Financial Cryptography

Threatwatch - sigint by Hezbollah, nyms by torture units, closed source weaponry

Felix points to a Newsday article that describes signals intelligence in the recent Lebanon battle.

Hezbollah guerrillas were able to hack into Israeli radio communications during last month's battles in south Lebanon, an intelligence breakthrough that helped them thwart Israeli tank assaults, according to Hezbollah and Lebanese officials.

Using technology most likely supplied by Iran, special Hezbollah teams monitored the constantly changing radio frequencies of Israeli troops on the ground. That gave guerrillas a picture of Israeli movements, casualty reports and supply routes. It also allowed Hezbollah anti-tank units to more effectively target advancing Israeli armor, according to the officials.

"We were able to monitor Israeli communications, and we used this information to adjust our planning," said a Hezbollah commander involved in the battles, speaking on the condition of anonymity.

First off, article tries and fails to make the case that the codes were cracked. If that article is anything to go by, it was straightforward -- and well done -- signals intelligence, not code cracking. (El Reg describes it more fairly.) Secondly, it provides more evidence for the reasons behind the Israeli defeat at the hands of the Hezbollah (defeat in straight military mission terms):

"The Israelis did not realize that they were facing a guerrilla force with the capabilities of a regular army," said a senior Lebanese security official who asked not to be identified. "Hezbollah invested a lot of resources into eavesdropping and signals interception."

The Israelis like many modern political movements have been so well fed on a diet of terrorism that they missed the transition. Hezbollah has moved from terrorism through guerilla and up to army status, as laid out in the theory of guerilla warfare. The depth of sigint capability bears this out.

Aside from minor criticisms, a good article. Why talk matters military on an FC blog? One of the reasons that the Internet is so messed up, security wise, is that the threat models derived from military and spook lore. For example, the MITM is more of a threat in the military, less of a threat on the net (rising commercial use of wireless might have been expected to change that, but there isn't much empirical evidence). This failure to understand the different threat models caused massive rollouts of unneeded infrastructure, stuff that could help us now but is instead being slowly built around by banks, merchants and other institutions.

Just because we were fooled once doesn't mean we can't be fooled again, so it is important to keep an eye on related threat fields. Here's some older notes on recent threats in the military world.

In the ongoing saga of institutional torture in the US forces, the NYT published a new case regarding an elite terrorist unit known briefly as Task-Force 6-26 (SMH). Not only does the unit change its name from time to time the individual soldiers have picked up the trick:

Army investigators were forced to close their inquiry in June 2005 after they said task force members used battlefield pseudonyms that made it impossible to identify and locate the soldiers involved. The unit also asserted that 70 percent of its computer files had been lost.

Pseudonyms are not perfect. But, they can do a lot to help privacy, in that they break the chain of investigation. It's not so easy in digital systems, because the pseudonyms are generally used to communicate with other pseudonyms or persons, and that leaves a chain to track back, as well as the tendency for server software to log lots of events. But with persons, it is a grand trick.

Military and legal experts say the full breadth of abuses committed by Task Force 6-26 may never be known because of the secrecy surrounding the unit, and the likelihood that some allegations went unreported. In the summer of 2004, Camp Nama closed and the unit moved to a new headquarters in Balad, 45 miles north of Baghdad. The unit's operations are now shrouded in even tighter secrecy.

Secrecy is always a threat to your operations. It may bring benefits, but the costs are severe as secrecy hides weaknesses from yourself as well as your enemy, and there is no easy way to know who can breach that veil. It is the canonical two-edged sword, and we generally address such threats-to-self with governance techniques - separation of roles also known as the 4 eyes principle, publication of key events, entangled logging, shared signed receipts, and so forth.

Which leads us to the age-old problem of buying stuff from people you don't trust. Ben pointed to:

The UK has warned America that it will cancel its £12bn order for the Joint Strike Fighter if the US does not hand over full access to the computer software code that controls the jets. Lord Drayson, minister for defence procurement, told the The Daily Telegraph that the planes were useless without control of the software as they could effectively be "switched off" by the Americans without warning.

Well, of course. The software for those planes is quite something, and only the source code is going to give you some confidence that there aren't any backdoors.

In a related episode, Washington DC discovered around the same timeframe that there may be an issue with the Boeing 787, so they have asked Boeing to not hand over any military or secret related material to the Chinese. Whoops, too late, it turns out the wing is being manufactured in China ... for those who don't know, in avionics terms, the wing is the prize as it is the one component that limits and dominates everything else, design wise.

Posted by iang at September 20, 2006 06:27 AM | TrackBack