Subject: [NEXTEL-1] Are the glory days of electronic spying over—or just beginning?

From: Marcel <[email-masked]>
Date: Thu, 10 Apr 2003 00:53:27 -0400

Listening In

Are the glory days of electronic spying over—or just beginning?

By Stephen Cass

 Submarines prowl the ocean floor, while ships above carefully skirt the limits
of international waters. On dry land, guards patrol high fences surrounding
acres of huge golf ball-shaped radar domes. In the skies, airplanes knife
through the stratosphere, while higher up orbiting electronic ears listen to
whispers from the planet below.

They're all trolling a vast sea of electromagnetic signals in hopes of catching
a terrorist plot in the making, a shady arms deal, economic intelligence, or a
rogue nation building a weapon of mass destruction. This so-called signals
intelligence, or Sigint, has been vital to the United States and its allies for
decades. But, in the wake of 9/11 and the failure to capture Osama bin Laden,
the shortcomings of the world's biggest interception system are apparent.

The ships, planes, antennas, and satellites are the result of a triumph of Cold
War engineering, designed to keep tabs on the Soviet Union and its allies. The
question now is: how useful is the system against terrorists who know not to
trust their satellite phones? How effective can it be in an age when almost
untappable fiber-optic lines carry information at stupefying rates and cheap,
off-the-shelf encryption systems can stump the most powerful supercomputers on
earth?

Given the veil of secrecy drawn by nations around their intelligence operations,
these questions might seem unanswerable, but even top-secret agencies have to
operate in the real world, making it possible to draw some conclusions.

Those findings paint an intriguing picture of modern Sigint, in which the best
way past a tough problem can be to solve a different one. Rather than the
creation of ever more sensitive receivers or code-breaking computers, the hot
areas of cloak-and-dagger information gathering include tapping fiber-optic
cables (even at the bottom of the sea); using tiny bugging devices and old
fashioned bribery, blackmail, and burglary to get at data before it has been
encrypted; exploiting software flaws and poorly configured communications
systems to bypass data-security measures; and automatically winnowing the vast
amounts of intercepted communications.

Big brother or white elephant?
The old workhorse surveillance system described above is run by the United
States—with the United Kingdom, Canada, Australia, and New Zealand as junior
partners—under the secret 1947 UKUSA agreement. Often referred to as Echelon in
the popular press, some fear it as the ultimate Big Brother: listening in on
every telephone conversation, reading every e-mail, tracking every Web surfer
around the globe.

But these fears are greatly exaggerated, explains Gerhard Schmid, vice president
of the European Parliament and rapporteur of a 2001 report to the parliament on
the UKUSA system. Schmid notes an obvious fact that many seem to forget: only
those communications that the system has access to in some way can be
intercepted. "There is no special magic physics for secret services....The rest
is movie stories, rumors, and nonsense," says Schmid.

In effect, whether or not the Sigint system is of value boils down to a
technical question: in the face of a telecommunications explosion that has
brought e-mail, cellphones, beepers, instant messaging, fiber-optic cables,
faxes, videoconferencing, and the World Wide Web to every corner of the globe,
can the UKUSA intelligence agencies attain enough access to know what's going
on?

Of course, some communications are easier to access than others. Wireless
communications in particular offer two key advantages—you can intercept them
without physically tapping into the target's communications system, and there is
no way to detect that they have been intercepted. "Microwave, radio, telephone,
walkie-talkie—communications that are in the air are all interceptible by some
sort of antenna in the right place," says Jeffrey T. Richelson, author of The
U.S. Intelligence Community (Westview Press, Boulder, Colo., 1999).

Much of the UKUSA system's physical assets around the world and orbiting above
it are devoted to making sure there is an antenna in the right place. Listening
posts of varying scale dot the earth—including on top of every U.S. embassy.
Many are attached to military installations, while some are operated remotely.
Others are mobile, on navy ships and submarines and on specially modified planes
such as the EP-3 that crash-landed in China in 2001. For decades these
eavesdroppers provided much of the intelligence community's Sigint.

But, for tactical and technical reasons, the well began to dry up at the start
of the 1990s. The biggest tactical problem was that the Soviet Union's collapse
kicked the legs out from under a monitoring network built up over decades.
"There were some easy things about the Soviet Union," says James Bamford, author
of Body of Secrets: Anatomy of the Ultra-Secret National Security Agency
(Doubleday, New York, 2001). "The first one was you always knew where it was.
You could invest a lot of money in a big listening post in Japan near
Vladivostok because the Soviet navy was always going to be there."

Apart from being easily located on a map, the USSR also generated a steady
stream of routine radio and microwave transmissions to provide grist for the
intelligence wheel. "It's completely different when you're going after sporadic
miniwars and terrorism," says Bamford.

The technical issues arose from the Internet-driven telecommunications
explosion, the most serious consequence of which is the ever increasing shift
toward fiber-optic-based international communications. The shift was due to the
commercially attractive fact that one fiber can carry 128 times as much digital
traffic as a satellite transponder—over 240 000 channels, each carrying 64 kb/s.

Breaking into Davy Jones's locker
Before the widespread use of fiber-optic cables, geosynchronous satellite
constellations such as Intelsat and the Russian-sponsored Intersputnik carried
much of the international communications traffic. Such links can be
comprehensively monitored by placing a receiving station in each satellite's
transmission footprint. And thanks to the global range of the territories
belonging to the UKUSA countries, exactly such a collection of stations was
built, from Pine Gap in central Australia to Morwenstow in England and Sugar
Grove in Virginia [see map].

In contrast, cables have to be tapped directly. While this is easy enough to do
if the cable makes landfall in a territory controlled by a UKUSA country,
someone has to visit the cable clandestinely if it doesn't, typically in a
submarine. Fiber-optic cables are the toughest to crack: fibers don't radiate
helpful electromagnetic fields (as did the old metal cables) that can be
detected with an inductively coupled pick-up collar.

Eavesdroppers first solved this problem by targeting the signal-boosting
repeater stations strung along the cables. Early repeaters had to convert the
signal from light into electricity and back again in order to amplify it, and in
its electronic stage, the signal could be tapped externally in much the same way
as a metal cable. But the development of erbium-doped fiber amplifiers, in which
the signal is boosted without ever being converted into electricity, called for
a new approach.

In theory, it's easy to find out what's being transmitted along a fiber. "All
you have to do is put a little bit of a bend in the fiber and look at the light
that comes off it," says Jim Hayes, president of the Fiber Optic Association, a
professional society for the industry. The signal loss in the fiber would be
just a few tenths of a decibel, making the tap undetectable. "But practically,"
he adds, "it's not so easy."

The problem, Hayes explains, is that, in a typical cable, the fiber in question
is one of a dozen hair-thin strands of glass, which are embedded inside a
laser-welded, hermetically sealed, 3-mm-diameter stainless steel tube. This tube
is in turn covered by a few centimeters of reinforcing steel wire and cables
carrying 10 kV of dc power, all at a depth of a couple of thousand meters.

"It's not impossible—but it certainly pushes the definition of practical," Hayes
notes. The easiest interception technique is to open up one of the repeaters to
get at the fibers, but, Hayes cautions, "the whole issue of resealing it is
quite difficult because you have to do it perfectly." Parts must either be
sourced from the manufacturer or duplicated exactly.

Despite these challenges, "the U.S. has been reconfiguring the submarine USS
Jimmy Carter for [fiber-optic tapping]," says Richelson. The Jimmy Carter, one
of a new Seawolf class, is being extensively modified for a range of covert
missions by the introduction of a new hull section, which will facilitate the
use of remotely operated vehicles, surveillance equipment, and the transport of
Navy Seals, the U.S. Navy's special operations warfare specialists. The sub is
also being fitted with an advanced communications mast, which will allow it both
to eavesdrop on radio signals and transmit information back to base. The Jimmy
Carter should be fully operational by mid-2005 [see illustration].

Bond, James Bond
But a big remaining challenge, according to John Pike, a defense expert and
founder of GlobalSecurity.org, are fiber-optic cables that stay on land. "I
think that one of the things that [Navy Seals] spend a fair amount of time doing
is [going] ashore...and walking to the nearest land line," says Pike. "They were
doing that in Iraq a decade ago." Pike believes that this may also be how
fiber-optic communications in North Korea and other countries are monitored:
"It's cat and mouse, we try to see how many taps we can put on [chief of state
Kim Jong II's] fiber-optic network, and the Dear Leader runs around and tries to
catch them."

Another, more aggressive approach to the land-line problem is to force an
opponent onto the airwaves. "One of the things the United States has been doing
since the middle of 2002 is systematically taking apart Iraq's land-line
communications with air strikes, to force them to communicate via channels that
are more readily compromised," says Pike. Indeed, this may be the reason why
U.S. Secretary of State Colin Powell was able to present incriminating Iraqi
telephone conversations to the United Nations last February.

When a more subtle approach than aerial bombardment is called for, agencies like
the U.S. National Security Agency (NSA) and the Central Intelligence Agency
(CIA) can call upon organizations such as the Special Collection Service (SCS),
a joint NSA-CIA covert group headquartered in Beltsville, Md. "What this group
does is the more surreptitious black-bag operations," explains Wayne Madsen, who
previously worked at the NSA and is now a senior fellow at the Electronic
Privacy Information Center (Washington, D.C.). Black-bag operations can include
breaking into embassies or facilities of communications providers and stealing
information or installing bugs.

--------------------------------------------------------------------------------

"It's been extremely difficult to break Russian ciphers"
--------------------------------------------------------------------------------

By bugging a computer or communications system, information can be captured
before it's sent through a fiber-optic cable, author Bamford observes. A tiny
microphone dropped into a keyboard can pick up the sound made by the keys as
they are struck and transmit the sounds to a nearby receiver. Different keys,
according to Bamford, "sound different—each has a specific signature." Those
signatures can be used to reconstruct what was typed.

The SCS also allows the Sigint community "to be proactive, to go after
information rather than sit and wait," explains Bamford. Another important SCS
mission is to recruit people who work for targeted governments, like
cryptographic clerks or systems administrators, to ensure access to sensitive
information, such as cipher keys. When successful, such activities also allow
the NSA to avoid another steep hurdle: encryption.

Say what?
The NSA claims to be the world's largest single employer of mathematicians and
has always projected an image of being a code-breaking outfit par excellence, in
the mold of the legendary British Bletchley Park, which succeeded in breaking
the German Enigma and other ciphers during World War II. But these days, there
may be some misdirection in that image.

The NSA has "covered up some quite spectacular successes at breaking into cipher
systems...by pretending that they were simply better at mathematics and computer
science, whereas what was usually happening was some form of sabotage,
blackmail, theft, corruption, or whatever," says Ross Anderson, a reader in
security engineering at the University of Cambridge and cryptographic systems
expert. (When contacted by Spectrum for this article, a spokesperson for the NSA
said that it does not comment on operational matters.)

NSA's code-breaking efforts began to run into serious trouble relatively early
in the Cold War. According to Bamford, immediately after World War II the NSA
captured German code-breaking machines that allowed them to read advanced
teleprinter ciphers that the Soviets were using at the time. But because of a
suspected spy, the Russians found out and in 1948 changed all their ciphers
overnight.

The next day became known as Black Friday, reports Bamford. "From that date on,
it's been extremely difficult to break Russian ciphers. Most of what the NSA
got, they got from occasional busts." A bust is a mistake in the implementation
or operation of a cipher system.

"Sometimes they don't know they're making a mistake. A clerk is typing away and
all of a sudden the crypto system disengages," explains Bamford. This can give a
code-breaker enough of an opening to be able to go back and read the entire
message.

The solution was to go around the problem. To divine Soviet diplomatic plans,
the UKUSA agencies might track a meeting between a third-world diplomat and the
Kremlin. When the diplomat sent a coded report back to the home government, the
spooks would go after this target's weaker encryption.

"Big governments like the United States and Russia use home-brewed [cipher
systems]. But they've learned through 50 years of experience to do that well,"
says Brian Gladman, a former deputy director of the NATO Shape Technical Center
who has worked with Government Communications Headquarters (GCHQ), the British
equivalent of the NSA. "Smaller countries don't have that experience, and [when
they] build home-brewed ciphers, they don't do very well." Countries—including
Middle Eastern nations—have also purchased commercial cryptographic machines,
but may not have always operated them properly. (There are also rumors that the
NSA obtained the default keys to some units prior to delivery.)

In any case, the rise of ubiquitous computer communications has allowed the
emergence of widely available strong cipher systems, such as public key
cryptography, which rely on mathematical functions that would take the greatest
supercomputer on earth millennia to break. Initially, this caused something of a
panic in intelligence circles and sparked the so-called crypto wars of the
1990s, when the U.S. government arrested Phil Zimmerman, the creator of one
popular public key program, Pretty Good Privacy, and attempted to impose
stringent export controls on cryptographic software. But the underlying
mathematics was already freely circulating. Non-U.S. companies threatened to
take over the expanding market for online security products and the government
eventually relented.

But even with theoretically unbreakable encryption available to anyone with
Internet access, all is not lost for the code-breakers; once again the solution
is to go around the problem. Nowadays, "exploits against cipher systems involve
failures in design and implementation rather than in the underlying
cryptographic algorithms," as during World War II, explains Anderson. The same
kind of flaws and foul-ups—buggy software, poorly configured systems—that allow
computer worms to wreak havoc on the Internet, combined with SCS-style
activities, give agencies like the NSA a continuing window of access to the
activities of rogue nations and the businesses they deal with.

Indeed, the adoption of new telecommunications technologies has not been all bad
for the intelligence agencies. Actually, the widespread deployment of cellphones
in countries with historically underdeveloped communications infrastructures has
made surveillance easier, especially of nongovernment targets, like terrorists.
"There's more and more cellphone coverage, even in places like Pakistan," says
Madsen.

Pike agrees: "Incomes rose faster than land lines could be put in....Since so
much of the economic activity in these emerging economies was focused in a few
primary cities, it was relatively easy to overlay a cellphone system." And it is
exactly these cities that are likely to host an eavesdropping U.S. embassy or
consulate.

Cell- and satellite phones can also reveal a caller's location. In cooperative
countries, such information may be extracted directly from the cellphone
network, while in other regions the location may be determined if multiple
listening stations (possibly including satellites) can pick up the phone's
transmissions. It was by pinpointing the origin of a satellite phone call that
the United States determined the coordinates for the 1998 cruise missile attack
on one of Osama bin Laden's camps in Afghanistan.

Drowning in data
But these successes in keeping 21st century communications an open book have
just compounded the biggest issue of all: volume. "It's hard to comprehend the
enormous increase in communications in the last 15 years....You're talking two
million pieces of communication an hour from one listening post," says Bamford.

More and more of the NSA's vast computer resources are devoted to simply storing
and cataloging the torrent of raw Sigint that pours into its Fort Meade, Md.,
headquarters. The agency's ultimate problem is that there are just too many
people on earth to monitor everyone. The only solution is to throw away as much
as possible of the information as soon as possible after it's been collected.

"The electrical engineers and computer scientists at NSA spend a lot of their
time developing [automatic] filter systems," says Bamford. Strategies like
focusing on telephone calls from a particular installation, searching for
specific words and phrases in e-mails, or using voice recognition techniques
[see "Getting the Message"] are all deployed in the hope of picking up a
terrorist giving orders rather than someone arguing with their significant
other.

While it is unlikely that any government, army, or terrorist group will ever
again have its plans as comprehensively exposed as the Nazi war machine's,
Sigint should still be effective against specific targets—but, as 9/11 and the
search for Osama bin Laden prove, only as part of an integrated intelligence
strategy that prevents it from turning a deaf ear.

--------------------------------------------------------------------------------

To Probe Further

The European Parliament's report on the Echelon eavesdropping network can be
found online at http://www.europarl.eu.int/tempcom/echelon/rrechelon_en.htm.

The National Security Agency's Web site (http://www.nsa.gov/) has information on
its history and outreach programs.

An open-source public key encryption application, Gnu Privacy Guard, can be
found at http://www.gnupg.org/.

http://www.spectrum.ieee.org/WEBONLY/publicfeature/apr03/code.html

------------------------ Yahoo! Groups Sponsor ---------------------~-->
FREE Cell Phones with up to $400 Cash Back!
http://us.click.yahoo.com/_bBUKB/vYxFAA/i5gGAA/61FxlB/TM
---------------------------------------------------------------------~->

Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/