To Avoid Detection, Terrorists Made Messages Seem Like Spam

HughPickens.com writes: It's common knowledge the NSA collects plenty of data on suspected terrorists as well as ordinary citizens, but the agency also has algorithms in place to filter out information that doesn't need to be collected or stored for further analysis, such as spam emails. Now Alice Truong reports that during operations in Afghanistan after 9/11, the U.S. was able to analyze laptops formerly owned by Taliban members. According to NSA officer Michael Wertheimer, they discovered an email written in English found on the computers contained a purposely spammy subject line: "CONSOLIDATE YOUR DEBT."

According to Wertheimer, the email was sent to and from nondescript addresses that were later confirmed to belong to combatants. "It is surely the case that the sender and receiver attempted to avoid allied collection of this operational message by triggering presumed "spam" filters (PDF)." From a surveillance perspective, Wertheimer writes that this highlights the importance of filtering algorithms. Implementing them makes parsing huge amounts of data easier, but it also presents opportunities for someone with a secret to figure out what type of information is being tossed out and exploit the loophole.

Comments

Solution!

[MightyMartian]

Applying the Cameron Solution, all we need to do is ban spam... or email. I confess I'm not quite clear.

Or the alternative

[Anonymous Coward]

Prince of Nigeria is really funding terror cells to cure his erectile disfunction.

I wonder, how much REAL spam these guys received

[mi]

If "Consolidate Your Debt" was a special subject for them, I wonder, how many proposals of that kind the assholes had to sift through to find messages from real comrades.

NSA Spam Filter

[Hobadee]

So does this mean the NSA will now filter my spam for me? Hooray!

Re:NSA Spam Filter

[ColdWetDog]

If everybody hadn't got all of their panties in a bunch, they would have filtered your spam, backed up your hard drive, kept permanent records of your phone calls, your tax returns and every text you've ever made.

All for free (well, not exactly free but at least 'No Extra Cost').

I swear, Americans are just so jumpy these days. No good deed goes unpunished.

Re:I wonder, how much REAL spam these guys receive

[mythosaz]

More interestingly, I wonder how many perfectly good terrorist emails I've deleted from my spam folder.

Drone Strikes Against Spammers ?

[Crashmarik]

Sure we will get some actual spammers in with that, but better safe than sorry.

Re:Drone Strikes Against Spammers ?

[KiloByte]

Every spam message that goes past the filters takes several seconds out of someone's life -- and not just the "gross" part that includes sleep, commutes, bathing, etc but of the actual productive part of the day (around 1/3 of it). Averaging batch reading of mail at the start of a day vs full context switch, let's take 5s per piece of spam. Let's assume a 95% spam filter effectiveness rate. Now the hardest part -- how big a spam campaign run is? Let's assume 100M delivery attempts (I'm doing a Fermi estimate -- or rather, pure rectal extraction -- on this number).

This means, a single spammer who did just 10 spam campaign runs effectively murdered a person -- in a death of thousand cuts.

You think it's bad there

[fustakrakich]

Watch the Home Shopping Network. All their plans are on display. Look for the hidden pictures in those artsy plates they sell. They're actually maps and blueprints.

And Hair Club for Men is a sleeper cell.

"I've fallen! And I can't get up!" is a call to arms.

They're everywhere. Am I not right?

I actually warned the FBI...

[Anonymous Coward]

.......of something similar back in 2002. There were a lot of messages on UseNet that had been attributed to being either spammers or some college testing out an AI. I noticed that the messages all had the same subject but with an added "suffix" at the end and that the messages were all the same in the beginning but at the end of them they had what appeared as a word salad. I dropped a hint to the FBI that it looked like the "suffix" was giving the order in which to reassemble the message and that the word salad at the end was likely some form of steganography that contained the actual message. Two days later those messages stopped appearing on UseNet and were never seen again. Was it a terrorist? I don't know but they were made aware of it at that point at least. I would have contacted the NSA but I didn't want to deal with them on any level.

Re:I actually warned the FBI...

[Carnildo]

You alerted them to actual spam.

The purpose of the suffix was to evade simple subject-line spam filters, while the "word salad" was an effort to evade word-classifier spam filters by drowning out the "spam-like" words with "non-spam" words, or to poison the classifiers and render them useless by loading up the "spam" wordlists with words that usually appear in non-spam messages.

Spam Mimic

[Rick Richardson]

http://www.spammimic.com/

Re:I do the opposite

[ColdWetDog]

You're supposed to say "Allah Akbar". Your keywords flag you as a paranoid schizophrenic or Slashdot aficionado. Either one mostly harmless to the Three Letter Agencies.

Re:Stupid

[aix tom]

Of course, never in History, not even in WW1 and 2 has any spy agency tried do collect ALL information that was there. Like every letter sent, every phone call made, every conversation made in public, etc... like spy organisations these days seem to try.

Former East Germany came closest in the last century I guess. Then again, they probably had 20% of the population working at least part-time as undercover agents to spy on the rest.

There is a technical cryptographic term for this

[slashdot_commentator]

Its called steganography.

Re:I wonder, how much REAL spam these guys receive

[rtb61]

More poignantly, does than mean we should be treating mass spammers like terrorist, oh my, I am torn between annoyance and justice, arghhh.

Use hufman coding to disguise messages

[complete loony]

Train a compression algo using a spam corpus to build a dictionary. Compress and encrypt your message. Then use the spam dictionary to *decompress* it. Hey presto, your message looks exactly like a randomly generated spam message.