Author: mrkoot

“China Folk Counterespionage Manual” (NEEDED: full translation Chinese->English)

UPDATE 2017-04-17: perhaps there’s some renewed relevance to having the Chinese text below translated: Anti-Espionage: A New Mass Line Campaign in China? Anti-espionage appears to be the most important theme of this year’s “National Security Education Day.” (The Diplomat)

UPDATE 2017-04-10: not specifically related to the text below, but still relevant: a new approach to counterintelligence – China reportedly offers cash rewards between USD 1,500 and USD 72,400 to encourage residents in Beijing to provide information on infiltration, subversion and theft of information by foreign spies inside the country. The rewards depends on the importance of the reported information.

Does anyone understand Chinese more reliably than Google Translate does and care to translate the 9000-word “China Folk Counterespionage Manual” quoted below? It quite an effort, but I’d be happy to return the favor, for instance by carrying out a Dutch to English translation and/or by making a donation to a charity of your choice. The manual was posted in 2008 on a Chinese internet forum. Didi Kirsten Tatlow blogs that it is a manual on how to recognize foreign spies. China recently adopted new counterespionage legislation; this is the context/frame in which said report discusses this manual. The Chinese populist news paper Global Times spent attention on this topic on September 18th 2014:

Be wary of espionage trap surrounding us
(Global Times) 08:37, September 18, 2014

According to foreign media outlets, Ma Jisheng, who served as Chinese ambassador to Iceland, was allegedly arrested by the Ministry of State Security earlier this year on suspicion of passing intelligence to Japan. In recent years, we have frequently witnessed vicious incidents where top Chinese diplomats, military officers and senior research fellows of think tanks have been involved in espionage and selling intelligence. If Ma is confirmed to be involved in this case, that will be startling news.

China has become one of the most powerful strategic competitors with incredible strength, rapid development and a self-contained decision-making mechanism, which has made it a key target of the world’s major intelligence agencies. Meanwhile, given the relatively low vigilance in Chinese society, authorities have failed to effectively convey their judgments and understandings to the public. Among the high-risk groups easily eyed by overseas intelligence services, some lack both sufficient knowledge in this regard and a capacity of discernment.

There have been no contemporary spy dramas made in China for a long time, as directors will find it hard to acquire materials, and even if they do, such screenplays would not gain approval. Therefore literary creation in this area seems like a forbidden zone, despite continuous information warfare.

Plus, there are few news stories involving espionage and Chinese officials. A number of major cases that startled the Chinese elite were not released to the public through the media. In actuality, reporting such incidents will educate many people by letting them know how close those manipulators of overseas intelligence agencies are to us.

Officials and scholars accused of espionage did not fall into the trap overnight. Most of them developed distorted values and indulged themselves, hankering after cash and a life of luxury, so they were easily targeted by foreign intelligence services. They were treated to dinners and offered gifts, which gradually induced them to sell national intelligence.

Owing to a lack of public education in this field, ordinary Chinese have a quite shallow understanding of espionage.

Some people feel that everything is secret and become panicked about contact with foreigners, while others are adverse to rules on classified information and regard certain necessary measures as formalism.

Although information warfare is a common phenomenon around the world and almost every big power has once been mired in espionage cases, China has obviously suffered more losses in recent years. Ma Jisheng is not the first top diplomat caught for spying.

With advanced technologies in the modern era, there is an increasing possibility that those selling intelligence will be caught. And all the potential high-risk groups should recognize this point, which may help them refrain from selling information when they are about to cross the red line.

If it is confirmed that Ma has been caught, we hope that his story will one day appear on media to serve as a warning for others.

Globaltimes.cn also published the following infographic:

20140828_Peeking-in-China_source-Globaltimes.cn

Here is the manual (NEEDED: full translation Chinese->English):

中国防间谍不完全手册:里面的很多内容不光对留学生有用,对国内的网友来说也是非常有用的。一、间谍做什么?
二、谁会成为反华势力的间谍?
三、现实生活中策反/造谣类间谍的表现
四、网络上策反/造谣类间谍的表现
五、借信仰之名,行策反之实的假基督徒间谍(省略)
六、初级间谍拉人入伙的最初识别(省略)
七、总结情报工作无孔不入,情报人员其实就出没在我们的周围,他们看起来绝对不像是JamesBond那么酷,他们其实就和你的朋友没什么两样——说不定你的朋友 中就有情报人员。一个好的情报人员,一定是低调的,一定是能和群众打成一片的,一定是让你甚至连想都不会往这方面想的——一句话,扔到人堆里你绝对找不出 来的。而这些普普通通的情报人员,却在为各自的目的,为各个政治集团做着默默或者张扬的工作。一、间谍做什么?狭义的情报人员是服务于某政治集团的一些比较特殊的人员,他们的工作性质、工作内容也各不相同。通常的“间谍”一词所指的,只是其中的一部分。下面,我们看一看一般我们在国内外能够遇到的情报人员,一般都有哪些任务。1、刺探。这是情报人员最古老的工作之一。这项工作的目的是主动刺探敌方军情或者政治秘密,为我方采取战术或者战略反制措施提供决策依据。比较常见的是在军事基地附近拍照的间谍,以及发展第五纵队从敌方军政机构里面获取涉密信息的间谍。2、分析。如果说刺探是主动出击收集信息,那么分析则是被动地收集信息。例如专门分析报刊杂志上面政经信息的驻外文官(情报分析员),以及坐在某军工研究所附近餐馆 吃饭的常客(听研究人员吃饭时无意透露的最新武器研制信息)。其实不一定要专业的情报人员才能做这样的事情,许多平民也有这方面的惊人才能,例如在希特勒 闪击波兰前几个月,德国的一个平民就根据几年来收集到的公开报刊杂志分析出了希特勒闪击波兰的全部作战计划,连时间、编制、战役细节都推测得八九不离十。 他把分析结果出版,引起了希特勒的震惊与恼羞成怒,于是不久便派盖世太保将其暗杀。希特勒不得不重新调整战役部署,然而泄漏过多,难以完全达到战争的突然 性。幸而波兰国内的耶和华见证人(邪教)多方阻挠波兰人民抵抗,希特勒才没有在闪击波兰的过程中遇到太大的麻烦。3、窃取。间谍古已有之的任务。一般是使用技术手段获取敌方的技术图纸、数据、图片、录音等秘密信息,以及偷窃对方的某些技术装置(如特种合金碎片、芯片、导弹制导装置等部件,甚至是整架战斗机)。4、策反。这也是情报人员最古老的任务之一。顾名思义,策反就是通过各种心理战手段,将敌方人员从思想上转化为我方人员,从而削弱敌方力量,增强我方力量。被策反的 敌方人员,往往可以继续发展成我方间谍,或为我方提供特殊的技术能力,以使得情报工作效果最大化。这也是“和平演变”的核心所在,乃“兵不血刃”之高招。5、造谣。由于人民从广泛意义上比较缺乏专门的知识和辨识能力,容易倾向于相信一些他们所希望相信的东西,因此情报人员用造谣的方法,可以将人民群众拉拢支持己方政 治集团,反对敌方政治集团。以削弱敌方政治集团的民意基础,给敌方政治集团的执政带来很大困难,造成敌方政权管辖范围内的动荡,等等。同样,造谣也可以用 于攻击敌方个人,以诋毁其声誉。6、传递。这是一类比较特殊的情报人员,他们不单独行动,他们的任务是将信息情报在前线情报人员和后方总部之间进行有效而秘密的传递。二、谁会成为反华势力的间谍?中国人所要面对的,基本上全是反华势力的间谍了。因此,我们以下的讨论将仅仅局限于反华势力。西方每个国家都有不同的反华势力,他们各有不同,其中美国反华势力流派最多、经验最老到、势力也最大。在西欧(原北约成员国),反华势力的基本做法都和美国相去不多,因此下面仅讨论美国反华势力。美国反华势力主要可分为政府级别和民间级别.其中民间级别的包括臭名昭著的轮子、民运等,由于其自身的问题而不得势。然而政府主导的情报工作,却是力度很大、成效颇丰的。美国的情报机构,对外主要是CIA,对内主要是FBI。其中CIA尤其注重在留学生中进行情报工作。 经过几十年的实践总结,CIA已经形成了一整套招募发展外国间谍的行之有效的方法。概括起来可以用4个字母表示:MICE。(老鼠的复数?)M= money,即金钱。这个其实没什么好说的,许多人见钱眼开,给奶便是娘。I= ideology,意识形态。这个在冷战时期非常管用,那些极端厌恶共产党的社会主义路线的人,在本国受挫后,常常在反华势力“自由”、“民主”的旗号的煽动之下,主动投靠反华势力,充当其走狗。C即个人表现。比方说,CIA会跟你说,你给他们当间谍,你就可以成为007那样受到万人追捧的明星;你给他们当间谍,你就可以实现人生的最高价值,等等。

E即道德压力,就是常见的利用美色或者经济问题来引人上钩,抓到把柄,然后以此来要挟人为自己当间谍。

CIA的这个“老鼠”法,可谓屡试不爽。因此,符合这四条中任何一条很显著的人,都很有可能被美国反华势力发展成为间谍。比方说:

见钱眼开者,削尖脑袋也要享受资本主义奢侈糜烂生活的人。

那些如平可夫这种“对共产主义毫无兴趣”,对共产党恨之入骨的反共反华者。

那些个人成就动机极其强烈,尤其是希望得到万众瞩目的人。

还有就是那些贪官污吏啦,以及个人生活作风有问题的人。

由此,如果你发现有人对政治特别感兴趣,其政治倾向为反共反华,又符合上面四条中的任何一条(甚至几条),就要高度注意了。这样的人很可能不是自己头脑发热,不是自己真的要愤世嫉俗,而是为了反华集团而卖命。

三、现实生活中策反/造谣类间谍的表现

在现实生活中,与我们这些学生接触较多的反华势力的间谍,通常以学生的身份出现,这样对于我们这些普通的学生而言,无疑具有更大的亲和力,也可以避免我们的警惕与防范。

1、台湾中情局派出的“职业学生”

根据中国国家安全局的数据,在欧美的台湾留学生中,每5个人中就有一个是由台湾中情局直接进行经济支持的策反类间谍,这是台湾政府的内部规定。于是在台湾 学生中间就有了这么一个名词:职业学生。这些学生以在大学里面学习为职业,他们只要继续读书,就可以从中情局拿到不菲的薪水(当然通常来说都是不会让朋友 知道的)。他们的任务只有两个:1、策反大陆学生;2、防止台湾学生被大陆人策反。中情局对这些“职业学生”的要求,就是尽可能拖延毕业、多多组织台湾学 生的活动、多多接触大陆人。

根据这些特点,我们可以总结出这些台湾的策反类间谍的识别方法:

(1)持鲜明反共立场,有可能持台独立场,经常表示政治立场

(2)长期不毕业

(3)不好好学习,社会活动多,常组织社会活动

(4)故意拖延毕业时间

(5)频繁与台湾人/大陆人接触

(6)不需要打工,经济条件却很宽裕

(7)他们的家人不大出国(因为被政府看着做“人质”防止间谍叛逃。起码以前是这样,不知道现在是否在“民主诉求”之下还有这一条)

其中,6和7这两条若不用间谍来解释,就是互相矛盾的。若家庭经济条件好,不需要打工,则其家人一般来说出过探亲旅游的倾向性很高;若家庭经济条件不好,家人没钱出国旅游,则一定需要打工才能生存。这是台湾“职业学生”的一大软肋所在。

要特别注意的一点是,台湾中情局所豢养的这些间谍,并不一定都是台湾人,也有许多是被策反了的大陆学生,他们也基本符合上面的1-6条。

有些间谍因为某些原因洗手不干了,这个时候就会被中情局威胁。当然,实际上一般情况下中情局不可能对他们的家人做出多么不利的事情,顶多就是以后办理出国 手续的时候卡一下。不过,中情局停掉工资是肯定的。我还真的看到过有的台湾“职业学生”洗手不干之后的悲惨日子。一般来说这样的间谍会突然遇到非常严重的 经济困难(目前尚不清楚中情局是否会阻止他们的台湾家人给他们汇款),于是得外出打工等。在学生签证满了10年之后,无法继续延签(许多欧洲国家规定学生 签证最多只能给10年)——如果这个间谍工作成效比较好的话,中情局会想办法让他继续服务的,签证便也就不成问题。如果发现你的朋友中有这样的情况,要特 别的当心。

2、为美国或欧洲反华势力工作的学生间谍。

姜还是老的辣,美国的情报工作历史悠久、经验丰富,比台湾的中情局强不知道多少倍。因此,想要有那么几条简单的比较统一的判断标准,也非常的困难,甚而至于比较精确的推断都非常不容易。我们只能根据长期情报工作所总结出来的经验规律,从侧面大致来推断。

(1)愤世嫉俗。

这一点是肯定的,他们如果想要开展社会政治策反工作,反共反华,一定要愤世嫉俗,否则便不可能造成社会影响力。上面说过,他们具体的表现就是一味攻击谩骂中国和共产党而无意提出理性的解决方案,也无意投身于建设祖国的事业中。

(2)崇美恐美情绪明显。

任何事情,美国的观点总是正确的,中国相类似的事情,就算没有问题也要鸡蛋里面挑骨头出来批判。

(3) 经济状况。

大陆学生一般而言都比较穷(那些贪官子弟当然另当别论),在国外读书一般都必须靠奖学金或者打工过活。如果你发现你的某个朋友的支出明显高于他的明面上的 收入,就得小心了。情报部门所给的经济资助,一般相当丰厚,每月少则几百,多则几千美元。而且,如果你发现你的朋友在收入一事上对不同的人有不同的说法, 也需要特别小心。

(4)社交圈子相对独立。

情报部门一般来说也会要求基层间谍与他的朋友保持一定距离,即使有几个表面上的“密友”,也只是用于掩护的。仔细观察可以发现,这些间谍与他们的“密友” 之间仍然保持着相当大的距离,比方说不轻易邀请密友到家中做客,几乎不参加密友所组织的较大型的活动,也不带密友和他的其他社交圈子中间的朋友一同参加活 动、彼此认识。总而言之,就是他试图保持几个社交圈子之间的隔离性。

(5)比较典型的美式逻辑:“深刻的偏激优于平庸的全面”。

美国历史上在这种偏激的哲学思想之下,诞生出了一代又一代的偏激大师,如佛洛伊德、布热斯津等。然而既然是偏激,就很不全面,虽然言语非常的震撼,却绝对不代表真理。

(6)言论与其专业训练明显不符。

通常而言,文科生比理科生容易策反,工科学生被策反的不确定性很大(视专业不同有很大的区别)。

在理科生中,有较强不确定性、今后在国外工作前景较为乐观(例如生物、化学)的学生,策反起来,比要求严谨逻辑和事实观察、今后工作前景不那么乐观的学生(例如数学、物理),相对要容易。

如果你发现一个学数学或物理的高才生居然在言论中逻辑性很差,不注重事实,盲目崇美恐美,这就与他的专业训练背景相抵触,其背后必有隐情。这样也就可以大致对某些人进行推断。

(7) 原创观点明显偏少,大量引用他人的观点与论证方法,甚至语言形式。

这些被策反的间谍所说的言论,虽然具体阐释上面可以自己发挥,但基本论点和论证形式一般来说都由上家指导甚至直接确定。其实这一点本不是情报机构的首创, 而是古老的邪教的惯用手段,就是由总部来培训邪教传教士,教他们如何歪曲宗教经典,用似是而非的诡辩方法来赢得人心。至今,我们还可以从耶和华见证人、东 方闪电和**功那里,明显地看到这种策略。把它套用到政治观点上面,由于出国留学的学生总体认知水平比较高,如果关心政治,应该有自己的观点(要么就是完 全不关心政治,这种人一般来说也很少会谈论政治),因此,自己的观点明显偏少,却大量引用他人的观点与论证方法,甚至连具体的语言形式都似曾相识,这就是 比较明显的受上家操控的标志。比较典型的语言特征例如以柴玲为代表的“民运”式,以**等人为代表的“FL功”式,等等。

(8)刻意歪曲中国的事实,将特定历史的事件反复拿出来以孤立的方法进行曲解。

现在中国的总体情况是令人乐观的,虽有争论之处,却正在稳步改进过程中。然而反华分子们唯恐中国不乱,唯恐中国发展,即便现在抓不到什么,也要刻意歪曲事实找事情来批判。

例如饿死人问题,及强调89年天安门有大屠杀(连当年民运四君子之一的侯德健都站出来澄清清场的时候根本就没有屠杀),说现在共产党仍然在迫害基督徒(事 实上90年代以后共产党中央政府就一直没有与基督徒为敌,反而在逐步放松对宗教的管制,也在试图发挥基督教在国家生活中的重要作用,见胡锦涛温家宝的公开 讲话),等等。

他们把一些特定的历史环境之下的事情孤立起来,高举某些反对共产党、又被共产党打压的人,而不管这些人自己有什么问题,就把这些人当作是“(反共)义 士”,例如解放之初一些无政府主义、自由主义、宗教极端主义的人士被当成右派打击,就被反华势力抓住当作把柄,把这些无政府主义者当成反共义士大家抬举, 全然无视当时的情况,以及美国当年也在大力打击无政府主义者的历史。

(9)片面反战,主张中国应该解除武装。

其实这是美国政府从朝鲜战争到越南战争所吃的最大的苦头。如果不是国内反战浪潮过于猛烈,朝鲜战争美国如果在李奇微将军的带领下以范弗利特弹药量继续战斗,历史很有可能改写;越南战争也是因为美国政府顶不住国内的反战压力,才被迫撤军。

然而美国政府聪明地发现,这片面反战的力量,却是瓦解敌国抵抗意志的良方。其实片面反战并不是美国人民的首创,著名的邪教耶和华见证人就是极力强调片面反 战的,他们认为一切战争都是不好的,敌人打过来了,我们也只能束手就擒,任人宰割。他们不仅自己不抵抗,还想方设法地阻挠其他的人民抵抗。二战时原东欧地 区的快速陷落,少不了耶和华见证人的“贡献”。

这些“功绩”至今仍然记录在这个邪教组织所定期发行的杂志《守望台》上。因此美国政府在1990年的海湾战争、2003年的伊拉克战争中,下了很大力气去 打击国内的反战人士(许多被监禁、被殴打,甚至被逼迫公开承认反人民的罪行)。然而在美国国外,他们却大力推行片面反战的观点,并加上“中国威胁论”,认 为中国有核武器、有先进的战机军舰就是地区和平的威胁。典型的“只许州官放火,不许百姓点灯”。

(10)偷偷摸摸进行改名改址活动

如把人民解放军改为国民军,人民军队改为国家军队,人民大会堂改为国民会议堂.

借各种理由,把首都迁往他处,把开国元勋人民领袖纪念堂迁往什么什么地方.

三八国际妇女节/五一国际劳动节/六一国际儿童节都要改.

等等这些,无不暗藏”颜色革命”动机.

以上当然只是中美在长期的情报斗争中总结出来的一些经验规律。美国毕竟经验老到,因此单独一个方面拿出来看,问题都不是很大,都有其他的方法可以解释。但是,如果一个人同时具有上面许多点特征,他是美国反华势力的间谍的可能性就非常大了。

四、网络上策反/造谣类间谍的表现

现如今,网络成为年轻一代主要的信息传播与获取渠道。反华势力很早就注意到网络的特性,非常有利于展开策反/造谣工作,因此早在十几年前互联网刚刚普及的时候,他们就在紧锣密鼓地部署网络策反与造谣的工作。

具体说来,网络适合于策反/造谣工作的特性,可以归纳如下:

1.影响面大。

不需要耗巨资组织大型的活动,不需要耗巨资去电视台演讲,只要轻敲键盘鼠标,在网络论坛上发文章,便可以吸引世界各地数以万计的眼球。而且可以跨越国界,逃避政府的管制

2.隐蔽。

网络上,没有人知道你是一条狗。网络上都为化名,谁也不知道他真正是谁。因此,这也就给策反与散布谣言者以逃避法律追究的便利。

3.信息真假难辨。

由于网络世界没有主控机构,更没有新闻审查,真假信息鱼龙混杂,什么东西更震撼,什么东西更噱头,什么东西就能够更吸引眼球,即便它是假消息。

4.管制困难。

网络上流传的信息,很难被管制。一方面,现在国际互联网的流量非常大,要在这么大的流量之中进行实时关键词搜索本来就已经需要耗费无数台超级计算机的计算 能力了,只要在敏感关键词中加一个空格,便可轻易逃过检查。即便是超级计算机,也对大量加密的语音和图像信息难以做到有效的过滤筛查。

网络上的间谍活动,由于更加隐蔽,而且信息渠道单一,因此容易伪装得良好,更具威力。这些间谍广泛分布于中国国内国外,有大张旗鼓的,也有默默无闻的。在网络上活跃的主要有这么几种间谍:

1.刺探军政情报的间谍

这类间谍活跃在军事和国政类论坛上,为的是从网友那里套取最新的军政情报。其惯用手法为:

(1)故意诋毁贬低中国的军政实力,引来爱国人士的反击。在此过程中,间谍会故意引诱爱国人士透露一些绝密情报。

(2)故意说一些错误的信息,例如部队的番号、导弹的射程等,引起一些真正知道这些情报的人士的不满,又喜好表现自己知识渊博,于是将正确的数据说出来。

(3)展示自己收集得一些装备的照片,诱使其他网友贴出他们自己拍摄的装备、军营等照片。一张船坞的照片就可以分析出中国新建造的军舰的大致性能,以及中国是否在准备十年以内建造航母等非常重要的战术和战略信息。

2.打击人民安全感的间谍。

这类间谍通常也活跃在论坛上,他们的共同手法是用许多似是而非的东西来攻击中国军队和政府,其目的就是让人民觉得中国军队非常腐败,技术也远不如人,因此无力保家卫国。

(1)歪曲历史,以刻意贬低中国军队的形象,打击人民对军队的信任感和自豪感。最常见的例子例如抹杀中国人民志愿军抗美援朝的意义,胡说什么当时不进行抗美援朝更好,云云。

(2)以一些子虚乌有的所谓“内部数据”来证明中国的武器根本无法与美国武器相抗衡,鼓吹美国制胜论。

(3)揭露所谓的“军队内的腐败黑幕”,试图让大家相信中国军队已经非常腐败,如当年清朝军队一样,不堪一击。殊不知90年代末期以后军队大整肃,大大提高了战斗力,腐败分子被内部处理了很多,军队经商问题得到了极大的遏制。

3.以亦真亦假的谣言煽动反政府情绪的间谍

这类间谍常活动与时政、强国等类型的论坛上,主要是以亦真亦假的社会事件的“内幕”,煽动人民的反政府情绪。

这类间谍属于最隐蔽的一种,因为他们的表现和一般的愤青以及不满现实的持改良政见者不容易分开,而且信息渠道单一(仅仅通过网上的言论)。然而,专业的反 间谍人员在长期的监控中,也发现了一些迹象。虽然对于这样的间谍,即便是专业的反间谍人员也需要透过专业技侦手段才能最终确认,我们普通老百姓就更难以分 辨,然而我们可以靠着一些蛛丝马迹,有一个倾向性的判断,就不容易被他们的言论迷惑,更可以和这些间谍在现实生活中保持距离。

这些间谍,其言论内容具有[三.2.(1),(2),(5),(7),(8),(9),(10)]的特征。仅凭这些言论特征,还不足以让我们高度怀疑他是一个间谍。专门从事网络策反煽动的间谍,还有其它的一些特征。

(1)IP/MAC地址常变,但网段变动不大。

尤其在中国国内,间谍由于要在网络上保护自己,不易被技侦手段锁定,常常变换上网发帖所用的计算机。在公共场合,例如网吧、学校这样的地方,是他们活动的 好战场。如果配合一些黑客手段,在这样的公共场合即便被技侦部门跟踪,也很难抓到其人。当然在国外,由于不用担心被中国安全部门监视(其实还是有的,只是 大部分人不知道而已),在家里一直使用自己电脑的也不在少数。

(2)煞有介事地报道一些热门社会事件的“内幕消息”,夸大政府、军警的残忍,突出上访、游行、抗议者被抓、被打、被抄家、被酷刑折磨等悲惨遭遇,突出在中国生活的胆战心惊。

对引起这样社会事件的复杂背景、历史等仅作非常简略的偏向性介绍,从不谈及上访、游行、抗议者自己的任何行动过激、不当之处。其内容真真假假.

比较专业的间谍通常采用“美国之音”的策略:90%的真话加上10%的假话。由于普通群众根本没有可能性去详细核实,因此大家在听信90%的真话的同时, 也把那10%的假话听进去。有些比较露骨的,会自称诸如“人权观察协会”、“国际大赦组织”的观察员,这些组织表面上是民间非政治机构,然而了解历史和国 际政治的人都知道,这些组织都是受美国等政府的支持和操纵,借口人权等问题攻击敌对国的傀儡组织。但由于这些组织有来自于他们主子政治集团的强大舆论与经 济支持,帮他们混淆视听、浑水摸鱼,因此这些间谍中的有些人敢于明目张胆,即便是在中国国内。

(3)发帖争议性大,往往引得众多网友互相辩论。

而贴主(也有可能注册另一个用户名)所作的回应和引导,不是为了平息争论、得到共识,反而是有意加剧争论,以吸引更多的眼球。常用的手法是作人身攻击,激 怒持反对意见的网友;不正面回答网友的质疑;玩弄文字游戏,设逻辑陷阱。经过培训的间谍往往有更加专业的诡辩技巧,其逻辑漏洞隐蔽,没有系统地学过逻辑或 研究过辩论的人,极易上当。

(4)比较初级的间谍常采用的手法是在论坛上注册一个新的用户名ID,发几个帖子之后就消失,以为这样不容易被跟踪上。

但经过专门培训的间谍就经常不采用这种容易被网友识破的方式,他们会很有耐心地用相当长一段时间进行“树立威信”的工作,即用好几个月甚至数年的时间在一 个固定的论坛上用一个固定的用户名ID,表现出一副儒雅风范,很平静地参与讨论,树立道德高度,以博得大家的喜爱与拥戴,甚至成为版主。然后,才开始逐步 地在讨论中涉及敏感话题。这种逐步的转换由于历时甚长,不易被普通网友所发觉。然而如果通过论坛搜索功能一次调出其在一两年甚至更长时间内的文章总汇,就 可以比较清楚地看到这种人的话题、论点和态度的转变。尤其在局势紧张的时候,这种转变尤为明显。在下一点中将详细谈到。

(5)局势紧张的时候,间谍的反共反华言论突然大量增加。

这是非常合理的举动,因为每当局势紧张(例如台海、东海、南海方向)时,各方面的信息和观点都会大量增加,人民对时局的关注程度也会大幅度增加,这些间谍 的主子便会要求他们加大策反力度,(比如最近的格俄问题),制造更多的反华反共言论,以“增加与共产主义不相合的精神因素”(原美国驻华大使司徒雷登 语),削弱海内外中华民众对中国政府的支持与信任,借机培养第五纵队,在可能到来的激烈的政治军事斗争中,为中国增加内乱的可能性。如果我们发现原先比较 温和的网友在局势紧张时不顾一切地大幅度增加反共反华言论,甚至被众人唾骂也在所不惜,这种违反其常规、也违反通常人常规的做法,显示出他背后有操纵者, 也是一个比较明显的间谍的标志。

通常来说,在时局变换的时候,各类间谍的活动普遍会加剧,从而很有可能产生情报机构过度使用某一条间谍线的情况,而使得这条线被暴露。各国反间谍部门都视 这个时候为排查、收网的好时机。在上次台海危机中,被中国国家安全局破获的最大的在中国大陆的台湾间谍网,一次抓获各类间谍470余人,其中90%以上是 从未到过台湾也从未出过国的大陆人。而在这排查抓捕的行动中,据称网络监控发挥了重要的作用。

(6)采用明显的美国政府式舆论边缘化操纵策略。

这是一种非常厉害、非常专业的手法,不是搞情报的一般人很难做到,除美国以外也绝少能够见到这种策略,因为这种策略的产生与发展,与美国文化和历史的发展密切相关。因此,如果大家能够看到使用这种手法的人,多半是受过美国情报部门专业训练的间谍。

其实这种手法讲起来本身并不复杂,就是不太理会反对者的意见,而用海量的己方观点去冲淡反对者的意见,使得反对者意见被边缘化。同时,变换不同的方式一再重复己方观点,使得“谎言重复一千次就成了真理”。

(7)对持反对意见者一般仅仅进行人身攻击,避而不谈观点、论据等本身。

这一条是辅助识别标志,因为间谍在论坛上讨论仅仅是要推广他们的观点、吸引眼球(点击率)、企图树立个人知名度,并不顾及到其观点的正确性和论证的严密 性.对反对者进行人身攻击,将反对者描绘成“坏人”,是最行之有效的方法。而这种方法常常也能够引来反对者的情绪反弹,拼命要证明自己不是“坏人”,从而 让争论愈加复杂和激烈,更能吸引眼球,却离讨论的问题本身越来越远。

五、借信仰之名,行策反之实的假基督徒间谍(省略)

六、初级间谍拉人入伙的最初识别(省略)

七、总结

事实上,作为危险性比较大的策反/造谣类工作,本国资深情报人员是不轻易去直接做的,他们策反中国人为他们卖命,就是为了保护他们自己。外国情报机构不会 顾及中国间谍的死活,给这种“初级”中国间谍的培训也是极为有限的,因为绝大多数中国人对情报工作的知识几乎为零,因此间谍通常也用不着高级培训。

其实,一般的人只要认真想一想,就可以总结出一些间谍的手法来。为什么这么说呢?俗话说得好:“要想抓贼,必先做贼”,如果我们能够设身处地地想一想,如 果有这么一个间谍任务交给我们做,我们会怎么隐藏我们的真实意图,就能够发现实际上间谍能用的手段并不多。加上一些情报机构长期总结出的规律,我们每个都 能够具备基本的识别间谍的能力。

我们的祖辈父辈,在新中国成立之后都受过相当的军事和情报训练,有着基本的反间谍的知识。建国初30年,大部分的间谍都是被人民群众发现并报告给国家安全 部门的。弱小的共和国之所以能够平安走过那环境险恶的年代,情报战线的人民战争起了决定性的作用。今天,情报战争的烈度不减当年,仅靠国家安全部门的专业 人员,难免挂一漏万。我们对这些斗争无幸参与,虽不一定把这些间谍揪出来扭送安全部门,但至少可以做到自己不被这些间谍的言论所蛊惑,不参与到他们的反华 行动中去。

反华势力亡我之心不死,任何时候都在紧锣密鼓地策划和实施着“以华人制华”的策略(美国CIA解密文件和兰德公司公开发表的战略白皮书中都有明确提及)。 为了祖国的繁荣富强,为了中国人在世界各地能够不受欺侮,为了我们每个人以及我们亲友的幸福生活,请大家保持警惕,远离间谍。

 签名档

纸上得来终觉浅 绝知此事要躬行

不为浮云遮望眼,要拿魂魄碾冰霜!

(h/t @spybusters)

EOF

Notes on Lawful Interception: selections from “Intelligence Support Systems” (2005, Hoffmann and Terplan)

Intelligence Support Systems (2005) by Paul Hoffmann (telecom expert; Germany) and Kornel Terplan (telecom expert; U.S.) is by far the best technically in-depth book on Lawful Interception (LI) in existence. It’s an expensive book, but used copies can be found that are more affordable (I bought one of those). In the remainder of this post I quote a selection of paragraphs from the following Chapters:

  • Chapter 1: Setting the Stage
  • Chapter 5: Extended Functions for Lawful Intercepts
  • Chapter 10: Outsourcing Lawful Interception Functions

The term “intelligence support systems” (ISSs) is used throughout the text below, and is explained as follows in the book’s preface:

Intelligence support systems (ISSs), the focus of this book, are about intelligence as opposed to security. Security involves providing firewalls, anti-virus protection, and intrusion detection and prevention; in other words, security is about guarding against loss. Conversely, in ISS, information is gathered about illegal activities, and that knowledge is applied to increasing security where applicable. ISSs interface with, or are part of, billing, ordering, provisioning, and authenticating systems, as well as law enforcement systems.

The concepts, technology and issues presented in the book are varyingly relevant to the US, EU and beyond.


 

Chapter 1. Setting the Stage

[…]

The focus of intelligence support systems (ISSs) is on expanded infrastructure requirements of telecommunications service providers (TSPs), which are basically no different from the requirements of operations support systems (OSSs) and business support systems (BSSs). Intelligence plays two principal roles in this area. On one hand, it provides surveillance by collecting information on illegal activities, such as terrorism, criminal activities, fraud, and money laundering, and on the other hand, it provides the basic data that improve the bottom line of TSPs, such as revenue assurance, business intelligence (BI), and protection against telecommunications fraud. In short, ISSs are software elements or units that interface with, or are subsumed under, billing and ordering systems, provisioning and authentication systems, and outside parties such as law enforcement agencies (LEAs) (Lucas, 2003f).

TSP will be used as a generic term throughout the book for a number of different service providers, including access providers, network operators, communications service providers, electronic communications service providers, and licensed telecommunications service operators. Terms differ according to the standards for lawful interception of different countries and different LEAs.

1.1 Positioning Lawful Intercepts (LIs) and Surveillance

Information and intelligence must be differentiated from each other. Information in the context of surveillance consists of knowledge, data, objects, events, or facts that are sought or observed. It is the raw material from which intelligence is derived (Petersen, 2001).

Intelligence is information that has been processed and assessed within a given context, and it comprises many categories (Petersen, 2001). In the context of this book, communications intelligence — derived from communications that are intercepted or derived by an agent other than the expected or intended recipient or are not known by the sender to be of significance if overheard or intercepted — is the key focus. Oral or written communications, whether traditional or electronic, are the most common form of surveillance for communications intelligence, but such intelligence may broadly include letters, radio transmissions, e-mail, phone conversations, face-to-face communications, semaphore, and sign language. In practice, the original data that forms a body of communications intelligence may or may not reach the intended recipient. Data may be intercepted, it may reach the recipient at a date later than intended, or it may be intercepted, changed, and then forwarded onward. However, the process of relaying delayed or changed information is not part of the definition of communications intelligence; rather, the focus is on intelligence that can be derived from detecting, locating, processing, decrypting, translating, or interpreting information in a social, economic, defense, or other context (Petersen, 2001).

Information collection is usually used to support surveillance activities. Surveillance is defined as keeping watch over someone or something, and technological surveillance is the use of technological techniques or devices to aid in detecting attributes, activities, people, trends, or events (Petersen, 2001). Three typical types of surveillance are relevant to LIs:

  1. Covert surveillance: surveillance that is not intended to be known to the target. Covert wiretaps, hidden cameras, cell phone intercepts, and unauthorized snooping in drawers or correspondence are examples. Most covert surveillance is unlawful; special permission, a warrant, or other authorization is required for its execution. Covert surveillance is commonly used in law enforcement, espionage, and unlawful activities.
  2. Overt surveillance: surveillance in which the target has been informed of the nature and the scope of the surveillance activities.
  3. Clandestine surveillance: Surveillance in which the surveilling system or its functioning is not hidden but also is not obvious to the target.

Finally, there are various categories of surveillance devices (Petersen, 2001): (1) acoustic (audio, infra and ultrasound, and sonar), (2) electromagnetic (radio, infrared, visible, ultraviolet, x-ray), (3) biochemical (chemical, biological, and biometric), and (4) miscellaneous (magnetic, cryptologic, and computer). In different contexts, including some of those described in this book, a combination of such devices might be used (e.g., a combination of acoustic, electromagnetic, and miscellaneous devices). Appropriate chapters will clearly highlight the technologies and devices in use.

1.2 ISS Basics and Application Areas

[…]

iss-figure-1.2

As indicated in Figure 1.2, there are three different types of intelligence (Cohen, 2003):

  1. Summary intelligence: An ISS that provides this level of information needs to capture all key summary data in a manner that is lawful and protects the rights of individuals. For instance, an ISS may be programmed to capture information on everyone who visits a particular suspect Web site without capturing individual names. The ISS may then take this information and see if any of the IPs visiting this Web site have also been communicating via e-mail or chatting with another known target. If so, a legal authorization may be obtained to look at the individual in question in more detail.
  2. Target intelligence: Once a target has been identified on the basis of summary intelligence or other information sources and lawful authorization has been received, it may be necessary to look at any and all of that particular individual’s communications on all networks, including e-mail, Web sites visited, chatting, instant messaging, short message service (SMS), and multimedia messaging service (MMS) mobile phone messages, Voice-over-IP (VoIP) broadband connection calls, and so forth. Specific details can then be obtained from this information.
  3. Content intelligence: Content intelligence may be needed to lawfully review specific content, for example, all e-mail communications of the target. The ISS should make it possible to look at this detailed content information in all forms (e.g., e-mail, VoIP, Web site replay, and chatting replay).

[…]

1.6 Framework of LIs

iss-figure-1.4

Figure 1.4 shows a generic framework of LIs (Baker, 2003) derived from a draft model commissioned by the Internet Engineering Task Force (IETF). This draft streamlines principal functions, components, and key players. This generic framework shows a high level of compliance with North American and European standards regarding lawful interception.

Several entities are included in this LI model:

  • LI administration function: This function provides the provisioning interface for the intercept stemming from a written request by an LEA. It can involve separate provisioning interfaces for several components of the network. Because of the requirement to limit accessibility to authorized personnel, as well as the requirement that LEAs not be aware of each other, this interface must be strictly controlled. The personnel who provide the intercepts are especially authorized to do so and are often employed directly or indirectly by the TSPs whose facilities are being tapped. In many cases, the identity of the subject received from the LEA has to be translated to one that can be used by the networking infrastructure to enable the intercept.
  • Intercept access point (IAP): An IAP is a device within the network that is used for intercepting lawfully authorized information. It may be an existing device with intercept capability (e.g., a switch or router), or it may be a special device (e.g., a probe) provided for that purpose. Two types of IAPs are considered here: those providing IRI and those providing content information.
    • IRI IAP: This type of IAP is used to provide IRI, that is, information related to the traffic of interest. There is currently no standardized definition of IRI for IP traffic. IRI is the collection of information or data associated with telecommunications services involving target identity, specifically communication-associated information or data (e.g., unsuccessful communication attempts), service-associated information or data (e.g., service profile management), and location information.
    • Content IAP: A content IAP is one that is used to intercept the traffic of interest.
  • LEA: The agency requesting the intercept and to which the TSP delivers the information.
  • Mediation device (MD): These devices receive the data from the IAP, package it in the correct format, correlate them with LI warrants, and deliver it to the LEA. In cases in which multiple LEAs are intercepting the same subject, the MD may replicate the information multiple times.

This generic reference model contains a number of interfaces, as can be seen in Table 1.1, and it can be deployed in many different ways. More details are presented in Chapter 3.

[…]

1.7 Challenges

Supporting lawful interception in various geographical areas is not without challenges. This concluding section concentrates on technical, economical, and privacy challenges due to lawful interception.

[…]

In summary, the technical challenges relating to ISSs are as follows:

  • Enormous volumes of dispersed data:
    • Data volumes of various services are much higher than with voice-related data.
    • Data throughout the networks (not just at the device) must be correlated.
    • Data can be missed or lost because of these huge volumes.
    • Data is too voluminous to be stored in a database without real-time processing and reduction of data.
  • Need for real-time data:
    • Dispersed data requires real-time processing and correlation to produce information.
    • Network speeds make it difficult to capture and process information in real-time.

[…]

In summary, the following are the economic challenges associated with ISSs:

  • Costs of point solutions for intercepts are high.
  • Scalability is not guaranteed.
  • Necessary skills and procedures are lacking.
  • It is difficult to guarantee ROI with surveillance only.
  • Using existing technology with modifications for surveillance seems to be a viable option, but its cost justification is still difficult to support with hard numbers.

[…]

In summary, privacy challenges relating to ISSs are as follows:

  • Legal rules differ in different countries.
  • Technological issues are different for voice and data networks.
  • Current technology does not support LIs and privacy laws simultaneously.

[…]

5. Extended Functions for Lawful Intercepts

[…]

5.3 Handover Interfaces (HIs)

[…]

5.3.2 Handover Protocols

[…]

IPDR Streaming Protocol is a new, reliable, real-time protocol that (1) leverages IPDR foundations, (2) uses XDR-based compact binary encoding and TCP/IP transport, (3) is applicable to a broad set of services and domains, and (4) is specifically designed to address requirements for data exchange applicable to the area of LIs. The attributes of this protocol are its reliability, flexibility, efficiency, and manageability; the fact that it provides real-time streaming; and the fact that it leverages overall IPDR technology benefits.

5.3.2.1 Reliability

Why is reliability important?

  • Support of critical applications
  • Avoidance, through high availability, of additional availability costs
  • Compliance with regulatory requirements

How can reliability be increased?

  • Use of data-capturing systems that provide scalable availability
  • Use of application-level acknowledgment for information exchange
  • Use of reliable transport, such as TCP/IP
  • Use of built-in fallover and fallback mechanisms
  • Use of redundant probes and hot standby support
  • Use of cost-effective deduplication mechanism
  • Use of tunable keep-alive messages

5.3.2.2 Flexibility

Why is flexibility important?

  • All services are supported, including emergency services
  • Reductions in proliferation of other surveillance-related protocols
  • Support of a wide range of LI models
  • Support of a variety of OSSs/BSSs, including billing, fraud, performance management, and fault management
  • Investment protection

How can flexibility be increased?

  • Use of readable XML schema definitions of record structures
  • Negotiation of upgrades (“future-friendly”)
  • Specified transformations to and from XML or XDR IPDR files

5.3.2.3 Efficiency

Why is efficiency important?

  • Minimizes effects on network and service elements, on the network itself, and on data-capturing systems
  • Reduces costs
  • Allows large amounts of data to be handled

How can efficiency be increased?

  • Compute and export only the data requested by collectors (e.g., LEAs)
  • Export data only with collector subscription
  • Use entire bandwidth via windowed application-level acknowledgment
  • Minimize fall-over times by keeping hot standby ready with “keep-alives”
  • Compact (XDR) data representation

5.3.2.4 Manageability

Why is manageability important?

  • Supports a global, heterogeneous environment
  • Supports plug-and-play for large multivendor deployments

How can manageability be increased?

  • Built-in negotiation of protocol version, data capturer and exporter capabilities, templates, and fields
  • Support by exporter and collector of one or multiple versions of protocols
  • Use of back-end-friendly interfaces

5.3.2.5 Real-Time Streaming

Why is real-time streaming important?

  • Allows hot surveillance-related applications
  • Allows real-time reaction to activity (e.g., target identification, fraud, and security breaches)
  • Supports other real-time applications

How can real-time streaming be implemented?

  • Immediate transmission of intercepted data with minimal latency and avoidance of periodic batch closes
  • Continuous stream of events sent from IAPs
  • Presence of hot backup allowing a secondary option to receive data in the case of configurably defined criteria

5.3.2.6 Leverage of Overall IPDR Technology Benefits

IPDR technology benefits are leveraged via the following:

  • Use of information model-based service descriptions, applicable regardless of encoding or transport method
  • Availability of open source implementations without the need to pay royalties
  • Uniform applicability in network data collection
  • Open standards-based format
  • Availability of certified products

The IPDR protocol is broadly applicable to Voice-over-IP (VoIP), CPEs, data over cable, media and application servers, and traffic analyzers.

[…]

5.7 Receiver Applications

[…]

5.7.1 Support for Recognizing Criminal Activities

5.7.1.1 Search for Criminal Activities

This area falls under strategic surveillance owing to the fact that there are no specific targets at the initiation of the process. Observation of communication directions and paths, and evaluation of the contents of various applications, may help narrow lists of potential targets. However, large amounts of data must be evaluated, filtered, analyzed, sorted, classified, and selected to reach conclusions regarding individuals, groups, locations, or suspect activities.

5.7.1.2 Communication Analysis

Collection of actionable intelligence requires in-depth analysis of communication activities. This process involves correlation of time stamps, locations, communication relationships, authentications, directions, and communications forms and volumes. Location tracking, geographical information systems, and data mining are some of the methods under consideration to support such analyses.

5.7.1.3 Content Analysis

In-depth analysis of communicated content is necessary as well. This involves analyzing and correlating application identifications, language recognition, speaker recognition and identification, word spotting, topic recognition, optical character recognition, logo recognition, and image recognition. Both text-based and audio-based analyses are frequently used.

5.7.1.4 Automated Intelligence Support

Content is created from text- and audio-based documentation elements. Results are generated by combining and correlating multiple inputs, including faxes, TIFF files, image files, eDoc files, HTTP, e-mail, chat, and sound files. Figure 5.10 shows an example of such a combination and correlation (Axland, 2004). In a further step, languages and speakers may be recognized by using combined forms of intelligence.

[…]

10. Outsourcing Lawful Interception Functions

[…]

10.1 Forces Driving Outsourcing

Several principal forces drive the outsourcing of LI functions (Warren, 2003b):

  • In-house provisioning, administration, and security surveillance have become too expensive; in particular, personnel costs are increasing rapidly.
  • There is a chronic shortage of skilled personnel.
  • TSPs must comply with LEA requirements, and legal interpretations must be clear and quick in today’s changing legal environment.
  • Supporting LIs in-house may result in a loss of focus on strategic issues that help increase revenue and generate profit.
  • Service expectations may be defined and supervised more effectively with an outsourcer than in the case of an insourced solution.

TSPs must contend with several other issues as well:

  • Technology has simplified access to network elements and information.
  • LEAs are now demanding access to digital storage of customer-related information.
  • LEAs are demanding Communications Assistance for Law Enforcement Act (CALEA) and ETSI compliance.
  • Most ISPs do not have the personnel or business support systems (BSSs) in place to handle broad record production searches and electronic surveillance demands.

Another important factor to consider is the increasing personnel burden and high costs involved in support of LEAs’ demands for records and technical assistance. For example, growing workloads increase the potential for mistakes. Also, as workloads increase and backlogs grow, there are greater legal risks stemming from the possibility of errors, thus potentially leading to greater risk of damage to a TSP’s public image.

Finally, in terms of business challenges, more is being demanded of TSPs, and business realities show that the LI function is not a revenue-generating one. In addition, today’s economic conditions require cost reductions on the part of TSPs. TSPs must weigh two fundamental options:

  1. Building an internal infrastructure: obtaining legal assistance in developing policies and procedures, hiring and training personnel with expertise in legal matters, implementing compliance programs and audit procedures, and investing in technology to support operations
  2. Outsourcing surveillance-related activities: using an outside law firm for deploying policies and procedures and implementing an end-to-end solution with a service bureau

Before deciding for or against outsourcing, TSPs should carefully evaluate the following criteria:

  • Present or expected end-to-end costs of supporting LIs: All effects should be quantified in terms of both capital and operational expenses.
  • Efficiency of existing processes, tools, and human resources: This area is essential in determining which functions, if any, to outsource.
  • Extent of dependence on speed: The real-time requests of LEAs must be met.
  • Grade of service and applications required: These needs may dictate the type of outsourcing used.
  • Level of security for the handover interface (HI) between SPs and LEAs.
  • Cost effectiveness: Is it more cost-effective to concentrate on the provider’s core business than to build a full infrastructure to support lawful interception.
  • Capital investment required: If the company must invest substantial amounts in lawful interception, it should favor outsourcing; if not, outsourcing may still be considered but should receive lower priority.
  • Current and future need for skilled personnel: The most sophisticated LI technology will be useless if the company cannot find employees to run it.
  • Potential acquisitions, mergers, sales of business units, as well as changes in service portfolio: These elements should be carefully evaluated, given that each may affect contracts with outsourcers.
  • Whether it is possible to negotiate acceptable outsourcing contracts: Contract terms are of paramount importance considering the long durations of contracts in this sensitive area.
  • Careful evaluation: Determination of all services and functions offered by the outsourcer, as well as knowledge levels and experience.
  • Careful review of the proposed transitioning warranty: This must be done on behalf of the outsourcer.

10.2 The LEA Model

In this case, LEAs take full responsibility for all principal functions. If required, they initiate all necessary processes including on-the-fly provisioning of networking equipment and facilities. TSPs are expected to provide physical access to equipment and facilities. Occasionally, the physical presence of subject matter experts of TSPs is required during surveillance.

In addition to obvious benefits in the area of legal expertise, benefits of this model are LEAs’ extensive knowledge regarding the targets of and reasons for surveillance, their high motivation to prosecute criminals, and the possibility of enhanced collection results. Disadvantages included limited technical know-how in regard to networking technologies, the limited (and most likely obsolete) surveillance tools available, lack of experience with the access and delivery functions (AF and DF), and shortages in terms of human resources.

10.3 The ASP Model

In this case, application service providers (ASPs) take full responsibility for providing the application software necessary to support all principal surveillance functions. ASPs are represented by TSPs or third parties. Benefits of this model include the following:

  • Good scalability of solutions
  • Usage-based billing
  • Lower number of personnel required
  • Flexibility in instances in which networking technology changes are required

Disadvantages include:

  • Security risks due to shared applications
  • Dependence on the ASP
  • Contractual risks
  • Limited legal background of the ASP

10.4 The Service Bureau Model

The requirements associated with this model can be summarized as follows:

  • The service bureau must provide comprehensive record production.
  • It must adhere to professional legal and service standards.
  • It must support effective coordination with LEAs.
  • It should provide technology that is trusted by both SPs and LEAs.
  • It must ensure high scalability for increasing data volumes.
  • It must minimize legal risks in both civil and criminal terms.
  • It must protect the public image of the SP.
  • It must represent a cost-effective alternative to an SP internal structure.
  • It is expected to be staffed by subject domain experts with extensive field experience.

 

The benefits of the service bureau model are:

  • Focus on core business opportunities
  • Reductions in operating costs
  • Conservation of capital; risk and up-front investments in personnel and surveillance technology assumed by service bureau
  • Support of future-proof services
  • No concern about operations for TSPs

Disadvantages include:

  • Legal dependency on outsourcer
  • Technological dependency on outsourcer
  • Security risks with HI
  • Possible internal resistance
  • Potential loss of subject matter experts
  • Need for minimal (critical) mass of staff as backup
  • Need for continuous supervision of contracts
  • Possible lack of cost savings
  • Transitional problems
  • Risk of losing control over LI-related information
  • Risk of outsourcer not representing the interests of the SP

Supporting the Service Bureau Model, Trusted Third Parties (TTP) are gaining a lot of attention these days.

The value proposition of TTP includes the following items:

  • Independence is key to trust by enhancing privacy with Calea and Etsi
  • TTP has freedom to employ a range of architectures, such as internal, external, and adjunct
  • TTP can generally follow safe harbor standards
  • TTP offers value-added services, such as authentication of trust systems, legal analysis and verification of orders, proof of performance, and subpoena processing

Comparing costs, outsourcing most likely outperforms self-deployment of lawful intercept technologies from year one.

Outsourcing of lawful intercept in service bureau form offers the following additional values to LEAs and TSPs:

  • Reduces operations expenses including staffing needs
  • Minimizes capital expenditures for future network services
  • Minimizes LEA-related network interference
  • Alleviates risk of stranded investment in rapidly changing network infrastructure
  • Most cost-effective way to meet LEA needs at the right time
  • Faster time to market, easier entrance to new markets, generates compliance rapidly
  • Allows carriers to focus on their core business

Table 10.1 shows options in the functions for outsourcing supporting LI activities.

iss-table-1.1

Outsourcers should be rated according to the following criteria, among others:

  • Financial strength and stability over a long period
  • Excellent security record and clearance for highly sensitive assignments
  • Outstanding business reputation
  • Outstanding legal background
  • Demonstrated ability to support lawful interceptions
  • Number of employees, along with their clearance level and level of experience in supporting lawful interception
  • History of using and implementing state-of-the-art technology, frameworks, and tools
  • Ability to customize tools to networking technologies

The strengths and weaknesses of each category of outsourcers are summarized in Table 10.2.

iss-table-10.2

[…]

10.6 Who Are the Principal Players?

Because of the sensitivity of LIs, participating entities are careful about sharing responsibilities with external companies. As a result, outsourcing trends are not yet visible. If they so desire, professional outsourcers in the telecommunications field can extend their services toward LI activities. Also, outsourcers from the legal side can offer services in regard to at least the collection function. This section considers a few early examples of outsourcing options:

  • LEAs: Typical example is the FBI in the United States
  • ASPs: Forensics Explorer
  • Service bureau providers: VeriSign
  • LI-monitoring centers: Siemens solution with a number of add-on functions, in cooperation with GTEN, Datakom, and Utimaco System integrators: VeriSign and GTEN
  • Consulting companies: Neustar/Fiducianet, Inc., in the United States

It is expected that this short list will grow rapidly in the near future.

[…]

EOF

 

[Dutch] De voordelen en nadelen van signals intelligence (Wiebes, 2002)

Dr. Cees Wiebes geeft in Intelligence en de oorlog in Bosnië 1992-1995 (2002) een duiding van de voordelen en nadelen van signals intelligence. De Engelstalige versie van dat boek — een bijlage bij het Srebrenica-rapport van het NIOD — is vrij/open op internet beschikbaar: hier (.pdf). Van de Nederlandstalige versie is geen digitale versie beschikbaar. Ik heb de betrokken pagina’s 234-242 uit het gedrukte boek ingescand, geOCR’d en vervolgens handmatig gecorrigeerd: zie hieronder het resultaat (~3700 woorden). Ook beschikbaar als platte tekst: hier. En de scan: hier (.pdf). In Introduction on The Importance of Signals Intelligence in the Cold War (2001) schreven Matthew Aid en Cees Wiebes trouwens ook over dit onderwerp: zie hier enkele fragmenten uit die Engelstalige publicatie.

[…]2. De voor- en nadelen van Signals intelligence

Over Signals intelligence tijdens de Koude Oorlog en na de val van de muur is weinig bekend. Signals intelligence is namelijk nogal technisch van aard, en daardoor is vaak moeilijk uit te leggen wat het belang ervan is. Mede hierdoor hebben wetenschappers en journalisten het onderwerp veelal gemeden.

De schaarse aandacht die er wel voor was had meestal betrekking op de Tweede Wereldoorlog. Toch was Signals intelligence door de specifieke informatie die dit opleverde de belangrijkste bron van intelligence bij militaire conflicten tijdens en na de Koude Oorlog. Sinds mensenheugenis hebben regeringen immers altijd willen weten wat hun vijanden, maar ook hun vrienden in hun schild voerden. De gemakkelijkste manier daarvoor is om gewoon naar hun communicatieverkeer te luisteren. Het voormalige hoofd van de US Navy Communications Intelligence Organization schreef bijvoorbeeld: ‘The ambition of every nation has been to develop unbreakable ciphers for its own use and to solve every cipher in use by its actual or potential enemies.’

Voordelen van Signals Intelligence

Door het specifieke karakter van de verkregen informatie heeft Signals intelligence een aantal eigen kwaliteiten, waardoor dit een zeer effectieve methode is om intelligence te vergaren. In oktober 1998 beschreef John Millis, wijlen staff director van het House Permanent Select Committee on Intelligence, dat Signals intelligence ‘has been and continues to be the intelligence of choice of the policy maker and the military commander’. Hij voegde hieraan toe: ‘the fact of the matter is, it’s there quickly when needed. It’s always there. Or it has always been there.’ Hierna komen een negental voordelen aan de orde.

Een eerste voordeel van deze vorm van intelligence is dat het hiereen passieve methode betreft, in het algemeen uitgevoerd zonder dat het doelwit daar weet van heeft. Verder kan Signals intelligence gebruikt worden tegen een doel dat soms honderden of zelfs duizenden kilometers ver ligt; het is vaak niet nodig om onderscheppingenapparatuur dichtbij het doel te hebben. Signals intelligence kent daarom weinig politieke of fysieke risico’s; een uitzondering hierop vormde de vergaring van deze informatie vanuit vliegtuigen langs de kust van verschillende staten.

In de tweede plaats is Signals intelligence objectief; de betrouwbaarheid ervan is groot, en dat kan soms een perfect intelligence-product opleveren. Het zal, in tegenstelling tot inlichtingen vergaard door menselijke bronnen, Human intelligence, altijd vrij zijn van politieke vooringenomenheid en zal niet worden beïnvloed door de politieke perceptie van de bronnen van de agent. Human intelligence kan soms politiek gekleurd zijn, omdat deze wordt aangeleverd door verraders, of vanwege chantage, corruptie, politiek of financieel gewin. Maar Signals intelligence levert in ruwe vorm precies wat er geregistreerd wordt in een onverbloemde, niet-gekleurde en onverdraaide gedaante. Signals intelligence verwierf hierdoor een belangrijke status bij de afnemers van intelligence. Zo stelde een voormalige CIA-agent: ‘You know the origin and you know that this is genuine. It’s not like a clandestine [Human intelligence] report where you don’t know if this is a good agent or a weak agent or a bad agent or a double agent.’ Een andere CIA-medewerker noemde hierbij meteen ook de schaduwzijde: ‘Electronic intercepts are great, but you don’t know if you’ve got two idiots talking on the phone.’

Een derde voordeel is dat sommige – zeker niet aIle – intercepts een zelfstandig intelligen- ce-product kunnen zijn, zonder dat het nodig is om de informatie te verifieren via andere bronnen. De voormalige directeur van de CIA, Stansfield Turner, schreef in 1991:

“Electronic intercepts may be even more useful [than agents] in discerning intentions. For instance, if a foreign official writes about plans in a message and the United States intercepts it, or if he discusses it and we record it with a listening device, those verbatim intercepts are likely to be more reliable than second-hand reports from an agent.”

Een intercept kan dus unieke intelligence opleveren. Daarom krijgt de Amerikaanse president elke morgen, naast een Top Secret intelligence summary, een zogeheten Black Book met daarin de belangrijkste intercepts van de afgelopen 24 uur. In Den Haag wordt onder de hoogste ambtelijke beleidsmakers een soortgelijke op Nederland gerichte publicatie verspreid, de zogeheten ‘Groene Editie’ .

In de vierde plaats is Signals intelligence voor de intelligence-afnemer meestal de snelst beschikbare vorm van intelligence. Vooral de National Security Agency kan dankzij zijn wereldwijde afluisternetwerk Signals intelligence sneller aanleveren dan iedere andere vorm van intelligence. Tijdens de Cuba-crisis in 1962 duurde het bijvoorbeeld gemiddeld meer dan een week voordat een Human intelligence-rapport de CIA bereikte. Intercepts daarentegen waren voor de beleidsmakers direct beschikbaar. Hierdoor ging Signals intelligence (en Imagery Intelligence, beelden vanuit de lucht) een steeds belangrijkere rol vervullen bij waarschuwingen voor een vijandelijke aanval.

In de vijfde plaats levert Signals intelligence veel meer intelligence op over een breed scala van onderwerpen dan iedere andere vorm van intelligence. Aan het eind van de jaren zestig van de vorige eeuw produceerde de National Security Agency al meer dan 400.000 intelligence- rapporten per jaar, dus meer dan duizend rapporten per dag.”

In de zesde plaats: Signals intelligence ‘slaapt nooit’. Agenten en hun bronnen moeten immers van tijd tot tijd rusten en Imagery intelligence is soms niet inzendbaar vanwege duisternis, zandstormen of meteorologische omstandigheden. Signals intelligence kan echter dag en nacht worden ingezet: 24 uur per dag en 365 dagen per jaar.

In de zevende plaats is Signals intelligence flexibeler en meer gericht op de afnemer dan de meeste andere vormen van intelligence. Daarom stelde een rapport van het Amerikaanse Congres uit 1998: ‘much of the National Security Agency’s past strength has come from its localised creativity and quick-reaction capability’.” Vooral de grotere Signals intelligence organisaties zijn in staat om snel nieuwe doelen af te luisteren. Inlichtingendiensten kunnen nu eenmaal niet binnen 24 uur een heel nieuw netwerk van agenten en spionnen opbouwen. Ook Imagery intelligence is niet flexibel genoeg, want er zijn enorme kosten aan verbonden om een spionagesatelliet in een nieuwe baan te brengen.

Ten achtste is het potentieel van Signals intelligence veel groter dan iedere andere vorm van intelligence. Een succesvolle doorbraak bij het breken van een buitenlandse code kan waardevollere informatie opleveren dan alle andere intelligence-bronnen bij elkaar. Het kraken van een code is soms het ‘equivalent not of one but of a thousand spies, all ideally placed, all secure, and all reporting instantaneously’.”Zelfs de meest fervente voorstander van Human intelligence, de legendarische CIA-directeur van 1953 tot 1961 Allen W. Dulles, moest toegeven dat Signals intelligence ‘the best and “hottest” intelligence’ opleverde ‘that one government can gather about another’.

Ten slotte zou Signals intelligence de effectiefste manier zijn (vergeleken met andere methoden) om intelligence te verzamelen: het biedt, ondanks de hoge kosten, over het algemeen ‘meer waar voor zijn geld’.” Signals intelligence is inderdaad prijzig. Tijdens de Koude Oorlog besteedde de Amerikaanse overheid vier tot vijf keer zoveel geld aan Signals intelligence als aan Human intelligence. Sinds 1945 heeft de National Security Agency er waarschijnlijk meer dan $ 100 miljard aan uitgegeven, waarvan 75 procent aan Signals intelligence, en het overige aan de beveiliging van verbindingen (Communications Security).

Signals intelligence was en is kortom waarschijnlijk een van de meest productieve technieken om intelligence te vergaren.

Sinds de val van de Muur is het relatieve belang van Signals intelligence aIleen maar toegenomen. Dit geldt niet aIleen voor de Verenigde Staten, maar ook voor hun Europese bondgenoten. Die werden waarschijnlijk door het ontbreken van goede capaciteiten voor Imagery intelligence (beelden vanuit de lucht) zelfs nog afhankelijker van Signals intelligence.

Een voorbeeld hiervan zijn de banden tussen de Verenigde Staten en het Verenigd Koninkrijk: al gedurende de jaren tachtig was het grootste deel (tachtig á negentig procent) van de ruwe intelligence die elke dag naar het Britse Joint Intelligence Committee toevloeide afkomstig uit Signals intelligence, en in mei 1999 verklaarde de Britse minister van Buitenlandse Zaken, Robin Cook, over de Britse afluisterdienst dat ‘the Government Communications Headquarters work is vital in supporting our foreign and defence policies’. Ook het jaarverslag over 2000 van de Intelligence and Security Committee van het Britse Parlement gaf het belang van Signals intelligence aan: ‘The quality of the [Government Communications Headquarters-intelligence gathered clearly reflects the value of the close co-ordination under the UK-USAagreement.’ Hiermee werd verwezen naar een verdrag dat in juni 1948 werd ondertekend door Londen en Washington, genaamd het UK-USA Communications Intelligence Agreement. Dit legde de verdeling vast van de Communications intelligence- inspanning die toen gericht was tegen Moskou en zijn bondgenoten. Later gingen ook Canada, Australie en Nieuw-Zeeland van deze UK-USA-overeenkomst deel uitmaken.

Ook voor andere landen was Signals Intelligence van groot belang, zoals voor Canada, een belangrijke troepenleverend land van UNPROFOR. De nationale Signals intelligence- organisatie, de Communications Security Establishment, was de belangrijkste leverancier van intelligence in de Canadese hoofdstad Ottawa. En ook in Nederland speelden verbindingsinlichtingen in het verleden een belangrijke rol, zoals tijdens de oliecrisis. Ook in latere jaren heeft de, thans genoemde Afdeling Verbindingsinlichtingen (AVI) van de MID belangrijke intelligence aangeleverd.

Nadelen van Signals Intelligence

Tegenover de voordelen van Signals intelligence staat ook een aantal nadelen. Die zwakke kanten en beperkingen zijn overigens soms ook van toepassing op andere intelligence-

Allereerst gaan intercepts altijd gepaard met de grootste geheimhouding. De distributie van het Signals intelligence-product is daarom altijd zeer beperkt. Slechts een zeer kleine kring van de allerhoogste politieke en militaire beleidsmakers heeft toegang tot ruwe Signals intelligence. Deze geheimhouding is ook belangrijk in de context van de intelligence-sharing tussen de Verenigde Staten en hun westerse bondgenoten: vaak wordt Signals intelligence wel verwerkt in intelligence-rapportages, maar de ruwe Signals intelligence is aan weinigen voorbehouden, en dan meestal nog aIleen op een ‘need to know’-basis. De belangrijkste reden daarvoor is dat uitgelekte Signals intelligence grote schade kan veroorzaken. Als degene die afgeluisterd is, de ‘target’ in intelligence-jargon, dat ontdekt, kan deze namelijk snel codes of sleutels veranderen, waardoor de inspanning die geleverd is in de voorafgaande periode om die code of sleutel te breken in één klap waardeloos wordt.

Het nadeel van deze extreme geheimhouding is dat Signals intelligence vaak de juiste personen op de lagere niveaus niet bereikt. Soms bereikt Signals intelligence de commandanten op de grond niet, omdat besloten werd dat deze een need-to-know-classificatiehad, waardoor het intelligence-productgeen verdere verspreiding kreeg. Dit was bijvoorbeeld het geval tijdens de oorlog in Korea: de Communications intelligence bereikte niet aIleen de Amerikaanse troepen op de grond niet, maar evenmin de Amerikaanse marine en luchtmacht. Hierdoor bleef zeer waardevolle tactische en strategische intelligence ongebruikt.

De Amerikanen leerden niet veel van de Korea-oorlog, want tijdens de Vietnam-oorlog gebeurde nagenoeg hetzelfde. Belangrijke Signals intelligence over locaties van NoordVietnamese afweersystemen en MIG-gevechtsvliegtuigen, bleef bij de National Security Agency ‘hangen’, en bereikte de Amerikaanse luchtmacht en marine nooit. De gevolgen daarvan waren verstrekkend: er werden meer Amerikaanse vliegtuigen neergeschoten en er kwamen meer piloten om dan no dig was.

In het midden van de jaren tachtig, onder de regering-Reagan, weigerde de National Security Agency aanvankelijk zelfs om intercepts over steun uit Cuba en Nicaragua aan het gewapende verzet in El Salvador door te geven aan de CIA.

Ook in andere landen dan de Verenigde Staten gelden dergelijke beperkingen: in Moskou gaven KGB en de militaire inlichtingendienst GRU hun Signals intelligence slechts door aan een kleine groep binnen het Politbureau. Het delen van deze inlichtingen met leden van het Warschaupact was zelfs officieel verboden. En ook in Europese landen, als het Verenigd Koninkrijk, Duitsland, Frankrijk en Nederland, is de toegang tot Signals intelligence beperkt tot een selecte groep van beleidsmakers en militairen.

Naast de extreme geheimhouding en daardoor beperkte distributie is een tweede nadeel van Signals intelligence de rem op het gebruik ervan. Gedurende de jaren vijftig en zestig had elk Amerikaans Communications intelligence-rapportde volgende vaste beginregel: ‘No action is to be taken on information herein reported, regardless of temporary advantage, if such action might have the effect of revealing the existence and nature of the source.’ Waarschijhlijk wordt die beginregel nog steeds genoemd.

Deze beperking heeft tot zeer bizarre situaties geleid. Zo onderschepte de Australische Signals intelligence-organisatie (Defence Signals Directorate) in oktober 1995 Indonesische militaire berichten, waaruit bleek dat er plannen waren om vijf gearresteerde Australische journalisten op Oost-Timor te executeren. De dienst besloot om deze inlichtingen niet door te geven aan de Australische premier Gough Whitlam, omdat men vreesde dat deze vervolgens zou handelen op basis van deze onderschepte berichten, of zelfs zou openbaren. Dit zou de capaciteit van de Defence Signals Directorate om het Indonesische militaire verkeer mee te lezen, kunnen verraden, zo was de redenering. Vervolgens werden alle vijf journalisten vermoord door Indonesische Special Forces.

Een derde nadeel is dat Signals intelligence vaak niet op waarde wordt geschat of zelfs soms niet wordt geloofd. Signals intelligence als bron werd bijvoorbeeld tijdens de Koude Oorlog niet betrouwbaar genoeg geacht. Ook al tijdens de oorlog in Korea hechtte de top van de Amerikaanse krijgsmacht geen waarde aan Communications intelligence over de werkelijke sterkte van Mao’s Rode Leger. En tijdens de oorlog in Indochina weigerden Franse commandanten aandacht te schenken aan intercepts van vijandelijk verkeer, omdat deze niet pasten in hun eigen analyse van de militaire situatie.

Een volgend nadeel bestaat er omgekeerd juist uit dat veel landen tijdens de Koude Oorlog te afhankelijk waren van Signals intelligence. In 1978 was de Amerikaanse intelligence- gemeenschap daarvan zo afhankelijk geworden dat president Carter een duidelijke waarschuwing afgaf: ‘Recently (… ) I have been concerned that the trend that was established about 15 years ago to get intelligence from electronic means might have been overemphasized.’ Ook de militaire leiding van de Sovjet-Unie bleek volstrekt van Signals intelligence afhankelijk te zijn geworden waar het ging om een tijdige waarschuwing voor een nucleaire of conventionele aanval. Dat had zeer onaangename gevolgen, zoals bleek in de herfst van 1983. Er dreigde toen een serieuze nucleaire crisis, als gevolg van misverstanden: Soviet- en Warschaupact-grondstations interpreteerden een NAVO-oefening volstrekt foutief, op grond van Signals intelligence: ze dachten dat er een verrassingsaanval met Pershingraketten ging komen. En in mei 1998 leidde een verkeerde interpretatie van intercepts bij de Signals intelligence-organisatie van het leger van India bijna tot een nucleaire confrontatie tusscu India en Pakistan.

Hiermee hangt het vijfde nadeel samen: blind vertrouwen in verbindingsinlichtingen kan leiden tot een soort Signals intelligence snobbery. Zo werd tijdens de Koude Oorlog en daarna het belang dat men aan Signals intelligence hechtte steeds groter. Vooral de introductie van spionagesatellieten en het spionagevliegtuig U-2 leidde tot een verwaarlozing van Human intelligence. Er ontstond een soort intelligence-elitisme, ook wel bekend als het ‘Groene-Deur-syndroom’: het idee dat alleen Signals intelligence (en in zekere mate ook Imagery intelligence) nog betrouwbaar zou zijn. Human intelligence werd dan veelal afgedaan als onbetrouwbaar. De zogeheten BrixMis-spionagemissies in de DDR hadden hieronder te lijdcn; hun missierapporten weken namelijk soms af van de Signals intelligencerapportages over hetzelfde onderwerp. Dan werd meestal de Signals intelligence geloofd, omdat rapportages van het Government Communications Headquarters nu eenmaal veel hoger geclassificeerd waren (‘Secret’ of ‘Top Secret’), terwijl dezelfde intelligence in het BrixMis-rapportslechts ‘UK Confidential’ als classificatie meekreeg.

In een te groot vertrouwen in Signals intelligence schuilt nog een extra risico, dat als het zesde nadeel geldt: dit intelligence-product moet namelijk vaak bekeken worden in samenhang met Human intelligence en Imagery intelligence. Op Signals intelligence als exclusief intelligence-productvalt slechts in speciale gevallen te bouwen: Signals intelligence geeft veelal alleen een stukje van de puzzel, en zelden de gehele puzzel. Veel verbindingsinlichtingen zijn namelijk fragmentarisch en indirect. Dat betekent ook dat op intelligence van de National Security Agency niet valt te bouwen, omdat deze alleen ruwe verbindingsinlichtingen produceert en geen finished intelligence. De verantwoordelijkheid om tot een afgerond intelligence-productte komen, ligt bij de afnemers (de consumenten) van het ruwe materiaal van de National Security Agency. Analisten binnen die Amerikaanse intelligence- gemeenschap moeten dan ook vaak honderden of zelfs duizenden verbindingsinlichtingen analyseren, wil het ‘plaatje’ duidelijk worden. Een medewerker van een Amerikaanse inlichtingendienst verklaarde in dit verband: ‘You rarely get a Signals intelligence smoking gun. It’s usually very fragmentary (…) Very often you don’t even know who you’re listening to.’ Dat is een bevestiging dat ook Signals intelligence niet alle antwoorden geeft; toepassing daarvan is zeker niet voldoende om de politieke voornemens of de interne politieke machinaties binnen een buitenlandse overheidsadministratie bloot te leggen. Overigens zijn ook Imagery intelligence en Human intelligence daar zelden toe in staat,

Een zevende nadeel bestaat erin dat Signals intelligence weliswaar snel is, maar desondanks soms toch te laat arriveert. Tijdens de Suez-crisis in 1956 en de invasie van Tsjechoslowakije in 1968 was er bijvoorbeeld voldoende Signals intelligence beschikbaar, maar de verwerking, analyse en rapportage bleek te tijdrovend. Pas dagen na beide invasies was de Signals intelligence beschikbaar.

Dit hangt weer samen met het achtste nadeel, dat waarschijnlijk het belangrijkste is: de stroom informatie is enorm, maar de analysecapaciteit is onvoldoende. Krachtige computers kunnen een snelle voorselectie uitvoeren en het kaf van het koren scheiden, maar de analist moet uiteindelijk toch bepalen of een bericht waardevol is. Signals intelligence- organisaties worden tijdens een crisis overspoeld met massa’s intercepts. CIA-analisten waren niet in staat om de oorlog in het Midden-Oosten in 1973 te voorspellen, omdat er honderden Communications intelligence-rapportenvan de National Security Agency op hun bureau landden: daardoor werd het overzicht verloren.

De directeur van National Security Agency in 1995, admiraal McConnell, verklaarde bijvoorbeeld dat de ‘National Security Agency’s capability to intercept far exceeds its capability to decode, analyze and report. The goods news is the agency can decode and analyze a million messages a day; the bad news is the agency must decide which million, of the billions of messages sent globally, to decode.’ Omstreeks 1995 verwerkte de National Security Agency inderdaad slechts ongeveer één procent van alle intercepts die het hoofkwartier in Fort Meade bereikten; in de jaren tachtig was dat nog twintig procent. Tekenend voor de verhouding tussen binnenkomende intercepts en uitgaande intelligence bij de National Security Agency is daarbij dat de huidige directeur van de National Security Agency, generaal Hayden, moest toegeven dat de National Security Agency inmiddels weI minder produceerde aan intelligence dan tien jaar geleden. Bij de intelligence-productievan de National Security Agency hielp ook niet – zoals een interne studie in het voorjaar van 1995 onthulde dat er voortdurend bureaucratische gevechten binnen de National Security Agency plaatsvonden, tussen de militaire en de civiele delen van de Divisie Operaties van deze organisatie. Dat vertraagde de stroom van intelligence naar andere diensten aanzienlijk; veel afnemers van het intelligence-productvan de National Security Agency klaagden midden 1995 dat de National Security Agency niet in staat bleek te zijn om aan hun behoefte te voldoen.

Een negende nadeel is de inherente kwetsbaarheid van verbindingsinlichtingen. Verbindingen worden beveiligd, codes kunnen plotseling veranderd worden, er kan frequency hopping plaatsvinden bij de zenders; daarbij springt de zender volgens een, aIleen bij de legitieme ontvanger bekend, patroon tussen verschillende frequenties. Ook kunnen er zogeheten bursttransmissies optreden, waarbij in enkele seconden enorme hoeveelheden informatie wordt verzonden. En er kan sprake zijn van spread spectrum, waarbij de te verzenden informatie verdeeld over simultaan uitgezonden frequenties wordt uitgezonden. Een andere voor de hand liggende manier om de verbindingsinlichtingen te storen door degene wiens berichtenverkeer wordt onderschept, is om opzettelijk valse berichten te verspreiden, in de hoop dat die opgevangen worden. Ook cryptografie is een uitstekend middel om het berichtenverkeer te beschermen. Millis noemde dit een van de grotere bedreigingen voor de inspanningen van de National Security Agency: Signals intelligence verkeerde volgens hem door deze factoren in een crisis, en de wereld van het communicatieverkeer was niet langer Signals intelligence-vriendelijk te noemen.

AIle inspanningen kunnen natuurlijk ook tenietgedaan worden door spionage of verraad. Sovjet-spionnen als William Weisband, William H. Martin en Bernon F. Mitchell hebben enorme schade toegebracht aan de Amerikaanse pogingen om verbindingsinlichtingen te verwerven. Versprekingen van de Amerikaanse president kunnen hetzelfde resultaat opleveren. Zo onthulde president Richard M. Nixon in 1969 tijdens een persconferentie dat de National Security Agency in staat was om het communicatieverkeer van de Sovjet-Unie en Noord-Korea te lezen. Na die verklaring veranderden Moskou en Pyongyang hun cryptografische systernen, en was de National Security Agency direct ‘doof’. De National Security Agency had maanden nodig om de schade die veroorzaakt was door Nixons verspreking te herstellen.

Een tiende nadeel is dat Signals intelligence vanwege de beperkte verspreiding ook voor eigen politieke doeleinden aangewend kan worden. Dat deed Henry Kissinger als National Security Advisor van Nixon; bepaalde gevoelige intercepts werden niet met de ministers van Defensie en Buitenlandse Zaken gedeeld. En in 1986 weigerde de National Security Agency zelfs Signals intelligence over de Iran-Contra-affaire te delen met de minister van Defensie, Weinberger: de redenering was dat het Pentagon geen ‘need-to-know’ had.

Als elfde nadeel geldt soms het ontbreken van gecoordineerde Signals intelligence-verzamelactiviteiten. Tijdens de Koude Oorlog waren de verschillende Signals intelligenceorganisaties van de drie Amerikaanse krijgsmachtonderdelen en van de diverse inlichtingendiensten vaak bezig met hetzelfde doel. Er ontstond zo een enorme verdubbeling van verbindingsinlichtingen. Ook na de Koude Oorlog kwam dat voor, bijvoorbeeld bij de jacht op drugskoning Pablo Escobar in 1992-1993: de National Security Agency, de Signals intelli- gence-eenhedenvan de CIA en de Amerikaanse krijgsmacht opereerden toen volstrekt onafhankelijkvan elkaar, om aan te tonen dat hun personeel en materieel ‘beter’ waren dan die van de andere organisatie. Ook in de Sovjet-Unie werkten de KGB en de militaire inlichtingendienst GRU vaak langs elkaar heen, en dit fenomeen deed zich niet aIleen voor bij deze twee grote mogendheden: in Duitsland vochten de Bundesnachrichtendienst en de Duitse militaire inlichtingendienst meer dan twintig jaar over de vraag wie er zeggenschap over Signals intelligence zou krijgen. In hoofdstuk 3 kwam al aan de orde dat er ook in Nederland drie afzonderlijke militaire organisaties bestonden voor verbindingsinlichtingen; van samenwerking of serieuze pogingen tot integratie was amper sprake. Pas in 1996 werden deze drie diensten geintegreerd tot de Afdeling Verbindingsinlichtingen.

Tot slot zijn ook technische obstakels een zekere belemmering bij Signals intelligence. Atmosferische storingen, ruis, zwakke ontvangst en het af en toe wegvallen van verbindingen kunnen een goede onderschepping in de weg staan. De gesteldheid van het terrein kan eveneens een belemmerende factor zijn. Dichtbewoonde gebieden, maar ook bergen en vaIleien, maken een goede interceptie van veraf vaak onmogelijk. Ten slotte kunnen storingen worden veroorzaakt door industriele activiteiten die de interceptie onmogelijk maken.

Samengevat: Signals intelligence is een belangrijke, veilige, sneIle, permanent inzetbare, kostbare, productieve en zeer betrouwbare methode om intelligence in de vorm van verbindingsinlichtingen te vergaren. Er kleven evenwel ook nadelen aan waarvan de belangrijkste zijn: de stortvloed aan onderschepte gegevens, het ontbreken van voldoende analysecapaciteit, de beperkte mogelijkheden van interceptie vanwege cryptografie, beveiligde verbindingen via landlijnen, de terreingesteldheid en atmosferische omstandigheden.

[…]

EOF

‘Chief of NSA/USCYBERCOM Eyes Deterrence in Cyberspace’ — here is a list of readings on deterrence

According to a report by DefenceTalk, the chief of the NSA and USCYBERCOM, Mike Rogers, is eyeing deterrence to fight adversarial behavior in cyberspace. The article quotes from Rogers’ response to the newly revealed reports that allege malicious behavior from Chinese and Russian actors: “Right now, if you are a nation-state, if you are a group, if you are an individual, my assessment is that most (hackers) come to the conclusion that [attacking U.S. targets in cyberspace] is incredibly low-risk, that there is little price to pay for the actions that they are taking”. Furthermore: “[it is] not in our best interests in the long term as a nation to have that perception”. No information is provided concerning a strategy for such deterrence. For inspiration, here is a list of readings on deterrence in cyberspace (covers various kinds of actors):

EOF

The Dutch Defense Cyber Command: A New Operational Capability

UPDATE 2017-05-23: reportedly (mirror: .html and .pdf) there is a longer-running partnership between the Dutch Defense Cyber Command (DCC) and the U.S. Army 780th Military Intelligence Brigade (aka ‘Cyber Brigade’). The partnership includes “sending U.S. cyber Soldiers and civilians to the Netherlands to attend the DCC Cyber Security Insight Course (CSIC)”. In October 2016, the Dutch participated in the “Bold Quest” training exercise at Fort Stewart, Georgia.

UPDATE 2016-11-30: the Dutch MoD announces that the DCC will be mission-ready in the first part of 2017; it has some 80 personnel, spanning defensive and offensive capabilities. (Note: that number represent just the DCC; obviously, more personnel with IT security knowledge and skills is present throughout the MoD, e.g. at DefCERT, Ivent and military intelligence.)

UPDATE 2016-06-xx: article, in Dutch, about the DCC: Defensie Cyber Commando, een nieuwe loot aan de defensieboom (.pdf, by BGen Hans Folmer, published in Intercom 2016-1, i.e., the magazine of the association of Dutch army signals officers)

UPDATE 2016-05-03: the Dutch MoD reports that it works with Thales to set up an advanced cyber training & test facility in the Du Moulin Barracks in Soesterberg.

UPDATE 2014-11-05: for illustrative purposes I added two tables on cyber vs physical/conventional topics from Cyberspace: The Ultimate Complex Adaptive System (.pdf, 2011) by Dr. Paul W. Phister Jr. (AF Research Laboratory, USA).

UPDATE 2014-10-23: added budget data, more context, and a chart from 2011 visualizing the implementation the Dutch Defense Cyber Strategy of 2012.

Colonel Hans Folmer, the Commander of the newly established Dutch Defense Cyber Command (DCC), wrote a short article (.pdf, in Dutch) for “Magazine Nationale veiligheid en crisisbeheersing 2014, nr. 5” entitled “The Dutch Defense Cyber Command: A New Operational Capability” (my translation). The magazine was published online by the Dutch government on October 22nd 2014. A translation of Folmer’s article follows in the body of this post.

Cyber can be used by the military to carry out — with varying cost/risk/yield ratios — defense, attack and intelligence. For instance, to deny, disrupt, degrade or destroy enemy capability involving digital systems; whether on land, sea, air, space, or in the digital domain itself. To illustrate the use of cyber in the conventional military objective of antiaccess/area-denial, consider the following table published by Harry Foster, Deputy Director of the USAF Center for Strategy and Technology at Air University, in JFQ-72 (4.2MB .pdf, 2014):

usaf-cyber-example

Two other illustrations can be found in Table 1 and Table 2 in Cyberspace: The Ultimate Complex Adaptive System (.pdf, 2011) by Dr. Paul W. Phister Jr. First, Table 1 maps the conventional domains — sea, ground, air and space — to the cyber domain:

phister2011-table-1-cyber-vs-conventional

Second, Table 2 maps attributes of the physical environment to those of the cyber environment:

phister2011-table-2-cyber-vs-physical

Now, on to the Dutch DCC. The Dutch DCC formally resides within the Royal Netherlands Army, the land forces element of the Dutch armed forces (in Dutch: “Commando Landstrijdkrachten” (CLAS)), but involves officers from all military domains. The DCC is primarily tasked with defense, but will also work on offense and, to a lesser extent, intelligence. The DCC will cooperate with the MIVD and the Joint Sigint Cyber Unit (JSCU). The JSCU is a joint organization of the General Intelligence & Security Service (AIVD) and the Military Intelligence & Security Service (MIVD) that is tasked with the collection of data from technical sources, making it accessible and searchable, perform analysis (correlation, data mining), and delivering sigint and cyber capability in support of the intelligence requirements of the AIVD and MIVD (possibly on-site in military deployment areas). Roughly put, the DCC is the Dutch smaller equivalent of USCYBERCOM, and the JSCU is the Dutch smaller equivalent of the NSA.

No organizational chart is available of the current situation (AFAIK), but in 2011, the following chart was used to visualize the implementation of the Dutch Defense Cyber Strategy, and still seems applicable:

dcc-ontwerp-organogram-2011

As of 2016, the annual budget of the DCC is estimated to be some EUR 21M. According to the budget (2.2MB .pdf, in Dutch) of the Ministry of Defense (MoD) for 2015, the investment budget for “cyber weapons” is EUR 5M in 2015, EUR 7M in 2016 and EUR 9M from 2017 onward. (Note: the document does not define “cyber weapons”.) The annual budget is divided in investments, exploitation and personnel as follows (in million euro):

defensie-budget-cyber-2015

Some 40% of this budget is assigned to the MIVD, some 40% to the DCC (including DCEC), and the remainder to Joint IV Command (JIVC), the Netherlands Defence Academy (NLDA) and Directorate of Operations (DOPS). The MIVD has some 800 employees, the AIVD has some 1500 employees. The JSCU will have 350 employees, mostly from the AIVD and MIVD. The number of employees residing under the DCC and DCEC is not known (to me), but it is reported that sixty new employees were acquired, and that fourteen military officers are will be trained in hacking by Fox IT.

Just like other parts of the armed forces, the operational use of the DCC will be controlled by the Chief of Defence (CHOD), the highest ranking military officer in the Dutch armed forces. This position is currently held by Tom Middendorp. (His predecessor, Dick Berlijn, has been Cybersecurity Advisor at Deloitte Netherlands since resigning in 2008.)

Here is a translation of Folmer’s article about the DCC (hyperlinks are mine):

The Defense Cyber Command, a new operational capability
By Colonel Hans Folmer
Commander of the Dutch Defense Cyber Command

On September 25th 2014, the Minister of Defense, Jeanine Hennis-Plasschaert, established the Defense Cyber Command in The Hague. She rightfully called [.pdf, in Dutch] the launch of a new operational unit and the final addition of the cyber weapon to the toolkit of the Dutch armed forces a historic event.

The nature and character of conflicts change. Maximum disruption of societies increasingly is the objective of malicious actors. Increasingly, better use is made of modern, easy to obtain technical digital means.

In military operations, the cyber domain is used effectively by all parties both for command and control, and propaganda. Weapons and sensory systems are digital systems. Attacks can now occur globally and in real time. The enemy does not even have to physically cross a border to attack us. On the other hand, the enemy can be grabbed at large distance, or disruptive activities can be counteracted. It is of crucial importance to recognize, understand and control this, and also to deploy cyber weapons ourselves. The Dutch armed forces draws conclusions from this and wants to play the prominent role that suits our country. To guarantee the ability to deploy the armed forces and to increase its effectiveness, the Ministry of Defense has been working on strengthening its digital defensibility for several years, and will in the coming years be developing the capability to carry out cyber operations.

The establishment of the Defense Cyber Command (DCC) was the final step toward embedding all cyber capabilities within the Ministry of Defense. In June 2012, the Minister of Defense, Hans Hillen, presented the Defense Cyber Strategy. The core of the strategy is that the digital domain, next to land, air, sea and space, has now become the fifth domain for military action. Digital means as weapon or means of intelligence will increasingly be an integral part of military action. However, the dependence on digital means also results in vulnerabilities that require urgent attention.

The strategy includes six priorities that will guide the Ministry of Defense in effectuating hear goals in the digital domain:

  1. the establishment of an integral approach;
  2. the strengthening of the digital defensibility of the Ministry of Defense (“defensive”);
  3. the development of the military capability to carry out cyber operations (“offensive”);
  4. the strengthening of intelligence in the digital domain (“intelligence”);
  5. the strengthening of knowledge position and innovative capability of the Ministry of Defense in the digital domain, including the acquisition and retaining of qualified personnel (“adaptive and innovative”);
  6. the intensification of national and international cooperation (“cooperation”).

In the establishment of the strategy, the strengthening of our own protection was prioritized (by the establishment of DefCERT, the Computer Emergency Response Team of the Ministry of Defense) and expanding the intelligence capability. In addition, the knowledge position has been worked on energetically, with the establishment of the Defense Cyber Expertise Center [as per May 214], and of course on the cooperation with public, private and international partners. The establishment of an operational capability was originally planned for the end of 2015, but in the memorandum “In het belang van Nederland” the urgency was recognized and the establishment of the DCC accelerated.

The Defense Cyber Command is the central entity within the Ministry of Defense for the development and use of military operational and offensive capability. For that purpose, the DCC, in addition to a small staff, has three departments.

  1. The Operations department consists of a pool of cyber advisers for the support of operational units. These cyber advisers will be used in small teams during actual operational deployment and exercises, and are tasked with advising the operational commander on the use of digital means, dependency, vulnerabilities and capabilities of the enemies and our own troops. They will also advise on the protection of our own means. The cyber advisers are the link between the operational unit in the deployment area and the cyber units in the Netherlands (DCC and DefCERT). These teams will be trained jointly with operational units, as preparation for cooperation during an operational deployment.
  2. The Technology department consists of cyber specialists that have the technical knowledge and skills to act offensively in the cyber domain, both to carry out an effective defense as well as to support operations. Offensive cyber capabilities are capabilities aimed at influences or disrupting enemy actions. This concerns the development of (knowledge about) complex and high-tech means and techniques specifically aimed at increasing our own military capability. A cyber attack on an air defense system, for instance, can increase the effectiveness of an air raid, while limiting the risk to collateral damage.
  3. The Defense Cyber Expertise Center (DCEC) is the central entity within the Ministry of Defense for strengthening our own knowledge position, and as a result the innovative capability in the cyber domain. The DCEC will supply practically applicable cyber knowledge, concepts/doctrines and Education&Training support to all parts of the Ministry of Defense, and thereby contributes to the strengthening of the three cyber capabilities. The DCEC cooperates with knowledge institutions, universities and other (international) knowledge centers.

The mere establishment of the DCC does not yet achieve our goals. The establishment of this command will take time. In this domain, a new world is still to be discovered and developed. Much is yet unclear, and we are but at the beginning of the development of new capabilities. Existing tactics and methods of acting must be reshaped in the cyber domain. To that end, a cyber doctrine is currently being developed. Learn, experiment and apply, that is the motto for the coming years.

Summarizing, it must be possible to support military operations with offensive cyber capabilities. For that purpose, the Defense Cyber Command has been established. Offensive cyber capabilities can be a force multiplier, and thereby increase the effectiveness of the armed forces. By developing a robust cyber capability, the Netherlands can play an important role on this area within NATO. It is important that it is not a silver bullet to our all-encompassing vulnerability. It is, however, a crucial addition to our existing conventional capabilities on land, sea and air. Not a substitute, but a very important force multiplier.

Folmer states that the Netherlands “can play an important [cyber] role within NATO”. DefCERT has an existing covenant with NATO Computer Incident Response Capability (NCIRC). Also, one of the three NATO Communications and Information Agencies (NCI Agencies) is located in The Hague, adjacent to the business unit Defence, Safety & Security of knowledge institute TNO. According to some Parliamentary Papers, the MoD cooperates with TNO on the area of big data.

Furthermore, the MoD is a funding partner in Small Business Innovation Research Programs (SBIR) on cyber security. So far, two such calls exist: SBIR Cyber Security I (Sep 2012 – Dec 2014) and SBIR Cyber Security II (May 2014 – Jul 2016). Both involving some EUR 2-3M in available funding. A list of projects funded during the first call is available here. One of the example requirements the Dutch MoD expressed (.pdf, Jan 2014, in Dutch) in a pitch for SBIR-II is Linux/Python-built software for network reconnaissance against target networks for the purpose of identification, localization and detection; specifically also soliciting ideas for IPv6-based explorations.

Related:

EOF