OPSEC For Activists, Because Encryption Is No Guarantee

Nicola Hahn writes: "In the wake of the Snowden revelations strong encryption has been promoted by organizations like The Intercept and Freedom of the Press Foundation as a solution for safeguarding privacy against the encroachment of Big Brother. Even President Obama acknowledges that "there's no scenario in which we don't want really strong encryption."

Yet the public record shows that over the years the NSA has honed its ability to steal encryption keys. Recent reports about the compromise of Gemalto's network and sophisticated firmware manipulation programs by the Office of Tailored Access Operations underscore this reality.

The inconvenient truth is that the current cyber self-defense formulas being presented are conspicuously incomplete. Security tools can and will fail. And when they do, what then? It's called Operational Security (OPSEC), a topic that hasn't received much coverage — but it should.

Comments

Semantic games

[diamondmagic]

So it would appear that POTUS is now towing a line advocated by none other than whistler-blower Snowden who asserted [8] that “properly implemented strong crypto systems are one of the few things that you can rely on.”

Only there’s a problem with this narrative and its promise of salvation: When your threat profile entails a funded outfit like the NSA, cyber security is largely a placebo.

How many pointless articles could be avoided if authors and editors understood the difference between a necessary condition and a sufficient condition? Of course comsec is not a solution per se, Ulbricht can tell you all about that! (And how many more pointless discussions could be avoided if everyone knew "per se" = "by itself".)

Re:Semantic games

[Defenestrar]

You've got a good point, but the implementation of said conditions have a different intrinsic suspicion. Discussions on encryption will only get you put on the NSA watchlist along with everyone else. Conversations about OPSEC may get you a little bit more. For example - getting revealed as someone who sends encrypted messages to your friends is either in that category of nerdy or slightly suspicious. Getting revealed as someone who passes parcels to others via dead drops will probably get your door kicked in by the DEA shortly followed by a long line of other three letter groups.

PS - I'm not sure if I'll ever be able to use the word "intrinsic" without thinking of eating leprechauns or quantum mechanics. Does anyone else have this problem?

Re:Semantic games

[rtb61]

Problem with your analysis, damned if you do, damned if you do not. Many of the activities of the three letter US agencies have become largely criminal with gross and purposeful misinterpretations of the law and this not in pursuit of justice but in the pursuit of the psychopathic ego of many out of control 'agents' or upon the direct orders of political or corporate appointees. So doing nothing is no more or less effective at getting you door kicked in, being threatened with real and impending death for any reason imaginable including not obeying orders fast enough, a barking dog, happening to have some item in your hand at the time, any item. Then you and all other people in residence at the time being physically assaulted, really assaulted, not grab you hands put them behind your back and being handcuffed but thrown to the ground kicked and jumped on, a bought of "stop resisting' with more blows to the head and then of course your home trashed and your stuff stolen. Then if they hate you ludicrous bail conditions the ensure you remain in jail for years during an hugely purposefully extended trial and the inevitably had sucker you have been in jail for years, plead guilty and you will released with time server ha ha ha.

Basically you are attempting to defend yourself against really lazy and self serving types who in reality wont be bothered with the real leg work, the real reports or any real effort.

Besides it can be hugely fun. Be overtly covert, make a big show of analogue person to person communications. Don't be lazy yourself, do everything you can person to person, the more the merrier and the more wasted spy vs spy efforts. In the whole spy vs spy vs the rest of us, being overt, exposing your efforts, being more public about your activities, serves to protect you and will inevitably expose their spy vs spy efforts to the ridicule and derision it so often rightly deserves.

Re:Semantic games

[Anonymous Coward]

The ironic thing is that OPSEC is a must for any business organization. You can have data at rest protection, and data in transit, but without protection against the VoIP spoofer demanding access or else he will get people fired, this does work. I've worked at a company where the head security guy got fired because he challenged a muckety-muck PHB who was tailgating (trying to get past a door into a sensitive area from the outside of the building without badging in), and this fear caused people to not challenge anything... if it was someone who knew what they were doing, they could just claim to be someone higher up, and the company was theirs.

OPSEC isn't just reserved to TLAs and the military... organizations need at as well.

As for protesters and activists... you can't get most of the 20 something crowd interested in anything other than iPhones and beard oil, so things like keeping the ranks clean of trolls and goofballs are not even something they think about. Handing them an OPSEC guide would be like handing a duck an iPad... there would be curiosity, then it gets pooped on.

Of course

[ShieldW0lf]

If I'm the only one who can unlock your encrypted communications, then it's in my best interest to have everyone encrypt their communications, because then, I'll be the only one with total situation awareness.

It won't be in any of your interests, of course, because you'll be handing me my advantage on a silver platter... but you're all far too shortsighted to pay attention to such things.

Of course Obama and the NSA want you all using strong encryption. Stupid of you to give them what they want, though.

Test your security with false information

[hamjudo]

In the days of brick and mortar spying, the people being spied on would send messages that included false meeting times and locations. For example, in a town with underground utilities, announce a meeting to take place in a rarely used manhole. If the manhole cover is disturbed, then you know that the communication channel has been compromised. No math is required.

The high tech equivalent would be to mention a network resource where access can be monitored. When the network resource is accessed, you know there is a problem.

You are correct.

[Anonymous Coward]

Snowden confirmed our suspicions. And for that he lost his livelihood and his home. And in return for his sacrifice we....have done nothing.

We benefited from his revelations, and then we let him rot. We can't even be arsed into signing an online petition to help him out.

Given how we reward whistle blowers, I am surprised we have any at all.

Re: You are correct.

[Hevel-Varik]

I believe in dealing with terror with overwhelming violence and am not normally sympathetic to idealogical subversion but this is different. Regardless of how powerful and all knowing you feel the NSA needs to be, I cannot relate to any argument that they should know and store absolutely everything I ever say or write over any wire or store on any computer because of needing 'information dominance' while at the same time I SHOULD HAVE ABSOLUTELY NO FUCKING IDEA THAT THAT IS THE CASE. That's not government of the people by the people. The people need to now that the people know everything about the people, even if you believe the people need know everything about the people for the safety of the people. I don't sympathise at all with the if .... the terrorists have won but in this case, Snowden is a national here and I do hope that one day a President and hopefully a hardliner pardons him a gives him some type of reward.

Uninteresting

[AndyCanfield]

The article misses one partial solution: be uninteresting. I've got a bank account in a non-US bank. It's got several hundred dollars in it. Nobody's going to bother to steal that. I've got a password I use all over the Internet, including Slashdot, but you can't do anything with it but post stupid comments. My bank password was a different one. I look just like a million other Amerians living overseas, and that is my ultimate protection. Of course, the cheaper hard disks get, the more data the NSA can store, so the protection is only partial. But for now it is a factor. Of 200 million Americans, how many are worth tracking?

Some Real Advice

[linuxrocks123]

- It is technically possible to air-gap the machine you use to access your email, by copying the email over from an insecure computer to the air-gapped machine.
- TAILS is great, but they probably at least try to break it since it's popular. Will they succeed? Maybe. So use an OpenBSD live CD, it's more secure anyway. Or get creative: use Whonix. The FBI's pedestrian attempt at drive-by malware would have fallen flat on its face with an adversary using Whonix.
- Firejail. Google it. Won't protect you against local kernel privilege escalation attacks, though.

Yes, contingency planning is good. Yes, single points of failure are bad. But you can get very, very good communication security if you really try.

Re:Some Real Advice

[linuxrocks123]

I was thinking flash drive or possibly optical disk ... couldn't there theoretically be an exploitable buffer overflow in ZModem?

Not having a mobile phone is suspicious...

[Richard Kirk]

Any pattern in the way you behave can be used against you. If you are not emitting a mobile phone signal, then you are suspicious. If you have an iPhone, and the logs suggest you regularly take the batteries out, then you are very suspicious. A modern spy would carry a mobile phone - not the latest security recommended one, but something dull - and would tweet and post pictures of what they are eating and listening to just to get the right watch profile. You would have to leave the phone behind when you want to do Spy Things, but you could leave it in the locker at the swimming pool, or something plausible like that. If you have to send crypto messages over this phone, keep the message very short, and plausible.

I don't think there are many real spies here on Slashdot, but there are probably people who would like to keep their data secure in a way that does not attract attention to themselves. Perhaps we should all use encryption whether we need it or not, so those that need it will no longer stand out.

Re:Not having a mobile phone is suspicious...

[Bob the Super Hamste]

Personally if we really wanted to mess with them set up a bunch of disposable e-mail addresses over the course of a week using open WiFi connections with a computer running ToR and then periodically e-mail random data attachments back and forth. Hell I've done this for shits and giggles, when I am at the bank send off some random data since I can connect the Starbucks WiFi across the parking lot, at the used book store connect to McDonalds WiFi next door. Poisson the well make their mining of data useless and make them waste resources trying to decrypt output from /dev/random. The e-mail address are just first names of people in groups (the Beatles, the 12 apostles, Metallica, the US senate judiciary committee, etc) with random letter/number combination passwords. After a couple of months stop using those e-mails and then after a bit create a new set of accounts but a different number of them rinse and repeat. Being a white male with US citizenship, born in the US and residing in the US offers a lot of protection to do this but I wouldn't recommend anyone with a suspicious* background to do this.



* By suspicious I mean someone who might have ties to any protest organization, be a naturalized citizen, have visited any strange countries, be a minority, committed a crime other than a traffic/parking ticket, or any other group the government may want to target or would be ignored by the news media. Basically it would be similar to driving while black, or the opposite of being a young white girl who gets murdered or put on trial in a foreign country. I hate to say it but it is sadly true that the general population would't care about your plight if you could be painted as an undesireable.