Thoughts on Undercover Communication

http://grugq.tumblr.com/post/68391438761/thoughts-on-undercover-communication

by gwern • 13 years ago

96 21 13 years ago

grugq.tumblr.com

Whoa! I like this guys blog...his presentation on OPSEC was fantastic...but this is THE most inflammatory title I've seen in a year.

EDIT: He is the go-to OPSEC guy if you are new to computer security writers.

alx• 13 years ago

The Grugq - OPSEC: Because Jail is for wuftpd

https://www.youtube.com/watch?v=9XaYdCdwiWU

gwern4• 13 years ago

but this is THE most inflammatory title I've seen in a year.

That was deliberate. I suspect that HN has somehow penalized or moderated my submissions, because while my submissions used to get on the main page literally every other day, for the past month my submissions have almost all been stuck at +1 or +2 (https://news.ycombinator.com/submitted?id=gwern). So instead of the utterly boring and anodyne title Gruqq gave his post...

grugq4• 13 years ago

That's actually the title that was originally used to link to baal.html. http://dee.su/liberte-peer-review

dfc• 13 years ago

The faq/guideline is pretty clear that the title field is not for editorializing. I don't know if there is a moderation feature like you posit but what can one expect after breaking community guidelines. Are the lower scored submissions items that you modified the title?

grugq4• 13 years ago

Hmmm... "Musings on Underground Communication"? "Underground Communication, some thoughts"? Not really sure what's so inflammatory about the title.

When analyzing the activities of groups facing an adversarial environment to learn what works, what doesn't, and why, (unfortunately) the pool of covert organisations is somewhat limited: intelligence agencies; terrorist groups; hacker crews; narcos; insurgents; child pornographers... Few other groups face such a hostile operating environment that their security measures are really "tested".

This group had an incredibly effective set of security practices. They imposed strict compartmentation, regularly migrated identities and locations, required consistent Tor and PGP use, etc. They had legitimate punishments for people who transgressed the rules (expulsion) and they survived a massive investigation effort. Clearly, they were doing something right (actually a number of things).

Just as clearly, they are reprehensible people who engage inactivity that is immoral and unethical, by any measure. (Paying for child pornography to be produced is flat out wrong, regardless on where you stand on the spectrum of opinions regarding child porn laws.

The thing is, there are basically no nice people who provide case studies of OPSEC practices. Most are engaged in violence, serious drug trafficking (at the "kill people for interfering" level), theft and manipulation of human beings, etc. Thats the nature of the beast.

As a friend of mine said "if your secure communications system isn't being used by terrorists and pedophiles, you're probably doing it wrong".

People with well funded, trained and motivated adversaries have the strongest incentives to practice the highest level of security. They're the ones to learn from. :)

chmike• 13 years ago

This is like antibiotics. The natural selection process will push people to use more secure communication methods etc. The conclusion, for me, is that repression is not the way to go and makes the problem only harder to monitor and control. The strategy I would follow to address this problem is to identify the mechanism by which these type of behaviors reproduce themselves and contamine new people. This is where to target. And again, not in the Rambo way, in a chess way where everything is kept under control and will lead to the final check mate.

Shish2k• 13 years ago

Not really sure what's so inflammatory about the title.

The original submission was something like "useful lessons from paedophiles"

mikegioia• 13 years ago

Does anyone have a cached copy of http://dee.su/uploads/baal.html? It seems dee.su exceeded his CPU limit already...

Estragon• 13 years ago

http://webcache.googleusercontent.com/search?q=cache:mZhbfnr...

7b64f0f2• 13 years ago

http://pastebin.com/n2c6Muhe

krallja• 13 years ago

https://gist.github.com/krallja/7710464

gwern4• 13 years ago

It is also in the Internet Archive.

lucb1e2• 13 years ago

Is anyone able to verify the signature? GnuPG gives me a BADSIG error.

I was actually looking for what info was included in the signature (e.g. a timestamp), but it seems KGPG doesn't provide that. However the sig itself does not even seem to be valid, though it's probably because I copied it out of Google's cache.

Edit: For some reason, this does validate for me: https://gist.github.com/krallja/7710464

e12e• 13 years ago

Validates fine if you get the raw gist:

curl 'https://gist.github.com/krallja/7710464/raw/8d55ac6fb74e979b... | gpg -v

(...)

gpg: Good signature from "Baal_signing <Baal <Use-Author-Supplied-Address-Header@[127.1]>>" aka (...)

lucb1e2• 13 years ago

Yes I managed to get this already, thanks though!

It was probably Google's cache that was giving trouble, the Github one worked fine.

grugq4• 13 years ago

The follow up posts on this particular piece are:

http://grugq.tumblr.com/post/68391880015/defcon-21-de-anonym...

And:

http://grugq.tumblr.com/post/68392646777/castleman-affidavit

contingencies• 13 years ago

The later one links to google docs. Anonymous quagga, indeed.

grugq4• 13 years ago

The castleman affidavit is available from a number online sources. I have mirrored it on google docs to save people the hassle of tracking it down.

Here is one link off google, if you prefer: http://www.rep-am.com/newsdocuments/affidavit.pdf

gwern4• 13 years ago

I spent the $5 to jailbreak the full Castleman complaint from PACER: https://dl.dropboxusercontent.com/u/182368464/2008-gov.uscou...

Thoughts on Undercover Communication

Related Stories