Schneier on Security

Clive Robinson • June 13, 2020 12:40 AM

@ ALL,

With regards, the notion that this was a “unique case” or a “special case”[1] and this somehow justified this allegedly “one off” tool development. Let me remind people that this is a “figleaf argument” for “doing bad things” because “we are the good guys” or some other self serving bull for other motives.

The basic flaw in their “unique” or “special” argument is all cases are, special or unique depending on how you look at them, all you have to do is walk around the problem till you find that supposadly unique view, which is not exactly difficult to do. Thus the follow through is that it boils down to “as all cases are unique, then all cases can be treated this way”.

Thus you have to ask the real question as to why Facebook did it, especially when you consider how they started (online abuse of young women).

The usual answer when corporates are involved is “shareholder value” which in the way Facebook has stiched up it’s shareholders must mean that somebody important would have to have been convinced by somebody else quite senior. Thus could not only see a big big loss in the near future, they would also be shown a “solution” to the problem.

Thus I suspect that the real reason Facebook did this was they did a cost-benifit analysis and went with the profit. That is they could see major bad publicity heading their way, at a time when political preasure was mounting and they just wanted it to go away before it cost them big… And a senior person gave a “gift wrapped idea” as a potential solution along with costings etc.

But the cost-benifit analysis could only be done, after someone with sufficient technical knowledge proposed the action to make the gift wrapped solution possible. Others would then need to “scout out” suppliers etc, which would require a lot of technical input. Thus the motives and morals of the technical people involved are a distinct factor[2]. Thus brings into question the realisation of someone thinking “this would be neat” etc.

As security proffessionals people have to learn to seperate out the fact that policy is in place for a reason, often legal and not to be waived for some “corner case” argument. Because once you put your toe over that line there is no going back. What was only acceptable for “corner cases” becomes acceptable for “edge cases” then “minor cases” then as “general policy for all cases irrespective”.

One of the ways you “coerce people” often gets termed as “MICE” by field operatives. You find a persons weakness and you play on it to get them to do something inline with those beliefs. You then use that to leverage up to the point you have the ability to blackmail the person into doing things that they know are not just wrong but would otherwise condemn others for with a vitriolic voice and pitch fork.

Facebook will find out at some point that their hands are nolonger clean, and thus others will know that their convictions are cheap and voided with a little preasure in the right way.

But consider this from a different view point, one which is not a potential “cause célèbre”, to be turned into a “think of the children” drum beat much beloved by certain political types with a distinctly unhealthy agender for the voting citizen. Thus ask yourself the question, if the US Executive are prepared to go after a single whistleblower with international bribery and coruption, which are both illegal in the US, on a scale beyond that which most could imagine, what do you think they would do with a dirty hands corp like Facebook?

Ignoring for the moment what the suspect in this case did to attract attention[1], consider what he did to try and protect himself and why he failed. His failure at the end of the day was by making unwaranted assumptions about technology. Technology that various people have repeatedly warned about on this blog for years.

Unlike most people this suspect’s actions were not “spur of the moment”, he knew what was likely to happen to him if he was caught. Thus he took what he thought incorrectly were sufficient precautions. Precautions over and above those many think are more than sufficient for whistleblowers (see what journalists put up for their confidential information hotlines, for instance).

In point of fact he was caught via a new version of a known technique that had been used before, for which there are known preventative measures. So the suspect was apprehended due to their own limited OpSec capabilities. Proving once again that not only is OpSec hard, you need a level of knowledge way way beyond that which most are ever likely to have.

[1] We know there are others out there who have done worse, and will continue to do worse if they can see a way to profit by it.

[2] Getting a users computer to reveal it’s IP address whilst being a conceptualy simple idea is one fraught with technical difficulties which makes it chalanging at the very least. In fact many had assumed it was effectively impossible untill a few years ago when it was first used against a Tor based user. Such technically challenging activities are “mind candy” to certain types of people and also would look good on a C.V. so the temptation to do this to certain technical types would be irresistible, thus overide things such as ethical and moral considerarions not just for this case but all future cases.