Slashdot Mirror
'Echelon Study' Released by European Parliament
ckolar writes, "Duncan Campbell's report on Echelon has been delivered to the European Parliament's committee for Justice and Home Affairs and is available online. " This is the study that was commisioned by the EU - very interesting reading.
As your constituent, I'm writing to ask for your support for a congressional inquiry into a threat to the privacy and civil liberties of all residents of the United States. I've read several credible reports that suggest that the global electronic communications surveillance system -- frequently known by the code name ECHELON -- presents an extreme threat to my privacy and that of other people around the world.
If you want to free hand your correspondence, get your senator or representatives name, address etc, from their wed site, and send the letter. Complaining on forums such as Slashdot, Attrition or HNN will not accomplish anything in bringing this stuff into the light. Whining on Slashdot only increases your Karma.
More race stuff in one place,
than any one place on the net.
Also, there are several related links on the Personal Security page of the Center for the Study of Technology and Society.
Finally, if you want the wire version of the story, click here.
Yours,
A. Keiper
The Center for the Study of Technoloy and Society
The linked site appears to be slashdotted. I believe this is a valid mirrorof the report:
ht tp://www.cyber-rights.org/interception/stoa/inter
And it seems that France in particular has a taste for the fantastic. Microsoft is the NSA's largest customer, and IBM was forced into using DOS by the government?
France allegedly has its own Echelon, and no doubt that the UK does also. So if they're doing it themselves, why are they so pissed at the US?
Whining and bitching about big brother will achieve nothing.
If that's ALL you do, then that's true. You're preaching to the converted. But if you write (yes, with paper and stamps, because it's so much more effective than email that our benighted representatives seldom even hear about) to your representatives and THEN get onto a public forum like Slashdot and tell others what you did and why, it might get others to follow in your footsteps.
But please be polite. These people have to slog through bureaucratic BS all day. You won't win any friends in high places by venting your spleen at them. Just explain logically why this is a Bad Thing.
And while you're at it, write to your local newspaper. There you'll be preaching to many who are not yet converted. Spread the word!
How so? Well, I've seen several posts suggesting writing to representitives. What good is that going to do? The NSA has refused to even say if the name even means anything to them, under Client - Lawyer privilage. Have you seen Congress push them into saying anything further? One try, and they seem satisfied they've done their part.
Ok, what about this jamming? As I've said on a number of occasions, NOBODY does interception by keywords. Even IDS systems use pattern-recognition and context-sensitive detectors. Why would one of the largest, most advanced, most brilliant collection of programmers and mathematicians use a simple 'tcpdump | grep'? It makes no sense.
Ok, so "conventional" jamming won't work, complaining gets nowhere, what CAN you do?
I'm not going to say people are powerless, because they're not. However, they DO need to be unorthodox. You can't break encryption, if you don't know the algorithm, or possible set of algorithms. Even then, your probability of a false positive goes up considerably, the greater the number of keys and/or algorithms.
There are a GREAT many encryption algorithms out there, some stronger than others but that's not really the point. If nobody can really tell which algorithm you're using, your effective keylength is equal to the key length of the -LONGEST- key possible, PLUS log2(number of algorithms).
eg: PGP/GPG uses RSA to encrypt a secret key, but uses a simple secret cypher to encrypt the message itself, using that secret key. If someone modified PGP/GPG to allow you to pick (or have it randomly select) one of, oh, 16 algorithms for the secret encryption, then your effective keylength is equal to 128 + 4 = 132. That's a lot tougher to crack (it'll take 16 times as long) and might well prove too difficult for a real-time system, such as Echelon.
Even so, I =can= tell you that Echelon is complex. My understanding is that it includes vast arrays of DSP chips embedded in the physical network, for pre-processing. The only hope is to make systems such as IPSec and PGP/GPG sufficiently advanced that one-size-fits-all solutions can't be used effectively.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
how effective do slashdotters think echelon really is? and do you think they feed any data to U.S. commercial concerns? I've been thinking a bit about this recently; some simple calculations demonstrate that the amount of material they have to look through is simply phenomenal. The rumors say that the system has links to telephone lines, faxes, email systems, satellite links, and who knows what else. So, some extremely quick and dirty estimates:
I live in Boston with three other people and their respective girlfriends; most of us have cell phones. Our house has two phone lines, DSL, and ten computers hooked up behind a firewall. My roommate has a Palm V with an omnisky. That's eight or nine voice streams and as many data streams. The data streams are going all the time, and are all multiplexed through our single DSL connection. Now, admittedly we're a little more wired than most. So we'll scale this down a bit. Assume the government only is interested in monitoring large cities and a few out of the way enclaves dotted around the map. Maybe the ten largest US cities and 150 known subversive groups. Including the greater metro area, each city has maybe 4 million people on average, implying about 1.6 million families per city, giving 16 million
families total. We can guess that (plus or minus a few kooks) nearly every family has at least one phone line and 2 out of 5 have at least one cell phone. Probably 60% have an internet connection.
This gives us 32 million data streams, to monitor in real time, and at odd hours. Now given the current state of speech-to-text software, and assuming the NSA is 15-20 years ahead of the state-of-the-art (a very dubious assumption, these days), we'll also figure that with their software they can decrypt 200 voice streams per second with a pentium III. That still implies that they need the equivalent computing power of 160,000 high-end workstations.
Ok, this is not outside the realm of possibility. But it's right on the edge! Add in the complexity of understanding and dealing with different accents and different languages, static, spread spectrum cell phones, demultiplexing LANs, tapping who knows how many
switches, debugging the monitoring software and releasing (secret!) updates into the field, dealing with code words and both simple and complex black box and white box encryption, and dealing with the noise of slashdotters putting in things like "kill the president" and "natalie portman is trafficking in hot grits disguised as cocaine to pay off communist subversives," and we see that if Echelon exists, it's probably close to useless. And a horrible waste of taxpayers'
money. Though I guess developing such a omprehensive system could be valuable for use in targeted situations, like focusing on transmissions in a limited geographic area during high-tension conflicts.
These estimates are very much back-of-the-envelope, but does anybody see anything fundamentally wrong with them?
--
neil
Set it up and create secure connections between your peers. Very soon it will support automatic keying using DNS-SEC (public keys kept in the DNS database).
Echelon makes little difference if everyone is using end-to-end transport level strong encryption.
Burris
Is someone actually reading our mail? With terrorists, hostile governments, nuclear weapons, chemical weapons and biological weapons, does the government really care about anything you say?
If they are thoroughly reading your mail (suppose), are you suggesting that men in black suits come and oppress you? Because if not...
You must be suggesting that this evidence will be used in a court case against you. However, since it was obtained illegally, and the way in which it was obtained is classified (there was a case like this a while back), there is no way it can be used against you in a court of law.
As for the industrial espionage allegations, I could see someone doing that, but would suggest that it isn't commonplace. The government keeps a Very tight rein on its contractors, in terms of what they are allowed and not allowed to do, and it seems unlikely that it would make a *habit* of breaking similar rules itself, with the complicity of one of its contractors.
Also, do you think that microsoft and the nsa could slip something like that under our noses? Under several hundred million of our noses?
Jack Valenti and the MPAA are to technology as the Boston strangler is to the woman home alone
I think this also points up the reason the government has fought PGP so fiercely. Even if they subvert the author, they can't do anything very obvious or easy, and you or I are quite likely to break anything they hide in the code, while rooting about in it.
Perhaps the most important question now is: what do the new crypto rules imply, in light of this? If we can really just give the no-goods at NSA a heads-up and export freely, does this mean that they're giving up? Or could it be that they can do an end run around the crypto if they have to (as in Tempest, bounce a laser off your window, intimidate your neighbor, et cetera)? Perhaps the best answer is: don't do anything bad, and encrypt everything, just in case.
See what I've been reading.
Come on, what's with this echelon stuff? Have none of you read The CodeBreakers or The Puzzle Palace? Don't you realize this has been going on since the telegraph?
The wrong thing to do is to focus on "Echelon" Look, *ANYONE* can listen in on you, not just the NSA. Use a cell-phone? Use a cordless phone? Your neighbors will soon be able to buy or create scanners to decode digital transmissions. Use the internet? A hacker hacking into an ISP or wherever your mail is located can easily read it. How about cable modems? Opps, anyone can sniff your packets.
If you don't want to install window blinds or curtains on your windows, don't cry when someone uses a telescope to watch you getting undressed.
The only solution to the privacy problem is to use encryption. If your broadcast data in the clear over any medium, you are relying on security through obscurity.
Has anyone noticed how EU centric these articles are? Who's Echelon? Anyone not in mainland Europe apparently. US, Canada, Australia, New Zealand, UK, etc. (the GMO controversy also follows the same sort of dividing line, with the mainland Europeans being the most vocally opposed)
Of course, France, that moral and highly cultured "you don't even know what culture is you Americans", would never engage in something as distasteful as industrial espionage? Would they?
It's patently obvious that the world's spy agencies have been intercepting all the traffic they could, even since World War II and before. Echelon is nothing new, except a "ooh scary" code word.
1) There seems to be an assumption that part of Echelon is the ability to compromise a 128-bit key in a negligible amount of time (i.e. instantly.) Now, I'm not super-duper-hardcore up to date on my Echelon readings, but I haven't seen any indication that anyone actually has the capability to brute force a 128 bit key in real-time. If I've just been living in a cave (not far from the truth) and simply failed to hear about this advance, someone please post a link/reference, or e-mail me (above address, minus the DELETME), or something-- I'd be really interested in such news.
2)PGP/GPG uses RSA to encrypt a secret key, but uses a simple secret cypher to encrypt the message itself, using that secret key.
Maybe I'm reading this wrong, but it sounds like you're saying that PGP/GPG use a proprietary algo for their symmetrical crypto. At least with PGP, this is not the case. PGP (I think) currently uses IDEA, and used to use DES. While the latter is somewhat shady, these are hardly secret, and aren't that simple, either.
3) In the above set-up (with the PGP/GPG system which randomly selects the private-key algo to be used on a message-by-message basis) how do you securely communicate this to the recipient? Is the selected algo package with the key inside the public-key encrypted portion of the transmission, or do they just guess? (Not that having them just guess is such a bad idea-- it's sorta like those first versions of Public Key systems, the ones that used numeric puzzles for the keys. If the recipient just has the key, it'll take a more-or-less negligible amount of time for her to decrypt the message under each algo and see which version isn't gibberish.) Still, I'm not seeing the need for this, as per #1 I mean, if they can brute-force a 128-bit key in more-or-less no time, is making this time 16X longer gonna put that much of a knot in their britches? If 128-bit keys aren't secure, then this sort of arrangement is just a Band-Aid.
Again, it's possible that I'm just totally mis-reading the above. Sorry if all of this is out-of-left-field.
Much Love,
"S"HM
*****
(I refuse to spellcheck out of contempt for your belief system)
I hate it when sites go down and disappear. Here is a mirror of one of the reports complete with pretty pictures.