AC a bit of reading shows Australia has some super computer ambitions and spending.
Quantum computer work has been great for funding.
"Quantum storage breakthrough key to 'unbreakable' encryption
A new quantum hard drive jointly developed by researchers in Australia and New Zealand could lead the way to an 'unbreakable' worldwide data encryption network."(January 12, 2015) http://www.zdnet.com/article/q...
"Powerful quantum computers move a step closer to reality
A research team from Australia has pushed quantum computers closer to fruition, but a former NSA director warns that the technology could break encryption" (October 2014)
Re "What do they need this for?"
Small nations usually buy big computer for a few historic reasons, very advanced weapons design or a crypto race.
Australia has given up on its own advance weapon design and fully imports its needs from the USA.
Huge amounts of data collected in Asia for itself and the NSA/GCHQ flows into remote secure collection sites.
That bulk flow might find its way into a dual use civilian military telco system with global suppliers and other nations been very close to internal domestic military networks.
The only way to ensure its mil/gov networks stay secure its to try exotic new crypto it is trying to build all on its own.
For that it needs some free dual use fancy "weather" super computer to test its home brew crypto.
Australia also has to be able to break any encryption it find in Asia outside of the NSA and GCHQ help.
A "weather" super computer sounds just a bit more real than one for banking, agricultural or classic one site academic use.
ie a decades long quantum encryption boondoggle needs testing. Lots of testing, over time and the project is at the really big US computer stage.
Re "I'm sure there are much large potential savings in the defense budget, so why waste our limited time and attention on something so small, proportionally speaking."
The US seems fixated on moving data from satellite to satellite avoiding parts of the world and having to add extensive encryption to its own bespoke satellites. Data flow was the key from Australia, Japan, UK, Slivermine South Africa and other interesting locations.
The NSA and GCHQ seemed to distrust all other methods and hoped to stay ahead of the game buying ever more for the flow of gov/mil data.
The private sector soon learned of this need and set prices to match.
Why the interest? It shows the mind set of the US and UK going back decades vs a Russia or China who could only try to secure their networks or use http://cryptome.org/eyeball/ss...
The High Frontier Broadcast: 02/05/2005 http://www.abc.net.au/4corners...
has a transcript http://www.abc.net.au/4corners... thats suggests some of the US gov spending on communications in the private sector.
1. "Add public keys to major services"
The security services just use their own or find others or find the users.
2. Build better random number generators
Yet strange limits seem to be added to many public and private crypto like products efforts every decade. From banking to what shipped with personal computers.
3. Expand trusted hardware
That gets found and upgraded during while in the safe hands of the trusted global postage or delivery services. (supply-chain interdiction/Tailored Access Operations).
4. Add Merkle trees to the file system
More logging, tracking and understanding of any network or site helps. The main issue is who gets to see the files after an event?
Domestic or federal investigators just take it all away to cover parallel construction or another gov/mil access?
Many of the more skilled nations are opting for their own code, designing their own cpu and networking hardware to escape most of the the more direct ways into their own existing networks.
Re "Why is this news? I'm all for efficiency, but savings that small are not worth it in a budget that freaking large"
Go back over the years of getting:
"That year, about $280 million worth of satellite capability was bought outside the DISA process. If the GAO is correct, then the military could have gotten that same service for about $45 million less."
Back to 1990? 2000? 2010? The decades add up. The billions of $ needed to just to buy into the private sector can be very expensive.
The linked "DOD Needs Additional Information to Improve Procurements" at http://www.gao.gov/products/GA... had a "Full Report" pdf http://www.gao.gov/assets/680/... has:
"DISA also estimated that if DOD used a capital lease or purchase of a single band satellite based on commercially available technology, the department could avoid costs of about $4.5 billion over 15 years compared to the current baseline. This was the lowest cost alternative identified by the analysis."
The numbers have been around for years in public. The US gov/mil is fixated on buying from the private sector every decade.
"The High Frontier" (Broadcast: 02/05/2005)
"Outer space is open for business. It’s a booming $50 billion a year industry" http://www.abc.net.au/4corners...
from the transcript at http://www.abc.net.au/4corners...
".. makes $100,000,000 a year, buying and selling airtime on communication satellites....."
Re "So what is necessary to address the problem?"
A strong compartmentalized, air gapped database that has real human oversight? The US can make and run that for every agency, department and project it needs to over decades.
They dont leak by design. Nobody networks out with plain text anything. Every access internally is logged. There is no external access.
It seems the US wanted a database, networked and usable. Who would want such a networked database?
If you need a contractor with skills and its not logged. Thats a positive for projects that needed a lot of staff in different parts of the world at some time in the past.
Internally staff feel they can look up anything. A great way to see is looking up what and why while they feel like its an open network at their desk.
Great for testing and seeing who is looking for what when alone. Hard to do if they have a person next to them and an encrypted time limited window thats logged by default.
Re What will actually happen?
A wait to see who goes looking over huge lists of interesting sounding fictional projects.
For an Operation Bodyguard https://en.wikipedia.org/wiki/... to work the mix has to be interesting.
The US and UK have had great wins with other nations skilled staff.
Some insights can be seen with the 1945-early 1950's use of German, Italian and other staff to help with cryptography.
Induced, motivated and rewarded they saved the US and UK years of work with ready, working solutions to French, Soviet and other nations post ww2 crypto.
TICOM (Target Intelligence Committee) https://en.wikipedia.org/wiki/...
Operation Stella Polaris https://en.wikipedia.org/wiki/...
The US and UK then advanced this idea of trusting other nations staff to Australia, New Zealand, Canada. Their top crypto experts got to share with the USA and UK and their work was rewarded over decades.
Staff in France and West Germany soon got the same offers and results can now be more understood. The US and UK got total look down in plain text over allied nations thanks to trusted work with well with trusted foreigners.
Decades later French and German political leaders finally understand the reality of their own secure crypto and communications networks.
The US and UK dont allow databases to walk, they create easy to read information to test their own and other nations "trusted" staff.
Anything found, searched, used is bait. But the bait has to be believable and irresistible at low clearance level. Just not useful at any real clearance level.
Everyone involved has to believe it is a real leak of some real value. Political leaders and contractors have to be public in their real reactions. Sock puppets on social media have to offer their "it was real but fixable" spin. Just find the correct contractors, add more funding, over time.. and the bosses new security product.
How hard would it be to load up a massive database of past projects linked to past operations in parts of the world of no future concern?
Add in a lot of fakes and trackable data in an outward facing network and see how everyone interesting reacts.
Other nations, internal staff, social media. Keep pushing the message that the data is really real.
If the U.S. government wants a server to be secured it is, as designed, run, used.
The US lectured its more trusted allies in the 1950-2010's about keeping their own and all shared projects very secure.
The Soviet Union, Russia, China did not get far when trying to look into real US networks, systems without the direct help of local staff who had turned or where deep cover.
So the US could, can and in the future can design and run very secure networks of any size or standard when needed.
Why the sudden political and media interest in network security? US cleared staff have to understand that a 'list' trap is set, baited and will be tested.
Anyone on the vast low level 'digital' security list might get a chat down from two or more people who fit the caricature of foreigners with a story, files, backgrounds and an offer....
In changing economic times, with an understanding of security, staff might be tempted as the approach could be real and of great to gain personal wealth.
US staff now know every low level security validation is going to be re tested, reviewed, re interviewed, approached, chatted down as a list by expert contractors and gov officials.
The only reaction now is to report any approach. The US has secured a generation against approaches by other nations.
All the data in the wild is bait. Projects, places, events, dates. Everything at that level is set up to be trackable internally and externally.
To work as bait it has to be readable in English, usable over time by staff on internal networks in English and usable over the US to job fairs, contractors, operations needing staff, staff been given clearances as they change from gov to mil to private sector and back.
The other reaction is to test internal US networks and all staff levels as they react to the very 'real' 'news' of reviews.
Is someone in middle or upper management getting fixated looking up their own past, names, other names? Why?
Another test is to see how social media tracking and planted cover stories over years can handle the interest.
Cleared staff are been tested. How do they react to the media attention. What are they searching for on work and public networks.
Or not looking for when all their colleagues are.
The "managed very differently" aspect is just a new set of fancy expensive contractors with new security products to sell or rent.
Gov using contractors to watch over skilled contractors as they help gov upgrade to expensive new security.
The covert side of the gov and mil wanted the skills but no questions, no paper trail, no project names, multiple social security numbers, social media magic and an instant job interface between the public and private sector. That was harder to create but offers stories to different covert groups long term.
The private sector also needed ways to escape of paying all the local wages. Why not just hire a local cleared front company and have a long tail of cheap supply globally while meeting all the paper work. Disassembled and recreated with all the local paperwork. Multi nationals could then front for mil/gov grade work using lower wages and have the same legal standing for any mil/gov contract without traditional domestic costs.
The result is a perfect method of hiding projects, hiding global support by contractors for different projects, keeping costs hidden, reducing local wage claims and making top staff feel they are not been tracked. At their level as they have passed all the tests and are trusted alone, with vast plain text databases...
Cleared staff feel they have an open database to transverse looking up projects and names without been logged. How they use access has been watched for decades.
The freedom to look at open, plain text databases allow 'everyone' to look at fake names, fake projects, fake tasks, fake support requests that are all traps waiting for any sign of been searched for at any level on any network.
The national media attention about leaks might induce random cleared staff to look up a wide variety of projects and names... and that can be noted.
The new classifying system is not designed to be understood. It is designed to understand and test every cleared worker all the time while offering freedom to the private sector, hide covert needs from all and keep security contractors funded.
Its not a new idea. The UK tried it in the 1910-40's, rapid expansion, new technology, experts, rushed language support. The win was understanding most embassy work/codes in use in Europe as used. The downside is the loss of internal vetting control long term.
Re "just needed a new source"
How many nations are setting up front group "contractors" and "private sector" teams that are a direct link back to their own military counterintelligence units?
Watching diverse state and federal police forces offer complex tenders for and accepting code thats then used live around the world.
Front door, back door, trap door, skylight.... just watching day to day network use would be useful to see what is been whitelisted, tracked or allowed to go under patched for week, months, years...
Re "have jurisdiction over citizens of... "
Most of the gifts and joint efforts establish a long term foothold in other nations. A nation of interest gets upgrades to secure networks, fast new software that always needs "free" updates and upgrades.
Local staff are then invited on fact finding trips to learn more about 'very' advance methods and return with new ideas and more news about emerging technology.
Over time the trips become routine to meet with their new colleagues.
Who uses the systems diligently or is much more cautious about sharing local methods and the best informant details long term. The question of local files or the vast shared network.
Some advice can be offered over who has a good working relationship with and might get promoted locally.
Hearts and minds over many decades. Free offers of further education, funding, trips go far. Military intelligence and all vital counter surveillance teams would be getting the same help.
Jurisdiction becomes a friendly request between "international" staff who have known each other for years as their bosses did.
AC it depends on how much the US gov screams globally about dumping product, national security and keeping top quality local jobs in the USA again this decade.
It becomes very expensive just to keep the paperwork, legal teams, export controls around US R and D teams.
Sooner or later a generational hardware change will see other nations like Canada, Israel, Australia, South Korea, France, Taiwan just offer the same expert export focused campus deals. Top experts, a much more understanding local tax system and no questions about: national security, export production lines, where the final product is made.
Production can shift to any nation with low cost workers and design can spread to nations that are more understanding to a multinationals needs and trending global sales.
Most nations have fully understood how Japan was treaded in the 1980's and 1990's over computer related design and exports.
It really depends how some parts of the US government react. At this time most interesting people have their phone on them or are sitting at some desktop.
A person in a chair can be found and logged around the world by staff in another chair timezones away. Onion routing, a VPN or tame crypto failed or malware or...
One tasked group gets the win, glory and the long term connections globally back to that device connected to a user.
If this idea of a legal, low power device gets to be used then other traditional expensive local methods will have to be considered again.
Suddenly only a final hop is understood and the owner, residence, provider and other easy details are useless until the interesting user makes mistakes.
Governments would be back to the early 1980's having to send out teams in cars, vans, trucks trying to track short term signal bursts as they work back to the real network origin.
Locals tend to notice fast or slow new transport in the area or new funding for instant CCTV in an area, public and private. Even flying over an area in a search pattern gets noticed.
The main risk is the user makes mistakes or they return to unique patterns, hardware or terms they use on their normal everyday accounts.
A wireless surveillance system for wifi and other data siginals can cover a big city, in place to provide near instant triangulation of any signal of interest?
Are total spectrum tools ready for in use in most domestic city areas? The need for a plane or larger van locally would be reduced as origin could be found in real time.
re "Second, the business community will not and cannot tolerate losing the ability to encrypt while also using the public internet synchronize their databases and handle communications."
Most banks have everyday, normal accounts tracked federally down to the 100's of $ over time on any normal account.
Thats all been reported and fully accounted for as it has been for years. Other issues are usually never public as the banks talk of the confidence of investors.
More federal oversight on the same type of accounts would not be an issue.
Anything found on servers facing outside networks is usually altered to make tracking very, very easy. Anything interesting is changed to help track internal cleared staff "looking up" data.
A unique term found or created by internal security is very trackable and would be on a lot of powerful watch lists at much more higher security levels.
Vast accessible databases contain vast numbers of extra projects, terms, locations, ranks, support requests that might have existed in some form or never existed, sound amazing but are left in, updated as a trap.
Tracking all internal and later external searches from such interesting databases is more easy if the data is readable and staff dont have to ask and have a reason in person.
Its a honeypot for all internal staff cleared to have access at that level and points to any signs of external leaks or staff issues.
That is why governments will do what they do. Constant internal and external tests to see who does what, why, how, when, where and can then act on the results with no risk to any real projects.
Do the number of network look ups match the given paper work, paper trail? What else was been search for?
The cleared staff, other governments, external groups looking in, the media have to understand the entire data set is very much 'real', 'vital' and 'active'.
In decades past other governments would pay big, expose their own spy networks and believe they had something rare.
Over the decades open network database finds are more carefully considered by most smart nations.
Collect it all is not just for external public networks or public encryption use.
Re "Third, who are they actually trying to stop from using encryption?"
All governments have understood since the 1950's that any US or UK network, hardware is a trap.
Longer, safer more traditional methods work just fine unless a one way message is needed and is worth the risk or everything related has been uncovered.
Cults, faiths and other groups have their own person to person methods and years of complex internal vetting.
Top corporate companies, private interests usually have contacts in their own governments and should be aware of what their competitors and other nations can do to their complex internal networks.
Sleeper, deep penetration agents, gov fronts for international humanitarian work, expat workers with direct links to other nations are usually very careful too.
A face to face holiday meeting back home or a one way message "broadcast" for all is low risk. Entire lives on social media hold up to most complex private sector and other gov scrutiny.
The list of interesting people to watch is short, considering the new political message that all networks will be watching all users all the time.
The only win is the sale of more collect it all hardware, software, upgrades and maintenance contracts.
The traditional watch and listen as to keep the collect it all networks open and in use would have still worked. Parallel construction with wide press coverage as to the fake methods used was still working for many.
The budgets for contractors "collect it all" systems might be so huge soon that they will have to be public by default?
The UK had to work too hard to hide its emerging SIGINT spy satellites options. The change of funding to much cheaper US systems was a huge loss to US and UK contractors.
With mil funding been more in the open, the growth for contractors is no longer limited by the ability to hide project funding every year.
Whomever is pushing this will collect it all in terms of public funding over decades.
re "Unless some kind of oniony or multi-hop routing is involved, I presume."
What is the first hop from an average home computer, out of an office network, a cafe with wifi?
The everyday, average real time use of a destination or origin is trackable on most national networks.
A public telco, private network or telco? The layers of communications can request oniony or multi-hop but that physical network entry and exit point is a bit more fixed in most nations.
Think of the work that went into detecting the use of virtual encrypted disks over time. All that matters is the detection or wider public understanding that the message cannot be detected over a network.
With detection comes the origin of the message, destination, method used and ability to trap door, back door to get the message before any steganography.
Re "I know someone in the.... who told me that they can access anyone's phone,... EXCEPT"
Every connected device sold in the US has to be "wiretap" friendly by design over every generation of product.
Thats full logs, voice prints, plain text, images, voice, gps, call details, unique camera details per image, remote mic/camera on, network power on.
A city, state, county might have some well understood new private sector software packages that they show all their "cleared" staff.
The staff having seen that experiment then consider some brands safer and buy it, recommend it, whisper and chat about it.
Word gets around that a few top, easy to find US brands are still safe to communicate fully and freely on over every decade.
A few different branded phones are then used. A normal work phone, a private phone, a phone for...
Great to keep everyone of interest talking on digital networks that can collect it all.
A person has the freedom to develop, talk about, attract interested people, fix, code, test, compile, run and release any crypto they like on mainstream OS and networks.
The security works as tested by a few or many experts who found each other on the same mainstream networks and sites...
The obscurity part is entering the plain text, tracking the message and decoding.
Do that on a tame OS and tracked network and all that freedom for security jus makes the message stand out.
Decade in decade out, enjoy the "free" crypto community hosted by...
Strong encryption use just makes a message stand out. All French networks can collect it all thanks to "free" help from the US and UK going back to the early 1970's.
Who is sending any messages and where makes for easy traditional police work at a local level. France has a lot of police and funding so long term undercover work is not a problem. Any regional or local groups can be turned or watched as they form and communicate using any encryption.
The only problem for France is that its vastly improved network tracking let the US and UK deep into its secure French gov networks again.
A collect it all system from the US/UK has helped decode the French gov.
France got to collect it all but so did the US and UK.
The ability of the UK and US to track any networked message removes all anonymity and then allows privacy be worked on.
A person, brand, company, project can create, compile, sell, offer, use all the encryption it wants.
A US or UK telco or network interconnect will always be able to track the message from its origin to the destination.
With a loss of anonymity, privacy is then very easy remove per user or site.
US and UK network ready devices, networks, tame computer systems are all law enforcement friendly so the layer the user encryption was created on will always be obtainable as designed and sold.
Plain text, voice, images, a log of network use are just waiting on most big brand US computer systems as designed and sold.
The ability of law enforcement to collect plain text as entered or when decrypted on a normal user system ensures privacy is never a problem once tasked.
How a user opts to use a network between two computer systems compromised by design is not really an issue.
The other plus for a lot of popularized encryption is that it stands out for a US/UK collect it all system.
Encryption is just the easy way to find a user and then use a waiting trap door or back door in the office, home, network or commercial system or hardware.
The US and UK will not restrict encryption. The more users feeling they need to find and turn on junk encryption just makes the task of finding people of interest on networks more easy.
Thats why number stations and one time pads worked well in the past. Its kind of hard to find who listened to an international broadcast.
But with the direct use of any encryption between two sites that task is now very easy.
With anonymity gone, plain text is just a network request to a law enforcement friendly OS.
Wise Western governments should fund, offer grants to all encryption products, experts they can find. Create front companies and fund tame academics. It makes finding interesting people so much more easy on all networks when they use known encryption everytime.
Restricted encryption historically was a tool to drive people onto the tame encryption over generations.
Why the interest in all human rights groups?
Irish attempts to reach out to the US with human rights issues in the mid/late 1960's had to be reshaped.
South Africa had a vital site shared with the UK for global network tacking expanded in the 1970's.
Argentina was interesting emerging market for UK naval systems (frigates) sales into the1970's.
The issues of trade unions within the UK national security sector was interesting due to the 1987 the European Commission of Human Rights findings.
The emerging 1990's European Convention on Human Rights was an issue for the UK gov.
Every decade had its press and human rights issues that had to be shaped so UK protesters, academics and lawyers could be guided around, away from complex trade and mil issues.
Re "revelations was the discovery that the NSA doesn't have any secret ways into properly done crypto "
The NSA and GCHQ have enough hold over emerging academics, crypto, open source and crypto history to shape any useful standards.
Before Snowden the idea was that some one or something to do with academics, open source, political scandal, private sector legal leadership, private sector risk, the press or very smart people or antivirus protection teams would notice "something" about weak international crypto standards and the computer press globally would ensure a rapid international exposure and correction.
Nothing was noticed in the banking and telco networks of the 1960's, 70's? into the home computers of the 1980s, the emerging social and security standards, beyond 2000... company and university experts and their endless funding and grants.
The UK enjoyed plain text decryption in pre ww2 Europe and into the 1950's. The US expected the same on any emerging networks.
NATO nations and any country with links to the West got expert help to secure their systems and new networks. Totally secure along the network. Reverting to plain text in realtime for the NSA and GCHQ every upgrade and decade.
Re "This is the cause for the government's alarm: encryption by default would be very inconvenient for them."
The hardware and low level text input will always revert to plain text to be displayed or entered by the user. Law enforcement will always have access to that if the device is to be sold in the US or UK. The user can run any application they want and developer can compile, sell any application they like on top but the voice and text at its most readable level always reverts to a form that is wiretap friendly as sold within the device by design as sold.
Compile, design, encrypt, its the hardware and OS that will always be ready to report back when needed every time a cell or other network connection is made.
re "There's nothing anyone can really do to fix that"
The Soviet Union fixed the issue by using one time pads in the 1950's for a short time but had to give up as it had so much data to move globally. Once upgraded entire networks where again fully open to the NSA and GCHQ at all levels over decades.
France had all its diplomatic traffic intercepted by the US and UK in the 1950's. Hardware fixes in the 1960's helped but then the amazing upgrade offers from the GCHQ in the early 1970's opened most interesting French networks to the US and UK again.
re "The government lost the first with Clipper" The US and UK had hardware, networks and software standards as shipped. A generation was distracted from understanding the lower layers of popular OS or networks standard as shipped by ideas that an extra 'special' chip was needed.
The sale and use of home computer or cell phone at a low cost was all that was needed.
re "There's nothing anyone can really do to fix that" The world is slowly understanding that decades of weak networks and junk crypto standards are not just open to 5 eye nations. Smart people, dual citizens and other trusted nations with other regional goals all now know of the the same methods and ideas and have have been enjoying the same access.
Companies and people with good emerging products and ideas need anonymity and privacy so they can bring a product to market. Having competing nations read deals, grants and support requests is going to result in loss to established competing brands.
The fix is for nations and their own brands to get their internal anonymity and privacy back. More back doors in every computer and networks open as shipped is not going to help with that.
The crypto war was lost in the 1920's with telephone networks and embassy networks. No emerging network was ever out of reach again.
Slashdot Mirror
AC a bit of reading shows Australia has some super computer ambitions and spending.
Quantum computer work has been great for funding.
"Quantum storage breakthrough key to 'unbreakable' encryption A new quantum hard drive jointly developed by researchers in Australia and New Zealand could lead the way to an 'unbreakable' worldwide data encryption network."(January 12, 2015)
http://www.zdnet.com/article/q...
"Powerful quantum computers move a step closer to reality A research team from Australia has pushed quantum computers closer to fruition, but a former NSA director warns that the technology could break encryption" (October 2014)
Re "What do they need this for?"
Small nations usually buy big computer for a few historic reasons, very advanced weapons design or a crypto race.
Australia has given up on its own advance weapon design and fully imports its needs from the USA.
Huge amounts of data collected in Asia for itself and the NSA/GCHQ flows into remote secure collection sites.
That bulk flow might find its way into a dual use civilian military telco system with global suppliers and other nations been very close to internal domestic military networks.
The only way to ensure its mil/gov networks stay secure its to try exotic new crypto it is trying to build all on its own.
For that it needs some free dual use fancy "weather" super computer to test its home brew crypto.
Australia also has to be able to break any encryption it find in Asia outside of the NSA and GCHQ help.
A "weather" super computer sounds just a bit more real than one for banking, agricultural or classic one site academic use.
ie a decades long quantum encryption boondoggle needs testing. Lots of testing, over time and the project is at the really big US computer stage.
Re "I'm sure there are much large potential savings in the defense budget, so why waste our limited time and attention on something so small, proportionally speaking."
The US seems fixated on moving data from satellite to satellite avoiding parts of the world and having to add extensive encryption to its own bespoke satellites. Data flow was the key from Australia, Japan, UK, Slivermine South Africa and other interesting locations.
The NSA and GCHQ seemed to distrust all other methods and hoped to stay ahead of the game buying ever more for the flow of gov/mil data.
The private sector soon learned of this need and set prices to match.
Why the interest? It shows the mind set of the US and UK going back decades vs a Russia or China who could only try to secure their networks or use http://cryptome.org/eyeball/ss...
The High Frontier Broadcast: 02/05/2005 http://www.abc.net.au/4corners...
has a transcript http://www.abc.net.au/4corners... thats suggests some of the US gov spending on communications in the private sector.
1. "Add public keys to major services"
The security services just use their own or find others or find the users.
2. Build better random number generators
Yet strange limits seem to be added to many public and private crypto like products efforts every decade. From banking to what shipped with personal computers.
3. Expand trusted hardware
That gets found and upgraded during while in the safe hands of the trusted global postage or delivery services. (supply-chain interdiction/Tailored Access Operations).
4. Add Merkle trees to the file system
More logging, tracking and understanding of any network or site helps. The main issue is who gets to see the files after an event? Domestic or federal investigators just take it all away to cover parallel construction or another gov/mil access?
Many of the more skilled nations are opting for their own code, designing their own cpu and networking hardware to escape most of the the more direct ways into their own existing networks.
Re "Why is this news? I'm all for efficiency, but savings that small are not worth it in a budget that freaking large" :
Go back over the years of getting:
"That year, about $280 million worth of satellite capability was bought outside the DISA process. If the GAO is correct, then the military could have gotten that same service for about $45 million less."
Back to 1990? 2000? 2010? The decades add up. The billions of $ needed to just to buy into the private sector can be very expensive.
The linked "DOD Needs Additional Information to Improve Procurements" at http://www.gao.gov/products/GA... had a "Full Report" pdf
http://www.gao.gov/assets/680/... has
"DISA also estimated that if DOD used a capital lease or purchase of a single band satellite based on commercially available technology, the department could avoid
costs of about $4.5 billion over 15 years compared to the current baseline.
This was the lowest cost alternative identified by the analysis."
The numbers have been around for years in public. The US gov/mil is fixated on buying from the private sector every decade. ...."
"The High Frontier" (Broadcast: 02/05/2005)
"Outer space is open for business. It’s a booming $50 billion a year industry"
http://www.abc.net.au/4corners...
from the transcript at http://www.abc.net.au/4corners...
".. makes $100,000,000 a year, buying and selling airtime on communication satellites.
Re "So what is necessary to address the problem?"
A strong compartmentalized, air gapped database that has real human oversight? The US can make and run that for every agency, department and project it needs to over decades.
They dont leak by design. Nobody networks out with plain text anything. Every access internally is logged. There is no external access.
It seems the US wanted a database, networked and usable. Who would want such a networked database?
If you need a contractor with skills and its not logged. Thats a positive for projects that needed a lot of staff in different parts of the world at some time in the past.
Internally staff feel they can look up anything. A great way to see is looking up what and why while they feel like its an open network at their desk.
Great for testing and seeing who is looking for what when alone. Hard to do if they have a person next to them and an encrypted time limited window thats logged by default.
Re What will actually happen?
A wait to see who goes looking over huge lists of interesting sounding fictional projects.
For an Operation Bodyguard https://en.wikipedia.org/wiki/... to work the mix has to be interesting.
The US and UK have had great wins with other nations skilled staff.
Some insights can be seen with the 1945-early 1950's use of German, Italian and other staff to help with cryptography.
Induced, motivated and rewarded they saved the US and UK years of work with ready, working solutions to French, Soviet and other nations post ww2 crypto.
TICOM (Target Intelligence Committee) https://en.wikipedia.org/wiki/...
Operation Stella Polaris https://en.wikipedia.org/wiki/...
The US and UK then advanced this idea of trusting other nations staff to Australia, New Zealand, Canada. Their top crypto experts got to share with the USA and UK and their work was rewarded over decades.
Staff in France and West Germany soon got the same offers and results can now be more understood. The US and UK got total look down in plain text over allied nations thanks to trusted work with well with trusted foreigners.
Decades later French and German political leaders finally understand the reality of their own secure crypto and communications networks.
The US and UK dont allow databases to walk, they create easy to read information to test their own and other nations "trusted" staff.
Anything found, searched, used is bait. But the bait has to be believable and irresistible at low clearance level. Just not useful at any real clearance level.
Everyone involved has to believe it is a real leak of some real value. Political leaders and contractors have to be public in their real reactions. Sock puppets on social media have to offer their "it was real but fixable" spin. Just find the correct contractors, add more funding, over time.. and the bosses new security product.
How hard would it be to load up a massive database of past projects linked to past operations in parts of the world of no future concern?
Add in a lot of fakes and trackable data in an outward facing network and see how everyone interesting reacts.
Other nations, internal staff, social media. Keep pushing the message that the data is really real.
If the U.S. government wants a server to be secured it is, as designed, run, used.
The US lectured its more trusted allies in the 1950-2010's about keeping their own and all shared projects very secure.
The Soviet Union, Russia, China did not get far when trying to look into real US networks, systems without the direct help of local staff who had turned or where deep cover.
So the US could, can and in the future can design and run very secure networks of any size or standard when needed.
Why the sudden political and media interest in network security? US cleared staff have to understand that a 'list' trap is set, baited and will be tested.
Anyone on the vast low level 'digital' security list might get a chat down from two or more people who fit the caricature of foreigners with a story, files, backgrounds and an offer....
In changing economic times, with an understanding of security, staff might be tempted as the approach could be real and of great to gain personal wealth.
US staff now know every low level security validation is going to be re tested, reviewed, re interviewed, approached, chatted down as a list by expert contractors and gov officials.
The only reaction now is to report any approach. The US has secured a generation against approaches by other nations.
All the data in the wild is bait. Projects, places, events, dates. Everything at that level is set up to be trackable internally and externally.
To work as bait it has to be readable in English, usable over time by staff on internal networks in English and usable over the US to job fairs, contractors, operations needing staff, staff been given clearances as they change from gov to mil to private sector and back.
The other reaction is to test internal US networks and all staff levels as they react to the very 'real' 'news' of reviews.
Is someone in middle or upper management getting fixated looking up their own past, names, other names? Why?
Another test is to see how social media tracking and planted cover stories over years can handle the interest.
Cleared staff are been tested. How do they react to the media attention. What are they searching for on work and public networks.
Or not looking for when all their colleagues are.
The "managed very differently" aspect is just a new set of fancy expensive contractors with new security products to sell or rent.
Gov using contractors to watch over skilled contractors as they help gov upgrade to expensive new security.
The covert side of the gov and mil wanted the skills but no questions, no paper trail, no project names, multiple social security numbers, social media magic and an instant job interface between the public and private sector. That was harder to create but offers stories to different covert groups long term.
The private sector also needed ways to escape of paying all the local wages. Why not just hire a local cleared front company and have a long tail of cheap supply globally while meeting all the paper work. Disassembled and recreated with all the local paperwork. Multi nationals could then front for mil/gov grade work using lower wages and have the same legal standing for any mil/gov contract without traditional domestic costs.
The result is a perfect method of hiding projects, hiding global support by contractors for different projects, keeping costs hidden, reducing local wage claims and making top staff feel they are not been tracked.
At their level as they have passed all the tests and are trusted alone, with vast plain text databases...
Cleared staff feel they have an open database to transverse looking up projects and names without been logged. How they use access has been watched for decades.
The freedom to look at open, plain text databases allow 'everyone' to look at fake names, fake projects, fake tasks, fake support requests that are all traps waiting for any sign of been searched for at any level on any network.
The national media attention about leaks might induce random cleared staff to look up a wide variety of projects and names... and that can be noted.
The new classifying system is not designed to be understood. It is designed to understand and test every cleared worker all the time while offering freedom to the private sector, hide covert needs from all and keep security contractors funded.
Its not a new idea. The UK tried it in the 1910-40's, rapid expansion, new technology, experts, rushed language support. The win was understanding most embassy work/codes in use in Europe as used. The downside is the loss of internal vetting control long term.
Re "just needed a new source"
How many nations are setting up front group "contractors" and "private sector" teams that are a direct link back to their own military counterintelligence units?
Watching diverse state and federal police forces offer complex tenders for and accepting code thats then used live around the world.
Front door, back door, trap door, skylight.... just watching day to day network use would be useful to see what is been whitelisted, tracked or allowed to go under patched for week, months, years...
Re "have jurisdiction over citizens of ... "
Most of the gifts and joint efforts establish a long term foothold in other nations. A nation of interest gets upgrades to secure networks, fast new software that always needs "free" updates and upgrades.
Local staff are then invited on fact finding trips to learn more about 'very' advance methods and return with new ideas and more news about emerging technology.
Over time the trips become routine to meet with their new colleagues.
Who uses the systems diligently or is much more cautious about sharing local methods and the best informant details long term. The question of local files or the vast shared network.
Some advice can be offered over who has a good working relationship with and might get promoted locally.
Hearts and minds over many decades. Free offers of further education, funding, trips go far. Military intelligence and all vital counter surveillance teams would be getting the same help.
Jurisdiction becomes a friendly request between "international" staff who have known each other for years as their bosses did.
AC it depends on how much the US gov screams globally about dumping product, national security and keeping top quality local jobs in the USA again this decade.
It becomes very expensive just to keep the paperwork, legal teams, export controls around US R and D teams.
Sooner or later a generational hardware change will see other nations like Canada, Israel, Australia, South Korea, France, Taiwan just offer the same expert export focused campus deals. Top experts, a much more understanding local tax system and no questions about: national security, export production lines, where the final product is made.
Production can shift to any nation with low cost workers and design can spread to nations that are more understanding to a multinationals needs and trending global sales.
Most nations have fully understood how Japan was treaded in the 1980's and 1990's over computer related design and exports.
It really depends how some parts of the US government react. At this time most interesting people have their phone on them or are sitting at some desktop.
A person in a chair can be found and logged around the world by staff in another chair timezones away. Onion routing, a VPN or tame crypto failed or malware or...
One tasked group gets the win, glory and the long term connections globally back to that device connected to a user.
If this idea of a legal, low power device gets to be used then other traditional expensive local methods will have to be considered again.
Suddenly only a final hop is understood and the owner, residence, provider and other easy details are useless until the interesting user makes mistakes.
Governments would be back to the early 1980's having to send out teams in cars, vans, trucks trying to track short term signal bursts as they work back to the real network origin.
Locals tend to notice fast or slow new transport in the area or new funding for instant CCTV in an area, public and private. Even flying over an area in a search pattern gets noticed.
The main risk is the user makes mistakes or they return to unique patterns, hardware or terms they use on their normal everyday accounts.
A wireless surveillance system for wifi and other data siginals can cover a big city, in place to provide near instant triangulation of any signal of interest?
Are total spectrum tools ready for in use in most domestic city areas? The need for a plane or larger van locally would be reduced as origin could be found in real time.
re "Second, the business community will not and cannot tolerate losing the ability to encrypt while also using the public internet synchronize their databases and handle communications."
Most banks have everyday, normal accounts tracked federally down to the 100's of $ over time on any normal account.
Thats all been reported and fully accounted for as it has been for years. Other issues are usually never public as the banks talk of the confidence of investors.
More federal oversight on the same type of accounts would not be an issue.
Anything found on servers facing outside networks is usually altered to make tracking very, very easy. Anything interesting is changed to help track internal cleared staff "looking up" data.
A unique term found or created by internal security is very trackable and would be on a lot of powerful watch lists at much more higher security levels.
Vast accessible databases contain vast numbers of extra projects, terms, locations, ranks, support requests that might have existed in some form or never existed, sound amazing but are left in, updated as a trap.
Tracking all internal and later external searches from such interesting databases is more easy if the data is readable and staff dont have to ask and have a reason in person.
Its a honeypot for all internal staff cleared to have access at that level and points to any signs of external leaks or staff issues.
That is why governments will do what they do. Constant internal and external tests to see who does what, why, how, when, where and can then act on the results with no risk to any real projects.
Do the number of network look ups match the given paper work, paper trail? What else was been search for?
The cleared staff, other governments, external groups looking in, the media have to understand the entire data set is very much 'real', 'vital' and 'active'.
In decades past other governments would pay big, expose their own spy networks and believe they had something rare.
Over the decades open network database finds are more carefully considered by most smart nations.
Collect it all is not just for external public networks or public encryption use.
Re "Third, who are they actually trying to stop from using encryption?"
All governments have understood since the 1950's that any US or UK network, hardware is a trap.
Longer, safer more traditional methods work just fine unless a one way message is needed and is worth the risk or everything related has been uncovered.
Cults, faiths and other groups have their own person to person methods and years of complex internal vetting.
Top corporate companies, private interests usually have contacts in their own governments and should be aware of what their competitors and other nations can do to their complex internal networks.
Sleeper, deep penetration agents, gov fronts for international humanitarian work, expat workers with direct links to other nations are usually very careful too.
A face to face holiday meeting back home or a one way message "broadcast" for all is low risk. Entire lives on social media hold up to most complex private sector and other gov scrutiny.
The list of interesting people to watch is short, considering the new political message that all networks will be watching all users all the time.
The only win is the sale of more collect it all hardware, software, upgrades and maintenance contracts.
The traditional watch and listen as to keep the collect it all networks open and in use would have still worked. Parallel construction with wide press coverage as to the fake methods used was still working for many.
The budgets for contractors "collect it all" systems might be so huge soon that they will have to be public by default?
The UK had to work too hard to hide its emerging SIGINT spy satellites options. The change of funding to much cheaper US systems was a huge loss to US and UK contractors.
With mil funding been more in the open, the growth for contractors is no longer limited by the ability to hide project funding every year. Whomever is pushing this will collect it all in terms of public funding over decades.
re "Unless some kind of oniony or multi-hop routing is involved, I presume."
What is the first hop from an average home computer, out of an office network, a cafe with wifi?
The everyday, average real time use of a destination or origin is trackable on most national networks.
A public telco, private network or telco? The layers of communications can request oniony or multi-hop but that physical network entry and exit point is a bit more fixed in most nations.
Think of the work that went into detecting the use of virtual encrypted disks over time. All that matters is the detection or wider public understanding that the message cannot be detected over a network.
With detection comes the origin of the message, destination, method used and ability to trap door, back door to get the message before any steganography.
Re "I know someone in the .... who told me that they can access anyone's phone, ... EXCEPT" ...
Every connected device sold in the US has to be "wiretap" friendly by design over every generation of product.
Thats full logs, voice prints, plain text, images, voice, gps, call details, unique camera details per image, remote mic/camera on, network power on.
A city, state, county might have some well understood new private sector software packages that they show all their "cleared" staff.
The staff having seen that experiment then consider some brands safer and buy it, recommend it, whisper and chat about it.
Word gets around that a few top, easy to find US brands are still safe to communicate fully and freely on over every decade.
A few different branded phones are then used. A normal work phone, a private phone, a phone for
Great to keep everyone of interest talking on digital networks that can collect it all.
A person has the freedom to develop, talk about, attract interested people, fix, code, test, compile, run and release any crypto they like on mainstream OS and networks. ...
The security works as tested by a few or many experts who found each other on the same mainstream networks and sites...
The obscurity part is entering the plain text, tracking the message and decoding.
Do that on a tame OS and tracked network and all that freedom for security jus makes the message stand out.
Decade in decade out, enjoy the "free" crypto community hosted by
Strong encryption use just makes a message stand out. All French networks can collect it all thanks to "free" help from the US and UK going back to the early 1970's.
Who is sending any messages and where makes for easy traditional police work at a local level. France has a lot of police and funding so long term undercover work is not a problem. Any regional or local groups can be turned or watched as they form and communicate using any encryption.
The only problem for France is that its vastly improved network tracking let the US and UK deep into its secure French gov networks again.
A collect it all system from the US/UK has helped decode the French gov.
France got to collect it all but so did the US and UK.
The ability of the UK and US to track any networked message removes all anonymity and then allows privacy be worked on.
A person, brand, company, project can create, compile, sell, offer, use all the encryption it wants.
A US or UK telco or network interconnect will always be able to track the message from its origin to the destination.
With a loss of anonymity, privacy is then very easy remove per user or site.
US and UK network ready devices, networks, tame computer systems are all law enforcement friendly so the layer the user encryption was created on will always be obtainable as designed and sold.
Plain text, voice, images, a log of network use are just waiting on most big brand US computer systems as designed and sold.
The ability of law enforcement to collect plain text as entered or when decrypted on a normal user system ensures privacy is never a problem once tasked.
How a user opts to use a network between two computer systems compromised by design is not really an issue.
The other plus for a lot of popularized encryption is that it stands out for a US/UK collect it all system.
Encryption is just the easy way to find a user and then use a waiting trap door or back door in the office, home, network or commercial system or hardware.
The US and UK will not restrict encryption. The more users feeling they need to find and turn on junk encryption just makes the task of finding people of interest on networks more easy.
Thats why number stations and one time pads worked well in the past. Its kind of hard to find who listened to an international broadcast.
But with the direct use of any encryption between two sites that task is now very easy.
With anonymity gone, plain text is just a network request to a law enforcement friendly OS.
Wise Western governments should fund, offer grants to all encryption products, experts they can find. Create front companies and fund tame academics.
It makes finding interesting people so much more easy on all networks when they use known encryption everytime.
Restricted encryption historically was a tool to drive people onto the tame encryption over generations.
Why the interest in all human rights groups?
Irish attempts to reach out to the US with human rights issues in the mid/late 1960's had to be reshaped.
South Africa had a vital site shared with the UK for global network tacking expanded in the 1970's.
Argentina was interesting emerging market for UK naval systems (frigates) sales into the1970's.
The issues of trade unions within the UK national security sector was interesting due to the 1987 the European Commission of Human Rights findings.
The emerging 1990's European Convention on Human Rights was an issue for the UK gov.
Every decade had its press and human rights issues that had to be shaped so UK protesters, academics and lawyers could be guided around, away from complex trade and mil issues.
Re "revelations was the discovery that the NSA doesn't have any secret ways into properly done crypto "
The NSA and GCHQ have enough hold over emerging academics, crypto, open source and crypto history to shape any useful standards.
Before Snowden the idea was that some one or something to do with academics, open source, political scandal, private sector legal leadership, private sector risk, the press or very smart people or antivirus protection teams would notice "something" about weak international crypto standards and the computer press globally would ensure a rapid international exposure and correction.
Nothing was noticed in the banking and telco networks of the 1960's, 70's? into the home computers of the 1980s, the emerging social and security standards, beyond 2000... company and university experts and their endless funding and grants.
The UK enjoyed plain text decryption in pre ww2 Europe and into the 1950's. The US expected the same on any emerging networks.
NATO nations and any country with links to the West got expert help to secure their systems and new networks. Totally secure along the network. Reverting to plain text in realtime for the NSA and GCHQ every upgrade and decade.
Re "This is the cause for the government's alarm: encryption by default would be very inconvenient for them."
The hardware and low level text input will always revert to plain text to be displayed or entered by the user. Law enforcement will always have access to that if the device is to be sold in the US or UK. The user can run any application they want and developer can compile, sell any application they like on top but the voice and text at its most readable level always reverts to a form that is wiretap friendly as sold within the device by design as sold.
Compile, design, encrypt, its the hardware and OS that will always be ready to report back when needed every time a cell or other network connection is made.
re "There's nothing anyone can really do to fix that"
The Soviet Union fixed the issue by using one time pads in the 1950's for a short time but had to give up as it had so much data to move globally. Once upgraded entire networks where again fully open to the NSA and GCHQ at all levels over decades.
France had all its diplomatic traffic intercepted by the US and UK in the 1950's. Hardware fixes in the 1960's helped but then the amazing upgrade offers from the GCHQ in the early 1970's opened most interesting French networks to the US and UK again.
re "The government lost the first with Clipper" The US and UK had hardware, networks and software standards as shipped. A generation was distracted from understanding the lower layers of popular OS or networks standard as shipped by ideas that an extra 'special' chip was needed.
The sale and use of home computer or cell phone at a low cost was all that was needed.
re "There's nothing anyone can really do to fix that" The world is slowly understanding that decades of weak networks and junk crypto standards are not just open to 5 eye nations. Smart people, dual citizens and other trusted nations with other regional goals all now know of the the same methods and ideas and have have been enjoying the same access.
Companies and people with good emerging products and ideas need anonymity and privacy so they can bring a product to market. Having competing nations read deals, grants and support requests is going to result in loss to established competing brands.
The fix is for nations and their own brands to get their internal anonymity and privacy back. More back doors in every computer and networks open as shipped is not going to help with that.
The crypto war was lost in the 1920's with telephone networks and embassy networks. No emerging network was ever out of reach again.