Schneier on Security

Clive Robinson • May 23, 2016 2:02 AM

@ Dirk Praet,

Interesting Guardian read: how the Pentagon deliberately ratted out whistleblowers

What amazes me is that people don’t see the system of “patronage” that is the main cause of this corruption.

Most people understand from their civics classes at school that taxes are –supposadly– raised for “the good of society” in general. That is the money is supposed to be spent on things that benift society as a whole, ie “a rising tide raises all boats”. The simple fact is by and large the tax take benifit’s very few in society, and the only time society gets considered is when it gets close to election time. It’s then that those in power figure out some way to spend tax revenue on staying in power, often by working out who is going to vote and who is not, then promise the “give away” to those who are likely to vote either to enrich them or assuage their fears of a “ravening hord” raised by preceding FUD (ie “War on XXXX”, “Think of the children”, etc etc). We see this in the UK currently with promises made to pensioners, and often the “big lie” also told in the US to “cut government” etc. As for the current US contenders for POTUS I will not pass partisan comment, just note that what both front runners have been saying does not add up or make sense to a non US observer, still I’m sure the flag waves, drums bangs and sabers rattle satisfactorily for them both.

A little bit of thought shows a basic “limited resource” issue, most people regard tax as “theft at the point of a gun”, but also want the tide to rise for them (but not for those they see as being beyond the pale). It’s quite peculiar some times to talk to those who are doing whatever they can to avoid tax complaining about those richer than themselves doing the same thing…

But this bribing of the electorate is in reality just a side show to the “nest feathering” activities that go one the rest of the time. Legislators know that their personal income payed from the tax take is tiny in comparison to their needs both personally and politicaly, and thus they are open to various inducements. But the legislators are also aware that at some point they won’t be in a position to command inducements any more, thus they are looking at ways to future proof their position as well. Likewise their aids and other government officials are looking at their future as GS pensions don’t realy compensate the way they would like.

But what do these people have to trade to get such future benifits, well appart from their supposed integrity, they can control not just how but to whom the tax take gets diverted to, as well as various exemptions tucked into legislation. They also have a degree of control over those who wish to succeed them in office etc.

Thus you have all the basic requirments for a “patronage system” where futures are purchased on an unstated “understanding”. Put simply being a “team player” is a code from some one “with an understanding” to another saying “Don’t p155 in my rice bowl, or I will smash yours”.

The thing is there is quite litteraly billions at stake for all these rice bowl holding government “welfare mothers”. We non GS citizend don’t tend to see it due to the trillions sloshing through the tax system.

One way to see just what is at stake is to count the number of lobbyists and multiply by their average seven figure “real”[1] salary, then multiply by around a hundred. That’s the barest minimum of what those paying expect to get in return one way or another out of either the tax take, or not paying into the tax pot, and often both.

Then of course don’t forget to add in all those sincure jobs as non executive directors that ex legislators and senior GS employees get on early retirment etc. It’s the sort of nest feathering that makes the divertion of aid money in third world countries by tyrants and dictators look like “petty cash”.

For instance take the ex UK Prime Minister “the honorable” Tony Blair, it is said that the reason he did not alow himself to be enobaled and move up to the House of Lords, is that he did not want to take the paycut he would have forced on him by the declaration of income into the public record. Some guestimates put his annual income up in the 10,000,000USD bracket, and that’s before all the other perks, the cost of which would inflate it significantly. All of which derives from his time in office… You could also look at one of his predecessors Neil Kinnock and what his family get out of Europe etc…

In the US you could try and find out what Bill Clinton get’s these days, but it appears to be a well guarded piece of information. However less well protected is knowledge of Chelsea Clinton’s sincure jobs…

But then I could say similar for most ex leaders of any of the G20 countries, their ministers, and senior civil servants.

Which brings me back to the “big lie” which is the disconect between “cutting the size of government” and the size of the tax take. Politicians do not want “big government” these days as it is a liability to them, as it includes all sorts of accounting and controls. What they want is to “outsource” it all into the private sector which gives them both “arms length deniability” and “significant patronage”, thus giving them even more power and nest feathering ability than they ever had before…

[1] By real salary, I mean include not just the direct salary plus the usual health care etc perks, but those “in service” perks as well. Look at it this way if you are taking a legislator to dinner in a very very expensive restaurant, you want to be at the same table, subtly selling the message, which means you have to appear atleast as an equal, thus eat the same food and drink the same wine etc. Thus half the cost of that meal is an “in service” perk, that you would not have been able to experience on your declared salary, likewise much of the rest of the lobbyist “life style”.

Clive Robinson • May 23, 2016 3:55 AM

@ Nick P,

I’ve already said he blew many of our foreign operations and secrets on top of the domestic whistleblowing.

I’ll be honest, I’ve not seen the evidence to support “he blew many of our foreign operations”. I’ve seen way more of sitting US Politico’s blowing both operations and operatives, by whoring to the press to make themselves look more important than they are (worse they have done it to a number of their allies as well).

What he did do was raise what was already known very much more into the public eye. Whilst this may have woken up Foe as well as Friend is a matter of oppinion as to the harm that can be attributed to it.

As has been noted with the increasing use of encryption by various organisations the trend predated the Ed Snowden revelations. It realy started after a commander using a satellite phone had a cruise missile dropped on him. OBL almost immediately stopped using his and developed older courier type communications. Others realised that you could “game the system” by making meta-data work for them not the US. Thus they used burner phones for just long enough for them to be usefull to them, but not long enough to be of use to the US et al. But worse they used them for “political advantage”, they sold/gave the phones to others and got a fair distance away knowing that very shortly a hellfire would drop on the phone, killing those who had the phone and many around them. Then used the world press to report yet another US et al atrocity. As one senior US person put it “We use meta-data to kill people”, revealing more about the significant US Intelligence Failure than the revelations have.

But there is an issue that is not talked about in the US, and it’s the point the Guardian article highlights, whistle blowers never get the lift, only the shaft downwards. The reason is even though there is legislation to protect them, it’s easily by passed hidding the evidence that supports the whistleblowers statments or making them guilty of espionage etc. Thus if you want to whistleblow you have to “protect your evidence” which automaticaly makes you “guilty of espionage”…

In the UK we saw this back when Maggie Thatcher was in power back in the 1980’s with her use of DORA and OSA to hound journalists and their sources.

The lesson was get your evidence and protect it in a way beyond your control. What happened and is happening to Pte Manning is an object lesson in not doing this the right way, and in that particular case harm to foreign operations and operatives can be shown.

The problem with protecting evidence, is first what is and is not evidence not just at the time you collect it but in the future as well. This means a whistleblower has to adopt the same stratagem as the US Intel Community of “collect it all”. This in turn gives rise to other issues to do with time and resources.

It has been guesstimated that the Ed Snowden trove is of the order of 1-2 million documents (not pages). There is no way a single individual can read let alone take in and check that volume of information, let alone identify key “smoking gun” documents of official malfeasance, or their supporting meta-documents.

Thus you have to find others you can trust to do that job for you. You only need look at the size of prosecution and defence teams in Government cases against the likes of companies for cartel behaviour to realise just how large a team of people you would need to go through the Snowden Trove in any reasonable time frame. That sized team costs real money and has many security issues as well, thus is not the way to go.

Ultimately when talking about harms you get down to the “greater good” argument, that is what level of harm is justified to prevent greater harm. When someone is sitting there with their finger on the button of a small nuclear device, putting one betwen their eyes is not seen by many as much of a choice. But when the greater harm is of the “boil the frog” type it becomes more difficult. For instance there are about 1 billion smokers in the world, of which atleast half will die an untimely and quite unpleasent –for them and their loved ones– death. What if I suggested we kill of the three trillion a year tobacco industry? Many would be in favour of that. But how many would be in favour of putting all the directors, lobbyists and marketers in the industry up against the wall and shooting them? Very few I suspect. But it is easy to argue that per head those directors etc have killed and will go on to kill more people than a serial killer or mad bomber with their finger on the button of a small nuclear device…

Now there are well over 300million US citizens who have had their fundemental constitutional rights taken away from them, can you asses the harm done? How about all those industrial and other trade secrets, that almost certainly have been used to the detriment of the secrets owners? How about the harm done to the US economy by the mind numbingly large tax take these ineffective for stated purpose systems cost?

Personaly I think that the benifits of the Snowden Revelations have so far, far exceeded any harms that people are trying to falsely or otherwise attribute to them. Further some of those supposed harms to foreign operations, might actually be argued to be benifits. As the operations would based on US foreign policy in the ME and other places, probably be to cause major harms to the citizens in those foreign nations, and further directly or indirectly to US citizens as well as a result (nobody looks good being repatriated in a body bag).

The problem we have in judging, is the old “History is written by the victors” issue. It’s already becoming apparent that the US Gov true to form is trying to re-write or destroy the evidence of the few facts that are known, and by and large they are not being challenged on it. It’s thus a matter of guess work what else they have re-written out of existance or repurposed or renamed, or what they have done in the decade following many of the Trove documents.

But perhaps of more interest is how little the Trove or Ed Snowden actually get mentioned in the main stream media these days. After all when did you last see or hear of him mentioned on TV or Radio? How about MSM newspapers?

Thus I get the feeling that for the majority of US Citizens Ed Snowdens name is now rapidly fading in their minds. Which means the USG and IC have in effect got away with it…

Clive Robinson • May 23, 2016 9:11 AM

@ Dirk Praet,

It looks like the Austrian vote is going to the wire.

If Norbert Hofer get’s in then it will be the first far right government in Europe since befor WWII… Many of his main policies are similar to the more crazy suggestions from Donald Trump.

The fact the vote looks so close is rather worrying in it’s own right, irrespective of who actually gets in.

We have seen this “turn to the right” get worse over the past decade, and what comes with it is rather unpleasent and is already putting people in fear of their lives.

It would be terribly bad for Europe if those fleeing from the violence of middle east conflicts were to meet with violence and death in the heart of Europe. It’s bad enough that some EU politicos are pandering to the current Turkish Government.

Clive Robinson • May 23, 2016 9:01 PM

@ Nick P,

I’d be interested in your take on major democracies such as the Nordic countries (esp Sweden), Germany, Switzerland, and China.

Curious you put China in with major democracies…

As for European countries especially Germany and Sweden, you as an American would not be popular, nor would your business. Oh they’d smile and take your money and do as they are paid to do up to a point, but… The US is not popular in Europe currently, Donald Trump and Hillary Clinton and Obama’s TTIP are doing you a lot of harm and as my early discussion with Dirk may have shown you right wing nationalism is very much on the rise.

A friend of mine spotted early signs of it a decade or so ago and was warning about it. I thought he was over reacting, it would appear not. He was especialy worried about what he was seeing in Sweeden, where he was studying. Other friends in Germany were likewise raising red flags about nationalism.

People in Europe blaim “Mummy Merkel” for mass immigration thus job loses etc if they are working class, whilst the middle clase blaim the US for what is going on in the ME which has caused a large part of both the refugees and the economic migrants who are using them as cover. Which in turn has put ISIS in the back garden of the EU’s political house in Brussels.

Having studied in Sweeden myself, I’m very much aware of their and Belgiums disproportionately large (against population size) interest in ICTSec. Interestingly northen European countries that were significantly effected by Germany or Russia during WWII developed a very strong interest in signals intelligence which they have retained through the cold war through to today. The thing is that their signals directorates tend to see themselves as being above politics and the elected representatives and the legal process which Germany has been shocked to find is true for them as well. The reality is it is nolonger the BRUSA relationship of the US bringing industrial resources and the UK bringing the brains and Commenwealth WASP nations. Five Eyes is no more than a fading memory that died in the 80’s and 90’s when fiber took over from satellites and mobile phones started replacing land lines. A new IC federation was born, the countries involved can be identified by looking at a map of undersea cables and GSM equipment manufacturers and the way traffic is routed. Thus whilst one or two old eyes are fading (NZ in particular) there are keen new second tier entrants like Germany, Sweeden, Israel and one or two others. In some their politicians are very aware of the relationship and allegiances (Israel) in others less so, and in atleast one case (Germany) they appear on the surface to be totaly shocked. But worse as UK and US politicians have found out their own ICs actively spy on them and selectively report back to them whilst alowing “full take” to circulate within the IC Federation…

If you are looking for European countries I would look outside the political union –of full EU members– and outside of any NATO members, which realy does not give you much in the way of choices.

Oh and keep your fingers crossed that nationalism quickly peaks and wanes, otherwise we could see what happened in the 1930’s start up again, irrespective of trade agreements.

Clive Robinson • May 24, 2016 10:05 PM

@ r,

Have I told you lately that I love you?

Hmm not sure what to say to that, especially as my singing voice is not what it once was 🙂

On a more serious note, about lack of available petro-chem to a rebuilding civilization. If you look at history, the fundementals of industrialization has been metal working. Man kind then spent a few thousand years developing it without using petro-chem, they used charcoal in the main derived from trees.

What few historians ever talk about is the contribution of beer and tea to industrialization, and also that of religions. Which is a shame because it’s fairly clear that industrialization almost happened by chance as an outgrowth of religious iconography using excess wealth to promot artisanal classes of white smiths.

The thing to note about beer is that it requires a large energy input to boil the mash, and this needed a group of people to collect the fuel, grow the ingredients etc, the result however was a “safe drink” free from waterbourn pathogens. Beer is known to have been made by two major civilizations (Rome Egypt) but neither managed to get past the pre-industrialization stage befor falling. Similar can be said for other civilizations that developed beer or it’s equivalent.

Various arguments have been put forward, but one is interesting because it involves getting over the side effects of beer –stupor– with a new safe drink “tea” which again involved the removal of pathogens from water by boiling, but importantly unlike coffee had an aditional antibacterial effect, alowing towns to become cities of more than fourty thousand people.

This alowed the merchant classes to expand and utilize people as machine attendents, thus vastly increasing the spare wealth, and it was this wealth that alowed a middle class to develop that could devote time to study, research and thus gave rise to science and the technicians that replaced the artisans, and gave us the kick forwards to more efficient utilisation of energy thus economicaly viable industrialisation. It was then that high energy portable fuels at the begining of the twentieth century gave rise to transportation that was not tied to water, wind, animals or rails, which alowed further economic industrialization.

The question is though does the same “by luck” path have to be followed? History shows us that in general when an empire falls it is not entirely destroyed, the politics may die, but the art and science tends to remain at some level.

During WWII the Germans developed methods of turning coal into liquid fuels and lubricants, by the process of “gassification”. We also now know how to do the same with most bio-masses. I’ve experimented with methane generation by bio-digestion and been able to run a generator on it. I’ve also experimented on gasification of wheat waste (bran, straw) and got viable “town gas” for running generators.

So with that knowledge and a some remaining technology then yes we could re-industrialize without having the use of fossil fuel petro-chemicals. But the real problem is would there be sufficient excess energy for the size of population to get the spare economic capacity to then get back to the ability to have altetnative reliable energy sources.

And this is the real 21st Century issue. The UK for instance has sufficient available “wind power” to run on average most of Western Europe. But it is not reliable energy, to make it so requires economic storage systems, which we currently do not have…

If we can work out a way to efficiently use what are now called alterative/green energy sources into generation of petro-chemicals then yes we could make our economy independent of finite fossil fuels.

The reason why it needs to be petro-chemicals and not just batteries is the second issue with industrialization which is “feed stock”. The first step of any industrial process is gathering the raw materials required to make a product. Even in the twentieth century we were not pulling sufficient raw materials out of the earth to maintain economic growth, iron and aluminium products get upto 75% of the feed stock from recycling not mining. Similarly with other metals. In the twentyfirst century, it’s fairly obvious to those who want to look, is that nearly 90% of non metalic feed stock is from petro-chemicals, and this includes food and medicines. We are thus limiting our future by using petro-chemicals for fuel rather than feed stock. However unlike metals petro-chemicals are not as easily recycled, thus we have a pressing need to be able to turn bio-mass into petro-chemicals via alternative energy sources. The resulting petro-chemicals could be used not just for closed cycle energy storage but feed stock as well. But we do not have sufficient land surface to grow bio-mass to meet more than around 10% of our transportation needs, so we need to look at making transportation very much more efficient or change back from personal independent transportation to public transportation methods. But the freedom of personal transportarion is a Pandora’s box issue and is already showing the polarisation we see in other areas.

But when all is said and done one thing is clear, we are currently consuming energy at unsustanable rates. That is it exceeds the amount of utilizable energy that gets to the earths surface. Thus we have the limited options of getting higher efficiency, or reducing our energy consumption. There is however another option which is get more energy from the sun, and the easiest and ultimately most economic way is to move industry out of earths gravity well and into space.

Clive Robinson • May 25, 2016 7:00 AM

@ JG4,

Re Silicon valley getting radical over encryption.

The reality is they are not, they have looked at what Apple spent fighting the Feds and made a simple financial risk analysis. And have worked out it is going to cost them a lot less in the long run if,

1, They have no user data in their systems.
2, Cannot provide access to user data on user systems.

Whilst the likes of Google and Facebook can sell user data at a premium, smaller companies can not command anywhere near the same money.

Thus they are looking at a small return for a very big company killer sized risk.

It does not matter what the FBI’s Comey says, he and the other psychos at the DOJ have made it clear by their actions they are going to try every which way to get what they want, if there is the slightest chance they can get it.

So the only rational stratagem is as made clear in a cult 80’s film, “not to play” so texh companies are turning their tech into “no way, no how, no chance” systems.

This will not stop thr DOJ psychos wasting tax payer money, but it will reduce the liability to the companies, who simply demonstrate to a judge “the system can not do it”.

Oddly it’s a stratagem @Nick P and myself have independently investigated and talked about here some years ago over the thorny issue of crossing borders with laptops.

So the idea is far from new, It’s just that the FBI/DOJ psychos have moved the tipping point so far by their very stupid very public machismo game play, that it’s no longer a far left field idea.

Clive Robinson • May 26, 2016 6:55 PM

@ Nick P,

I’ve had a fast flick through the paper, then went back over their three claims.

Appart from the last (we’ve built it) I don’t see anything that RobertT and myself have talked about ad nauseam in the past.

Look back for RobertT talking about buried via’s and close running traces to use capacitive coupling. That covers the papers pick ups.

I’ve talked about the problems with “test harnesses” acting as security bypass mechanisms. As RobertT noted on a chip these are generaly not put in by the foundry customer (SoC designers) but the mask producers of the foundry themselves as it can be very technology dependent.

I’ve also talked about the use of “matched filters” which are effectively what the papers authors are doing with the input to their leaky integrator (the correct name for their voltage charging discharging capacitor).

As for the dead space on SoC devices, I’ve mentioned before that there is the “heat death” issue, which is one of a number of reasons for having dead space on the chip.

I’ll give the paper a fuller read tomorrow on my way upto the hospital for the “frying alive nurological checks, 30mA DC being applied to you f3cking hurts as does the slow heat “soldering iron” like probe, so it will give me something to take my mind off of it all).

Clive Robinson • May 30, 2016 10:48 PM

@ Anon10,

If Putin just wants to be perceived as standing up to the US, there’s usually a thousand different ways he could accomplish that at any given point in time.

Possibly, but how much do they cost? Ed Snowden was cheap real cheap, after all he’d paid his own air fare, and how much does it cost to keep him there?

The US would be nuts to go after Snowden, in any way whilst he’s in Russia, the political capital it would give Putin would be like winning the lottery a hundred times over. So the cost of having Ed in Russia is on balance negligible compared to the potential gains.