Schneier on Security

Clive Robinson • April 9, 2025 10:38 AM

@ ALL

No method currently available to ordinary individuals is secure not even close.

This is due to the simple fact that what is available technology wise is “consumer/commercial” and none of it has been designed to be even remotely secure.

Secondly because all the technology is like a “fish trap” designed to funnel every electronic communication into a single net.

There are two solutions to this,

1, Don’t put your toe in the water.
2, Ensure the stream you swim in is not the one that ends in the net.

As those who want to communicate with journalists are putting their toe in the water then that leaves only the second option to them.

There are two types of communication “half duplex” and “full duplex” the first is unidirectional and more secure than the bidirectional second.

Journalist almost always betray their sources because they want to ask questions first of which is almost always “verify who you are”…

This means that journalists will almost always want “full duplex” bidirectional communications and will do just about everything they can to force a source into it and in effect betraying themselves.

I’m not saying “don’t communicate with journalists” I’m saying that the process is always risky and relinquishing control of it is very very unlikely to reduce your risk, in fact the very opposite.

So if you are going to maintain control you have to be responsible for not just yourself, but all others directly or indirectly involved, including the journalist and all at their organisation, and those you work(ed) with and your friends and family.

It’s safe to assume that all communications you do not 100% control will get you caught. So all modern consumer or commercial electronic communications are unwise to use, unless you really understand the technology to the lowest levels.

Likewise all commercial post and package services will be risky to use because everything gets tracked these days one way or another. Primarily for “accounting and auditing” reasons which means they are “third party business records” that have no legal protection from inquisitive authorities.

Thus unless you are a technologist of wide scope you are better considering “Old School Field Craft”. But due to modern technology like wireless CCTV units that can fit in a cube the size of a games dice your golden rule has to be “never the same place or way twice.”

Unless of course you know how to lay a false scent that leads the blood hounds away. However that usually means giving them a sacrificial goat or more to rip the belly out of…

You might think that you can “start safe” unfortunately you can not and this is often the most dangerous step. History shows that during the cold war anyone working in a diplomatic mission was watched around the clock 24×365. But also anyone who approached or entered a diplomatic building or even NGO with foreign funding was photographed and where possible identified and checked.

It’s safe to assume with the paranoia about journalists that some are clearly displaying, and the unlimited resources they effectively command, that journalists today have the same level of surveillance or worse on them that cold war diplomats had.

Why worse?..

Well because technology is at least 20 generations advanced on the cold war thus the human resources needed are almost vanishing in comparison. Also they give a “time machine effect”. Think about CCTV tapes from cameras in a shopping center car park or cafe etc etc. As long as the exist, an investigator can “flip back in time” through the glass eye of the camera recording. They don’t need a human every place they only need one to go through the hundreds or thousands of tapes “facial identification software” pulls up as “possibles”.

None of this is SciFi it’s all very mundane today.

Oh and don’t forget all those “lets make history” devices you have on you like your Smart Devices such as fitness and medical devices, mobile phones, and just about anything with electronics in it these days even toys those in your family have even your pacemaker or other implanted medical electronics.

Bluetooth Low Energy is ubiquitous in “System On a Chip”(SoC) microcontrollers these days. Such microcontrollers are in so many products that avoiding them is at best difficult, at worst impossible. Those “air tags and tiles” luggage tags that people got briefly paranoid about are many times bigger than they need to be for just the electronics because batteries have a lousy power density. If you can find an alternative power source then think a fat grain of rice…

It’s what RFIDs became before we forgot about them. We know some RFIDs can be scanned from outside a shipping container they are in, or from the “bumper badge” to toll gate gantry 20ft up as you drive under it.

Making Smart-RFIDs to work with BLE Beaconing is a trivial manufacturing job these days (though expensive per unit below the 100,000 unit volume).

Old school field craft will if both parties have good OpSec enable you to have diminished risk. But history shows all to often journalists don’t do good OpSec. In part this is because the editors under guidance from the legal people want “full verification” at all costs otherwise they wont touch a story.

Clive Robinson • April 11, 2025 6:36 AM

@ ResearcherZero,

When you say,

“There will be one nation in particular where those frustrations will be focused. Given the political environment and the cuts to federal agencies, exploiting those divisions and attitudes will be far easier.”

You forget to mention just how fragile it is, due to it’s over reliance on technology.

I note from time to time,

“Technology is agnostic to use, so can be used equally in ways an observer can see as good or bad.”

We’ve recently seen the CALE Act 1994 interfaces being used by others to spy on not just Americans but many others. The fact the NSA et al lead the way on this behaviour type indicates there was more than opportunity involved.

The same is being seen with Signaling System Seven”(SS7) and will no doubt have it’s fifteen minutes in the NSM.

Both are exploits of poorly thought out technology at the standards level. The designers of which also failed to accept the reality of century old mathematical work that predicted such standards would be exploitable by all not just “a chosen few”.

But such failings are also in the very tangible world of physical objects. As I’ve indicated in the past 9/11 is a clear example of technology repurposing from passenger aircraft to guided missile.

But life is about trade, without it we would not be where we are. The problem is that trade used to be little more than barter assisted by metals considered of equivalent value to the labours involved with production and transportation. Yes it was subject to crime but it was discrete crime as isolated incidents. Now trade settlement is done not by tangible pieces of metal considered as valuable, but by intangible information impressed on sub atomic particles and corresponding movements of charge all interconnected and all vulnerable on mass.

Back when Obama sat in the oval office there was talk if a “big red button” to “kill the Internet”… But it was already too late, the Internet had become in the US the arteries through which trade happened… So kill the Internet, Kill American trade, Kill American existence as it’s citizens know and live it…

But it’s not just the Internet, it’s all consumer and most commercial communications that are fragile. So also are the water, gas, fuel, electricity infrastructure that are dependent on electronic comms. Worse they are so interlocked that when one goes down they all go down like dominoes. And once down they can not be brought back up because the others need to be already up and functioning. So specialist individuals have to go out and manually bring things up bit by bit at best. But due to “The American Dream” such people have been “out sourced for shareholder value” and scarcely exist now…

And I’ve no doubt some bright mutt of DOGiE pedigree already has plans to replace the last of specialist infrastructure workers with 100% power, water, and communications infrastructure dependent AI…

If people can not see where this is going to go, then perhaps they should send their C.V. to Hellon Rusk I gather he’s made email to him, his DOGiE Mutts, and their AI available, if not mandatory…

With regards “Move fast and break things”…

The result is the US has become a glass bauble moving at terminal velocity toward a hard ground state that will be more fractured than Humpty Dumpty.

Just don’t say you were not warned…