Schneier on Security

Rick Taggard • April 29, 2016 9:09 PM

Bruce, @all

1) there is and has been, and certainly will continue to be, intense cyber espionage wars going on. Both nation state based and large corporation based. Often, the two working together.

I do not think this should be attempted to be fit into the “cold war” model.

It is different. It is no longer about – or with the painful pretense of – ideology. It is about money. It is about knowledge. It is about power.

2) The “war” term. Never been popular, but also is popular. It does fit. Bruce is Bruce, not a polemicist.

3) I do view the current round of debates as partly defensive (due to guilt of massive failures, like Snowden, and fear of repercussions, which they have avoided). OPM was a failure. There have been a lot of serious intelligence failures.

Normally, people get fired for far less.

But, I also view this as partly turf wars. Who will get the big cybersecurity budget. Who will become the primary owner of the cutting edge cybersecurity hacking.

When someone is raising hell about security dangers, and being a pundit like this, very often they expect to get something in return. Like the budget necessary for the manpower.

Squeaky wheels do often get the grease, and even if not, it is a basic human tactic.

4) The argument that, if backdooring becomes real, it will offshore encryption and security technology. This is a few moves down the board, but unfortunately, even in upper leadership quarters many simply do not ever think a few moves ahead.

It is ludicrously inevitable.

5) Risk and threat. I very often see people way over estimate their risk, and the threats against them. This is the first analysis people should personally do. What do you have which anyone else wants?

Conversely, who is it who is a best target of secret surveillance? Surely, anyone high in government. In many types of corporations. Very often, even peripheral players can play critical “ins”. For instance, your friendly neighborhood janitor. Or security guard. Or spouse. Or secretary.

Politicians in democratic society are especially vulnerable to secret surveillance with an eye to control. Everyone has secrets. Everyone does and says things off mic. The smallest of their sins can ruin their career. This certainly does also apply to even unelected officials. Such as we saw with the downfall of Patraeus.

6) Ramifications of secret surveillance, and of strategies and tactics which depend on it.

I really rarely see this anywhere, except in very rare fictional shows, and in declassified, WWII documents. Certainly, there is also more in memoirs and declassified studies on organizations democratic (Hoover) and totalitarian (any of them, but especially the slicker groups like China or Russia) where these strategies are outlined.

Hacking is not just a form of surveillance. It is the most powerful form of surveillance available.

It can provide blackmail material. It can give edges in competitions, like in politics, plans can be leaked to the press or competitors. Or, in business. It can provide material to have profound, esp like rapport with people so they instantly and deeply trust you.

Hoover, for instance, damned well near controlled the government. Nobody knew about it then, except politicians and presidents who kept their mouth shut. Out of fear. The man could not be fired and got himself to a position where he could do almost anything.

But, that has been overly hashed out. What are the possible ramifications tomorrow? If an organization is enabled to have largely unfettered capacities for secret surveillance, how can they be stopped — or even detected?

If they have the capability to run slick undercover programs, combined with that capability, they can do anything.

Secret surveillance, in the form of hacking, certainly can provide them funding. With funding, they can disconnect from the government. Or, continue to run their piddling programs as a cover for what they really do.

Yes, this sort of scenario was expounded in “Swordfish”, and some other fictional scenarios. But, even the most absurd of tales sometimes uncannily predict the future. Or, reveal what already is and nobody knows about it.

7) Sabotage.

Nations can pretty well sabotage adversarial nations via hacking as they will. Assuming they have no penetration.

But this can also be subtle. You want to have your corporate interests decimate foreign corporate interests? There are many ways, theoretically, even the largest of enterprises can be decimated by hacking. And the culprits can get away with it, too.

Simple, small matters like being able to get them to overestimate their next quarter’s revenue can do enormous damage.

Implanting obscure software bugs which cause their accounting to become ‘hard to notice’ flawed.

And so on.

Rick Taggard • April 29, 2016 9:50 PM

Additions:

1) If a nation gets a golden key, or golden keys, for their nationally made systems, how can they ensure this is not stolen by adversarial nations, or even organized crime?

Historically, they definitely can not assure that.

Especially considering the potential value of it. Consider, the FBI spent seven million to get data from the SVR on Hanssen. And an unknown “millions” for this recent break of an out of date iphone.

You could be talking about having 100 million to spend towards such an operation. Bribing someone with near access for a million is nothing. Nevermind they are a bit better at getting rid of people then you could expect criminals to be.

They can claim there are no moles. They fixed the problems they found with past moles. These are empty claims.

2) One of the interesting problems arisen with the rise of these technologies is both the difficulty and power these technologies provide to “undercover”.

Why does “undercover” matter? Because if you do not want to be on anyone’s radar, your group is best to be undercover. The flimsy, cheap way to do this is simply have your firm with an inauspicious name in the outlands of Virginia or Maryland. As many do.

The more secure way is to go all out and really blend in.

More secure way is necessary for doing more useful things.

On one hand, you see even untrained, but diabolically clever loser mid-life adults create false persons using other people’s online information.

On the other hand, if you are creating a paper trail, how do you do it? Disguises which can pass airport security, done. Israel did it in 2010. Some Chinese guy did it a few years ago with tech that can be bought for 700.

How do you pass fake dna? You have to compromise the databases.

And it is far harder to just be someone who never existed before. You have to replace someone real, who exists, online.

That can be a bit of a tightrope.

After all, if anyone can check up on the real person, they can prove you are a fake.

Facial recognition can scan past known databases, but also available material for social media. So, your mask better tie back to someone who exists, or you are clearly fake.

Rick Taggard • April 30, 2016 2:24 PM

@Citizen X

Rick Taggard wrote:It is different. It is no longer about – or with the painful pretense of – ideology. It is about money. It is about knowledge. It is about power.

It may no longer be about a very one-dimensional ideological landscape, but don’t dismiss the way that history’s simple one-dimensional idealogical spectrum has blossomed into a more multi-dimensional landscape. You are certainly correct, money is a big part of it, but I don’t think the book has been closed on long term epic ideological clashes and shifts. Snowden appears to have been motivated by ideology more than money AFAICT. But maybe he’s just a really good really well paid actor (or advanced CGI puppet) for all I really know.

These things depend on one’s definitions. While there are consensual agreed upon words, in use, we are getting right away into more specific and individual use.

(As language certainly allows.)

So, ‘what I mean by ideology’, is most specifically the appearance of it.

Nations have ideology which they juxtapose over their “national interests”, just as people juxtapose their own ideologies over their “personal interests”.

Very often these ideologies simply function as shortcuts, abbreviations, of those interests.

It is not unrelated to what researchers have found with individual human beings distinct dependance on the “strawman” glasses. Well replicated studies. In short, everyone has a natural tendency to make “strawman” arguments against everything contrary to their most highly held beliefs.

It is the mind’s way of shortcutting thought, is one theory.

Like a blind spot of the eyes, where our minds fill in the blanks with probabilistic, statistical imaginings… instead of constantly having to perceive raw data every moment, all the time. Which is far more cost prohibitive then just relying on memory and imagination.

But, for instance, we see these blinders come increasingly off.

There is little to no room for the ideologies of old for the work of thieving. Thieves are not successful if they are not inherent professionals. They have no mistake about it, they are after the money. It is for no higher nor different cause then their own best interest.

Attempting to put such causes on them, only is detrimental, in professional thievery, to accomplishing their objectives.

Sometimes, certainly, thieves may rationalize or even strategize “angles”. For instance, some will say, “no one cares about stealing from this target” (because they are so rich, etc). But, that is a good survival cause. If they target groups that would bring universal condemnation on their heads, they greatly increase the chance of failure.

I put national and personal interests in quotes, because while there is strong evidence that people and corporate entities work in their own best interests; the fact is, as noted above, people are flawed. And so very, very often do what is not in their best interests.

What hacking is like is a glitch cheat in a video game, where there is multiplayer involved.

Everyone has to use the glitch, or they lose.

It completely ruins the aura and delusion, the suspension of belief, of the game. But, they have to use the cheat or lose.

Snowden was working by ideology, certainly. But, so are the folks against him. This is how such ideology works, why it is successful, and why it is relied on. Because you can have many divergent perspectives all aligned together.

Sure, each side may see the other as traitors to the ideology – in this case, the ideology of freedom and maintaining that – but because of this dissonance, there is that debate happening.

Snowden probably felt horrible enough about what he saw, to feel he had no choice but to act.

Likewise, this is how those on the otherside of that debate must feel.

So, they keep it up. They both are working entirely by ideologies. Otherwise, there is zero reason to even think longer on any of it.

Certainly zero reason to have any feelings, either way.

But, zeroing in on this, a little:

Snowden appears to have been motivated by ideology more than money AFAICT. But maybe he’s just a really good really well paid actor (or advanced CGI puppet) for all I really know.

I am not aware of any case where paid actors are used in a very high level conspiracy. This was a very high level conspiracy, as “conspiracy” is the very definition of covert work.

The reason for this is because you can not trust to have people keep their mouths shut just by money.

Anyone engaged in a very deep conspiracy has to have a very wide range of deep handholds to be trusted in such a conspiracy.

So, it is, across the whole history of intelligence, the only time actors have been engaged is when they just happen to be actors and have agreed to be full blown spies.

Like Inglorious Basterds. Where you see a popular German actress there willing to work with the Allied powers? That part of the movie certainly had basis in fact.

And it is also true, like in that movie, they invariably ended up dead. Almost.

This does not mean undercover is not acting. It is horrifically demanding acting. It often engages the same sort of work one finds in both long and short cons, which also rely heavily on acting. But, I would never call a spy or grifter an actor, because what they are doing is so very much more.

Where this idea has come up, has been from some recent conspiracy theories that have zero concern about accuracy, like the Sandy Hook deniers:

http://www.cracked.com/personal-experiences-2232-my-son-died-at-sandy-hook-conspiracy-nuts-think-im-lying.html

cgi, also, no.

Could, however, Snowden be working for an external, well resourced group? Yes, he could.

He is in Russia right now, so that, for one, eliminates a lot of potential theories. Including also the “he is just a well paid actor” one.

Generally, spies do what they do for their beliefs.

They are ideological, in that sense of the word. But, this is assuming that I mean the same thing. I do not. It is pragmatic. It was necessary to be done for the greater good of the nation and the world, and the line to that was very clear cut.

The problem with his opponents is they are all closely grouped together. They have a responsibility to bullshit each other. It is how they keep hired, and how they make their way through their subculture. Their beliefs are their currency.

But, Snowden does not require such bullshit to maintain his currency with the groups who agree with him.

Rick Taggard • April 30, 2016 4:24 PM

@Clive Robinson

Except reach back in time secretly…

This is why “Collect it All” is such a significant threat, orders of magnitude worse than Hoover. Hoover had to wait untill his own position late in life was secure enough to start his secret surveillance, and only when he had collected enough could he start slowly flexing his surveillance bounty muscles.

Imagine though that you are a twenty something administrator with megalomaniac ideas who could just siphon it off in a few days…

Very good points.

We all make mistakes, or get into situations that although innocent can be misconstrued and used against us, unless we already have power to have the problem “sanitized” or what ever the current “wet work” euphemism is these days…

Quiet sabotage from a fellow coworker who happens to be in a similar subculture as the target.

The ‘flying soldier’s’ metaphor.

Rick Taggard • May 1, 2016 1:32 PM

@Dr. Longbeard

completely agree with other commenters on the use of the word ‘war’. Here in The Netherlands the habit of calling every action a war is laughing stock, the more as so far most ‘war on X’ efforts are highly unsuccessful. The war on drugs, poverty, Iraq, Iran, ISIS etc. Most shocking is that some of these so called wars are even US government policy. So please Bruce, don’t become yet another warlord.

There is the term “struggle”, but then you have “jihad” and “mein kampf”.

But, this is very true. It is painfully Orwellian.