Dear diary...

A small and insignificant source of commentaries on what's going on in the world today. By Jozef Purdes.

Departments
Front page
Random Ramblings
The Luddite's View
Hyde Park
Propaganda'r'Us
For Future Reference
Archive
E-mail

Friends
Adam
Sorknes Art
Single Butterfly
Snowberry Way

Rate Me on BlogHop.com!
help?

This work is licensed under a Creative Commons License.

How not to catch the terrorists
From the "For Future Reference" department
The New York Times backlash is raging on, by people who obviously don’t know how risk calculations work. This just follows the same old pattern: find a liberal target, and when a few people start attacking, join them until a crowd is formed. This kind of herd mentality has been around as long as animals congregated in herds.

But consider two things. The first was already discussed on plenty of places, from Reason Magazine to the Jon Stewart Show. The New York Times disclosed the first surveillance program that’s actually legal and not controversial at all. This is the first program the administration shouldn’t be ashamed of admitting at all. The opponents will counter that it’s not the President’s image that counts, but the security of the nation. This is also a valid point. However, they fail to realize that any terrorist or criminal with half a brain would have expected the existence of this program a long time ago. By fuming about revealing the existence of the financial surveillance program, conservatives show how much they underestimate the terrorists. This has caused the loss of countless lives, and unless we start taking the terrorists seriously we’ll be losing countless more.

Underestimating the enemy leads to complacency. And thus, we are currently in a situation where we are able to intercept the communication of only those people who are innocent or too dumb to use even the simplest methods to evade surveillance. Just consider:

Phone wiretapping. Direct connection voice services have been around since Windows 3.1. You don’t use any voice or VoIP network; instead connect directly to the end user. You’d need to monitor all Internet traffic to capture these data streams. As an alternative, you can use phone services of instant messenger programs, and connect to the Internet through a proxy from a safe country. A terrorist in Iran could connect to a UK proxy, and call up his friend in the US. The surveillance software would give this call a very low priority level; that is, if the software was able to monitor these calls. It isn’t.
Internet monitoring. AOL does not monitor its traffic at all. Earthlink monitors a very small portion of its traffic. Sprint, the nation’s largest Tier I ISP, misses 40% of the most common Internet attacks; it does not monitor for non-malicious traffic. Those who monitor parts of the traffic record the data on high-capacity tapes and physically ship them for analysis. The only outlet that monitors and stores all Internet traffic going through its pipes is the Department of Defense. They collect around 500GB of data per day, but only for forensic purposes. That’s because running a simple query on the data can take up to two weeks. What I’m saying is that there is currently no monitoring of Internet communications. The only thing the security agencies can do is to monitor specific traffic from specific IP blocks, such as certain countries.
E-mail monitoring. Monitoring like this is feasible. Look for certain traffic from terrorism-friendly countries. As before, using instant messaging and IP anonymizers will do the trick.
Web-site monitoring. Security services love to spend their time looking for secret messages on known terrorist Web sites. If a terrorist is too paranoid, all it takes is to open an account on Flickr or similar service, and upload family pictures with encoded messages will be undetectable. In fact, this is so many steps ahead of current surveillance capabilities (at least those the government admits to) that the US won’t ever catch up to even the least computer savvy terrorists. To make the bad news even worse, the incremental inconvenience for using such system is minimal.

The US security services are clearly wasting their money on programs that are ineffective, and when they are leaked to the public, they try to shoot the messenger. They clearly show that they are underestimating the enemy, and they are willing to do so, as long as the money is flowing. Clearly, the government and its supporters don’t know the odds. This year, the average American had a 10% chance to have his identity stolen. In 2001, the year of the biggest attack on the US soil, the average American had a 0.001% chance to die in a terrorist attack. In other words, for every American dying in a terrorist attack there were 10,000 at risk of having their identity stolen. Having refused to own a credit card, I know how hard it is to live in the US without a credit history. I’m much more afraid of identity theft than the terrorists. And don’t get me even started at the odds of dying on the Atlanta roads…

Instead of tackling the identity theft issue, the authorities are as complacent as with the terrorists. They claim that everything has been fine with the stolen laptop with over 26 million identities because the data appears not to have been accessed. Here’s news for the authorities: many hard drive recovery methods, such as using the Knoppix Live CD, can access even password-protected portions of the disk and extract data, without triggering the flag that would identify the data as having been accessed.

What was I trying to say with this? That revealing the financial surveillance program is not news. That our opponents, whether terrorists or criminals are much more savvy than we give them credit. And that all these programs achieve is to keep us complacent until the next big one hits. And there’s nothing we can do about it, no matter how much the government spies on those people who have nothing to hide, while knowing fully well that it does not have the capability to spy on those who don’t want to be seen.
June 30, 2006 at 3:35 pm GMT by Jozef