Religion as cover for their actions regardless of the religion. As for the religions themselves, that’s between the person and her or his maker. It’s not my intention to start a religious debate, there are other forums for that and I don’t participate there either. My comments about Islam and Muslims are a response to what’s being said.

It’s not cool to “hate” on any religion. The Crusaders represent Christianity no more than IS represents Islam.

Clive Robinson • November 19, 2015 4:51 AM

@ Martin,

Don’t feel dispondent about not knowing what ROT13 is, it was never ment to be “encryption” but “obfuscation” of vaguely questionable jokes etc posted to the original public lists. Old hands could read it as though written as normal plain text. I think the only time people thought of it as being a secure cipher was more than a couple of millennia ago, oh and “literate school boys” 😉 Even the famed Kamasutra had a marginally better reflector/pairing substitution “Mulavediya” cipher. Oh and speaking of “naughty texts” even Casanova did a bit of cryptanalysis to get into a womans bed chamber…

So not only is it an obscure hence “in joke” it’s also old enough that only people over 50 or so have actually used it first hand (yup Bruce and I are in that category as are a few others here 😉

You will however if you dig a little find that some people still think it a good idea in file system databases and logging suystems that it will stop the average user going in and manually edit things…

Surprisingly they appear to be correct so “Old and Obscure” does appear to be a good categorisation of ROT13.

Clive Robinson • November 19, 2015 5:41 AM

@ Wael, interesting,

It’s not cool to “hate” on any religion. The Crusaders represent Christianity no more than IS represents Islam.

I heard an interesting interview this morning of a French Muslim, they made several points, one of which was about various Press and Talking heads claiming that Muslims had not been out protesting. They pointed out that many modern muslims that follow the Koran, know that it has no requirment for a dress code other than modest, thus are “easily not seen” at protests by those looking for later Medieval dress codes[1]. But the point they made that realy struck home was that the small number of IS was as much to do with the other 1.7billion Muslims in the world as the Klu Klux Clan had to do with the other Christians…

A point that some Politico’s, Press and Talkingheads should realy take on board, as they spout their biased banalities.

[1] Afterall do we look for Christian Women to still cover their ears because the medieval church got hung up on “Mary conceived through the word of God told to her by the angel…”.

badwind • November 19, 2015 6:08 AM

@Dwining Commissary

Any news on why Tor appears to have halved its user base overnight?

For me, any attempt to connect via obfs4 resulted in all my connections being dropped until moving to a new IP, repeatedly (in the UK).

Steve • November 19, 2015 6:28 AM

I enjoyed listening to Michael Morell on the heels of the attack as much as I enjoyed listening to the other CBS expert John Miller

Face The Nation, Sunday November 15, 2015
http://www.cbsnews.com/news/face-the-nation-transcripts-november-15-sanders-nunes-burr/

DICKERSON: What — going back to this attack capability that you talked about, this was a — give me your sense of the sophistication of this attack and what we can tell from that.

MORELL: Right. So, it looks like — right — we don’t know for sure, but it looks like this was planned, organized, directed from Iraq and Syria. So, that first — that point makes this complicated. Right? Second is, you are moving operatives around. You have got a large number of operatives. They have to get explosives. They have to get weapons. They have to communicate among themselves and communicate back to Iraq and Syria. That is a level of sophistication that we have not seen since the London bombings in 2005.

…

DICKERSON: And how does that communication take place?

MORELL: So, I think what we’re going to learn, we don’t know for sure yet, but I think what we’re going to learn is that these guys are communicating via these encrypted apps, right, the commercial encryption, which is very difficult, if not impossible, for governments to break, and the producers of which don’t produce the keys necessary for law enforcement to read the encrypted messages.

…

DICKERSON: — going back to this encryption, what would a step be in terms of legislation or what kind of tools would be needed to combat this?

MORELL: So, we need to have a public debate about this, right? We have in a sense had a public debate. That — that debate was defined by Edward Snowden, right, and the concern about privacy. I think we’re now going to have another debate about that. It’s going to be defined by what happened in Paris.

DICKERSON: All right, Michael Morell, you are going to stick with us. Thanks so much.

MORELL: OK.

CBS This Morning, Monday November 16, 2015
http://www.cbsnews.com/news/cia-deputy-director-michael-morell-us-intelligence-on-isis-not-good-enough/

Norah O’Donnell: You’ve raised the thing about terrorists going dark and essentially using their phones and encrypted apps to communicate, are they using these same – not only in Belgium and in France and perhaps other places – are they using them in Syria and Iraq to communicate?

Michael Morell: Yes, absolutely.

Charlie Rose: Why is intelligence so bad?

Michael Morell: It’s not easy to collect intelligence in a denied area, right? It’s not easy to collect intelligence in a war zone,” Morell said.”We’re not on the ground in an embassy right in the middle of the Islamic caliphate. So developing human sources takes a lot of time. I’m absolutely confident it’s going to get better, it’s already gotten better, but it needs to be a lot better.

…

Gayle King: Does that mean we might have to give up some of our privacy for security?
Michael Morell: I now think we’re going to have another public debate about encryption, and whether government should have the keys, and I think the result may be different this time as a result of what’s happened in Paris.

Now should the former Deputy Director make public admissions that espionage is carried out from our Embassies – a well known secret. Also I think they’ld like the IS terrorists in Iraq and Syria to use encrypted apps on smart phones since then they would be using smart phones and communications that are encrypted could be observed and tracked with GPS maybe… but I don’t think they’ll go for that bait at this point anyway.

@clive robertson is right that it would stick out

Dirk Praet • November 19, 2015 7:49 AM

@ Wael

The Crusaders represent Christianity no more than IS represents Islam.

Well said, my friend.

@ Interesting

It is interesting to me how it is cool to hate on Christians

Of which you will find exactly zero instances on this blog. Born and raised in a Catholic family, I was fortunate enough to enjoy an education at a Jesuit high school that taught us about all major religions of the world, pointed out the good, the bad and the ugly of all of them, but most of all encouraged us to reject any and all prejudice and bigotry towards people of other race, colour and religion.

So let me ask you: do you have any Muslim friends or do you even personally know one Muslim? If not, try adding it to your bucket list as there is a fair chance that your western MSM induced perception and understanding of Islam is as wrong as that of the average brainwashed Da’esh militant.

@ Rob

It doesn’t necessarily mean that they are not psychopaths or ‘brainwashed’ but it might go some way to explain how people get drawn in to the madness.

There are reasons and underlying causes for practically everything. But understanding them is an entirely different thing than accepting them. Your wife may be cheating on you because due to some medical condition you are unable to perform. However understandable, it’s not going to make you feel better and you may still file for a divorce. Likewise, the appeal of Adolf Hitler in post-WWI Germany was very much understandable, but I’m not going to pursue this one because I’d be violating Godwin’s Law for the second time in two days. I guess I’ll leave that to @rgaff.

@ Gerard Van Vooren

Whether Brennan is incompetent, I don’t know. But manipulative, that’s for sure.

Both Comey and Brennan are lying schmucks that knowingly and willingly perpetuate the “going dark” myth just to cover their own asses every time their bureaus miss yet another plot for completely different reasons than not being able to decrypt communications. The Paris attacks are one more fine example thereof.

@ Andy

The force in Syria consists of 70% young, disillusioned Europeans.

Where did you get that from? According to reports of the Soufan Group, the majority of foreign fighters in Syria and Iraq are from Arab and North African countries, with roughly about only 25% from Europe. Foreign fighters are also not in any way the majority of the regular Da’esh army and are mostly used as cannon fodder because they’re generally more gullible and stupid than local fighters.

Paul Renault • November 19, 2015 8:44 AM

They just need to be smarter than your average bear…

And what is it about this “mastermind” label? Why do we have to make them smarter than they are?

As far as I can tell, by being slightly smarter than the intelligence and police forces – which still leaves that bar pretty low – they qualify as heir to Herbert Edgar Wyndham’s legacy.

(Also, by calling them evil geniuses, they establish to corollaries: 1) If they didn’t catch them, it’s not their fault; 2) If they do catch them, it makes the ‘good guys’ look even better than they really are.)

ytiruces • November 19, 2015 10:07 AM

EU clamps down on bitcoin, anonymous payments to curb terrorism funding
http://mobile.reuters.com/article/idUSKCN0T81BW20151119

BRUSSELS (Reuters) – European Union countries plan a crackdown on virtual currencies and anonymous payments made online and via pre-paid cards in a bid to tackle terrorism financing after the Paris attacks, a draft document seen by Reuters said.

EU interior and justice ministers will gather in Brussels on Friday for a crisis meeting called after the Paris carnage of last weekend.

They will urge the European Commission, the EU executive arm, to propose measures to “strengthen controls of non-banking payment methods such as electronic/anonymous payments and virtual currencies and transfers of gold, precious metals, by pre-paid cards,” draft conclusions of the meeting said.

Michael_H • November 19, 2015 10:26 AM

This whole idea of Snowden providing the thugs with the concept of using encryption is so much media BS. The media themselves analyze and over analyze the entire thing and then report, “well we are lucky they did not do action A or we were helped by the fact that they did action B”. ISIS can then just read the attack eval in the papers and on the internet and correct the deficiency. Case in point, it has now been reported that cell phones found at the attack scene led French security back to the safe houses to stop the subsequent attack. Guess what? Now they know to get rid of the phones prior to the next attack. Duh.. The media with their analysts are far more responsible for the perfection of the terrorist technique.

Walks with Black Eagles • November 19, 2015 10:51 AM

Of course, this comes to the surprise of exactly no one who knows what they are talking about and do their homework.

These governments are making a choice:

Mass surveillance?

or,

Targeted surveillance?

They are choosing “mass surveillance”, for obvious reasons. Power, in short. Dreams of power for their tiny little boss’ minds. Their lives are so short, their careers, why do they even strive so? But, they do. In fact, older they are, less time to retirement, harder they strive. The inertia of greed built up over decades just works that way. Greed for power. And, believe me, that is “power” in quotes.

Mass surveillance costs money.

Targeted surveillance, executed with lawful, reasonable warrants also costs money to do right. It can take just as much money as anyone could ever dream to throw at mass surveillance systems.

It absolutely requires enormous study and understanding by leadership, because it is very difficult to do properly.

You have to have break in teams; best technology in miniaturized gps, video, audio; chemical tools; vehicles; very sophisticated cover management systems; advanced disguise systems for proper ‘getting close’ and ‘following them; highly trained people for surveillance, for countersurveillance, for prosecution, for computer security technology, for deals with major sites and vendors, etc, etc; extremely sophisticated vuln analysis teams inhouse and for your defense contractors such as combination RASP & SAST systems; on and on and on.

Mass surveillance systems also require extensive sophistication from leadership. The best use for non-reactive but proactive and real time results that are meaningful require enormous cost in every way. But, they dumb it down for themselves and figure little of that into anything.

Worst of all, as everyone should note: terrorism means, for them, more business. More power, more budgets, more happy defense contractors, more happy peers. So, this is why they are not fighting ISIS correctly. This is why they were happy to be so sloppy with Iraq in reconstruction and in leaving. And with Libya. With Egypt. And with relations with conservative Sunnis. And with Iran and Saudi Arabia.

Right now, they could end ISIS by hitting them hard with air. They are, instead, performing false punches for the cameras.

They are very well aware ISIS is at the point to where they won’t stop until they have executed far worse and more terrorism abroad. In free nations.

So, they are certain to throw sissy punches, air punches at ISIS now. Only makes them more deluded in their power lust, blood drunk frenzied state they are in.

As we saw with their very over quick and so well anticipated reaction to Paris to push arguments for their own agendas that are proven not to work for anyone but their own greedy hearts… they are certainly twirling their mustaches and rubbing their hands in eager anticipation for ISIS to do more of their bidding in terms of significant terrorist attacks against America and Europe.

Sooner or later, though, all bad folks get exposed to everyone else. Short term gain, for eternal infamy. Not worth it. But there is no appeal to those whose conscience were gone so very long ago.

Dirk Praet • November 19, 2015 10:52 AM

@ Winter

From one of the articles you linked to: “Daesh want to provoke racist retaliation against Muslims around the world”

It’s one of two reasons why they planted that Syrian passport. The other one is that they consider all fleeing Syrians traitors to their cause that shouldn’t be able to get refuge anywhere but return home instead to either fight along with them or be slaughtered.

On a related side note, the French have just officially confirmed that Abdelhamid Abaaoud, the alledged Belgian commander of the terrorists, was one of the two people killed in the St. Denis raids yesterday and that the suspected bomb maker Mohamed K. has turned himself in at a police station in Lille. Good riddance, I’d say.

WorkingOnIt • November 19, 2015 10:56 AM

Two companies showed in the leaks, DNT and CES, with which the NSA works intimately. So to me that says ‘Dell Network Technology’ and ‘Cisco Enterprise Systems’ (Computrace?). At the Black Hat Briefings conference in 2009, researchers Anibal Sacco and Alfredo Ortega showed that the implementation of the Computrace/LoJack agent embedded in the BIOS has vulnerabilities and that this “available control of the anti-theft agent allows a highly dangerous form of BIOS-enhanced rootkit that can bypass all chipset or installation restrictions and reutilize many existing features offered in this kind of software.” So don’t read too much into there capabilities?

@Michael_H “Guess what? Now they know to get rid of the phones prior to the next attack.!” Guess what, nobody could give a shit about your “Google” spy-phone technology!

Mailman • November 19, 2015 12:02 PM

I am against creating backdoor in encryption products for the benefit of government snooping, but I’ll make an exception here.
I volunteer to create a program that will give governments access to ROT-13 encrypted communications. The program will even work on messages encrypted with ROT-13 several times.

Michael_H • November 19, 2015 12:07 PM

@WorkingOnIt what “Google” spy-phone tech? You miss the point. The media continues to analyze the techniques to the minutiae. Thus providing any subsequent thugs with a nice public debriefing on what to do or not to do. This so much more than some perceived action on Snowden’s part to point them to encryption, helps refine their technique.

tele_interview_planner • November 19, 2015 1:01 PM

@Steve that keeps posting the CBS links:

Apparently you don’t know that those interviews are very highly structured.

The questions are known and the answers are vetted by production staff before going on air. The only thing left is to feed the question to the on-screen personality with cameras running.

I’m not sure why more people don’t know this.

tele_interview_planner • November 19, 2015 1:09 PM

A bunch of people getting hot and bothered about “encryption” when the so-called five eyes had the data given at least one of the characters were on no-fly lists and whatnot.

When someone is posting FUD on some security wonk’s blog, it’s hard NOT to get the tin foil hat out.

Steve • November 19, 2015 1:23 PM

On one hand we have Trump advocating more guns and looser restrictions on guns even though terrorists use guns. This could be compared to the proposition that farmers shouldn’t feel guilty or be banned, because terrorists eat food. (Noting that it may be illegal to knowingly give comfort or assist criminals).

Really though, can certain computations and specifically certain arithmetic computations on gp computers or calculators, tablets, cell phones be made illegal? We do already have the situation that certain integers are illegal, that certain arrangements of bits are illegal to possess, if they could be decoded (by some viewer) as the pixels of an illegal photograph or as the text of a classified document. An algorithm is itself an arrangement bits, bytes, or symbols. But should be distinguished from its active control a physical device (functioning in time – performing an action – consuming energy – generating heat)

I don’t know where I’m going with this…the legality of physical arrangements of symbols (or the physical arrangement of matter or the dynamic arrangement of actions in time) and the communication therof here in the US have to meet Constitutional standards and requirements…blah blah blah

Steve • November 19, 2015 1:31 PM

@tele_interview_planner – Oh I do know it’s theater, but it’s ugly and awful to watch, yet part of the record. You can throw it back at them. They call it journalism, but access the words without transcripts after the signal diffuses into the past is difficult

WorkingOnIt • November 19, 2015 1:42 PM

@Michael_H – Incorrect, the governments insistence that encryption is there crutch is a huge smoke screen and a blatant Lie. I have an untraceable cell-phone, when I say it’s untraceable, what I mean is, I have deleted the RSA encryption certificates from the Cell-phone list of trusted authorities. Because I didn’t sign those certificates and I sure as hell don’t trust a security certificate even from RSA if its signed as a Government Certificate!

They’ve been playing a very clever game, one where the Telco’s insert RSA certificates into peoples devices so the Telco’s themselves are the ones hacking those devices using those very same certificates, if you need the proof, I’ll guide you on what model to go buy for 15.00 bucks and show you the same trick, encryption is not the problem for them. A lack of it is…

Walks with Black Eagles • November 19, 2015 1:43 PM

@Steve • November 19, 2015 12:26 PM

Looks like the media and the intelligence community have found their smoking gun: Telegram

https://www.washingtonpost.com/news/morning-mix/wp/2015/11/19/founder-of-app-used-by-isis-once-said-we-shouldnt-feel-guilty-on-wednesday-he-banned-their-accounts/

Proof that IS is using encryption to communicate. I don’t no anything about this app. I only have a flip phone. Would this possibly work for opsec?

It is woefully insecure, and just shows how they would have to use targeted surveillance, anyway. Which is what they are giving up to do mass surveillance.

http://motherboard.vice.com/read/encryption-app-telegram-probably-isnt-as-secure-for-terrorists-as-isis-thinks

Also, it is Russian based.

If the US ever did get their pipe dream backdoor in all US software and hardware products, business would simply flood to Europe, Russia, and anywhere else vendors will service the demand. With security assurance.

I know it is hard to fathom for a government that shrugged when 22 million of their classified workers details were stolen – by who knows who (China is one guess they have), maybe N Korea for all they know, and NK doxes organizations – but security assurance in information technology is important for citizens and companies.

Should be important for government… but, apparently, not.

Government so often works like the old Soviet Union or the DMV. Crappy, inefficient, stalid, out of date.

WorkingOnIt • November 19, 2015 1:48 PM

@Steve && @Michael_H if you don’t believe removal of RSA security tokens is a huge threat to there security model, then clearly you fail to understand the two stage signing process involved in the creation of RSA tokens which obviously people can then sell on to both the customer and then the government. One key for the customer and a master key for the government which is what they “HAVE BEEN DOING!”

Steve • November 19, 2015 2:12 PM

@Walks with Black Eagles – thanks, I’ll take “woefully insecure” as gospel. As soon as it looked like encryption wasn’t used for the attacks, the media trots Telegram out as proof otherwise to maintain the “going dark” fear mongering and to manufacture consent for anti-encryption/mass surveillance legislation. Chalk one up for short memories, ignorance, and the Orwellian news cycle. Forget the facts, forget the specious claims, remember the fear and anger.

WorkingOnIt • November 19, 2015 2:13 PM

@Michael_H – Here you go, buy yourself a cheap Huawei G6620 on eBay, any network, doesn’t matter which, then you’ll want to go into Security Settings (5) Certificate Manager, now DELETE all the RSA tokens.. Then back out and goto web’n’walk service – settings (6) Trusted Certificates and DELETE all RSA tokens.

Now your Telecom’s provider has no way to access your device remotely @ ALL…

Can’t see your contact’s, can’t access your Phone Book, Can’t see you on there GPRS..

Encryption gone = BIG Problem for THEM!

Qbert • November 19, 2015 2:33 PM

About that “Telegram” app, from this article…

Founder of app used by ISIS once said ‘We shouldn’t feel guilty.’ On Wednesday he banned their accounts
https://www.washingtonpost.com/news/morning-mix/wp/2015/11/19/founder-of-app-used-by-isis-once-said-we-shouldnt-feel-guilty-on-wednesday-he-banned-their-accounts/

From the article…

Pavel Durov knew that terrorists were using his app to communicate. And he decided it was something he could live with.
…
“We were disturbed to learn that Telegram’s public channels were being used by ISIS to spread their propaganda

So seriously…this Pavel Durov somehow first knew that the terrorists were using his app. Obviously judging from this the app is likely a Russian version of Whisper.

How difficult would it really be to do a search in your own web apps DB to determine what kind of stuff people post there? Being “disturbed to learn that Telegram’s public channels were being used by ISIS” just sounds lame.

MarkH • November 19, 2015 2:38 PM

Proof of how dumb these terrorists are.

We all know that it is necessary to use triple ROT, to foil the meet-in-the-middle attack. Double ROT is no more secure than single ROT (for some keys, even less).

WorkingOnIt • November 19, 2015 2:53 PM

@Randy – That’s the model I have and I can confirm it work’s well enough, but of course your welcome to do it to any cell-phone but just don’t expect the web to work too well on your smart phone afterwards! TXT’s to other people, will be received, TXT’s to your provider on there shortcode TXT’s wont be. So my way of looking at is, if they view the encryption as a problem, lets do them the honour of removing it!

Randy • November 19, 2015 2:55 PM

@MarkH

haha yea they must be dumb. But I think they should use Base64 to encrypt their messages, I heard that it is really tough to crack.

Or maybe even quadruple ROT-13, specifically on a 26-letter Latin alphabet.

@Qbert,

that just shows that use of the Telegram app, esp. their public channels, does not really constitute a use of encryption.

Randy • November 19, 2015 3:01 PM

@WorkingOnIt,

cool, thank you, I am glad to hear that you have gotten it to work on that model.

Although…in cases when the keys are missing…can’t the authorities simply access your device through an un-encrypted protocol?

Wael • November 19, 2015 3:09 PM

Since the Arabic letters are 28, two ROT-13s don’t cancel each other. They just degenerate to a ROT ___ ? Left as an excercise for the reader because my brain isn’t working at the moment 😉

Wael • November 19, 2015 3:12 PM

And if they were using French letters, then that would be different as well (not to be confused with a French letter.)

Anura • November 19, 2015 3:15 PM

@Person who is in desperate need of a good night’s sleep

Since the Arabic letters are 28, two ROT-13s don’t cancel each other. They just degenerate to a ROT ___ ? Left as an excercise for the reader because my brain isn’t working at the moment 😉

ROT-26

Wael • November 19, 2015 3:19 PM

Come to think of, it would have been nice if the parents of ISIS members used French letters more often 😉

Wael • November 19, 2015 3:31 PM

@Anura,

Thank you. But since Arabic is written right to left, which ROT would that be? ROT-2 from the opposite direction would be a little more efficient or is it different than a ROT-26 (standard direction)?

Anura • November 19, 2015 3:41 PM

@Wael

That’s undefined since you only specified ROT-13 – while the direction doesn’t matter on a 26-character alphabet, it does on a 28 character alphabet, so it could be referring to a ROTL-26 or ROTR-26; ROTL-26 being equivalent to ROTR-2 and ROTR-26 to ROTL-2. So, if you assume ROTL-13 and apply it twice then it is rotated left 26 characters, or if you assume ROTR-13 and apply it twice then it is rotated right 26 characters.

Zaphod • November 19, 2015 3:53 PM

@Clive, et al

Ha ha. Speak for yourself; some of us youngsters are ‘au courant’ w/ROT-13…..

We just prefer the vastly superior dd encryption with conv=swab.

I’ll get me coat…..
Zaphod

Clive Robinson • November 19, 2015 4:15 PM

@ Wael, Anura,

Left as an excercise for the reader because my brain isn’t working at the moment 😉

Hey are they not “Cheese eating surender monkeys” according to your old “all hallowed bushy boss”. Thus should they not be using,

ROTFOUR…

LowEel • November 19, 2015 4:39 PM

Every time the secret services are failing because of lack of intelligence, incompetence or other faults, then it pops up the problem is … encryption.

Wael • November 19, 2015 4:56 PM

@Clive Robinson, @Anura,

… all hallowed bushy boss …

Oh, man! The half awake neuron that’s left in my skull isn’t able to make heads from tails out of this one. Maybe @Anura is correct that I need sleep 🙁

tyr • November 19, 2015 5:00 PM

I come up with ROT26 mod 2.

According to Twain the French have a dual national
nature of rabbits and tigers and no one can tell
what trips the switch from one to the other.

Bush cronys were sure the Germans had become cowards
highly doubtful considering the historical records.

Chmod000 • November 19, 2015 5:14 PM

I don’t get it — the NSA is apparently monitoring all Western Internet and cell traffic, recording all SMS messages and phone calls, aggregating all this information in easy to search databases like XKeyscore, and sharing it with other Western countries… yet they can’t determine that an attack is about to occur when known ISIS supporters send details about their attacks and information strongly suggesting where and when the attacks will take place over unencrypted SMS messages?

And it’s not just the Paris attacks. The Boston bombings and many other terrorist attacks were completely undeterred by the surveillance state — as far as we know, the NSA had no clue they were going to take place.

I’m sorry if I’m not thinking of something obvious, but why is all this surveillance so ineffective? One would think that an agency with as much information as the NSA would have no trouble catching people like the Boston bombers and the people behind the Paris attacks before the attacks take place, but they can’t. It would seem to me that the only possible explanations are that the NSA is either secretly behind these attacks or is staffed by a bunch of blithering incompetents — yet both of these explanations seem completely implausible.

I’m not extremely knowledgeable on how the NSA operates, so maybe I’m not understanding something… could someone explain why, despite the vast quantity of information they take in, the NSA is completely unable to preempt these attacks?

Clive Robinson • November 19, 2015 5:16 PM

@ Wael,

I would have thought the refrence to “Cheese eating surrender monkeys” used to refere to the “French” would have been enough to Idetify GWBush and Iraq invasion conspiritors.

What you folks call “Rockfour Cheese” in the US is actually the second most popular cheese in France and of the 18,000,000Kg/anum produced only around 450,000Kg makes it to the US.

Thus the ROTFOUR joke (It sounds like ROCKFOUR) being popular with French Terrorists…

Steve • November 19, 2015 5:35 PM

Wouldn’t our brains work much better with just a single neuron and the clock speed turned way up? Less crosstalk.

Walks with Black Eagles • November 19, 2015 5:42 PM

@Steve • November 19, 2015 2:12 PM

thanks, I’ll take “woefully insecure” as gospel. As soon as it looked like encryption wasn’t used for the attacks, the media trots Telegram out as proof otherwise to maintain the “going dark” fear mongering and to manufacture consent for anti-encryption/mass surveillance legislation. Chalk one up for short memories, ignorance, and the Orwellian news cycle. Forget the facts, forget the specious claims, remember the fear and anger.

These systems are mostly just intel leader’s wet dreams. Stalin didn’t use his domestic intelligence things for anything but control and power. Same with Hoover. Hoover had the entire house and senate wiretapped, and extensively surveilled presidents, their wives, and their entire networks looking for blackmail material.

Ultimately, they just want to have as much free reign to surveil whomever they want to, whenever, without pesky courts involved or people or politicians.

If they were interested in catching terrorists, they would be focusing on, you know, actual terrorists. Instead of EVERYONE.

But, if they did that, then they would substantially reduce their budget.

Terrorist strikes are the fuel of their budget.

WorkingOnIt • November 19, 2015 5:53 PM

@Randy – Without a secure connection nope, because the tokens are required on the device twice, from the crappy browser to the operating system, not so much on FanDroid, but on a Huawei G6620 kind of critical, also if you disable things like WAP and Push messaging in the phones browser or alternatively add your own security token, they’re pretty much locked-out of the device along with there ability to intercept your message’s. GSM crypto and RSA web tokens are two totally different kettles of fish. An “Googles” very cheeky “Government Certificate Authority” is clearly part of there sweet backdoor in the talkback service, which can also safely be deleted from the device.

WorkingOnIt • November 19, 2015 5:58 PM

@Randy – They should be careful what they wish for… Encryption is a Problem for us.. etc, etc.. That’s all good, we’ll go back to using simple GSM with no GPRS, that narrows your Cell down to an area of about 15 Miles and without the triangulation provided by GPRS, they’re going to have a long search and the inability to use GPS, inability to read your SMS, inability to search your contacts, inability to read your private stuff. Yeap encryption can be a real pain in the ass when there is none! LOL

Sancho_P • November 19, 2015 6:06 PM

Oh really, that makes sense: To block “78 ISIS-related channels across 12 languages”.

You know 78 suspect accounts? Trash them!

Yeah, no more targeted surveillance, transcripts, translation and investigation!
More time for dirty laundry, porn and lulz.

Don’t like their arguments? —> Block them, solved.

W • November 19, 2015 6:08 PM

I’m confused here – if the goal for encryption activists is to encrypt all communications, then shouldn’t the focus be on the fact that most of the terrorists were known to intelligence agencies to begin with? Had broadcasted their plans on the English version of ISIS’ propaganda magazine?

Basically – shouldn’t the goal be to point out that intelligence services can do their job just fine in a world even if all in-transit communications were encrypted by default?

Wael • November 19, 2015 6:16 PM

@Clive Robinson,

Uh! That’s a profound joke! I hate Roquefort cheese. Perhaps it’s the reason I didn’t get your reference. I also hate cauliflower with a passion. I can’t even stand looking at it.

If I’m ever detained for some reason, I maybe able to resist a water board. If I hear one of them saying: Alright, bring the cauliflower, I would say: I did it, where the F### do I sign 😉 I don’t think I’d do the same with blue cheese, but maybe I’ll rat someone out 🙂

John DingleDineObviouslyFakeName • November 19, 2015 7:06 PM

@Justin

It is my impression that the vast majority of traffic on TOR is connections to botnet C&C hidden services and the like. I don’t think it’s unusual for TOR traffic to suddenly halve or fluctuate when a large botnet is moved, decommissioned, or shut down. Then it’ll grow again when some other malware is spread. The TOR people themselves admit to being overwhelmed with botnet traffic.

Your impression is formed by studying a few high level articles that speak to one side of the matter. If you can quote sources pointing out where there is legitimate usage of Tor, showing you understand them, it would not make it look like you suffer from confirmation bias.

Tor has malicious users, and a lot of non-malicious users.

Many legitimate networks and systems get overwhelmed with malicious traffic.

Informed people often make judgments about such things, not considering they should try and actually be scientific about it.

Kind of like Roswell housing aliens, or people being gangstalked.

Random beliefs of unstable people.

D.B. • November 19, 2015 7:13 PM

Chmod000:

I don’t get it — the NSA is apparently monitoring all Western Internet and cell traffic, recording all SMS messages and phone calls, aggregating all this information in easy to search databases like XKeyscore, and sharing it with other Western countries… yet they can’t determine that an attack is about to occur when known ISIS supporters send details about their attacks and information strongly suggesting where and when the attacks will take place over unencrypted SMS messages?

+1…this is exactly why I think that more information is needed, preferably really technical in detail. Not sure if the Snowden documents even included really technical stuff?

And it looks like they may have stopped releasing those documents…

If this goes on, Snowden will (unfortunately, considering his sacrifice) become rather irrelevant. This is because, for one thing, those documents kept the discussion alive, and secondly because the documents will eventually be so old as to be potentially outdated.

Dirk Praet • November 19, 2015 7:40 PM

@ Sancho_P, @ qbert

Oh really, that makes sense: To block “78 ISIS-related channels across 12 languages”.

It’s a cat and mouse game. With every account blocked, they just start a fresh somewhere else. For politicians, it’s an easy way to show the populace they’re cracking down hard on them, but for the IC it means they every time have to find out where they have moved to.

Durov probably caved in to pressure from the Kremlin. I’m pretty sure their IC does black bag ops, abductions and secret detention centres too.

Josh Rubin • November 19, 2015 11:34 PM

Ok guys and gals, get a little common sense. I agree 95% with Schneier’s quoted portion of the Intercept article, but comparing “vilifying encryption” and mass murder is weird rhetoric. They are different categories of evil. Kindly refrain from ranking them.

In the Shadow of a Murder of Ravens • November 20, 2015 12:00 AM

@Josh Rubin

Ok guys and gals, get a little common sense. I agree 95% with Schneier’s quoted portion of the Intercept article, but comparing “vilifying encryption” and mass murder is weird rhetoric. They are different categories of evil. Kindly refrain from ranking them.

Would be, if he said that, which he didn’t…

So, “weird rhetoric” would be in your ballpark there.

Care to explain your self?

Or, just wasting everyone’s time?

WorkingOnIt • November 20, 2015 3:28 AM

On your Phone handset, the provider typically set’s the Default WAP settings password, usually to something ridiculously stupid such as http://www.o2.co.uk login: o2 pass: o2 so to completely remove there ability and capability to access your handset, it makes a lot of sense to simply remove the secure access tokens, that the provider itself relies upon to communicate with the internal OS on your handset. If you need encryption to do on-line banking and the certificate is not present on your device, the browser will prompt you when you attempt to perform an HTTPS connection to download and use the banks own Security token. So in hindsight and upon the deepest reflection, give em exactly what they keep insisting they need. No Security Token into your device which in turn = No encryption and that means NO ACCESS or ACCESS DENIED. Exactly what they repeatedly insisted they needed to thwart Terror!

Clive Robinson • November 20, 2015 4:05 AM

@ Wael,

Uh! That’s a profound joke!

As you know from past experiance it has to have a certain degree of unguessable to get past Bruce/Moderator…

As for “blue cheese” it’s not it’s green, because it’s an entirely different microb, one of the penicillin family, that is natural in the soil of the caves they use. And for a century or so befor a certain Scott guessed lucky the Shepards in the area knew that if the cheese was applied to wounds they healed faster and were not likely to get gangreen etc…

But I suspect the reason you don’t like it is the by product of the break down of the sheeps milk into fatty acid Beutal (from butter) which is the prominent smell in human vomit. However there is a considerable mounting pilr of evidence that your colon realy needs this to be healthy otherwise cancer beckons… Oh and resistant starch helps the bodies own flora produce it so half a cup of raw rolled oats with full fat milk after a few grams of the live cheese, might well have a significant impact on your longterm health…

WorkingOnIt • November 20, 2015 4:37 AM

@Clive Robinson – Mmm, prefer Honey applied to wounds as a anticeptic although I wonder if @Wael has heard of Stinking Bishop. You know the vile smell of Smeg from your own Penis? Yeap, that’s the aroma and the taste – it makes Blue Cheese pale by comparison. Highly recommended for cheese lovers everywhere!

WorkingOnIt • November 20, 2015 6:06 AM

@Wael It’s positively disgusting, for best results, microwave for exactly one minute, smear it onto a cracker and I’ll rate you if you can stomache the idea of putting it in your mouth, I took one whiff and nearly fainted…

WorkingOnIt • November 20, 2015 6:36 AM

@herman – actually the trick is to not breath, through your nasal cavity, before or after consumption and plenty of alcohol to wash away the taste or you’ll be violently ill just from the lingering after-taste and aroma!

Dirk Praet • November 20, 2015 8:14 AM

@ Herman

This crowd was simply a bunch of drug addict losers.

Or so the media would like us to believe. But even if true – which it probably is – doesn’t make them less dangerous. It’s the exact sort of extremely vulnerable and volatile crowd stone cold psychopaths would want to recruit for suicide missions.

Josh Rubin • November 20, 2015 9:52 AM

@In the Shadow of a Murder of Ravens

I take your criticism seriously, so let me try again. Maybe I misunderstand something.

The last sentence of the techdirt.com article is:

“But the point remains that to use a tragedy to vilify encryption, push for surveillance expansion, and pass backdoor laws that will make everybody less safe — is nearly as gruesome as the attacks themselves.”

In my mind, I reduced the sentence to something like this:

“to use a tragedy to vilify encryption (and some other things) is nearly as gruesome as the attacks themselves.”

Using a tragedy to vilify (whatever) is a rhetorical device. The attacks are
an act of violence. Both are evil. I don’t think comparing those two is wise, because it interferes with thought and discussion.

Wael • November 20, 2015 10:16 AM

@WorkingOnIt,

and I’ll rate you if you can stomache the idea of putting it in your mouth

I doubt I can do that. I see your stinky bishop and raise you THIS

Insert X • November 20, 2015 12:01 PM

@ W • November 19, 2015 6:08 PM

I’m confused here – if the goal for encryption activists is to encrypt all communications, then shouldn’t the focus be on the fact that most of the terrorists were known to intelligence agencies to begin with?

If a system works off ‘knowns’ then invariably implies that there exists a parallel system for discovery. This is known for crooks and felons, and commonly interpreted as a study of statistics of profiles.

For compilation of statistics, one can logically deduct that there exists triggers under watch on a webs of works. A work is by this context a piece of job or written knowledge completed by a human being. Thus a web of works is a representation of a knowledge graph, like in linear algebra.

Thus the core argument I arrived by reading the limited snowden documents that I clicked on was that of working off knowns vs. blanket surveillance, which IMHO snowden argued for the former.

Justin • November 20, 2015 1:13 PM

@ John DingleDineObviouslyFakeName

Tor has malicious users, and a lot of non-malicious users.

Many legitimate networks and systems get overwhelmed with malicious traffic.

Which is fact-wise a fairly good paraphrase of what I actually did say. (Also by the way you could say that about this very forum.) But I must be an idiot because I did not word it exactly like you did, and I did not express it from exactly the same point of view.

Which really has nothing whatsoever to do with stalking, although I suppose it is possible for stalkers to hide their identity with TOR while looking up information on their victims, or hacking into their cell phones or computers, etc.

Regarding “gangstalking” which people seem to keep bringing up because I have posted about it in the past. “Stalking” like any other crime may involve one person or more than one person. Stalking by more than one person may be called, I suppose, “gangstalking”, but according to Wikipedia,

News reports have described how groups of Internet users have cooperated to exchange detailed conspiracy theories involving coordinated activities by large numbers of people called “gang stalking”, often described as involving electronic harassment, the use of “psychotronic weapons”, and other alleged mind control techniques.

The conspiracy theories, of course you can look up. Google such terms as gangstalking, organized stalking, organized harassment, electronic harassment, or targeted individuals. There is a strange cult-like “community” that has gathered online about such terms. A strangely unified line of propaganda to deceive their members and make them appear crazy / mentally ill to the public. (Paranoid schizophrenia vs. falling for a scam online.) All those sites offer fake “support” and make it difficult for stalking victims to obtain assistance from the police.

The fact that there are crazy conspiracy theories about stalking does not preclude the fact that stalking sometimes does take place and it is a crime. People who post on this forum in particular risk being “looked up” and stalked. Lock your doors at night and don’t fall for scams and conspiracy theories.

CallMeLateForSupper • November 20, 2015 1:59 PM

@Chmod000
“I’m sorry if I’m not thinking of something obvious, but why is all this surveillance so ineffective?

I think you will find this article helpful:
“The Limits of the Panopticon”
https://lawfareblog.com/limits-panopticon

Keep in mind the saying “Hindsight is 20/20”. We see this often, even in this blog.

A voice of reason • November 20, 2015 4:29 PM

History has shown that the insecurity services are perfectly comfortable with carrying out false flag terrorism, the kind sponsored by a state in order to further an agenda.

To most people, the image of that thought is too scarey and abhorrent to even consider. My advice to those still in denial, don’t make the mistake of assuming that everyone, which includes billionaires & politicians, that they “think and feel” the same as you do.

In the Shadow of a Murder of Ravens • November 21, 2015 9:07 AM

@Josh Rubin

Oh, figured it was something like that, thanks for clarification.

I do find it poor taste that they are using the tragedy to vilify encryption, but obviously not on the league as the actual attacks themselves.

John DingleDineObviouslyFakeName • November 21, 2015 10:58 AM

@Justin

Your statement implied most usage of tor was malicious. This is not true, however, I am glad to see you come down from that branch a bit and state you actually meant to say ‘some users are malicious, some are not’.

Botnets are often very large systems run by just a few users. Likewise, with hackers using tor to attack sites and systems (cnc problems, as you mention being a very small subset of that), you are talking about small sets of users causing very large problems.

So, just running from those facts, one might come to the conclusion that the pool of legitimate users is far higher then the pool of illegitimate users.

But, to get more then your “impression” from some wild guess without actually performing any research, one would have to google tor usage for polls. I did just a two second google, and immediately found a poll:
https://nakedsecurity.sophos.com/2015/09/30/which-web-browser-do-you-trust-poll-2/

Which has people trusting Tor and presumably using it more then they do Internet Explorer.

Obviously, that poll is not the best, it was by volunteers and a very small pool, but I am sure if you took the time to google for more significant and scientific polls you would find that tor is actually used by a lot of people for legitimate reasons.

… looking a bit more for you…

9% of Americans have used Tor

http://www.pewinternet.org/2015/05/20/americans-attitudes-about-privacy-security-and-surveillance/

“9% say they have used a service that allows them to browse the Web anonymously, such as a proxy server, Tor software, or a virtual personal network.”

I am certain much higher if the poll isolated by age range. (This is because twentysomethings and teens are much more likely to adapt to new habits, and have been much more exposed to anonymity tools and the problems of privacy invasion.)

9% may not sound like much, but of the American people that is 30 million people. That is about sick times the number of Americans with clearance.

That is the size of the population of New York three times over. It is about 9 times the population of Los Angeles. And so on.

“Google Gangstalking, it is real, despite the conspiracy theories” (paraphrasing).

You mix into your apology “stalking” and “electronic harassment”. Those are certainly real, and I think everyone knows it.

By far and wide “stalking” usually has a female as the victim, and the male as the stalker.

Stalkers often are delusional, and often will deny it, but other times will not. Stalking is a well known and relatively common crime.

“Gangstalking”, which I did google, you are not referring to, for instance, systematic online harassment or random group harassment such as what we saw against some of the female pundits in the “GamerGate” issue. But, you mean where a person reports being supposedly stalked most importantly in person by a very large number of people who use such tactics as posing as ordinary neighbors hanging around their neighborhood.

Their “evidence” is, apparently, eye contact from these neighbors.

No, that is not real.

No, that is the imagination of paranoid, unbalanced individuals who believe they are being “gangstalked” and so imagine the eye contact they see is malicious. This is both confirmation bias and pattern bias, or Pareidolia, both very common phemnomena: https://en.wikipedia.org/wiki/Pareidolia

“Targeted individuals”, you also bring up, with I also did google. And speaks of people who believe they are usually randomly but systematically targeted by the government.

In real life, only time anyone is likely to be heavily “stalked” like you are stating is when governments have a very good reason to surveil them. While some used may be so unprofessional as to make eye contact, making eye contact is one of the first things trained out.

(For instance, google the US counterintelligence training center and “eye contact”.)

(For instance, consider how that would be a “not to do thing” governments eventually figured out because it assures the surveillor is “made” by the target.)

In the Cold War, I saw figures of up to twenty person teams used for surveillance, for very important people. The highest figure I have seen used for a surveillance team is 200. That was by Russia during the Cold War. However, that figure is very likely not real, as it was relayed to a journalist whose cover was certainly busted by Edward Lee Howard when he was in the Soviet Union.

Today, the advance of technical surveillance tools, disguise technology, and chemical technology makes such large teams useless.

Though, of course, unless you actually are a spy or otherwise have a very good reason to have a governmental surveillance team on you this will never happen to you.

And if you are a spy of that level, such things are simply occupational hazards. Obviously, that number of folks across the entire planet would be in the thousands. (Maybe I am deflating that number for some weird reason.) But such people certainly do not need to be told by internet folks that they might be surveilled by a government surveillance team.

If you believe you have been informed to become aware of gangstalking on you from a conspiracy website online, trust me. Not the case.

See a psychiatrist right away and tell them this.

Justin • November 21, 2015 12:44 PM

@John DingleDineObviouslyFakeName

Your statement implied most usage of tor was malicious. This is not true, however, I am glad to see you come down from that branch a bit and state you actually meant to say ‘some users are malicious, some are not’.

The botnets are a case of a few malicious users generating most of the traffic. It’s like email in general. By far the majority of email sent is spam, but most users of email do not spam. Or the web in general. If you go down from the first page or two of google results for any particular search topic, you will see that most websites in general are content farms or link farms. These are created in far greater numbers (by a few spammers) than legitimate websites, which take much more time and effort to create and maintain.

“Google Gangstalking, it is real, despite the conspiracy theories” (paraphrasing).

Stalking is real. Bizarre conspiracy theories are not.

You mix into your apology “stalking” and “electronic harassment”. Those are certainly real, and I think everyone knows it.

I am apologizing for no such thing. If by electronic harassment, you mean harassment in general that occurs over electronic computer and telephone networks, then yes, certainly it is real. If on the other hand, you mean harassment with advanced electronic mind control weapons, a la Eleanor White, then you are getting into the far out conspiracy theories, and I am not going to believe that is real.

By far and wide “stalking” usually has a female as the victim, and the male as the stalker.

Stalkers often are delusional, and often will deny it, but other times will not. Stalking is a well known and relatively common crime.

You’re stereotyping the game of the chase here. Some stalkers (either male or female) are gay even if they will not admit it to themselves. Some stalk transgender individuals. Quite possibly female on male, but most women would rather be pursued (in a much less threatening way, of course) than pursue.

It is possible that some stalkers have a delusion that their victim is in love with them, but most criminals will deny their crimes. That does not mean they are delusional.

… and so imagine the eye contact they see is malicious. … While some used may be so unprofessional as to make eye contact, making eye contact is one of the first things trained out.

Perhaps a cultural thing, but normal people are usually not afraid to make brief eye contact and acknowledge one another’s existence, whereas people who skulk around as if they are ashamed of something and refuse to make eye contact look like they are up to no good and raise others’ suspicions.

See a psychiatrist right away and tell them this.

Psychiatrists don’t have time for any of this shit. Just lock your doors at night, don’t take your eyes off your drink in a restaurant, drive defensively, and don’t worry about what you can’t control.

… unless you actually are a spy or otherwise have a very good reason to have a governmental surveillance team on you this will never happen to you. … But such people certainly do not need to be told by internet folks that they might be surveilled by a government surveillance team.

Probably not. Government has bigger fish to fry, and so does John DingleDineObviouslyFakeName.

Grauhut • November 21, 2015 1:01 PM

@rajkumar: “As previously mentioned by someone ISIS I agree with lazy boys lyrics, Don’t make them smart! and they should be targeted.”

Difficult. Open security lives from open discussion.

John DingleDineObviouslyFakeName • November 22, 2015 1:01 PM

@John DingleDineObviouslyFakeName

… unless you actually are a spy or otherwise have a very good reason to have a governmental surveillance team on you this will never happen to you. … But such people certainly do not need to be told by internet folks that they might be surveilled by a government surveillance team.

Probably not. Government has bigger fish to fry, and so does John DingleDineObviouslyFakeName.

Well, I was there talking about the illusionary, human government. The real government has resources to “gangstalk” every single person on the planet. The real government is known, extremely vaguely by people, as “Heaven”.

But, they do not have the slightest idea. It is the truth behind every ever so distant myth, every conspiracy theory.

For Heaven, the world is “as if” a virtual reality over which there is absolute control and presence. Where the words “omnipresent” and “omniscient” come from. “Many”, but one. “Hear O Israel, the Lord our God is One”.

“Angels”, as people see them usually, are simply like communication devices in the form of human beings, companies, organizations. They can be instantiated endlessly, and with full stealth — complete legends, backgrounds, absolutely undetectable to the conscious observations. They can be long term instantiations or short term, like with human intelligence systems: long term undercover, or short term undercover.

Your meager, extremely traditionalist “Christian” training only blinds you to this, as so far, far above is the truth. Traditionalism rots the truths with hundreds of years of human added “facts”, evolved, added to like throwing junk in the junk pile.

It has simply not yet been quite set on fire.

Not that there are not plenty of fine “Christians”, regardless. And many who are “Christian” and do not even know it.

The real “government” is behind everything and above everything.

They are in every government on the planet, absolutely stealth.

Think “MIB”, and much better, the knock off, “RIPD”… only their business, unlike RIPD, is not the dead, but the “living”.

All the saved are gathered together and all the problem people are also gathered together.

This setup has been going on for decades, though “angels” have been among people since the beginning.

“Angels” in quotes, because I mean the instantions of these “humans”. Like NPCs, non-player characters in games, only the spark is a life between them.

Heaven is deeply involved in every major government action, so nothing is as it seems.

Hence, the nick I am using here, pointing out how fake Roger Dingledine’s name is. One of those things people know, but just can’t admit to themselves.

Surely Fakename • November 24, 2015 4:10 AM

The police are currently busting drug dealers in Australia for placing Ads that say stuff like “Down Time available to trade for Rock and Roll” or “Want to go really fast, fast engine for sale”. Criminals are stupid.
By surveying us all they are just going to turn the criminals to using encryption and securing their DNS and IP systems properly. The Australian government told everyone to use Wickr if they didn’t want their messages stored then complained they couldn’t read criminals messages that use Wickr. LOL

Apparently the FBI paid the university to hack Tor for them to get the Silk Road admin then (the uni claims they were and not paid instead) . Earlier the FBI said he was logging in the clear previously so they could get the credit for capturing his session and not expose they paid $1,000,000, or subpoenaed for access to the user on the Tor network.

Clive Robinson • November 24, 2015 6:50 AM

@ Surely…,

Criminals are stupid.

Yup they can be, but usually, as they are predators they are smarter than their prey victims/customers.

Criminals and “secret lovers” have used newspapers one way or another for as long as they have existed to pass messages etc. Back when newspapers would be printed three times a day it was a fast way of anonymously getting messages to confederates etc. Charles Babage and friends used to have fun decoding the secret messages and planting false ones.

The thing is as with all trade “it pays to advertise”, so the crimes involving customers are going to be drawn to newspaper type advertising.

I’m guessing, that they have been caught either by rudimentary police work, surveillance or via the way the adverts were paid for. With the latter the most likely these days, as people are taught “cash is dirty” etc.

So in this case securing their communications probably would not have helped.

But you are correct there is a trend to pushing criminals to encryption, as there is other people who want to “write letters not postcards”. In the UK the London and other riots the Police were openly saying they were monitoring messaging as part of their response. However they were not clear on what they were doing. Some felt they had got to phone manufacturer Blackberry’s managment as the messages were encrypted from phone to Blackberry’s servers. Needless to say Blackberry’s market position took another hit, not just with the young but businesses as well.

The question is then, is the pushing a policy or just PR grabbing by the police. US Politicals are known to “flap their gums” to the press when it comes to terrorism and have burned “HumInt assets” in the process which has cost other countries operations dearly. So are the Police doing likewise, just “flapping their gums” for positive publicity in testing times? Which though understandable is rather stupid, because they are revealing their “Methods and Sources” thus making them worthless hence the “going dark” issue happening faster.

But as you note the Politico’s are apparently being even dumber…

The advantage to pushing people from “store and forward” to “P2P” is that it makes traffic analysis easier and more immediate for the watchers and traffic much harder to hide for the watched.

Thus they may be trying to negate the effects of encryption they can not break in a timely fashion, or without “showing their hand” via a legal process.

The spy agencies have always been quite adverse to using “lawfull methods” such as warrants because of not just the “tipping off” aspect but also because of the more awkward tracability and inherant time delays and costs of getting them.

Personaly, if I were a criminal I would not be looking to use any kind of electronic communications or communications that are logged in some way unless it was a last resort measure. Back in the day dialin and messaging pagers had real advantages due to their Broadcast model of operation. You could just dial from any old POTS pay phone and the page would be sent. The receivers did not have to be connected to the network just turnrd on, therefore finding the person with the receiver difficult if they practised good OpSec.

Mobile phones have to connect to the network thus you get nailed to the map the instant you power them up. But that is the way the market is going.

So if criminals want to use the available electronic comms to blend in they need to exploit other techniques and the privacy of encryption is desirable. But if you don’t know about traffic analysis this could lead you to make a lot of very bad OpSec choices. Which those criminals that are at the bottom of the food chain or insufficiently knowledgeable might well make.

There are ways to deal with the traffic analysis and the “pinned to the map” issues but they require a lot of organisation planning and importantly money. Payment for the services needed is the real Achilles Heel of OpSec these days, nearly all payment systems used are “traceable” because they are direct payment via BACS or card. Even payment via a bank counter pay in of cash is recorded and easily linked to CCTV footage…. Whilst there are ways via prepayment / gift cards, the authorities are starting to close in on them little by little.

conspiracist • November 24, 2015 2:40 PM

@Surely Fakename

The Australian government told everyone to use Wickr if they didn’t want their messages stored then complained they couldn’t read criminals messages that use Wickr. LOL

…and that could be some backwards-psy-op in which Wickr is used as a communication honey pot. Like some dang Whisper.

I'm Unknown • December 9, 2015 3:32 PM

While it’s comforting to think of these low-level operatives as dumb, it is risky to think of the umbrella organizations as being populated largely by stupid individuals. To do so underestimates the scope of the peril and the evil these groups bring to modern civilization. Many of the most evil men in history have been highly intelligent.

I have little doubt that there are many people within these terrorist groups who are competent practitioners of cryptography, as well as steganography which poses even greater problems for law enforcement. Access to good cryptography is easy nowadays.

While I disdain the use of “mastermind” to describe these barbarians, we should face the fact that there are some very intelligent, well educated people who share these groups’ hatred of Western society. And while they may not be the ones who are strapping bombs to their bodies, they are even more dangerous than those who do.

Leave a comment

Login

Allowed HTML <a href="URL"> • <em> <cite> <i> • <strong> <b> • <sub> <sup> • <ul> <ol> <li> • <blockquote> <pre> Markdown Extra syntax via https://michelf.ca/projects/php-markdown/extra/

Sidebar photo of Bruce Schneier by Joe MacInnis.