IBM Seeks Patent On Digital Witch Hunts

theodp writes "Should Mark Zuckerberg want to identify a snitching Facebook employee, Elon Musk wish to set a trap for loose-lipped Tesla employees, or Steve Jobs want to 'play Asteroid,' they'll be happy to know that a new IBM 'invention' makes it easier than ever to be paranoid. In a newly-disclosed patent application for Embedding a Unique Serial Number into the Content of an Email for Tracking Information Dispersion (phew!), Big Blue describes how it's automated the creation of Canary Traps with patent-pending software that makes ever-so-slight changes to e-mail wording to allow you to spy on the unsuspecting recipients of your e-mail."

Comments

That's a neat trick!

[Tumbleweed]

I'm pretty sure witches are analog.

Re:That's a neat trick!

[SilverHatHacker]

Everyone knows witches are made of wood.

Re:That's a neat trick!

[Airborne-ng]

Everyone knows witches are made of wood.

"What also floats in water?" "Bread!" "Apples!" "Very small rocks!" "Cider!" "Great gravy!" "Cherries!" "Mud!" "Churches...churches!" "Lead...lead!"

Re:That's a neat trick!

[darkmeridian]

That's what the digital witches want you to believe.

What an advance!

[WindowlessView]

Anyone get the feeling that lately technology is increasingly about chasing our technological tails rather than actually doing much of anything?

Re:What an advance!

[Threni]

To be honest I assumed this sort of thing was already being done. It's just fingerprinting, using whatever medium is being used.

Re:What an advance!

[conlaw]

The next time you send an "infelicitously worded" email, you can just blame it on IBM.

Speaking of "infelicitously worded," did you notice that the all of the changed examples (i.e., the second through fourth) start to sound like an instruction manual that has been poorly translated into English?

Security through obscurity. Again.

[girlintraining]

Security through obscurity doesn't work. I don't know how many stupid asinine ideas like this I'll have to see before I quit this career, but I suspect the number will be higher than I care to contemplate. This is ridiculously easy to subvert -- just run it through the thesaurus algorithm a few more times. Viola, new unique copies, that don't match what they have on record.

Next on the docket -- "Why you can read your coworkers e-mail but not the NSA's. Explorations in the bleedingly obvious."

Re:Security through obscurity. Again.

[Dhalka226]

In your rush to bash people for not having an infallible solution, you're making two awfully big assumptions:

1. That they're intending this to have any effect whatsoever on people actively trying to disguise the source of the leak; and,
2. That a solution isn't worthwhile if it doesn't survive whatever geek-haxxor workarounds you can come up with.

This is exceptionally poor security for classified information. That's not its intent. It's poor security against people actively disguising themselves by "run[ning] it through the thesaurus algorithm a few more times." So be it.

It's still going to catch that guy who wants to show how in the know he is and forwards it to his buddies who post it on a website, and I'm sure there are far higher incidences of that than industrial espionage or whatever it is you're maligning them for not tackling.

I wouldn't personally implement a system like this, but the fact that it doesn't cover all potential circumstances doesn't mean it's worthless. I don't know why Slashdotters always have such a hard time grasping that.

Re:Security through obscurity. Again.

[nacturation]

Viola, new unique copies, that don't match what they have on record.

When I leak your post to the world, I'll be sure to change that to "Cello, new unique copies..."

Not new

[Anonymous Coward]

My girlfriend works in the bid and proposal department at Oshkosh Corps. They regularly deal with top secret government contracts for armored vehicles. Each persons copy of whatever paperwork has different sets of typos, so if there are any leaks, they know exactly who it came from.

And yes, they have caught corporate spies with this before.

Re:Not new

[kpainter]

Each persons copy of whatever paperwork has different sets of typos, so if there are any leaks, they know exactly who it came from.

For those that don't know, for each new 'typo', they add a few more zeros in the contract dollar amount. That is also why a government contract for armored vehicles would be Top Secret.

Re:Not new

[digitalchinky]

What if the 'corporate spy' is the mail server admin? Plucking crap out of the bcc_always queue or so on and so forth.

Having had a TS security clearance for a whole bunch of years myself, I frequently handled pass by hand (codeword) eyes only stuff. This entire 'unique copy to each person' thing only happens when someone is 'already' suspected of working for the other side, or in the movies.

Once you have a TS clearance you are trusted until there are signs present that indicate a review thereof might be necessary - at least this is how it worked in my part of the world anyway. The security branches responsible for investigating leaks were never quick to react - after all, it is a big old chess game, those leaks might also be put to good use before they hit the jail cell.

Re:Not new

[Ralph Spoilsport]

So? You just copy and paste it into Word and fix all the typos.

Then ,whoever has the "typo free" version gets blamed.

What a dumb way to do things.

No expectation of workplace privacy

[cryfreedomlove]

You should assume, while in the office, that there is a camera on you and that any content you produce on an employer provided computer will be available for inspection. That's just a simple reality these days. I keep personal information I don't want to share on my own personal computer at home.

finally

[Anonymous Coward]

I thought that this sort of thing was a fairly standard thing to do if you really cared about the document. (this sort of thing was describe in The Hunt for Red October, the concept isn't new, automating it _may_ be)

I hope this sort of thing becomes common.

it will let people track down who distributes things _without_ any need for DRM and that sort of nonsense. if you really can show that a document (mp3, video, etc) came from user X you should have a fairly straightforward case against them, and if you know that this sort of thing can be done you are not going to send out copies of things to everyone.

Two obvious comments

[Gnavpot]

1. How can this be patent worthy? Individual changes to documents to make them traceable have been performed for years - even in anonymous questionnaires...

2. Patented. Good. Perhaps that will prevent others from using this method. If we are really lucky, IBM won't use it either.

Re:Two obvious comments

[mouseblue]

I agree, it doesn't seem very patent worthy.
It's Digital Watermarking with a software thesaurus/dictionary.

The movie industry used digital watermarks for VHS trailer tapes. http://www.afterdawn.com/news/archive/4616.cfm

Trent Reznor used an alternate strategy for one of his short films (from 1992?):

"...a few people who received the movie as a special gift. Each version given away was missing a different section of video, thus enabling Reznor to keep track of those who betrayed him."

http://www.toplessrobot.com/2008/08/the_10_most_amazing_unreleased_things_ever_made.php

Re:Two obvious comments

[dr2chase]

Wow! Automation. Word processing. I had never imagined the computers were capable of such a thing.

Next you'll be telling me that they can automatically spot spelling errors, and wrap text at an 80-character margin.

Re:Wrong

[mouseblue]

Let me clarify: The ideal workaround is to get a very close translation (small error rate) and reverse the process so that the errors build up.

I took your quote on Babel Fish and ran it back to English to get this:

"All point of technology is to encode consecutive numbering by doing the little modification to wording of message. Reading those words to another medium still maintains the hand harsh number."

It's a terrible translation example but if you used a professional translator, you'd still have transformations from syntax and sentence structure from each language.

Their Hovercraft is full of Crap

[IonOtter]

This won't go anywhere.

Or if they do and try to implement this in their system, it will last until the first email is translated into a language OTHER than US English.

"Over the last 20 years, we have remained dedicated to a single mission..."

"Over the last 20 years, we have remained confined to a single mental institution..."

"Over the last 20 years, we have remained obligated to one church..."

"Over the last 20 years, we have remained engaged in espionage..."

Lots of prior art.

[jcr]

Spy agencies have been doing this kind of thing for decades. Slightly altering the wording in documents so that the individual recipient is traceable. They used to have a major problem with classified material being leaked to the press by congressional staffers.

-jcr

Re:Lots of prior art.

[Ungrounded Lightning]

Spy agencies have been doing this kind of thing for decades. ... They used to have a major problem with classified material being leaked to the press by congressional staffers.

Now you know why "Deep Throat" was so cagey, vague, and just pointed Woodward and Bernstein to the right lines of investigation and insisted they hunt down other sources and confirmation, rather than letting them use him as an unnamed direct source.

How long . . .

[DrMrLordX]

How long will it be until Apple patents goading a supplier into assassinating employees responsible for losing sensitive product prototypes?

Re:Digital Witch Hunt

[fuzzyfuzzyfungus]

Planning for a descent into totalitarian dystopia is like making money on a stock bubble.

A stock bubble will, sooner or later, go up in a giant pile of fake-money smoke(taking a whole lot of people's real money with it); but, until it does so, it offers the best returns in town. If you drop out too early, your returns will be secure; but pitiful. If you drop out too late, you'll get soaked.

In your case, if you drop out early, you'll be the penniless guy living in a shack and trying to make guns out of discarded tin cans. If you drop out too late, you'll have a bunch of shiny CNC gear that you don't know how to use show up about the same time Big Brother's jackbooted minions do.

The trick, of course, is finding the right time...

Obscurity isn't worthless

[Cajun Hell]

just run it through the thesaurus algorithm a few more times

But do leakers do that? Always?

People get caught when their guard is down. People fuck up. People think, "nobody's out to get me."

Sometimes they're wrong. Every single day, people die by that principle. They won't get mugged. They can drive home drunk and probably not crash. They can forgo the condom this time. It's true they're not guaranteed to lose. But sometimes they still do.

You're right that it's not a general solution that you can count on, to find your opponent. But at the same time, you know plenty of damn fools will get caught by it.

It's not security through obscurity; it's advantage through security.

Re:Obscurity isn't worthless

[techno-vampire]

the argument could be made that the document was leaked through a different source, run through the algorithm, and coincidentally matched the "signature" of the leaker's copy.

It's not enough to show that there's another possible explanation, you have to show that your story is just as reasonable as the DA's. Your lawyer has to raise reasonable doubt in the minds of the jury to get them to vote not guilty. And, do you really think the jury's going to find your claim reasonable? I sure don't!

Re:Obscurity isn't worthless

[pyro_peter_911]

People think, "nobody's out to get me."

You must be new here.

Peter

Condom?

[0100010001010011]

What are those for?

Why is this new ?

[mbone]

This has been used for years - for example, back in Maggie Thatcher's day they caught a mole this way. What, exactly, is new about this ? That it's in software ?

Re:Why is this new ?

[maxwell demon]

Well, they'll stop blindly using it the first time it creates a slight, but disastrous modification of the meaning.

Tom Clancy == prior art

[Slartibartfast]

Tom Clancy beat this drum -- almost tiresomely -- in several of his books back in the 90's. Our Fearless Protagonist, Jack Ryan, even came up with the algorithm, the name of which currently escapes me. Granted, the algorithm is never actually explained, but its output is identical to what this patent proposes, so methinks this probably isn't worthy of a patent.

Just my two cents, of course.

-Slarty