Clive Robinson June 6, 2022 12:47 PM

@ John, ALL,

Just tried to reply to you but it “got held in moderation”…

So split it into bits time…

Part 1,

Is the ‘state’ entitled to have secrets?

It thinks so, and that is often it’s downfall to a carefull observer.

From the start of the article,

“[A]mid the bland northern Virginia suburbs, are generic-looking office parks that hide secret government installations in plain sight. Employees in civilian dress get out of their cars, clutching their Starbucks, and disappear into the buildings. To the casual observer, they resemble anonymous corporate drones.”

This always amuses me because “plain sight” is a form of “Security by Obscurity” and it realy does not work.

Leon Theremin June 6, 2022 12:59 PM

The story won’t be much different when a whistleblower leaks on Silicon Valley’s electromagnetic surveillance with Eric Schmidt’s secret sensing chips.

Clive Robinson June 6, 2022 1:01 PM

@ John, ALL,

Part 2,

I won’t go into to many specifics but you can get a feel for Gov / Mil / LEO and other agencies because they are over cautious and the workers are generally not.

You can group things you can observe as a “passer by” into,

1, Buildings
2, Building Attachments
3, Security
4, Security Personnel
5, Workers behaviours
6, Workers attributes
7, Workers vehicles
8, Workers published info.

Often the buildings have a certain style that “does not fit” or just looks wrong. Such as few or no ground floor windows in an “office building” and what windows there are are screened in certain ways.

But the buildings have attachments that look odd that try to hide antennas, high power feed in, hidden air con and other utilities that don’t fit just walking down the pavement and seeing odd manhole covers can give hinky clues.

Clive Robinson June 6, 2022 1:06 PM

@ John, ALL,

Part 3,

Fun fact, in the UK one big giveaway of Police Agencies is the architects use of a certain “blue paint” on a certain style of “gate” and “railings”. Maybe they buy in bulk but you’ld think they would have twigged by now, or maybe they do not care.

But another big give away is “branding” or lack there of. Often it is an oddity and a quick check via “Company Databases” and other databases often “smells” like a rotting fish in a pond. Sometimes the fact they are a “front” can be found within a couple of minutes of Intetnet searching.

But their obsesive need for “security” shows up all to easily, fences of certain types, guards of certain types, security cameras and similar are give-aways.

But also the way people enter a building is a giveaway, right from the time they leave the public highway. But also when “Government” they frequently extend out into the public highway and surounding areas, such as traffic signs about parking and waiting, even how fast an “official response” to a “broken down vehicle” are all tells. Even the fact people on foot are discoraged in various ways.

Clive Robinson June 6, 2022 1:12 PM

@ John, ALL,

Part 4,

But a careful eye on when people turn up and leave work is a fairly good sign. Most Gov workers are “clock watching” their way to a cushy-pension” on lowish pay, their time keeping and the way they dress the bags they carry the shoes they wear are big tells in that. But also what they drive is an indication of income, marital status and age, which are often quite different to corporate employees.

Even hair cuts, facial hair, and similar are give aways to Mil and similar “flaged personnel” even the way they walk and carry themselves.

Then there are the “fitness” and similar trackers that have Internet access… Talk abou hanging a rope around your neck….

Hiding in plain sight is difficult enough for individuals who’s lives are on the line 24×365, an agency where most of the staff are time serving or maintaining their physical status stand out, realy does not have a hope in hell of hiding.

But also consider vehicle licence plates, they are fairly easy to check without going through “government databases” likewise who owns the houses those vehicle drivers live in and thus all sorts of information.

As for “social media”… “Take me out and shoot me”…

lurker June 6, 2022 1:36 PM

On March 7, 2017, the Web site WikiLeaks launched a series of disclosures that were catastrophic for the C.I.A. [Vault 7 & 8]

It will be interesting to see how they can pin this on Julian Assange . . .

Ted June 6, 2022 3:45 PM

“The new trial is scheduled to begin on June 13th”

Oh my goodness. Is Josh Schulte going to be representing himself? I don’t know how ‘boy emperors’ are as lawyers. The whole thing seems like an utter monstrosity for the CIA.

I’m sure this article went past reviews. It’s really great writing and research. There’s so much to analyze when things go wrong. I don’t see how the government can afford for Schulte to go unrestricted.

lurker June 6, 2022 4:42 PM

So this guy was a gun coder, sysadmin on the devlan, yet he had to search on the net for how to nuke his disk? Gimme a break . . .

Cerebus June 6, 2022 6:25 PM

All three markers of a classic insider threat. Shout out to annual infosec awareness training! 🙂

JonKnowsNothing June 6, 2022 7:03 PM

@lurker @All

re: It will be interesting to see how they can pin this on Julian Assange

I think that’s already in the works. Over at Marcy Wheeler’s site (1), she has been following both them for some time. The view from the US Legal pool doesn’t look good for either of them.

I expect that EW will post more about the legal issues as the trial information gets ramped up. Expect froth because it’s about the Legal Stuff and not about general perception.

From the USA side of things, it doesn’t matter much what the US asserts to the UK about M.Assange treatment should he be sent to the USA, because once he is physically in US Custody a new filing will emerge called a “Superseding Indictment”, wherein all the charges can change and new ones can be added on, and on, and on. (2)

The same thing will take place with M.Schulte.

Every breath they take, every move they make, they are watching…


1) h ttps:/ /www.emptywheel.n et/

(url lightly fractured)

2) EW has an entire slew of posts about Dec37 folks and Superseding Indictments. In some of those posts, EW includes a chart of what “enhancements” mean and how they get calculated for penalty time.

For every charge there is a matrix of penalties. As you move across the SS the penalties go up and as you move down the rows the penalties go up.

You select values from multiple columns and multiple rows and tote up the values. Then you can go a different path through the same matrix and get the same end value but using way less effort and a lot less evidence.

Clive Robinson June 6, 2022 9:21 PM

@ JonKnowsNothing, lurker,

EW has an entire slew of posts about Dec37 folks and Superseding Indictments.

Apparently there is another “truck load” on the way…

But I must admit, I’ve lost interest in much of the goings on.

It’s become clear that much of the current prosecution behaviour is highly politically biased, whipped up into some self rightious froth by certain “MSM for authoritarian follower air-heads”…

There is only so much of that nonsense a body can tolerate…

The reality is prosecutorial over reach is an understatment, and they are grasping not at straw, but nothing-burgers of “lying to FBI”. I guess to try to stop the FBI of wasting taxpayers money by way of malfeasance.

But what are you supposed to say when three years of investigating, three weeks in court presenting become “quickly aquited” and jury members point out publically there were better things that could have been done with the time… Yet the likes of Fox make wild unsubstantiated and clearly untruthful claims… You have to ask when this abusive politically inspired nonsense is going to stop…

What’s the betting the “pee tape” will be taking a turn on the stand before year end?

cmeier June 6, 2022 11:13 PM


Is the ‘state’ entitled to have secrets?

I vaguely remember reading that Czech author, dissident, and secret police victim Vaclav Havel discovered to his surprise after he became President, that yes, states do have to try and keep some things secret. Whether they are entitled to is a different question.

JonKnowsNothing June 6, 2022 11:26 PM

@ Clive , lurker, All

re: 3 years and 3 weeks for a non-lie

I admit that when I tried to follow Durham-v-Sussmann I was totally flummoxed by what was happening in the reporting.

I am molded by decades of MSM reports into thinking that there are some Good Guys left, not many but some; and that someone who goes to the FBI and reports something “hinky” is happening (which it was but that’s another sticky jam jar) and alerting the LEAs to check it out was a Good Guy. Only to find this dude Durham was accusing Sussmann of lying about it.

What a mess and a half.

The details and nuances EW waded through to bring some clarity was amazing and when the dots started to come together it rather solidified an age creeping cynicism about LEAs and The Courts that back them up for 3 years of nonsense.

Per EW, M.Durham has a few more of these sorts of things up his “sometime tailor made sleeves” and plans to ride them out to a nice government pension. (1)

Unraveling the knot of Dec37, is a tangled line being pulled from both ends. Normally this will yield a rather nastier knot. Perhaps some of that tangle will get unraveled a bit more in the next weeks.

1) There is what the public knows
2) There is what the reporters know
3) There is what both of these groups think they know
4) There is what the pundits claim to know

and then

5) There is EW wading through the Legal nits and nats to cross the Ts and dot the Is, about what is there and not what we want to be there. (2)


Search Term

1) Stan Freberg Presents

the United States of America

Volume One: The Early Years

2) David Hare (playwright)

Page Eight

SpaceLifeForm June 7, 2022 2:17 AM

Vault7 was Documentation. Vault8 was Source Code.

Of the very small dump of Vault8, which was an exploit, a key piece of the source code was intentionally NOT leaked. Those pieces that were leaked was apparently done to demonstrate that WL had more that just the Documentation.

Whether WL had all of the Source Code is an outstanding question. My guess is yes.

But, apparently, WL intentionally did not leak the Source Code for an exploit in it’s entirety to prevent skiddies from abusing it.

I am not convinced that the Devlan was really air-gapped.

John June 7, 2022 3:17 AM


Good discussion.

The primary role of the state should be to help it’s productive citizens become more and more productive.

For me, productive citizens create original wealth and include mostly farmers, miners and manufacturers.

Many states seem to turning their government role into one of making life more difficult for their productive citizens!


ResearcherZero June 7, 2022 3:21 AM

Petty and selfish behavior is all too common.

“Too many of us, leaders and followers, are irresponsible, rejecting ideas that don’t fit our preconceptions, refusing discussion and rejecting compromise.”

“Worse, we are prepared to deny the humanity and rights of others.”

Take the money. Don’t ask too many questions.

The World Bank estimates about $1 trillion is spent each year to bribe public officials, causing an array of economic distortions and damage to legitimate economic activity.

” Butina in December 2018 admitted to acting as an unregistered agent of the Russian government and infiltrating the National Rifle Association (NRA) in an attempt to sway US policy in favor of Russia. An indictment returned against Butina in July of that year said she and a high-ranking Russian official, believed to be the Russian politician Alexander Torshin, worked to create a “back channel” between Russia and the US, using the NRA as a conduit. ”

Butina’s conspiracy was directed by a “Russian Official,” understood to be former Russian senator and central banker Alexander Torshin.

in a March 2015 document titled Description of the Diplomacy Project. Butina wrote that she believed the candidate nominated by “Political Party #1” — i.e. the Republican party — would likely be elected president. According to the plea document, “Butina stated she had laid the groundwork for an unofficial channel of communication with the next U.S. administration” by gaining the confidence of “a certain U.S. civil society gun rights organization” — that is to say, the NRA — “which Butina posited had influence over Political Party #1.”

transactions totaling nearly $300,000

Trump was “indirectly providing Putin with a regular flow of intelligence on what the oligarchs were doing with their money in the U.S.”

He would secretly rat out his customers to Putin, who would allow them to keep buying Trump properties. Trump got rich. Putin got eyes on where the oligarchs had hidden their wealth.

“an undertaking decades in the making, through which Russian Mafia and Russian intelligence operatives successfully targeted, compromised, and implanted either a willfully ignorant or an inexplicably unaware Russian asset in the White House”

Current and former U.S. intelligence officials said that although Russian diplomats have secure means of communicating with Moscow, Kushner’s apparent request for access to such channels was extraordinary. The discussion of a secret channel adds to a broader pattern of efforts by Trump’s closest advisers to obscure their contacts with Russian counterparts.

Russia’s ambassador to Washington discussed the possibility of setting up a secret and secure communications channel between Trump’s transition team and the Kremlin, using Russian diplomatic facilities in an apparent move to shield their pre-inauguration discussions from monitoring

Russian organised crime enjoys significant levels of state protection.

“gangsterism on the streets has given way to kleptocracy in the state”

The notion of a criminal-syndicalist state is central and essential to understanding the findings and conclusions of the Russian Organized Crime Task Force. The task force concludes that, in the absence of significant reforms, the Russian Federation itself is likely to become a full-blown criminal-syndicalist state.

In his February 1997 state of the nation address, President Boris Yeltsin admitted that the “criminal world has openly challenged the state and launched into an open competition with it,” warning that “there is corruption at every level of power.”

Clive Robinson June 7, 2022 3:49 AM

@ JonKnowsNothing,

Good Guys left, not many but some; and that someone who goes to the FBI and reports something “hinky” is happening (which it was but that’s another sticky jam jar) and alerting the LEAs to check it out was a Good Guy. Only to find this dude Durham was accusing Sussmann of lying about it.

Do you know why MW is nolonger living in the US?

A hint might be she to went to the FBI to report something “hinky”.

Hopefully the Government of where she is, has a different approach than the US/UK do…

After all the highest serving judge in Scotland made a ruling, using an invented crime, against a UK online journalist in poor health, to have him jailed for being inconvenient to the Scottish First Minister, US and UK Governments and to prevent him giving evidence at a serious trial in another EU countrh. The ruling set a legal president about who is and is not a Journalist… And from what I can see MW is in the latter group of individuals.

Hopefully MW will keep her eye open for “stray buses and burly individuals”.

cmeier June 7, 2022 7:57 AM


This always amuses me because “plain sight” is a form of “Security by Obscurity” and it realy does not work.

I seriously doubt that anyone is trying to hide much of anything, at least not by choice of bland office building. They probably just need office space like any other organization. It is the journalist who wrote the melodramatic nonsense you quote who needs to be dinged.

Peter A. June 7, 2022 8:30 AM

@Clive: re: recognizing military facilities

Some time ago, before online maps era, when I had a lot of spare time to hike, cycle etc. I had a small hobby of locating such places. I bought maps of the area around my place (1:10000 to 1:50000) which were actually old military maps (like 10-20 years old map base, as indicated on the maps themselves) repurposed for civilian use; indeed they were published by the military cartographic office. They were cleansed of military installations, but not quite.

Some hints were present for the young curious people like me: rectangular clearing in a forest (shooting range); empty forested hill in an otherwise rather densely populated area (radar station); dead-end but heavily forked railway line (munitions storage facility); a group of buildings surrounded by a metal fence (yes, there was a map sign for that, probably they forgot to remove it from the map – military unit); or a bunch of long and narrow buildings set parallel or perpendicular to one another (same thing). Or just too straight paths in a section of a boggy forest.

The last hint was subtle but most curious: an area on the map was marked as patches of forest interspersed with patches of bogs and with a lot of streams marked; most paths marked were windy, avoiding boggy terrain, but there were two sections of straight parallel paths. They stood out as fake. I cycled there, identified the intersection leading to a supposedly straight path and went there – it was not straight at all, but went left and right around pools of water and across streams, but generally followed a southwest bend. There was a less boggy patch on the map the path was supposed to go right through, about 1/3 distance from the intersection. I went back, to the point I estimated to be around that 1/3, hid the bike in bushes and hiked into the dense forest. The land was very rough, rather unnaturally, like someone purposely dug holes and raised mounds, then let a forest grow there. After about a half an hour of scrambling up, down and through the bushes: TADA! several meters high barbed wire fence, plowed strip of land, another fence and… forest again. I found myself at a side of a rectangle, with wooden watchtowers at the corners. The towers were unmanned. I scrambled along towards the one that stood closer, to see the other side and saw another unmanned tower. The land was so rough I gave up trying to find the entrance and scrambled back to my bike. Later I was able to locate a forest road forking off a public road in the general direction of the structure. The road was not on the map; the entrance had the same signage as other forest roads in the area: no motor vehicles except forest services, no littering, call XXX in case of fire etc. and was otherwise inconspicuous, I had cycled past it many times before without even noticing it’s not on the map. I had no guts to cycle down it, even if the military facility seemed unguarded – from the forest side at least.

Peter A. June 7, 2022 8:41 AM

Clive: re: recognizing military facilities

Some time ago, before online maps era, when I had a lot of spare time to hike, cycle etc. I had a small hobby of locating such places. I bought maps of the area around my place (1:10000 to 1:50000) which were actually old military maps (like 10-20 years old map base, as indicated on the maps themselves) repurposed for civilian use; indeed they were published by the military cartographic office. They were cleansed of military installations, but not quite.

Some hints were present for the young curious people like me: rectangular clearing in a forest (shooting range); empty forested hill in an otherwise rather densely populated area (radar station); dead-end but heavily forked railway line (munitions storage facility); a group of buildings surrounded by a metal fence (yes, there was a map sign for that, probably they forgot to remove it from the map – military unit); or a bunch of long and narrow buildings set parallel or perpendicular to one another (same thing). Or just too straight paths in a section of a boggy forest.


Petre Peter June 7, 2022 8:46 AM

I agree that it’s a little fishy for a guy with his experience to not protect his searches.

ResearcherZero June 7, 2022 9:28 AM


The AFP has managed to compile a family tree of the mafia from data obtained from Operation Ironside.

“They are responsible for 70 to 80 per cent of the world’s cocaine and they are flooding Australia with illicit drugs.”

“Unfortunately they invested in the wrong technology when they invested in the ANOM app,”

Governments have “official” unofficial leaking policies, releasing tons of confidential material to the press without any attribution or public acknowledgement: they leak stuff to maintain good press relations, to test out ideas, to hurt their in-government rivals, or to let information be generally known without having to answer difficult questions about it (for example, letting the press report on “secret” drone strike in Yemen without a press-conference where embarrassing questions about civilian casualties might come up).

One of the most important provisions of an internal policy at the Justice Department, often called the News Media Guidelines, includes a presumption that affected journalists be notified before the department attempts to seize their records, with very limited exceptions.

“The government’s own guidelines require the FBI to pursue alternative sources before subpoenaing a newspaper,”

“The Biden administration said on Saturday that no one at the White House had been aware that the Justice Department was seeking to seize the email data of four New York Times reporters and had obtained a gag order in March barring a handful of newspaper executives who knew about the fight from discussing it.”

The disavowal came one day after a court lifted the gag order, which permitted a Times lawyer to disclose the department’s effort to obtain email logs from Google, which operates the Times’s email system. It had begun in the last days of the Trump administration…

…during the Trump administration, the department had authorized broad, secret demands for the phone and email records of eight reporters across the three outlets to identify confidential sources. the administration also secured a court order gagging CNN’s general counsel from informing anyone in the newsroom of an email records demand. The order remained in force until May, months into the Biden administration.

The case also raises new concerns among critics of government secrecy about the possible stifling effect of these investigations on a critical element of press freedom: the exchange of information between reporters and their sources.

In a sweeping and unusual move, the Justice Department secretly obtained two months’ worth of telephone records of journalists working for the Associated Press

Federal authorities obtained cellular, office and home telephone records of individual reporters and an editor, as well as records from AP general office numbers in Washington, New York and Hartford, Conn., and the main number for AP reporters covering Congress

Ted June 7, 2022 9:59 AM

@cmeier, Clive, All

It is the journalist who wrote the melodramatic nonsense you quote who needs to be dinged.

That made me laugh a little bit. There was a maybe a tiny bit of that. And a little fluffed up intrigue here:

When computer scientists at the Bureau examined Schulte’s desktop, they discovered a “virtual machine”—an entire operating system nested within the computer’s standard operating system.

Lol. Crafty. All-in-all though I liked how the writer captured some of the behavioral narratives of a juvenile escalatory instigator. It’s a threat model that wouldn’t have been top of my list for “the single largest leak of classified information in the agency’s history.”

- June 7, 2022 4:16 PM


A warning about “Dail Mail” articles has been given by several people in the past on this blog.

To sum them up,

Take care when quoting or linking to anything that appears in it,

1, It’s probably wise to use other sources where you can
2, also verify from atleast two other reliable sources
3, Or fully independent sources.

Oh anything ‘medical’ in it is almost certainly click bait ‘scare then’ silly at best hyperbole.

Winter June 7, 2022 4:54 PM


President Boris Yeltsin admitted that the “criminal world has openly challenged the state and launched into an open competition with it,

My previous response went the way of the bitbucket.

But most of it and much more can be found here:

Gangster’s paradise: how organised crime took over Russia

Many of the organising and operating principles of modern Russia follow the lead of the underworld. Maybe it is not that the vory* have disappeared so much as that everyone is now a vor, and that the vorovskoi mir – the world of the thieves – ultimately won.

*Vor = the Russian word for “thief”, but also a general term for a career member of the Soviet underworld.

SpaceLifeForm June 7, 2022 4:57 PM

@ -, ResearcherZero, Winter

re: Anom, Operation Ironside

Original source:


Clive Robinson June 7, 2022 5:49 PM

@ SpaceLifeForm, -, ResearcherZero, Winter,

Re : Italian Organised Anom?

That is curious.

Whilst Italy does indeed have quite significant organised crime and drug crime often seperatly, they are not realy a “way point” on Internet or other Communications routing.

So in theory a “clued up eye watching” could have spotted it as an abnormality and red-flaged it.

But as I have a habit of noting when it comes to “end point security” you want it off of the “communications end point” device due to various “end-run attacks”, that you can neither monitor nor mitigate when they use the same consumer or commercial grade Smart devices.

I guess the daft thing is that we knew this for centuries before and through WWII and to the last decade of the last century.

In this century all we appear to be doing with regards Privacy and Security both of which are key foundation stones of society is “slip backwards” in ways that would have shocked not just my Great Grand Parents, but my Grand Parents, Parents and myself (so around a century and a half). Even my offspring and friends who appear on the surface to be blasé to it, when you chat with them actually appear shocked and certainly more “politically aware” than I was at their age, with the “Hell in a handbag” statments of the 1980’s with regards “Maggie “bag/milk snatcher” Thatcher style comments being re-made about “the blond blow job slug” and compatriots…

Jon June 7, 2022 8:25 PM

@ Trying to look perfectly normal and completely failing:

I ran across (well, overtook) a convoy of trucks that were hauling nuclear materials. How did I know? Well…

They were 18-wheelers, and the tractors were blue. Just that. Blue. No stripes, no “Barry’s Trucking”, no additional lights, no Bible verses – just plain blue. No weigh-station stickers, no hazmat signs (although they probably should have!). Just blue. So aggressively non-decorated that just the tractors stood out.

The trailers were silver. Just that. Unpainted aluminum “silver”. No logo, no mudflap girls, just silver. But, just to be weird, they also were only about 2/3rds of the typical height of a trailer, almost square in cross-section. Aggressively normal: But distinctly strange.

I found they were hauling nuclear stuff on a news article where the government department responsible were complaining about budgetary problems – illustrated by one of those aggressively “plain” trucks.

Also mixed into the convoy (there were a dozen or more of these ‘plain’ trucks) were these little white motorhomes. And they were white. Just white. No stripes, no wolves in the windows, no rent-a-rv website – just plain white.

And just to be weird, someone had welded an unpainted bit of steel angle iron to the rear bumpers with a spare tire hanging off it, looking wildly out of place – and they all had one, in the same place. Trying to look perfectly normal, trying far too hard already; and then screwing it up with something just strange.

It was indeed a convoy. The only obvious military were two Humvees, one on each end, all doing precisely the speed limit (which, since we were on the I-5 running up California’s Central Valley, meant everyone and their uncle were overtaking them). I didn’t try to merge. J.

ResearcherZero June 7, 2022 11:02 PM

@Winter @- •

I don’t know, we might just being a little too skeptical. I spent a little time with Rupert a long time ago, and I wouldn’t call him completely and utterly ruthless all the time. Just like the government, there a brief moments of genuine honesty and unselfishness.

There is no way government would intentionally lie to it’s employees and their families for decades and leave them in harms way.
I remember back in the late 80’s when we were told by the government, “don’t tell anyone about this, it might cause public panic.”

The following is complete click-bait, and none of it is true, …probably.

“There’s no evidence that any country has developed or deployed such a weapon, which would require a 2,200-watt generator”

The US military is now looking for a sensor that can warn soldiers if they are being struck by microwave weapons. A wearable sensor would alert troops to the fact that they are being attacked, allowing them to take cover or disable the weapon before being hurt.

The microwave weapons are designed to disrupt or destroy the electronics inside various enemy assets, including drones, small boats, and missiles. While lasers are considered point weapons, HPMs can cover a wide area and destroy targets.

The US government initially rejected allegations of headaches, nausea, and ringing in the ears among its diplomatic and intelligence officers. However, microwaves, whose effects on the human brain were identified in the 1960s, were eventually suspected of being the source of the problem. Radio-frequency (RF) weaponry can cause not only headaches and vertigo, but also harm the neurological system of a person.

How would they work, if in fact they even exist at all. “Chirp, chirp chirp”

Officials in the British Air Ministry were worried about falling behind Nazi Germany in the technological arms race.
The death ray idea intrigued them: they had been offering a £1,000 prize for anyone who could zap a sheep at a hundred paces. So far, nobody had claimed it.
But should they fund more active research? Was a death ray even possible?

But by 1940, it was the British who had made a spectacular breakthrough: the resonant cavity magnetron, a radar transmitter far more powerful than its predecessors.
The magnetron stunned the Americans. Their research was years off the pace.

The emergence over the last few years of the active electronically scanned array (AESA) radar, and its ability to provide high average power for appreciable times, makes such electronically destructive devices all the more attractive and effective.

The weapons-effect utility of the AESA will provide a useful adjunct to other “nonkinetic”–not relying on explosives or impact–weapons research being done in the U.S. and in Europe. AESA radars produce a sustained pulse for microseconds over a limited frequency range to create an effect while HPM produces a one-pico-sec. pulse of much greater power over gigahertz of frequencies, says a long-time Pentagon radar specialist.

both AESA radars and HPM can produce a variety of pulse lengths and bandwidths. They contend the only difference between AESA radars and HPM systems are the waveforms and RF power levels. Both systems use the same electronics technologies and those electronics are optimized for the performance needed to achieve the desired radar or HPM effect. That goal is often to confuse or damage enemy electronics.

he radar’s weapons effect is measured in watts/sq. cm. AESA arrays are more efficient and reliable since their RF and low-noise amplifiers are near the radiators so that very little energy is lost. The beam is produced by ganging the effects of thousands of lower-wattage T/R modules.

There are lots of similarities between ground-based HPM systems and AESA radars including the T/R modules. In fact, ground-based HPM is becoming affordable because the proliferations of AESA radars has driven the price of modules down.

Russians have privately admitted this, justifying it because they were simply jamming listening devices on the U.S. embassy’s roof, as The New York Times reported some 45 years ago. As correspondent Bernard Gwertzman wrote on February 26, 1976, after 15 years of denials, “The Russians have privately admitted to using microwaves, to counter the array of listening devices on the [U.S. embassy’s] roof, they have claimed. Some people think they use microwaves to activate their own surveillance devices hidden in the embassy.”

Russian action had “irritated Administration officials and produced diplomatic protests” because of “possible damage to the health of American personnel from long periods of exposure”

documents which show that a variety of experiments were being carried out involving the potential uses of radiation as a means of poison and sabotage.

Work carried out jointly by the Russian Academy of Sciences and the defence ministry was likely to herald a “serious breakthrough in the field of laser issues [and] electromagnetic weapons”

of course microwave weapons don’t exist and this is not a video of one.

I could tell you how to build one of these fictional devices, or how they were smuggled into the country inside suitcases, via embassies, but that would be completely irresponsible.

ResearcherZero June 7, 2022 11:43 PM

This “never” happened…

“the organisation was infiltrated and says it is possible that many of Asio’s operational efforts during the 1970s and 1980s were compromised through revelations to the Soviets”

…And this is “not” the guy nicknamed ‘Mr Microwave’ who invented the story about ‘crickets’. Any allegations he was secretly communicating with the Russian embassy are also completely unsubstantiated.

This “definitively never” happened…

“ASIO, has recently investigated at least one major effort to back pro-Russian figures for an unspecified Australian political contest”

I can’t remember anything about who was in that spy network, or Mr Microwave’s involvement in transporting a device across the country which was later used against members CIA. Or any strange activity from people working in government departments for that matter.

There was definitively never any leaks to Russian, or Chinese agents, by individuals laundering money, or perhaps putting it straight into their bank accounts in a foolhardy manner.

There is no way that senior ASIO officials would withhold information like that from CIA officials, is there?

I wasn’t there, I did not see anything, and I don’t know anything about it.

ResearcherZero June 8, 2022 12:04 AM


None of us understand the high stresses of working in a high security office.

Allegedly the accused almost shot a man in the eye with a NERF gun!
In return a man allegedly responded, “I’m going to kill you!”

Presumably this was followed by some kind of limp wrist slappy fight.
Afterwards they even had to break out the medical kit to get a band-aid, and likely a box of tissues!

Then they took his software, allegedly, that he built alone from already publicly available and existing software made by someone else. It’s almost like when you are an employee, and then the boss and shareholders make more money. Heaven forbid. Imagine, profiteering from government contracts!

“President Biden and the Senate should work together to install a permanent inspector general at the Department of State and the Department of Defense.”

kind of like…

“The Chief of the Cia’s Counterintelligence Center Counterespionage Group will be permanently staffed by a senior executive from the FBI.”

Jon June 8, 2022 3:21 AM

There is no way government would intentionally lie to it’s employees and their families for decades and leave them in harms way.

Oh yes they would. The very first US Government claim of “National Security” in a civil case was lying to the families of the dead. Whether they lied to the dead as well will never be known.

It was a fresh-up Cold War spy mission, using an ex-WWII B-29 Superfortress. Those who knew the plane and the mission said, “It can’t do that”. None of the performance of that aircraft was a secret. A high panjandrum at the CIA said “Do it anyway.” They said “No.” The CIA said “Do it.”

The CIA got its way. The aircrew were right, the airplane couldn’t – and didn’t. Civilian employees of the CIA died. Their families sued. The government asserted “national security”, claiming that revealing anything would compromise national security, and so nobody was allowed to testify, thus no case.

It was a very straightforward cover-up of a CIA screw-up. With deliberate negligence on top.

Wasn’t de-classified until half a century later – and those documents now show beyond a reasonable doubt some doofus at the CIA thought he could simply order the plane to fly farther and get away with it.

Nobody was ever charged. No payments were ever made to the families of the dead.

The government did indeed intentionally lie to their families, and left them impoverished in harm’s way.

ResearcherZero June 8, 2022 4:03 AM


I did not add the [sarcasm] flag. Sorry about that. I have a horrible habit of being sarcastic, partly from being told a whole lot of reassuring bulls**t from police, while giving evidence in such cases, and then reading through all the evidence afterwards. My previous post will make more sense if you read it as an unhealthy dose of sarcastic diatribe or denunciation.

What the CIA and other agencies have known all along about these various cases is a lot more than they are letting on. I may have been there, and possibly saw something or another, and could of had some kind of access.
But it’s hard to remember, it was a long time ago.

spycraft often involves moving between legal and criminal worlds…

“the excitement and the ability to wield absolute power over other human beings”

When a person with a criminal personality becomes a law enforcement officer, problems invariably result.
If they are caught for a crime or infraction of department policy, these individuals know the system and are able to maneuver their way out of a jam.

Drew Peterson is a case in point. According to press reports, he was fired from the Bollingbrook (Illinois) police department after being found guilty of failing to report a bribe and official misconduct. The charges were later dropped, and he won reinstatement. He was subsequently accused of using excessive force. Recently, he was in the news because he was charged in the 2004 death of his third wife after his fourth wife disappeared in 2007. It took years to bring him to justice.

The point is that some criminals are attracted to what they perceive as “high voltage” occupations. Serving as police officers provides a cover to do as they choose, misusing their positions of authority.

“The cat-and-mouse game of counterespionage is about understanding who that officer is in touch with.”

“foreign spies are targeting those with access to sensitive information”

At least 10,000 UK nationals have been approached by fake profiles linked to hostile states, on the professional social network LinkedIn, over the past five years, according to MI5. The 10,000-plus figure includes staff in virtually every government departments as well as key industries,

One concern is the victims’ colleagues, in turn, become more willing to accept follow-up requests – because it looks as if they share a mutual acquaintance.

“No-one is immune to being socially manipulated into wrongdoing through these approaches,”

Former CIA officer Kevin Mallory was sentenced to 20 years in prison, after being convicted of giving secrets to China following an approach on LinkedIn.
And the UK’s move is also being backed by the other members of the Five Eyes intelligence alliance, Australia, Canada and New Zealand.

“in a world of open hostilities and drastic sanctions, the inhibition threshold for espionage, sabotage and illegitimate influence will continue to fall.”

“the largest portion of GRU members in the world is in Mexico right now.”

MarkH June 8, 2022 8:50 AM


I once read that the tractor-trailer trucks transporting Special Nuclear Material (that was the nomenclature) had rectangular loop-style antennas a few centimeters above (and pretty nearly matching the planform of) the cab roofs, with federal government license plates (on trailers and tractors both, I suppose) with digits and the letter ‘E’ (for Department of Energy).

That was long ago. Whether they’re still like that, I don’t know.

For at least some payloads, armed escort can be expected.

Jon June 8, 2022 6:34 PM

@ MarkH

They did indeed have federal plates. But few would notice, and fewer care. I’m weird about license plates because for some years I was a professional ‘license plate reader’ (before the automatic ones got good). Even more weirdly, at one point during that job (wasn’t just plates, although that was a big part of it) I drove around in a vehicle with federal license plates.

If they had antennas (can’t imagine they don’t – imagine the fun of a flat tire, or engine failure) they did not pop out as strange. The armed guards were, no doubt, in the little white motorhomes.


Andy June 9, 2022 8:47 AM

Skimmed through it. But a couple of things are puzzling :
34 TB – how do download or exfiltrate – in the jargon, 34 TB at work without anyone noticing, given the time involved (hdds?) even if some ssd array and how did he leave a high security building with it all undetected what was it stored on?
And Tails use – uploading 34TB of data over Tor? Quote : expected speed is between 25 KiB/s (200kbps) and 1 MiB/s (8mbps) according to Tor Metrics.

Clive Robinson June 9, 2022 11:51 AM

@ Andy,

Re : But a couple of things are puzzling

It’s clear you will never make it as a US Gov prosecutor…

Because you are,

“Alowing facts to get in the way of the all important narative”

How can,

“Justice be seen to be done”

When you “nit-pick” and “thread-pull” at the grandiose oratoral splendor of the theater of the court?

You are obviously some “Commie 5th Columnist, hiding under decent folks beds” 😉

SpaceLifeForm June 12, 2022 3:50 PM

@ JonKnowsNothing, Clive, lurker

I am not convinced that the Devlan was really air-gapped.

As expected, @emptywheel writes

Among the things Schulte worked on at CIA was a tool to jump an air gap and compressing and exfiltrating data.

Clive Robinson June 12, 2022 8:07 PM

@ SpaceLifeForm, JonKnowsNothing, lurker, ALL,

With regards “Empty Wheel”(EW) and,

“Among the things Schulte worked on at CIA was a tool to jump an air gap and compressing and exfiltrating data.”

The funny thing is that “jumping an air gap” was something I did years and years ago when looking into how I would go about “rigging an election” by using “fire and forget” malware to infect the voting machines “Maintainence Technicians” laptop. I described it in outline on this blog some considerable time before stuxnet or friends were ever logged or seen by AV analysts eyes. As far as I can tell from the time lines available, that was before Schulte worked on anything at the CIA.

Likewise I also worked out how to do “headless botnet control” and gave an outline on this blog. But… because of the complaints some “ostriches” made, I did not say how even in outline I’d also solved the exfiltration problem, just that I had.

So as time has progressed significantky kets just say “headless botnet control” has a great deal in common with the “exfiltration problem”, in that the same underlying principle works for both (which should be a sufficient hint for smarter people to “join the dots”).

As for the EW quote, people need to realise there is something not correct in it, and it gets people killed. Sadly I see people making this mistake over and over.

What they call “Compressing data” is actually not what you are doing if you actually know what you are doing with “exfiltrating data”.

The goal of “compression” is to just minimise the data size to be sent. This is generally done by removing redundancy at one or two of very many levels, it does not of necessity remove identifing statistics.

Some used to call a similar pre-encryption process “flatening the statistics” where the goal was removing statistics so increasing the unicity distance, thus making cryptanalysis quite a lot harder. It was just a coincidental bonus it reduced traffic length.

But the reality is that statistics is the killer, in that with compression you end up with “random” looking data that “stands out” from other data like “A lit candle in the dark”.

So the actual aim is not to “flaten the statistics” but shape or “tailor the statistics” to match the other traffic.

How far back the “tailor the statistics” idea goes back I don’t know, historical research hits the problem of a lack of available records. I do though have sufficient hints to say it was known prior to WWII by various individuals and organisations in the UK.

That is whilst there were machine ciphers, the bulk of “agent traffic” was encrypted by “hand ciphers” like double transposition based on memorised poems as the shared “root of trust” secret, known as “Poem Codes”(PC) or the “One Time Pad”(OTP).

The problem was PCs, although the agent carried no physical evidence, they were hoplessly insecure, as they had recognisable statistics in the ciphertext. Whilst OTPs were secure as they had no statistics in the ciphertext, they required the physical pads which were daming evidence if found.

Importantly any competent cryptanalysist could spot the difference in ciphertext statistics immediately. So on a tactical basis they simply did not bother with the OTP ciphertext and concentrated instead on the PC ciphertext. Which was undesirable, as getting a cryptanalysist to waste time on OTP took effort away from breaking the vulnerable CP traffic. Also as at the time OTP traffic signified a more important target the “radio service” would prioritize it for “Find, Fix, Finish”(FFF)…

Thus the trick was to make the OTP ciphertext look like it was CP ciphertext by altering it’s statistics. There are several ways to do this, but in deference to any “ostriches” that might be reading and might start flapping I won’t go into details.

However if others doubt the differing statistics in ciphertext can have FFF issues, they might remember Mat Balze mentioning the “missing nines” in some traffic from a Russian Numbers Station in Cuba that alowed correlation to the behaviours of certain people thus enabeling them to be identified as spys.

So getting back to “exfiltrating data” whilst “compression” is useful, “tailoring” statistics so it hides in the other traffic is way more important to avoiding the exfiltration being detected.

Hopefully this will come out more in the Schulte case if the powers that be unwisely proceed…

As I said “tailoring statistics” is something they might not want widely known… If people wonder “Why?” they need to look back in history around four decades ago. Back in the 1980’s and when Gordon Welchman published his book about the goings on at Bletchly Park. What caused the agency folk to get their panties in a wad, was not as many thought at the time that he was detailing the Enigma bomb and how it effected other nations still using similar cipher equipment, but actually that the knowledge of the way more powerfull “traffic analysis” would become known. Technically “tailoring the statistics” is an “anti-traffic analysis” technology as it has when you consider it carefully, quite wide implications, especially with “secure nets” that have “store and forward nodes”.

SpaceLifeForm June 13, 2022 5:13 PM

@ Clive

Technically “tailoring the statistics” is an “anti-traffic analysis” technology as it has when you consider it carefully, quite wide implications, especially with “secure nets” that have “store and forward nodes”.


This is totally implementable.

It is probably happening today, one bit at a time.

Clive Robinson June 13, 2022 7:55 PM

@ SpaceLifeForm,

Re : This is totally implementable.

Fun little side story…

Few programers have ever thought about the implications of the speed of light and “Time-Cones”.

I had the misfortune to recently hear “a software expert” drone on about “fully specified inputs” as a requirment.

They were not happy when I pointed out that there are some things for which you can not fully specify inputs. As I pointed out in the airospace industry you actually have to deal with the effects of Einstein’s Special Relativity, as do mobile phone system operators.

The blank look I got from them “spoke volumes” about their actual expertise.

I suspect somebody else in the audiance picked up on it or already had their own suspicions. Because they asked a question that showed the expert might understand sequential events but did not understand parallel events with independent clocks and how that stopped certain anti-deadlock protocols working.

In fact it sometimes floors me when software developers have no grasp on the real issues to do with the three basic times of,

1, Process time.
2, System time.
3, Wall time.

There was a horible bug in Python 3 libraries on MS OS platforms that did not show up on the two main *nix OS’s. It came to my attention because of my son “doing homework”.

I won’t go into details but I dug through the code and provided him with a work-around for the bug.

The problem I had was I did not actually find a “Specification” for the library code, so technically it was not a “bug” but a “surprise”[1]. One of my pet peves is under specified specifications.

The usuall argument is it’s a “Draft specification as a work in progress” the implication being that the programers will decide as they write code… Although very common this is a terrible idea, because it results in early design choices irrevocably setting the future course, and the notion RAD or similar will sort things out is equally as terrible.

A friend who is an experienced builder pointed out that in any wall each brick is a foundation stone for the bricks above, and should be treated as such and should therefore be laid with due consideration to that within the structure of the architects plans.

In short, before you start writing code the specification has to detail all the features and how they are positioned with respect to each other so you can slot in the appropriate layers of code. If specified correctly, then any changes will be only “local” not “structural” and mostly “cosmetic”.

[1] What differentiates a bug and a surprise when software does not behave as expected? Well it goes back last century to a comment attributed to Brian Kernighan of,

“A program that has not been ‘specified’ can not be incorrect, only ‘surprising’.”

The thing is specifications in the hands of the inexperienced follow not the “waterfall” method but the “spiral” method I prefere to call the “tailspin of doom”.

To see why Wikipedia puts it fairly succinctly,

“In aircraft that are capable of recovering from a spin, the spin has four phases. Some aircraft are difficult or impossible to recover from a spin, especially a flat spin. At low altitude, spin recovery may also be impossible before impacting terrain, making low and slow aircraft especially vulnerable to spin-related accidents.”

Like aircraft there are specifications where getting into a tailspin is at best difficult, others where it is possible but you can recover, then there are those from which recovery is not going to happen in any realistic senario. They go in the order of from “least surprising” to “most surprising” and the smell of burnt tail feathers.

SpaceLifeForm June 14, 2022 5:30 PM

@ JonKnowsNothing, Clive, lurker


I am not convinced that the Devlan was really air-gapped.

It may be that Judge Furman may be thinking the same.

Schulte: I’ll be here til 4 on my Friday SCIF day.

Judge: We’ll take up the rest in our classified setting. Adjourned.

It smells as though there is a ‘smoking gun’ in the SCIF.

It will not surprise me that this case gets dropped.

SpaceLifeForm June 15, 2022 4:56 PM

@ JonKnowsNothing, Clive, lurker

I am not convinced that the Devlan was really air-gapped.

Narrator: It was not air-gapped.


Schulte: So in DEVLAN there were shared passwords, right?

Evanchec: Yes.

Schulte: And no virus protection. CIA employees called it a dirty network, right?

Evanchec: Yes sir that’s correct.

Schulte: And there were international connections – so it was NOT a “local access network,” right?

Evanchec: Yes, two overseas offices could connect.

Schulte: Are you aware of Stash being stolen from the CIA?

Evanchec: It was source code that was also in the Wiki in Confluence.

Schulte: Are you saying that Stash is also stored on Confluence?

Evanchec: No.

Schulte: (laughs).

SpaceLifeForm June 17, 2022 7:42 PM

@ JonKnowsNothing, Clive, lurker

re: DEVLAN was not air-gapped

Some notes: if you are following this case, note that reports may have incorrect spelling. For example, if you see ‘link’ it probably refers to ‘LYNC’, and when you see ‘stash’, it probably refers to ‘STACH’. Judge Furman knows where Schulte is going with this. Judge Furman wants Schulte to make sure he asks clear questions and not testify. Also, not mention agent names or locations. I have not seen Confluence mis-spelled yet. Judge Furman knows that Schulte has to convince the ten jurors, not him.

A key important point in this case, is that because Schulte is representing himself pro se, he is in position to ask questions that outside counsel would not be able to ask in court, because they would not be given security clearance.

Let’s proceed.


Schulte: I want to ask you about DEVLAN. Have you heard it described as the Wild, Wild West?

CIA’s Leonis: No. Never heard that.

Schulte: Did you know that a developer put the Stash backup on a public page?

Leonis: No.

AUSA: Did you investigate Wikileaks publications?

Patrick Leedom: Yes. Of Vault 7 and Vault 8.

AUSA: Where did the leak come from in Confluence?

Patrick: From back-up files. The March 3 back-up.



Clive Robinson June 17, 2022 11:39 PM

@ SpaceLifeForm, JonKnowsNothing, lurker

re: DEVLAN was not air-gapped

As I noted a few days back,

It’s not the “system” that needed to be “gapped” but the information.

That is when the system was “backed up” where did the backup “tapes” go and thus who could have access.

The fact the files have a cutoff date of XX/YY/ZZZZ does not mean that was the date they were accessed. It just is the date of the “backup-tape” snapshot from days, weeks or months previously.

So if someone is trying to frame the defendent, they just have to find a backup from the time he was there, even though it might be weeks later when they pull it.

The only thing we know for certain is that the data was accessed at some point in time past the newest provably valid time stamp.

But just how provable are those timestamps? Probably not as much as we would like to think, in fact I suspect they are not going to be independently verifiable for this court case…

In which case, do they realy count as evidence?

Probably not.

SpaceLifeForm June 17, 2022 11:57 PM

@ JonKnowsNothing, Clive, lurker

re: DEVLAN was not air-gapped

Dot. You may be able to spot a couple of ‘not air-gapped’ channels if you look closely.


This is old, but I doubt it is out of date.

SpaceLifeForm June 18, 2022 3:42 AM

@ Clive, JonKnowsNothing, lurker

re: DEVLAN was not air-gapped

The only thing we know for certain is that the data was accessed at some point in time past the newest provably valid time stamp.

Objection! Assumes facts not in evidence!

See Timestomping. Schulte has already hinted at this.

Your statement appears to be totally logically correct. But seems quantum.

It appears, to this Observer, that you need to define ‘know’, ‘data’, ‘point in time’, ‘accessed’, ‘newest’, ‘provably valid’, and ‘timestamp’. Make sure your definitions will hold up in court, and not confuse the jury. Thank you.

If there are metadata timestamps inside the data, then that assertion could be proven false.

In other words, there may be evidence inside the data files that contradict the assumptions of when the backup was exfiltrated, because the data itself contains metadata timestamps that are later than the alleged exfiltration date.

I am not convinced that it really was a set of backup files. My hunch is that it was slowly exfiltrated over time, over the not air-gapped network.

Of course, I was not convinced that it was really air-gapped in the first place, but what do I know? Should I not believe the witnesses from FBI and CIA that have confirmed that I was correct?

Or should I think they are lying and deny my decades of experience?

Clive Robinson June 18, 2022 6:57 AM

@ SpaceLifeForm, ALL,

Re : Timestomping

I carefully worded it the way I did for a reason.

Look up MS NTFS “quarks” and “tunneling” (MS’s Raymond Chen wrote about it oh I guess a couple of decades ago).

The only “facts” that could be in evidence so in the defendents hands would be a backup tape with sequentialy written data blocks. But sequentially written in which order?

There are two basic orders “image order” they are written on the disk blocks in, and “contiguous file order” they would be read off the disk by the OS. Of which “image order” is the one on which you could perform a very limited form of what was once called “filesystem tectonics”[1] (Note the OS-contiguous order, would not realy comply with evidence disclosure rules).

Filesystem tectonics is important because of the likes of time ordered file updates within a file being reordered and not aligning with that of the filesystem, thus showing meta-meta-data revealing falsification of or tampering with evidence.

That is imagine a database file with records being updated with timestamps included internally in the records inside the file. The order of blocks used on the hard drive should reflect these internal file stamps. If not something is decidedly suspect or needs further explination with “proof”…

Microsoft NTFS is a “horror system” of semi-hidden time stamps in part due to “snap shots” and “Long to short filename conversion” (tunneling) but other “nasties in the log pile”. One Database file system all modern MS OS’s have is “the registry” and it can be a veritable gold mine of finding out if someone is playing hooky with file system time stamps.

So the question of “belief” may come down to the fact that the defence can show that the evidence presented by the prosecution into court is some how not as it should be, and without plausable cause other than deliberate falsification.

Hence my reason for saying,

The only thing we know for certain is that the data was accessed at some point in time past the newest provably valid time stamp.

I’m thinking that those “time stamps” presented by the prosecution will not be provable, or atleast can be shown to be sufficiently inconsistant to claim “fruit of the poisoned vine” reasoning. Or spin it up as the one or more “corrections” that got overlooked when a certain other person was trying to create a fake to frame the defendent out of “spite” or similar that we know the US IC has done before on previous employees.

Not sure how far the judge will be alowed to let this one run… So we might get a “two popcorn bowl” level of entertainment, but I suspect not four.

Because the simple fact is I can not see the IC agencies concerned alowing the defence, sufficient access to their systems to establish if the prosecution is being truthful or not. The fact that the agency concerned has provably failed to keep reasonable control on the employees behaviours, or addressss grievances correctly means that they can be painted as at best incompetent if not malicious already. Which means the defence can turn the knob and pull and “reasonable doubt” walks through the door with a big smile on it’s face, trotting out that old line of “If you’ve done nothing wrong then you’ve nothing to hide” at the prosecution. Thrn every twist and turn the prosecution makes will just make them look more guilty, not the defendent who just has to keep saying “what are you realy trying to hide?”.

Then of course there is the question of IC personnel not just lawfully alowed to lie in judicial proceadings but required to do so.

I suspect one of the defence witnesses has already done so…

[1] The idea behind “file system tectonics” is simple and can spot one form of timestoping. Put simply the “freelist” in disk file systems dictates where a new file block gets written. To aid recovery of accidently deleted files, and to give better “leveling” on SSDs and the like, any freshly deleted file goes on the tail not the head of the freelist que. So oldest gets reused first, if in the unlikely event these days of modern PC’s –with terabyte hard drives– you ever get close to the point of using the freelist in it’s entirety. Obviously for other reasons like minimising “head movment” file blocks do get reused but again in a way that can be accounted for. Some events sich as a “defrag” or “restore from backup” will change the tectonics of the file system as those files will be rewritten to disk contiguously rather than as fragments.

Clive Robinson June 18, 2022 7:10 AM

@ SpaceLifeForm, ALL,

You might have trouble finding information on MS and the “quarks and tunneling” as it’s not in their current knowledge base…

You will thus have to know the original MS KBID and look it up in “betaarchive” to save you the effort,

Note that it was last modified in 2007 a decade and a half ago, but… Some of the MS-OS’s (XP) listed marched on long after that and still do in many many “Government funded” institutions / agencies around the world today…

Clive Robinson June 18, 2022 8:12 AM

@ ALL,

For those that want to know a bit more about “timestomping”,

Importantly note,

1, It does not deal with .LNK links
2, It does not deal with application file access databases.
3, It does not deal with below the kernel level artifacts.

Sometimes you do have to take the drives and “bit-image” them and work through the images on a block by block or lower basis. This is both tedious and time consuming and needs to be done under a well practiced eye.

Few forensic investigators and even less forensic tools can do this, so an investigation gets an exponential cost increase…

So all to often the following happens,

1, The testing will not be done.
2, Prosecution will deny it is a necessary part of their duties.
3, People who know this will get away with their crimes without bothering to propperly cover their tracks.

As this becomes more widely known expect a new turf war beyween prosecution and defence legal teams to rack-up the fees and billable hours…

For the back ground Brian Cariers book from two decades ago can be a usefull place to start.

SpaceLifeForm June 19, 2022 6:27 PM

@ Clive, JonKnowsNothing, lurker

re: Timestomping, Air-gapping

“Lordy, I hope there are tapes.”

Sorry, but I doubt they exist in this instant case. All by design. The story of backup tapes is pure bs.

If one could even plausibly believe that they really air-gapped DEVLAN (which they did not), why would you think that they did tape backups?

One would have to be smoking really strong stuff to make that argument.

How does one exfiltrate a tape backup that should be ‘offline’?

Is not tape backup offline?

I have been around a bit. I know what happens. This is smoke and mirrors.

Leave a comment


Allowed HTML <a href="URL"> • <em> <cite> <i> • <strong> <b> • <sub> <sup> • <ul> <ol> <li> • <blockquote> <pre> Markdown Extra syntax via

Sidebar photo of Bruce Schneier by Joe MacInnis.