“China Folk Counterespionage Manual” (NEEDED: full translation Chinese->English)

UPDATE 2017-04-17: perhaps there’s some renewed relevance to having the Chinese text below translated: Anti-Espionage: A New Mass Line Campaign in China? Anti-espionage appears to be the most important theme of this year’s “National Security Education Day.” (The Diplomat)

UPDATE 2017-04-10: not specifically related to the text below, but still relevant: a new approach to counterintelligence – China reportedly offers cash rewards between USD 1,500 and USD 72,400 to encourage residents in Beijing to provide information on infiltration, subversion and theft of information by foreign spies inside the country. The rewards depends on the importance of the reported information.

Does anyone understand Chinese more reliably than Google Translate does and care to translate the 9000-word “China Folk Counterespionage Manual” quoted below? It quite an effort, but I’d be happy to return the favor, for instance by carrying out a Dutch to English translation and/or by making a donation to a charity of your choice. The manual was posted in 2008 on a Chinese internet forum. Didi Kirsten Tatlow blogs that it is a manual on how to recognize foreign spies. China recently adopted new counterespionage legislation; this is the context/frame in which said report discusses this manual. The Chinese populist news paper Global Times spent attention on this topic on September 18th 2014:

Be wary of espionage trap surrounding us
(Global Times) 08:37, September 18, 2014

According to foreign media outlets, Ma Jisheng, who served as Chinese ambassador to Iceland, was allegedly arrested by the Ministry of State Security earlier this year on suspicion of passing intelligence to Japan. In recent years, we have frequently witnessed vicious incidents where top Chinese diplomats, military officers and senior research fellows of think tanks have been involved in espionage and selling intelligence. If Ma is confirmed to be involved in this case, that will be startling news.

China has become one of the most powerful strategic competitors with incredible strength, rapid development and a self-contained decision-making mechanism, which has made it a key target of the world’s major intelligence agencies. Meanwhile, given the relatively low vigilance in Chinese society, authorities have failed to effectively convey their judgments and understandings to the public. Among the high-risk groups easily eyed by overseas intelligence services, some lack both sufficient knowledge in this regard and a capacity of discernment.

There have been no contemporary spy dramas made in China for a long time, as directors will find it hard to acquire materials, and even if they do, such screenplays would not gain approval. Therefore literary creation in this area seems like a forbidden zone, despite continuous information warfare.

Plus, there are few news stories involving espionage and Chinese officials. A number of major cases that startled the Chinese elite were not released to the public through the media. In actuality, reporting such incidents will educate many people by letting them know how close those manipulators of overseas intelligence agencies are to us.

Officials and scholars accused of espionage did not fall into the trap overnight. Most of them developed distorted values and indulged themselves, hankering after cash and a life of luxury, so they were easily targeted by foreign intelligence services. They were treated to dinners and offered gifts, which gradually induced them to sell national intelligence.

Owing to a lack of public education in this field, ordinary Chinese have a quite shallow understanding of espionage.

Some people feel that everything is secret and become panicked about contact with foreigners, while others are adverse to rules on classified information and regard certain necessary measures as formalism.

Although information warfare is a common phenomenon around the world and almost every big power has once been mired in espionage cases, China has obviously suffered more losses in recent years. Ma Jisheng is not the first top diplomat caught for spying.

With advanced technologies in the modern era, there is an increasing possibility that those selling intelligence will be caught. And all the potential high-risk groups should recognize this point, which may help them refrain from selling information when they are about to cross the red line.

If it is confirmed that Ma has been caught, we hope that his story will one day appear on media to serve as a warning for others.

Globaltimes.cn also published the following infographic:

20140828_Peeking-in-China_source-Globaltimes.cn

Here is the manual (NEEDED: full translation Chinese->English):

中国防间谍不完全手册:里面的很多内容不光对留学生有用,对国内的网友来说也是非常有用的。一、间谍做什么?
二、谁会成为反华势力的间谍?
三、现实生活中策反/造谣类间谍的表现
四、网络上策反/造谣类间谍的表现
五、借信仰之名,行策反之实的假基督徒间谍(省略)
六、初级间谍拉人入伙的最初识别(省略)
七、总结情报工作无孔不入,情报人员其实就出没在我们的周围,他们看起来绝对不像是JamesBond那么酷,他们其实就和你的朋友没什么两样——说不定你的朋友 中就有情报人员。一个好的情报人员,一定是低调的,一定是能和群众打成一片的,一定是让你甚至连想都不会往这方面想的——一句话,扔到人堆里你绝对找不出 来的。而这些普普通通的情报人员,却在为各自的目的,为各个政治集团做着默默或者张扬的工作。一、间谍做什么?狭义的情报人员是服务于某政治集团的一些比较特殊的人员,他们的工作性质、工作内容也各不相同。通常的“间谍”一词所指的,只是其中的一部分。下面,我们看一看一般我们在国内外能够遇到的情报人员,一般都有哪些任务。1、刺探。这是情报人员最古老的工作之一。这项工作的目的是主动刺探敌方军情或者政治秘密,为我方采取战术或者战略反制措施提供决策依据。比较常见的是在军事基地附近拍照的间谍,以及发展第五纵队从敌方军政机构里面获取涉密信息的间谍。2、分析。如果说刺探是主动出击收集信息,那么分析则是被动地收集信息。例如专门分析报刊杂志上面政经信息的驻外文官(情报分析员),以及坐在某军工研究所附近餐馆 吃饭的常客(听研究人员吃饭时无意透露的最新武器研制信息)。其实不一定要专业的情报人员才能做这样的事情,许多平民也有这方面的惊人才能,例如在希特勒 闪击波兰前几个月,德国的一个平民就根据几年来收集到的公开报刊杂志分析出了希特勒闪击波兰的全部作战计划,连时间、编制、战役细节都推测得八九不离十。 他把分析结果出版,引起了希特勒的震惊与恼羞成怒,于是不久便派盖世太保将其暗杀。希特勒不得不重新调整战役部署,然而泄漏过多,难以完全达到战争的突然 性。幸而波兰国内的耶和华见证人(邪教)多方阻挠波兰人民抵抗,希特勒才没有在闪击波兰的过程中遇到太大的麻烦。3、窃取。间谍古已有之的任务。一般是使用技术手段获取敌方的技术图纸、数据、图片、录音等秘密信息,以及偷窃对方的某些技术装置(如特种合金碎片、芯片、导弹制导装置等部件,甚至是整架战斗机)。4、策反。这也是情报人员最古老的任务之一。顾名思义,策反就是通过各种心理战手段,将敌方人员从思想上转化为我方人员,从而削弱敌方力量,增强我方力量。被策反的 敌方人员,往往可以继续发展成我方间谍,或为我方提供特殊的技术能力,以使得情报工作效果最大化。这也是“和平演变”的核心所在,乃“兵不血刃”之高招。5、造谣。由于人民从广泛意义上比较缺乏专门的知识和辨识能力,容易倾向于相信一些他们所希望相信的东西,因此情报人员用造谣的方法,可以将人民群众拉拢支持己方政 治集团,反对敌方政治集团。以削弱敌方政治集团的民意基础,给敌方政治集团的执政带来很大困难,造成敌方政权管辖范围内的动荡,等等。同样,造谣也可以用 于攻击敌方个人,以诋毁其声誉。6、传递。这是一类比较特殊的情报人员,他们不单独行动,他们的任务是将信息情报在前线情报人员和后方总部之间进行有效而秘密的传递。二、谁会成为反华势力的间谍?中国人所要面对的,基本上全是反华势力的间谍了。因此,我们以下的讨论将仅仅局限于反华势力。西方每个国家都有不同的反华势力,他们各有不同,其中美国反华势力流派最多、经验最老到、势力也最大。在西欧(原北约成员国),反华势力的基本做法都和美国相去不多,因此下面仅讨论美国反华势力。美国反华势力主要可分为政府级别和民间级别.其中民间级别的包括臭名昭著的轮子、民运等,由于其自身的问题而不得势。然而政府主导的情报工作,却是力度很大、成效颇丰的。美国的情报机构,对外主要是CIA,对内主要是FBI。其中CIA尤其注重在留学生中进行情报工作。 经过几十年的实践总结,CIA已经形成了一整套招募发展外国间谍的行之有效的方法。概括起来可以用4个字母表示:MICE。(老鼠的复数?)M= money,即金钱。这个其实没什么好说的,许多人见钱眼开,给奶便是娘。I= ideology,意识形态。这个在冷战时期非常管用,那些极端厌恶共产党的社会主义路线的人,在本国受挫后,常常在反华势力“自由”、“民主”的旗号的煽动之下,主动投靠反华势力,充当其走狗。C即个人表现。比方说,CIA会跟你说,你给他们当间谍,你就可以成为007那样受到万人追捧的明星;你给他们当间谍,你就可以实现人生的最高价值,等等。

E即道德压力,就是常见的利用美色或者经济问题来引人上钩,抓到把柄,然后以此来要挟人为自己当间谍。

CIA的这个“老鼠”法,可谓屡试不爽。因此,符合这四条中任何一条很显著的人,都很有可能被美国反华势力发展成为间谍。比方说:

见钱眼开者,削尖脑袋也要享受资本主义奢侈糜烂生活的人。

那些如平可夫这种“对共产主义毫无兴趣”,对共产党恨之入骨的反共反华者。

那些个人成就动机极其强烈,尤其是希望得到万众瞩目的人。

还有就是那些贪官污吏啦,以及个人生活作风有问题的人。

由此,如果你发现有人对政治特别感兴趣,其政治倾向为反共反华,又符合上面四条中的任何一条(甚至几条),就要高度注意了。这样的人很可能不是自己头脑发热,不是自己真的要愤世嫉俗,而是为了反华集团而卖命。

三、现实生活中策反/造谣类间谍的表现

在现实生活中,与我们这些学生接触较多的反华势力的间谍,通常以学生的身份出现,这样对于我们这些普通的学生而言,无疑具有更大的亲和力,也可以避免我们的警惕与防范。

1、台湾中情局派出的“职业学生”

根据中国国家安全局的数据,在欧美的台湾留学生中,每5个人中就有一个是由台湾中情局直接进行经济支持的策反类间谍,这是台湾政府的内部规定。于是在台湾 学生中间就有了这么一个名词:职业学生。这些学生以在大学里面学习为职业,他们只要继续读书,就可以从中情局拿到不菲的薪水(当然通常来说都是不会让朋友 知道的)。他们的任务只有两个:1、策反大陆学生;2、防止台湾学生被大陆人策反。中情局对这些“职业学生”的要求,就是尽可能拖延毕业、多多组织台湾学 生的活动、多多接触大陆人。

根据这些特点,我们可以总结出这些台湾的策反类间谍的识别方法:

(1)持鲜明反共立场,有可能持台独立场,经常表示政治立场

(2)长期不毕业

(3)不好好学习,社会活动多,常组织社会活动

(4)故意拖延毕业时间

(5)频繁与台湾人/大陆人接触

(6)不需要打工,经济条件却很宽裕

(7)他们的家人不大出国(因为被政府看着做“人质”防止间谍叛逃。起码以前是这样,不知道现在是否在“民主诉求”之下还有这一条)

其中,6和7这两条若不用间谍来解释,就是互相矛盾的。若家庭经济条件好,不需要打工,则其家人一般来说出过探亲旅游的倾向性很高;若家庭经济条件不好,家人没钱出国旅游,则一定需要打工才能生存。这是台湾“职业学生”的一大软肋所在。

要特别注意的一点是,台湾中情局所豢养的这些间谍,并不一定都是台湾人,也有许多是被策反了的大陆学生,他们也基本符合上面的1-6条。

有些间谍因为某些原因洗手不干了,这个时候就会被中情局威胁。当然,实际上一般情况下中情局不可能对他们的家人做出多么不利的事情,顶多就是以后办理出国 手续的时候卡一下。不过,中情局停掉工资是肯定的。我还真的看到过有的台湾“职业学生”洗手不干之后的悲惨日子。一般来说这样的间谍会突然遇到非常严重的 经济困难(目前尚不清楚中情局是否会阻止他们的台湾家人给他们汇款),于是得外出打工等。在学生签证满了10年之后,无法继续延签(许多欧洲国家规定学生 签证最多只能给10年)——如果这个间谍工作成效比较好的话,中情局会想办法让他继续服务的,签证便也就不成问题。如果发现你的朋友中有这样的情况,要特 别的当心。

2、为美国或欧洲反华势力工作的学生间谍。

姜还是老的辣,美国的情报工作历史悠久、经验丰富,比台湾的中情局强不知道多少倍。因此,想要有那么几条简单的比较统一的判断标准,也非常的困难,甚而至于比较精确的推断都非常不容易。我们只能根据长期情报工作所总结出来的经验规律,从侧面大致来推断。

(1)愤世嫉俗。

这一点是肯定的,他们如果想要开展社会政治策反工作,反共反华,一定要愤世嫉俗,否则便不可能造成社会影响力。上面说过,他们具体的表现就是一味攻击谩骂中国和共产党而无意提出理性的解决方案,也无意投身于建设祖国的事业中。

(2)崇美恐美情绪明显。

任何事情,美国的观点总是正确的,中国相类似的事情,就算没有问题也要鸡蛋里面挑骨头出来批判。

(3) 经济状况。

大陆学生一般而言都比较穷(那些贪官子弟当然另当别论),在国外读书一般都必须靠奖学金或者打工过活。如果你发现你的某个朋友的支出明显高于他的明面上的 收入,就得小心了。情报部门所给的经济资助,一般相当丰厚,每月少则几百,多则几千美元。而且,如果你发现你的朋友在收入一事上对不同的人有不同的说法, 也需要特别小心。

(4)社交圈子相对独立。

情报部门一般来说也会要求基层间谍与他的朋友保持一定距离,即使有几个表面上的“密友”,也只是用于掩护的。仔细观察可以发现,这些间谍与他们的“密友” 之间仍然保持着相当大的距离,比方说不轻易邀请密友到家中做客,几乎不参加密友所组织的较大型的活动,也不带密友和他的其他社交圈子中间的朋友一同参加活 动、彼此认识。总而言之,就是他试图保持几个社交圈子之间的隔离性。

(5)比较典型的美式逻辑:“深刻的偏激优于平庸的全面”。

美国历史上在这种偏激的哲学思想之下,诞生出了一代又一代的偏激大师,如佛洛伊德、布热斯津等。然而既然是偏激,就很不全面,虽然言语非常的震撼,却绝对不代表真理。

(6)言论与其专业训练明显不符。

通常而言,文科生比理科生容易策反,工科学生被策反的不确定性很大(视专业不同有很大的区别)。

在理科生中,有较强不确定性、今后在国外工作前景较为乐观(例如生物、化学)的学生,策反起来,比要求严谨逻辑和事实观察、今后工作前景不那么乐观的学生(例如数学、物理),相对要容易。

如果你发现一个学数学或物理的高才生居然在言论中逻辑性很差,不注重事实,盲目崇美恐美,这就与他的专业训练背景相抵触,其背后必有隐情。这样也就可以大致对某些人进行推断。

(7) 原创观点明显偏少,大量引用他人的观点与论证方法,甚至语言形式。

这些被策反的间谍所说的言论,虽然具体阐释上面可以自己发挥,但基本论点和论证形式一般来说都由上家指导甚至直接确定。其实这一点本不是情报机构的首创, 而是古老的邪教的惯用手段,就是由总部来培训邪教传教士,教他们如何歪曲宗教经典,用似是而非的诡辩方法来赢得人心。至今,我们还可以从耶和华见证人、东 方闪电和**功那里,明显地看到这种策略。把它套用到政治观点上面,由于出国留学的学生总体认知水平比较高,如果关心政治,应该有自己的观点(要么就是完 全不关心政治,这种人一般来说也很少会谈论政治),因此,自己的观点明显偏少,却大量引用他人的观点与论证方法,甚至连具体的语言形式都似曾相识,这就是 比较明显的受上家操控的标志。比较典型的语言特征例如以柴玲为代表的“民运”式,以**等人为代表的“FL功”式,等等。

(8)刻意歪曲中国的事实,将特定历史的事件反复拿出来以孤立的方法进行曲解。

现在中国的总体情况是令人乐观的,虽有争论之处,却正在稳步改进过程中。然而反华分子们唯恐中国不乱,唯恐中国发展,即便现在抓不到什么,也要刻意歪曲事实找事情来批判。

例如饿死人问题,及强调89年天安门有大屠杀(连当年民运四君子之一的侯德健都站出来澄清清场的时候根本就没有屠杀),说现在共产党仍然在迫害基督徒(事 实上90年代以后共产党中央政府就一直没有与基督徒为敌,反而在逐步放松对宗教的管制,也在试图发挥基督教在国家生活中的重要作用,见胡锦涛温家宝的公开 讲话),等等。

他们把一些特定的历史环境之下的事情孤立起来,高举某些反对共产党、又被共产党打压的人,而不管这些人自己有什么问题,就把这些人当作是“(反共)义 士”,例如解放之初一些无政府主义、自由主义、宗教极端主义的人士被当成右派打击,就被反华势力抓住当作把柄,把这些无政府主义者当成反共义士大家抬举, 全然无视当时的情况,以及美国当年也在大力打击无政府主义者的历史。

(9)片面反战,主张中国应该解除武装。

其实这是美国政府从朝鲜战争到越南战争所吃的最大的苦头。如果不是国内反战浪潮过于猛烈,朝鲜战争美国如果在李奇微将军的带领下以范弗利特弹药量继续战斗,历史很有可能改写;越南战争也是因为美国政府顶不住国内的反战压力,才被迫撤军。

然而美国政府聪明地发现,这片面反战的力量,却是瓦解敌国抵抗意志的良方。其实片面反战并不是美国人民的首创,著名的邪教耶和华见证人就是极力强调片面反 战的,他们认为一切战争都是不好的,敌人打过来了,我们也只能束手就擒,任人宰割。他们不仅自己不抵抗,还想方设法地阻挠其他的人民抵抗。二战时原东欧地 区的快速陷落,少不了耶和华见证人的“贡献”。

这些“功绩”至今仍然记录在这个邪教组织所定期发行的杂志《守望台》上。因此美国政府在1990年的海湾战争、2003年的伊拉克战争中,下了很大力气去 打击国内的反战人士(许多被监禁、被殴打,甚至被逼迫公开承认反人民的罪行)。然而在美国国外,他们却大力推行片面反战的观点,并加上“中国威胁论”,认 为中国有核武器、有先进的战机军舰就是地区和平的威胁。典型的“只许州官放火,不许百姓点灯”。

(10)偷偷摸摸进行改名改址活动

如把人民解放军改为国民军,人民军队改为国家军队,人民大会堂改为国民会议堂.

借各种理由,把首都迁往他处,把开国元勋人民领袖纪念堂迁往什么什么地方.

三八国际妇女节/五一国际劳动节/六一国际儿童节都要改.

等等这些,无不暗藏”颜色革命”动机.

以上当然只是中美在长期的情报斗争中总结出来的一些经验规律。美国毕竟经验老到,因此单独一个方面拿出来看,问题都不是很大,都有其他的方法可以解释。但是,如果一个人同时具有上面许多点特征,他是美国反华势力的间谍的可能性就非常大了。

四、网络上策反/造谣类间谍的表现

现如今,网络成为年轻一代主要的信息传播与获取渠道。反华势力很早就注意到网络的特性,非常有利于展开策反/造谣工作,因此早在十几年前互联网刚刚普及的时候,他们就在紧锣密鼓地部署网络策反与造谣的工作。

具体说来,网络适合于策反/造谣工作的特性,可以归纳如下:

1.影响面大。

不需要耗巨资组织大型的活动,不需要耗巨资去电视台演讲,只要轻敲键盘鼠标,在网络论坛上发文章,便可以吸引世界各地数以万计的眼球。而且可以跨越国界,逃避政府的管制

2.隐蔽。

网络上,没有人知道你是一条狗。网络上都为化名,谁也不知道他真正是谁。因此,这也就给策反与散布谣言者以逃避法律追究的便利。

3.信息真假难辨。

由于网络世界没有主控机构,更没有新闻审查,真假信息鱼龙混杂,什么东西更震撼,什么东西更噱头,什么东西就能够更吸引眼球,即便它是假消息。

4.管制困难。

网络上流传的信息,很难被管制。一方面,现在国际互联网的流量非常大,要在这么大的流量之中进行实时关键词搜索本来就已经需要耗费无数台超级计算机的计算 能力了,只要在敏感关键词中加一个空格,便可轻易逃过检查。即便是超级计算机,也对大量加密的语音和图像信息难以做到有效的过滤筛查。

网络上的间谍活动,由于更加隐蔽,而且信息渠道单一,因此容易伪装得良好,更具威力。这些间谍广泛分布于中国国内国外,有大张旗鼓的,也有默默无闻的。在网络上活跃的主要有这么几种间谍:

1.刺探军政情报的间谍

这类间谍活跃在军事和国政类论坛上,为的是从网友那里套取最新的军政情报。其惯用手法为:

(1)故意诋毁贬低中国的军政实力,引来爱国人士的反击。在此过程中,间谍会故意引诱爱国人士透露一些绝密情报。

(2)故意说一些错误的信息,例如部队的番号、导弹的射程等,引起一些真正知道这些情报的人士的不满,又喜好表现自己知识渊博,于是将正确的数据说出来。

(3)展示自己收集得一些装备的照片,诱使其他网友贴出他们自己拍摄的装备、军营等照片。一张船坞的照片就可以分析出中国新建造的军舰的大致性能,以及中国是否在准备十年以内建造航母等非常重要的战术和战略信息。

2.打击人民安全感的间谍。

这类间谍通常也活跃在论坛上,他们的共同手法是用许多似是而非的东西来攻击中国军队和政府,其目的就是让人民觉得中国军队非常腐败,技术也远不如人,因此无力保家卫国。

(1)歪曲历史,以刻意贬低中国军队的形象,打击人民对军队的信任感和自豪感。最常见的例子例如抹杀中国人民志愿军抗美援朝的意义,胡说什么当时不进行抗美援朝更好,云云。

(2)以一些子虚乌有的所谓“内部数据”来证明中国的武器根本无法与美国武器相抗衡,鼓吹美国制胜论。

(3)揭露所谓的“军队内的腐败黑幕”,试图让大家相信中国军队已经非常腐败,如当年清朝军队一样,不堪一击。殊不知90年代末期以后军队大整肃,大大提高了战斗力,腐败分子被内部处理了很多,军队经商问题得到了极大的遏制。

3.以亦真亦假的谣言煽动反政府情绪的间谍

这类间谍常活动与时政、强国等类型的论坛上,主要是以亦真亦假的社会事件的“内幕”,煽动人民的反政府情绪。

这类间谍属于最隐蔽的一种,因为他们的表现和一般的愤青以及不满现实的持改良政见者不容易分开,而且信息渠道单一(仅仅通过网上的言论)。然而,专业的反 间谍人员在长期的监控中,也发现了一些迹象。虽然对于这样的间谍,即便是专业的反间谍人员也需要透过专业技侦手段才能最终确认,我们普通老百姓就更难以分 辨,然而我们可以靠着一些蛛丝马迹,有一个倾向性的判断,就不容易被他们的言论迷惑,更可以和这些间谍在现实生活中保持距离。

这些间谍,其言论内容具有[三.2.(1),(2),(5),(7),(8),(9),(10)]的特征。仅凭这些言论特征,还不足以让我们高度怀疑他是一个间谍。专门从事网络策反煽动的间谍,还有其它的一些特征。

(1)IP/MAC地址常变,但网段变动不大。

尤其在中国国内,间谍由于要在网络上保护自己,不易被技侦手段锁定,常常变换上网发帖所用的计算机。在公共场合,例如网吧、学校这样的地方,是他们活动的 好战场。如果配合一些黑客手段,在这样的公共场合即便被技侦部门跟踪,也很难抓到其人。当然在国外,由于不用担心被中国安全部门监视(其实还是有的,只是 大部分人不知道而已),在家里一直使用自己电脑的也不在少数。

(2)煞有介事地报道一些热门社会事件的“内幕消息”,夸大政府、军警的残忍,突出上访、游行、抗议者被抓、被打、被抄家、被酷刑折磨等悲惨遭遇,突出在中国生活的胆战心惊。

对引起这样社会事件的复杂背景、历史等仅作非常简略的偏向性介绍,从不谈及上访、游行、抗议者自己的任何行动过激、不当之处。其内容真真假假.

比较专业的间谍通常采用“美国之音”的策略:90%的真话加上10%的假话。由于普通群众根本没有可能性去详细核实,因此大家在听信90%的真话的同时, 也把那10%的假话听进去。有些比较露骨的,会自称诸如“人权观察协会”、“国际大赦组织”的观察员,这些组织表面上是民间非政治机构,然而了解历史和国 际政治的人都知道,这些组织都是受美国等政府的支持和操纵,借口人权等问题攻击敌对国的傀儡组织。但由于这些组织有来自于他们主子政治集团的强大舆论与经 济支持,帮他们混淆视听、浑水摸鱼,因此这些间谍中的有些人敢于明目张胆,即便是在中国国内。

(3)发帖争议性大,往往引得众多网友互相辩论。

而贴主(也有可能注册另一个用户名)所作的回应和引导,不是为了平息争论、得到共识,反而是有意加剧争论,以吸引更多的眼球。常用的手法是作人身攻击,激 怒持反对意见的网友;不正面回答网友的质疑;玩弄文字游戏,设逻辑陷阱。经过培训的间谍往往有更加专业的诡辩技巧,其逻辑漏洞隐蔽,没有系统地学过逻辑或 研究过辩论的人,极易上当。

(4)比较初级的间谍常采用的手法是在论坛上注册一个新的用户名ID,发几个帖子之后就消失,以为这样不容易被跟踪上。

但经过专门培训的间谍就经常不采用这种容易被网友识破的方式,他们会很有耐心地用相当长一段时间进行“树立威信”的工作,即用好几个月甚至数年的时间在一 个固定的论坛上用一个固定的用户名ID,表现出一副儒雅风范,很平静地参与讨论,树立道德高度,以博得大家的喜爱与拥戴,甚至成为版主。然后,才开始逐步 地在讨论中涉及敏感话题。这种逐步的转换由于历时甚长,不易被普通网友所发觉。然而如果通过论坛搜索功能一次调出其在一两年甚至更长时间内的文章总汇,就 可以比较清楚地看到这种人的话题、论点和态度的转变。尤其在局势紧张的时候,这种转变尤为明显。在下一点中将详细谈到。

(5)局势紧张的时候,间谍的反共反华言论突然大量增加。

这是非常合理的举动,因为每当局势紧张(例如台海、东海、南海方向)时,各方面的信息和观点都会大量增加,人民对时局的关注程度也会大幅度增加,这些间谍 的主子便会要求他们加大策反力度,(比如最近的格俄问题),制造更多的反华反共言论,以“增加与共产主义不相合的精神因素”(原美国驻华大使司徒雷登 语),削弱海内外中华民众对中国政府的支持与信任,借机培养第五纵队,在可能到来的激烈的政治军事斗争中,为中国增加内乱的可能性。如果我们发现原先比较 温和的网友在局势紧张时不顾一切地大幅度增加反共反华言论,甚至被众人唾骂也在所不惜,这种违反其常规、也违反通常人常规的做法,显示出他背后有操纵者, 也是一个比较明显的间谍的标志。

通常来说,在时局变换的时候,各类间谍的活动普遍会加剧,从而很有可能产生情报机构过度使用某一条间谍线的情况,而使得这条线被暴露。各国反间谍部门都视 这个时候为排查、收网的好时机。在上次台海危机中,被中国国家安全局破获的最大的在中国大陆的台湾间谍网,一次抓获各类间谍470余人,其中90%以上是 从未到过台湾也从未出过国的大陆人。而在这排查抓捕的行动中,据称网络监控发挥了重要的作用。

(6)采用明显的美国政府式舆论边缘化操纵策略。

这是一种非常厉害、非常专业的手法,不是搞情报的一般人很难做到,除美国以外也绝少能够见到这种策略,因为这种策略的产生与发展,与美国文化和历史的发展密切相关。因此,如果大家能够看到使用这种手法的人,多半是受过美国情报部门专业训练的间谍。

其实这种手法讲起来本身并不复杂,就是不太理会反对者的意见,而用海量的己方观点去冲淡反对者的意见,使得反对者意见被边缘化。同时,变换不同的方式一再重复己方观点,使得“谎言重复一千次就成了真理”。

(7)对持反对意见者一般仅仅进行人身攻击,避而不谈观点、论据等本身。

这一条是辅助识别标志,因为间谍在论坛上讨论仅仅是要推广他们的观点、吸引眼球(点击率)、企图树立个人知名度,并不顾及到其观点的正确性和论证的严密 性.对反对者进行人身攻击,将反对者描绘成“坏人”,是最行之有效的方法。而这种方法常常也能够引来反对者的情绪反弹,拼命要证明自己不是“坏人”,从而 让争论愈加复杂和激烈,更能吸引眼球,却离讨论的问题本身越来越远。

五、借信仰之名,行策反之实的假基督徒间谍(省略)

六、初级间谍拉人入伙的最初识别(省略)

七、总结

事实上,作为危险性比较大的策反/造谣类工作,本国资深情报人员是不轻易去直接做的,他们策反中国人为他们卖命,就是为了保护他们自己。外国情报机构不会 顾及中国间谍的死活,给这种“初级”中国间谍的培训也是极为有限的,因为绝大多数中国人对情报工作的知识几乎为零,因此间谍通常也用不着高级培训。

其实,一般的人只要认真想一想,就可以总结出一些间谍的手法来。为什么这么说呢?俗话说得好:“要想抓贼,必先做贼”,如果我们能够设身处地地想一想,如 果有这么一个间谍任务交给我们做,我们会怎么隐藏我们的真实意图,就能够发现实际上间谍能用的手段并不多。加上一些情报机构长期总结出的规律,我们每个都 能够具备基本的识别间谍的能力。

我们的祖辈父辈,在新中国成立之后都受过相当的军事和情报训练,有着基本的反间谍的知识。建国初30年,大部分的间谍都是被人民群众发现并报告给国家安全 部门的。弱小的共和国之所以能够平安走过那环境险恶的年代,情报战线的人民战争起了决定性的作用。今天,情报战争的烈度不减当年,仅靠国家安全部门的专业 人员,难免挂一漏万。我们对这些斗争无幸参与,虽不一定把这些间谍揪出来扭送安全部门,但至少可以做到自己不被这些间谍的言论所蛊惑,不参与到他们的反华 行动中去。

反华势力亡我之心不死,任何时候都在紧锣密鼓地策划和实施着“以华人制华”的策略(美国CIA解密文件和兰德公司公开发表的战略白皮书中都有明确提及)。 为了祖国的繁荣富强,为了中国人在世界各地能够不受欺侮,为了我们每个人以及我们亲友的幸福生活,请大家保持警惕,远离间谍。

 签名档

纸上得来终觉浅 绝知此事要躬行

不为浮云遮望眼,要拿魂魄碾冰霜!

(h/t @spybusters)

EOF

Notes on Lawful Interception: selections from “Intelligence Support Systems” (2005, Hoffmann and Terplan)

Intelligence Support Systems (2005) by Paul Hoffmann (telecom expert; Germany) and Kornel Terplan (telecom expert; U.S.) is by far the best technically in-depth book on Lawful Interception (LI) in existence. It’s an expensive book, but used copies can be found that are more affordable (I bought one of those). In the remainder of this post I quote a selection of paragraphs from the following Chapters:

  • Chapter 1: Setting the Stage
  • Chapter 5: Extended Functions for Lawful Intercepts
  • Chapter 10: Outsourcing Lawful Interception Functions

The term “intelligence support systems” (ISSs) is used throughout the text below, and is explained as follows in the book’s preface:

Intelligence support systems (ISSs), the focus of this book, are about intelligence as opposed to security. Security involves providing firewalls, anti-virus protection, and intrusion detection and prevention; in other words, security is about guarding against loss. Conversely, in ISS, information is gathered about illegal activities, and that knowledge is applied to increasing security where applicable. ISSs interface with, or are part of, billing, ordering, provisioning, and authenticating systems, as well as law enforcement systems.

The concepts, technology and issues presented in the book are varyingly relevant to the US, EU and beyond.


 

Chapter 1. Setting the Stage

[…]

The focus of intelligence support systems (ISSs) is on expanded infrastructure requirements of telecommunications service providers (TSPs), which are basically no different from the requirements of operations support systems (OSSs) and business support systems (BSSs). Intelligence plays two principal roles in this area. On one hand, it provides surveillance by collecting information on illegal activities, such as terrorism, criminal activities, fraud, and money laundering, and on the other hand, it provides the basic data that improve the bottom line of TSPs, such as revenue assurance, business intelligence (BI), and protection against telecommunications fraud. In short, ISSs are software elements or units that interface with, or are subsumed under, billing and ordering systems, provisioning and authentication systems, and outside parties such as law enforcement agencies (LEAs) (Lucas, 2003f).

TSP will be used as a generic term throughout the book for a number of different service providers, including access providers, network operators, communications service providers, electronic communications service providers, and licensed telecommunications service operators. Terms differ according to the standards for lawful interception of different countries and different LEAs.

1.1 Positioning Lawful Intercepts (LIs) and Surveillance

Information and intelligence must be differentiated from each other. Information in the context of surveillance consists of knowledge, data, objects, events, or facts that are sought or observed. It is the raw material from which intelligence is derived (Petersen, 2001).

Intelligence is information that has been processed and assessed within a given context, and it comprises many categories (Petersen, 2001). In the context of this book, communications intelligence — derived from communications that are intercepted or derived by an agent other than the expected or intended recipient or are not known by the sender to be of significance if overheard or intercepted — is the key focus. Oral or written communications, whether traditional or electronic, are the most common form of surveillance for communications intelligence, but such intelligence may broadly include letters, radio transmissions, e-mail, phone conversations, face-to-face communications, semaphore, and sign language. In practice, the original data that forms a body of communications intelligence may or may not reach the intended recipient. Data may be intercepted, it may reach the recipient at a date later than intended, or it may be intercepted, changed, and then forwarded onward. However, the process of relaying delayed or changed information is not part of the definition of communications intelligence; rather, the focus is on intelligence that can be derived from detecting, locating, processing, decrypting, translating, or interpreting information in a social, economic, defense, or other context (Petersen, 2001).

Information collection is usually used to support surveillance activities. Surveillance is defined as keeping watch over someone or something, and technological surveillance is the use of technological techniques or devices to aid in detecting attributes, activities, people, trends, or events (Petersen, 2001). Three typical types of surveillance are relevant to LIs:

  1. Covert surveillance: surveillance that is not intended to be known to the target. Covert wiretaps, hidden cameras, cell phone intercepts, and unauthorized snooping in drawers or correspondence are examples. Most covert surveillance is unlawful; special permission, a warrant, or other authorization is required for its execution. Covert surveillance is commonly used in law enforcement, espionage, and unlawful activities.
  2. Overt surveillance: surveillance in which the target has been informed of the nature and the scope of the surveillance activities.
  3. Clandestine surveillance: Surveillance in which the surveilling system or its functioning is not hidden but also is not obvious to the target.

Finally, there are various categories of surveillance devices (Petersen, 2001): (1) acoustic (audio, infra and ultrasound, and sonar), (2) electromagnetic (radio, infrared, visible, ultraviolet, x-ray), (3) biochemical (chemical, biological, and biometric), and (4) miscellaneous (magnetic, cryptologic, and computer). In different contexts, including some of those described in this book, a combination of such devices might be used (e.g., a combination of acoustic, electromagnetic, and miscellaneous devices). Appropriate chapters will clearly highlight the technologies and devices in use.

1.2 ISS Basics and Application Areas

[…]

iss-figure-1.2

As indicated in Figure 1.2, there are three different types of intelligence (Cohen, 2003):

  1. Summary intelligence: An ISS that provides this level of information needs to capture all key summary data in a manner that is lawful and protects the rights of individuals. For instance, an ISS may be programmed to capture information on everyone who visits a particular suspect Web site without capturing individual names. The ISS may then take this information and see if any of the IPs visiting this Web site have also been communicating via e-mail or chatting with another known target. If so, a legal authorization may be obtained to look at the individual in question in more detail.
  2. Target intelligence: Once a target has been identified on the basis of summary intelligence or other information sources and lawful authorization has been received, it may be necessary to look at any and all of that particular individual’s communications on all networks, including e-mail, Web sites visited, chatting, instant messaging, short message service (SMS), and multimedia messaging service (MMS) mobile phone messages, Voice-over-IP (VoIP) broadband connection calls, and so forth. Specific details can then be obtained from this information.
  3. Content intelligence: Content intelligence may be needed to lawfully review specific content, for example, all e-mail communications of the target. The ISS should make it possible to look at this detailed content information in all forms (e.g., e-mail, VoIP, Web site replay, and chatting replay).

[…]

1.6 Framework of LIs

iss-figure-1.4

Figure 1.4 shows a generic framework of LIs (Baker, 2003) derived from a draft model commissioned by the Internet Engineering Task Force (IETF). This draft streamlines principal functions, components, and key players. This generic framework shows a high level of compliance with North American and European standards regarding lawful interception.

Several entities are included in this LI model:

  • LI administration function: This function provides the provisioning interface for the intercept stemming from a written request by an LEA. It can involve separate provisioning interfaces for several components of the network. Because of the requirement to limit accessibility to authorized personnel, as well as the requirement that LEAs not be aware of each other, this interface must be strictly controlled. The personnel who provide the intercepts are especially authorized to do so and are often employed directly or indirectly by the TSPs whose facilities are being tapped. In many cases, the identity of the subject received from the LEA has to be translated to one that can be used by the networking infrastructure to enable the intercept.
  • Intercept access point (IAP): An IAP is a device within the network that is used for intercepting lawfully authorized information. It may be an existing device with intercept capability (e.g., a switch or router), or it may be a special device (e.g., a probe) provided for that purpose. Two types of IAPs are considered here: those providing IRI and those providing content information.
    • IRI IAP: This type of IAP is used to provide IRI, that is, information related to the traffic of interest. There is currently no standardized definition of IRI for IP traffic. IRI is the collection of information or data associated with telecommunications services involving target identity, specifically communication-associated information or data (e.g., unsuccessful communication attempts), service-associated information or data (e.g., service profile management), and location information.
    • Content IAP: A content IAP is one that is used to intercept the traffic of interest.
  • LEA: The agency requesting the intercept and to which the TSP delivers the information.
  • Mediation device (MD): These devices receive the data from the IAP, package it in the correct format, correlate them with LI warrants, and deliver it to the LEA. In cases in which multiple LEAs are intercepting the same subject, the MD may replicate the information multiple times.

This generic reference model contains a number of interfaces, as can be seen in Table 1.1, and it can be deployed in many different ways. More details are presented in Chapter 3.

[…]

1.7 Challenges

Supporting lawful interception in various geographical areas is not without challenges. This concluding section concentrates on technical, economical, and privacy challenges due to lawful interception.

[…]

In summary, the technical challenges relating to ISSs are as follows:

  • Enormous volumes of dispersed data:
    • Data volumes of various services are much higher than with voice-related data.
    • Data throughout the networks (not just at the device) must be correlated.
    • Data can be missed or lost because of these huge volumes.
    • Data is too voluminous to be stored in a database without real-time processing and reduction of data.
  • Need for real-time data:
    • Dispersed data requires real-time processing and correlation to produce information.
    • Network speeds make it difficult to capture and process information in real-time.

[…]

In summary, the following are the economic challenges associated with ISSs:

  • Costs of point solutions for intercepts are high.
  • Scalability is not guaranteed.
  • Necessary skills and procedures are lacking.
  • It is difficult to guarantee ROI with surveillance only.
  • Using existing technology with modifications for surveillance seems to be a viable option, but its cost justification is still difficult to support with hard numbers.

[…]

In summary, privacy challenges relating to ISSs are as follows:

  • Legal rules differ in different countries.
  • Technological issues are different for voice and data networks.
  • Current technology does not support LIs and privacy laws simultaneously.

[…]

5. Extended Functions for Lawful Intercepts

[…]

5.3 Handover Interfaces (HIs)

[…]

5.3.2 Handover Protocols

[…]

IPDR Streaming Protocol is a new, reliable, real-time protocol that (1) leverages IPDR foundations, (2) uses XDR-based compact binary encoding and TCP/IP transport, (3) is applicable to a broad set of services and domains, and (4) is specifically designed to address requirements for data exchange applicable to the area of LIs. The attributes of this protocol are its reliability, flexibility, efficiency, and manageability; the fact that it provides real-time streaming; and the fact that it leverages overall IPDR technology benefits.

5.3.2.1 Reliability

Why is reliability important?

  • Support of critical applications
  • Avoidance, through high availability, of additional availability costs
  • Compliance with regulatory requirements

How can reliability be increased?

  • Use of data-capturing systems that provide scalable availability
  • Use of application-level acknowledgment for information exchange
  • Use of reliable transport, such as TCP/IP
  • Use of built-in fallover and fallback mechanisms
  • Use of redundant probes and hot standby support
  • Use of cost-effective deduplication mechanism
  • Use of tunable keep-alive messages

5.3.2.2 Flexibility

Why is flexibility important?

  • All services are supported, including emergency services
  • Reductions in proliferation of other surveillance-related protocols
  • Support of a wide range of LI models
  • Support of a variety of OSSs/BSSs, including billing, fraud, performance management, and fault management
  • Investment protection

How can flexibility be increased?

  • Use of readable XML schema definitions of record structures
  • Negotiation of upgrades (“future-friendly”)
  • Specified transformations to and from XML or XDR IPDR files

5.3.2.3 Efficiency

Why is efficiency important?

  • Minimizes effects on network and service elements, on the network itself, and on data-capturing systems
  • Reduces costs
  • Allows large amounts of data to be handled

How can efficiency be increased?

  • Compute and export only the data requested by collectors (e.g., LEAs)
  • Export data only with collector subscription
  • Use entire bandwidth via windowed application-level acknowledgment
  • Minimize fall-over times by keeping hot standby ready with “keep-alives”
  • Compact (XDR) data representation

5.3.2.4 Manageability

Why is manageability important?

  • Supports a global, heterogeneous environment
  • Supports plug-and-play for large multivendor deployments

How can manageability be increased?

  • Built-in negotiation of protocol version, data capturer and exporter capabilities, templates, and fields
  • Support by exporter and collector of one or multiple versions of protocols
  • Use of back-end-friendly interfaces

5.3.2.5 Real-Time Streaming

Why is real-time streaming important?

  • Allows hot surveillance-related applications
  • Allows real-time reaction to activity (e.g., target identification, fraud, and security breaches)
  • Supports other real-time applications

How can real-time streaming be implemented?

  • Immediate transmission of intercepted data with minimal latency and avoidance of periodic batch closes
  • Continuous stream of events sent from IAPs
  • Presence of hot backup allowing a secondary option to receive data in the case of configurably defined criteria

5.3.2.6 Leverage of Overall IPDR Technology Benefits

IPDR technology benefits are leveraged via the following:

  • Use of information model-based service descriptions, applicable regardless of encoding or transport method
  • Availability of open source implementations without the need to pay royalties
  • Uniform applicability in network data collection
  • Open standards-based format
  • Availability of certified products

The IPDR protocol is broadly applicable to Voice-over-IP (VoIP), CPEs, data over cable, media and application servers, and traffic analyzers.

[…]

5.7 Receiver Applications

[…]

5.7.1 Support for Recognizing Criminal Activities

5.7.1.1 Search for Criminal Activities

This area falls under strategic surveillance owing to the fact that there are no specific targets at the initiation of the process. Observation of communication directions and paths, and evaluation of the contents of various applications, may help narrow lists of potential targets. However, large amounts of data must be evaluated, filtered, analyzed, sorted, classified, and selected to reach conclusions regarding individuals, groups, locations, or suspect activities.

5.7.1.2 Communication Analysis

Collection of actionable intelligence requires in-depth analysis of communication activities. This process involves correlation of time stamps, locations, communication relationships, authentications, directions, and communications forms and volumes. Location tracking, geographical information systems, and data mining are some of the methods under consideration to support such analyses.

5.7.1.3 Content Analysis

In-depth analysis of communicated content is necessary as well. This involves analyzing and correlating application identifications, language recognition, speaker recognition and identification, word spotting, topic recognition, optical character recognition, logo recognition, and image recognition. Both text-based and audio-based analyses are frequently used.

5.7.1.4 Automated Intelligence Support

Content is created from text- and audio-based documentation elements. Results are generated by combining and correlating multiple inputs, including faxes, TIFF files, image files, eDoc files, HTTP, e-mail, chat, and sound files. Figure 5.10 shows an example of such a combination and correlation (Axland, 2004). In a further step, languages and speakers may be recognized by using combined forms of intelligence.

[…]

10. Outsourcing Lawful Interception Functions

[…]

10.1 Forces Driving Outsourcing

Several principal forces drive the outsourcing of LI functions (Warren, 2003b):

  • In-house provisioning, administration, and security surveillance have become too expensive; in particular, personnel costs are increasing rapidly.
  • There is a chronic shortage of skilled personnel.
  • TSPs must comply with LEA requirements, and legal interpretations must be clear and quick in today’s changing legal environment.
  • Supporting LIs in-house may result in a loss of focus on strategic issues that help increase revenue and generate profit.
  • Service expectations may be defined and supervised more effectively with an outsourcer than in the case of an insourced solution.

TSPs must contend with several other issues as well:

  • Technology has simplified access to network elements and information.
  • LEAs are now demanding access to digital storage of customer-related information.
  • LEAs are demanding Communications Assistance for Law Enforcement Act (CALEA) and ETSI compliance.
  • Most ISPs do not have the personnel or business support systems (BSSs) in place to handle broad record production searches and electronic surveillance demands.

Another important factor to consider is the increasing personnel burden and high costs involved in support of LEAs’ demands for records and technical assistance. For example, growing workloads increase the potential for mistakes. Also, as workloads increase and backlogs grow, there are greater legal risks stemming from the possibility of errors, thus potentially leading to greater risk of damage to a TSP’s public image.

Finally, in terms of business challenges, more is being demanded of TSPs, and business realities show that the LI function is not a revenue-generating one. In addition, today’s economic conditions require cost reductions on the part of TSPs. TSPs must weigh two fundamental options:

  1. Building an internal infrastructure: obtaining legal assistance in developing policies and procedures, hiring and training personnel with expertise in legal matters, implementing compliance programs and audit procedures, and investing in technology to support operations
  2. Outsourcing surveillance-related activities: using an outside law firm for deploying policies and procedures and implementing an end-to-end solution with a service bureau

Before deciding for or against outsourcing, TSPs should carefully evaluate the following criteria:

  • Present or expected end-to-end costs of supporting LIs: All effects should be quantified in terms of both capital and operational expenses.
  • Efficiency of existing processes, tools, and human resources: This area is essential in determining which functions, if any, to outsource.
  • Extent of dependence on speed: The real-time requests of LEAs must be met.
  • Grade of service and applications required: These needs may dictate the type of outsourcing used.
  • Level of security for the handover interface (HI) between SPs and LEAs.
  • Cost effectiveness: Is it more cost-effective to concentrate on the provider’s core business than to build a full infrastructure to support lawful interception.
  • Capital investment required: If the company must invest substantial amounts in lawful interception, it should favor outsourcing; if not, outsourcing may still be considered but should receive lower priority.
  • Current and future need for skilled personnel: The most sophisticated LI technology will be useless if the company cannot find employees to run it.
  • Potential acquisitions, mergers, sales of business units, as well as changes in service portfolio: These elements should be carefully evaluated, given that each may affect contracts with outsourcers.
  • Whether it is possible to negotiate acceptable outsourcing contracts: Contract terms are of paramount importance considering the long durations of contracts in this sensitive area.
  • Careful evaluation: Determination of all services and functions offered by the outsourcer, as well as knowledge levels and experience.
  • Careful review of the proposed transitioning warranty: This must be done on behalf of the outsourcer.

10.2 The LEA Model

In this case, LEAs take full responsibility for all principal functions. If required, they initiate all necessary processes including on-the-fly provisioning of networking equipment and facilities. TSPs are expected to provide physical access to equipment and facilities. Occasionally, the physical presence of subject matter experts of TSPs is required during surveillance.

In addition to obvious benefits in the area of legal expertise, benefits of this model are LEAs’ extensive knowledge regarding the targets of and reasons for surveillance, their high motivation to prosecute criminals, and the possibility of enhanced collection results. Disadvantages included limited technical know-how in regard to networking technologies, the limited (and most likely obsolete) surveillance tools available, lack of experience with the access and delivery functions (AF and DF), and shortages in terms of human resources.

10.3 The ASP Model

In this case, application service providers (ASPs) take full responsibility for providing the application software necessary to support all principal surveillance functions. ASPs are represented by TSPs or third parties. Benefits of this model include the following:

  • Good scalability of solutions
  • Usage-based billing
  • Lower number of personnel required
  • Flexibility in instances in which networking technology changes are required

Disadvantages include:

  • Security risks due to shared applications
  • Dependence on the ASP
  • Contractual risks
  • Limited legal background of the ASP

10.4 The Service Bureau Model

The requirements associated with this model can be summarized as follows:

  • The service bureau must provide comprehensive record production.
  • It must adhere to professional legal and service standards.
  • It must support effective coordination with LEAs.
  • It should provide technology that is trusted by both SPs and LEAs.
  • It must ensure high scalability for increasing data volumes.
  • It must minimize legal risks in both civil and criminal terms.
  • It must protect the public image of the SP.
  • It must represent a cost-effective alternative to an SP internal structure.
  • It is expected to be staffed by subject domain experts with extensive field experience.

 

The benefits of the service bureau model are:

  • Focus on core business opportunities
  • Reductions in operating costs
  • Conservation of capital; risk and up-front investments in personnel and surveillance technology assumed by service bureau
  • Support of future-proof services
  • No concern about operations for TSPs

Disadvantages include:

  • Legal dependency on outsourcer
  • Technological dependency on outsourcer
  • Security risks with HI
  • Possible internal resistance
  • Potential loss of subject matter experts
  • Need for minimal (critical) mass of staff as backup
  • Need for continuous supervision of contracts
  • Possible lack of cost savings
  • Transitional problems
  • Risk of losing control over LI-related information
  • Risk of outsourcer not representing the interests of the SP

Supporting the Service Bureau Model, Trusted Third Parties (TTP) are gaining a lot of attention these days.

The value proposition of TTP includes the following items:

  • Independence is key to trust by enhancing privacy with Calea and Etsi
  • TTP has freedom to employ a range of architectures, such as internal, external, and adjunct
  • TTP can generally follow safe harbor standards
  • TTP offers value-added services, such as authentication of trust systems, legal analysis and verification of orders, proof of performance, and subpoena processing

Comparing costs, outsourcing most likely outperforms self-deployment of lawful intercept technologies from year one.

Outsourcing of lawful intercept in service bureau form offers the following additional values to LEAs and TSPs:

  • Reduces operations expenses including staffing needs
  • Minimizes capital expenditures for future network services
  • Minimizes LEA-related network interference
  • Alleviates risk of stranded investment in rapidly changing network infrastructure
  • Most cost-effective way to meet LEA needs at the right time
  • Faster time to market, easier entrance to new markets, generates compliance rapidly
  • Allows carriers to focus on their core business

Table 10.1 shows options in the functions for outsourcing supporting LI activities.

iss-table-1.1

Outsourcers should be rated according to the following criteria, among others:

  • Financial strength and stability over a long period
  • Excellent security record and clearance for highly sensitive assignments
  • Outstanding business reputation
  • Outstanding legal background
  • Demonstrated ability to support lawful interceptions
  • Number of employees, along with their clearance level and level of experience in supporting lawful interception
  • History of using and implementing state-of-the-art technology, frameworks, and tools
  • Ability to customize tools to networking technologies

The strengths and weaknesses of each category of outsourcers are summarized in Table 10.2.

iss-table-10.2

[…]

10.6 Who Are the Principal Players?

Because of the sensitivity of LIs, participating entities are careful about sharing responsibilities with external companies. As a result, outsourcing trends are not yet visible. If they so desire, professional outsourcers in the telecommunications field can extend their services toward LI activities. Also, outsourcers from the legal side can offer services in regard to at least the collection function. This section considers a few early examples of outsourcing options:

  • LEAs: Typical example is the FBI in the United States
  • ASPs: Forensics Explorer
  • Service bureau providers: VeriSign
  • LI-monitoring centers: Siemens solution with a number of add-on functions, in cooperation with GTEN, Datakom, and Utimaco System integrators: VeriSign and GTEN
  • Consulting companies: Neustar/Fiducianet, Inc., in the United States

It is expected that this short list will grow rapidly in the near future.

[…]

EOF

 

[Dutch] De voordelen en nadelen van signals intelligence (Wiebes, 2002)

Dr. Cees Wiebes geeft in Intelligence en de oorlog in Bosnië 1992-1995 (2002) een duiding van de voordelen en nadelen van signals intelligence. De Engelstalige versie van dat boek — een bijlage bij het Srebrenica-rapport van het NIOD — is vrij/open op internet beschikbaar: hier (.pdf). Van de Nederlandstalige versie is geen digitale versie beschikbaar. Ik heb de betrokken pagina’s 234-242 uit het gedrukte boek ingescand, geOCR’d en vervolgens handmatig gecorrigeerd: zie hieronder het resultaat (~3700 woorden). Ook beschikbaar als platte tekst: hier. En de scan: hier (.pdf). In Introduction on The Importance of Signals Intelligence in the Cold War (2001) schreven Matthew Aid en Cees Wiebes trouwens ook over dit onderwerp: zie hier enkele fragmenten uit die Engelstalige publicatie.

[…]2. De voor- en nadelen van Signals intelligence

Over Signals intelligence tijdens de Koude Oorlog en na de val van de muur is weinig bekend. Signals intelligence is namelijk nogal technisch van aard, en daardoor is vaak moeilijk uit te leggen wat het belang ervan is. Mede hierdoor hebben wetenschappers en journalisten het onderwerp veelal gemeden.

De schaarse aandacht die er wel voor was had meestal betrekking op de Tweede Wereldoorlog. Toch was Signals intelligence door de specifieke informatie die dit opleverde de belangrijkste bron van intelligence bij militaire conflicten tijdens en na de Koude Oorlog. Sinds mensenheugenis hebben regeringen immers altijd willen weten wat hun vijanden, maar ook hun vrienden in hun schild voerden. De gemakkelijkste manier daarvoor is om gewoon naar hun communicatieverkeer te luisteren. Het voormalige hoofd van de US Navy Communications Intelligence Organization schreef bijvoorbeeld: ‘The ambition of every nation has been to develop unbreakable ciphers for its own use and to solve every cipher in use by its actual or potential enemies.’

Voordelen van Signals Intelligence

Door het specifieke karakter van de verkregen informatie heeft Signals intelligence een aantal eigen kwaliteiten, waardoor dit een zeer effectieve methode is om intelligence te vergaren. In oktober 1998 beschreef John Millis, wijlen staff director van het House Permanent Select Committee on Intelligence, dat Signals intelligence ‘has been and continues to be the intelligence of choice of the policy maker and the military commander’. Hij voegde hieraan toe: ‘the fact of the matter is, it’s there quickly when needed. It’s always there. Or it has always been there.’ Hierna komen een negental voordelen aan de orde.

Een eerste voordeel van deze vorm van intelligence is dat het hiereen passieve methode betreft, in het algemeen uitgevoerd zonder dat het doelwit daar weet van heeft. Verder kan Signals intelligence gebruikt worden tegen een doel dat soms honderden of zelfs duizenden kilometers ver ligt; het is vaak niet nodig om onderscheppingenapparatuur dichtbij het doel te hebben. Signals intelligence kent daarom weinig politieke of fysieke risico’s; een uitzondering hierop vormde de vergaring van deze informatie vanuit vliegtuigen langs de kust van verschillende staten.

In de tweede plaats is Signals intelligence objectief; de betrouwbaarheid ervan is groot, en dat kan soms een perfect intelligence-product opleveren. Het zal, in tegenstelling tot inlichtingen vergaard door menselijke bronnen, Human intelligence, altijd vrij zijn van politieke vooringenomenheid en zal niet worden beïnvloed door de politieke perceptie van de bronnen van de agent. Human intelligence kan soms politiek gekleurd zijn, omdat deze wordt aangeleverd door verraders, of vanwege chantage, corruptie, politiek of financieel gewin. Maar Signals intelligence levert in ruwe vorm precies wat er geregistreerd wordt in een onverbloemde, niet-gekleurde en onverdraaide gedaante. Signals intelligence verwierf hierdoor een belangrijke status bij de afnemers van intelligence. Zo stelde een voormalige CIA-agent: ‘You know the origin and you know that this is genuine. It’s not like a clandestine [Human intelligence] report where you don’t know if this is a good agent or a weak agent or a bad agent or a double agent.’ Een andere CIA-medewerker noemde hierbij meteen ook de schaduwzijde: ‘Electronic intercepts are great, but you don’t know if you’ve got two idiots talking on the phone.’

Een derde voordeel is dat sommige – zeker niet aIle – intercepts een zelfstandig intelligen- ce-product kunnen zijn, zonder dat het nodig is om de informatie te verifieren via andere bronnen. De voormalige directeur van de CIA, Stansfield Turner, schreef in 1991:

“Electronic intercepts may be even more useful [than agents] in discerning intentions. For instance, if a foreign official writes about plans in a message and the United States intercepts it, or if he discusses it and we record it with a listening device, those verbatim intercepts are likely to be more reliable than second-hand reports from an agent.”

Een intercept kan dus unieke intelligence opleveren. Daarom krijgt de Amerikaanse president elke morgen, naast een Top Secret intelligence summary, een zogeheten Black Book met daarin de belangrijkste intercepts van de afgelopen 24 uur. In Den Haag wordt onder de hoogste ambtelijke beleidsmakers een soortgelijke op Nederland gerichte publicatie verspreid, de zogeheten ‘Groene Editie’ .

In de vierde plaats is Signals intelligence voor de intelligence-afnemer meestal de snelst beschikbare vorm van intelligence. Vooral de National Security Agency kan dankzij zijn wereldwijde afluisternetwerk Signals intelligence sneller aanleveren dan iedere andere vorm van intelligence. Tijdens de Cuba-crisis in 1962 duurde het bijvoorbeeld gemiddeld meer dan een week voordat een Human intelligence-rapport de CIA bereikte. Intercepts daarentegen waren voor de beleidsmakers direct beschikbaar. Hierdoor ging Signals intelligence (en Imagery Intelligence, beelden vanuit de lucht) een steeds belangrijkere rol vervullen bij waarschuwingen voor een vijandelijke aanval.

In de vijfde plaats levert Signals intelligence veel meer intelligence op over een breed scala van onderwerpen dan iedere andere vorm van intelligence. Aan het eind van de jaren zestig van de vorige eeuw produceerde de National Security Agency al meer dan 400.000 intelligence- rapporten per jaar, dus meer dan duizend rapporten per dag.”

In de zesde plaats: Signals intelligence ‘slaapt nooit’. Agenten en hun bronnen moeten immers van tijd tot tijd rusten en Imagery intelligence is soms niet inzendbaar vanwege duisternis, zandstormen of meteorologische omstandigheden. Signals intelligence kan echter dag en nacht worden ingezet: 24 uur per dag en 365 dagen per jaar.

In de zevende plaats is Signals intelligence flexibeler en meer gericht op de afnemer dan de meeste andere vormen van intelligence. Daarom stelde een rapport van het Amerikaanse Congres uit 1998: ‘much of the National Security Agency’s past strength has come from its localised creativity and quick-reaction capability’.” Vooral de grotere Signals intelligence organisaties zijn in staat om snel nieuwe doelen af te luisteren. Inlichtingendiensten kunnen nu eenmaal niet binnen 24 uur een heel nieuw netwerk van agenten en spionnen opbouwen. Ook Imagery intelligence is niet flexibel genoeg, want er zijn enorme kosten aan verbonden om een spionagesatelliet in een nieuwe baan te brengen.

Ten achtste is het potentieel van Signals intelligence veel groter dan iedere andere vorm van intelligence. Een succesvolle doorbraak bij het breken van een buitenlandse code kan waardevollere informatie opleveren dan alle andere intelligence-bronnen bij elkaar. Het kraken van een code is soms het ‘equivalent not of one but of a thousand spies, all ideally placed, all secure, and all reporting instantaneously’.”Zelfs de meest fervente voorstander van Human intelligence, de legendarische CIA-directeur van 1953 tot 1961 Allen W. Dulles, moest toegeven dat Signals intelligence ‘the best and “hottest” intelligence’ opleverde ‘that one government can gather about another’.

Ten slotte zou Signals intelligence de effectiefste manier zijn (vergeleken met andere methoden) om intelligence te verzamelen: het biedt, ondanks de hoge kosten, over het algemeen ‘meer waar voor zijn geld’.” Signals intelligence is inderdaad prijzig. Tijdens de Koude Oorlog besteedde de Amerikaanse overheid vier tot vijf keer zoveel geld aan Signals intelligence als aan Human intelligence. Sinds 1945 heeft de National Security Agency er waarschijnlijk meer dan $ 100 miljard aan uitgegeven, waarvan 75 procent aan Signals intelligence, en het overige aan de beveiliging van verbindingen (Communications Security).

Signals intelligence was en is kortom waarschijnlijk een van de meest productieve technieken om intelligence te vergaren.

Sinds de val van de Muur is het relatieve belang van Signals intelligence aIleen maar toegenomen. Dit geldt niet aIleen voor de Verenigde Staten, maar ook voor hun Europese bondgenoten. Die werden waarschijnlijk door het ontbreken van goede capaciteiten voor Imagery intelligence (beelden vanuit de lucht) zelfs nog afhankelijker van Signals intelligence.

Een voorbeeld hiervan zijn de banden tussen de Verenigde Staten en het Verenigd Koninkrijk: al gedurende de jaren tachtig was het grootste deel (tachtig á negentig procent) van de ruwe intelligence die elke dag naar het Britse Joint Intelligence Committee toevloeide afkomstig uit Signals intelligence, en in mei 1999 verklaarde de Britse minister van Buitenlandse Zaken, Robin Cook, over de Britse afluisterdienst dat ‘the Government Communications Headquarters work is vital in supporting our foreign and defence policies’. Ook het jaarverslag over 2000 van de Intelligence and Security Committee van het Britse Parlement gaf het belang van Signals intelligence aan: ‘The quality of the [Government Communications Headquarters-intelligence gathered clearly reflects the value of the close co-ordination under the UK-USAagreement.’ Hiermee werd verwezen naar een verdrag dat in juni 1948 werd ondertekend door Londen en Washington, genaamd het UK-USA Communications Intelligence Agreement. Dit legde de verdeling vast van de Communications intelligence- inspanning die toen gericht was tegen Moskou en zijn bondgenoten. Later gingen ook Canada, Australie en Nieuw-Zeeland van deze UK-USA-overeenkomst deel uitmaken.

Ook voor andere landen was Signals Intelligence van groot belang, zoals voor Canada, een belangrijke troepenleverend land van UNPROFOR. De nationale Signals intelligence- organisatie, de Communications Security Establishment, was de belangrijkste leverancier van intelligence in de Canadese hoofdstad Ottawa. En ook in Nederland speelden verbindingsinlichtingen in het verleden een belangrijke rol, zoals tijdens de oliecrisis. Ook in latere jaren heeft de, thans genoemde Afdeling Verbindingsinlichtingen (AVI) van de MID belangrijke intelligence aangeleverd.

Nadelen van Signals Intelligence

Tegenover de voordelen van Signals intelligence staat ook een aantal nadelen. Die zwakke kanten en beperkingen zijn overigens soms ook van toepassing op andere intelligence-

Allereerst gaan intercepts altijd gepaard met de grootste geheimhouding. De distributie van het Signals intelligence-product is daarom altijd zeer beperkt. Slechts een zeer kleine kring van de allerhoogste politieke en militaire beleidsmakers heeft toegang tot ruwe Signals intelligence. Deze geheimhouding is ook belangrijk in de context van de intelligence-sharing tussen de Verenigde Staten en hun westerse bondgenoten: vaak wordt Signals intelligence wel verwerkt in intelligence-rapportages, maar de ruwe Signals intelligence is aan weinigen voorbehouden, en dan meestal nog aIleen op een ‘need to know’-basis. De belangrijkste reden daarvoor is dat uitgelekte Signals intelligence grote schade kan veroorzaken. Als degene die afgeluisterd is, de ‘target’ in intelligence-jargon, dat ontdekt, kan deze namelijk snel codes of sleutels veranderen, waardoor de inspanning die geleverd is in de voorafgaande periode om die code of sleutel te breken in één klap waardeloos wordt.

Het nadeel van deze extreme geheimhouding is dat Signals intelligence vaak de juiste personen op de lagere niveaus niet bereikt. Soms bereikt Signals intelligence de commandanten op de grond niet, omdat besloten werd dat deze een need-to-know-classificatiehad, waardoor het intelligence-productgeen verdere verspreiding kreeg. Dit was bijvoorbeeld het geval tijdens de oorlog in Korea: de Communications intelligence bereikte niet aIleen de Amerikaanse troepen op de grond niet, maar evenmin de Amerikaanse marine en luchtmacht. Hierdoor bleef zeer waardevolle tactische en strategische intelligence ongebruikt.

De Amerikanen leerden niet veel van de Korea-oorlog, want tijdens de Vietnam-oorlog gebeurde nagenoeg hetzelfde. Belangrijke Signals intelligence over locaties van NoordVietnamese afweersystemen en MIG-gevechtsvliegtuigen, bleef bij de National Security Agency ‘hangen’, en bereikte de Amerikaanse luchtmacht en marine nooit. De gevolgen daarvan waren verstrekkend: er werden meer Amerikaanse vliegtuigen neergeschoten en er kwamen meer piloten om dan no dig was.

In het midden van de jaren tachtig, onder de regering-Reagan, weigerde de National Security Agency aanvankelijk zelfs om intercepts over steun uit Cuba en Nicaragua aan het gewapende verzet in El Salvador door te geven aan de CIA.

Ook in andere landen dan de Verenigde Staten gelden dergelijke beperkingen: in Moskou gaven KGB en de militaire inlichtingendienst GRU hun Signals intelligence slechts door aan een kleine groep binnen het Politbureau. Het delen van deze inlichtingen met leden van het Warschaupact was zelfs officieel verboden. En ook in Europese landen, als het Verenigd Koninkrijk, Duitsland, Frankrijk en Nederland, is de toegang tot Signals intelligence beperkt tot een selecte groep van beleidsmakers en militairen.

Naast de extreme geheimhouding en daardoor beperkte distributie is een tweede nadeel van Signals intelligence de rem op het gebruik ervan. Gedurende de jaren vijftig en zestig had elk Amerikaans Communications intelligence-rapportde volgende vaste beginregel: ‘No action is to be taken on information herein reported, regardless of temporary advantage, if such action might have the effect of revealing the existence and nature of the source.’ Waarschijhlijk wordt die beginregel nog steeds genoemd.

Deze beperking heeft tot zeer bizarre situaties geleid. Zo onderschepte de Australische Signals intelligence-organisatie (Defence Signals Directorate) in oktober 1995 Indonesische militaire berichten, waaruit bleek dat er plannen waren om vijf gearresteerde Australische journalisten op Oost-Timor te executeren. De dienst besloot om deze inlichtingen niet door te geven aan de Australische premier Gough Whitlam, omdat men vreesde dat deze vervolgens zou handelen op basis van deze onderschepte berichten, of zelfs zou openbaren. Dit zou de capaciteit van de Defence Signals Directorate om het Indonesische militaire verkeer mee te lezen, kunnen verraden, zo was de redenering. Vervolgens werden alle vijf journalisten vermoord door Indonesische Special Forces.

Een derde nadeel is dat Signals intelligence vaak niet op waarde wordt geschat of zelfs soms niet wordt geloofd. Signals intelligence als bron werd bijvoorbeeld tijdens de Koude Oorlog niet betrouwbaar genoeg geacht. Ook al tijdens de oorlog in Korea hechtte de top van de Amerikaanse krijgsmacht geen waarde aan Communications intelligence over de werkelijke sterkte van Mao’s Rode Leger. En tijdens de oorlog in Indochina weigerden Franse commandanten aandacht te schenken aan intercepts van vijandelijk verkeer, omdat deze niet pasten in hun eigen analyse van de militaire situatie.

Een volgend nadeel bestaat er omgekeerd juist uit dat veel landen tijdens de Koude Oorlog te afhankelijk waren van Signals intelligence. In 1978 was de Amerikaanse intelligence- gemeenschap daarvan zo afhankelijk geworden dat president Carter een duidelijke waarschuwing afgaf: ‘Recently (… ) I have been concerned that the trend that was established about 15 years ago to get intelligence from electronic means might have been overemphasized.’ Ook de militaire leiding van de Sovjet-Unie bleek volstrekt van Signals intelligence afhankelijk te zijn geworden waar het ging om een tijdige waarschuwing voor een nucleaire of conventionele aanval. Dat had zeer onaangename gevolgen, zoals bleek in de herfst van 1983. Er dreigde toen een serieuze nucleaire crisis, als gevolg van misverstanden: Soviet- en Warschaupact-grondstations interpreteerden een NAVO-oefening volstrekt foutief, op grond van Signals intelligence: ze dachten dat er een verrassingsaanval met Pershingraketten ging komen. En in mei 1998 leidde een verkeerde interpretatie van intercepts bij de Signals intelligence-organisatie van het leger van India bijna tot een nucleaire confrontatie tusscu India en Pakistan.

Hiermee hangt het vijfde nadeel samen: blind vertrouwen in verbindingsinlichtingen kan leiden tot een soort Signals intelligence snobbery. Zo werd tijdens de Koude Oorlog en daarna het belang dat men aan Signals intelligence hechtte steeds groter. Vooral de introductie van spionagesatellieten en het spionagevliegtuig U-2 leidde tot een verwaarlozing van Human intelligence. Er ontstond een soort intelligence-elitisme, ook wel bekend als het ‘Groene-Deur-syndroom’: het idee dat alleen Signals intelligence (en in zekere mate ook Imagery intelligence) nog betrouwbaar zou zijn. Human intelligence werd dan veelal afgedaan als onbetrouwbaar. De zogeheten BrixMis-spionagemissies in de DDR hadden hieronder te lijdcn; hun missierapporten weken namelijk soms af van de Signals intelligencerapportages over hetzelfde onderwerp. Dan werd meestal de Signals intelligence geloofd, omdat rapportages van het Government Communications Headquarters nu eenmaal veel hoger geclassificeerd waren (‘Secret’ of ‘Top Secret’), terwijl dezelfde intelligence in het BrixMis-rapportslechts ‘UK Confidential’ als classificatie meekreeg.

In een te groot vertrouwen in Signals intelligence schuilt nog een extra risico, dat als het zesde nadeel geldt: dit intelligence-product moet namelijk vaak bekeken worden in samenhang met Human intelligence en Imagery intelligence. Op Signals intelligence als exclusief intelligence-productvalt slechts in speciale gevallen te bouwen: Signals intelligence geeft veelal alleen een stukje van de puzzel, en zelden de gehele puzzel. Veel verbindingsinlichtingen zijn namelijk fragmentarisch en indirect. Dat betekent ook dat op intelligence van de National Security Agency niet valt te bouwen, omdat deze alleen ruwe verbindingsinlichtingen produceert en geen finished intelligence. De verantwoordelijkheid om tot een afgerond intelligence-productte komen, ligt bij de afnemers (de consumenten) van het ruwe materiaal van de National Security Agency. Analisten binnen die Amerikaanse intelligence- gemeenschap moeten dan ook vaak honderden of zelfs duizenden verbindingsinlichtingen analyseren, wil het ‘plaatje’ duidelijk worden. Een medewerker van een Amerikaanse inlichtingendienst verklaarde in dit verband: ‘You rarely get a Signals intelligence smoking gun. It’s usually very fragmentary (…) Very often you don’t even know who you’re listening to.’ Dat is een bevestiging dat ook Signals intelligence niet alle antwoorden geeft; toepassing daarvan is zeker niet voldoende om de politieke voornemens of de interne politieke machinaties binnen een buitenlandse overheidsadministratie bloot te leggen. Overigens zijn ook Imagery intelligence en Human intelligence daar zelden toe in staat,

Een zevende nadeel bestaat erin dat Signals intelligence weliswaar snel is, maar desondanks soms toch te laat arriveert. Tijdens de Suez-crisis in 1956 en de invasie van Tsjechoslowakije in 1968 was er bijvoorbeeld voldoende Signals intelligence beschikbaar, maar de verwerking, analyse en rapportage bleek te tijdrovend. Pas dagen na beide invasies was de Signals intelligence beschikbaar.

Dit hangt weer samen met het achtste nadeel, dat waarschijnlijk het belangrijkste is: de stroom informatie is enorm, maar de analysecapaciteit is onvoldoende. Krachtige computers kunnen een snelle voorselectie uitvoeren en het kaf van het koren scheiden, maar de analist moet uiteindelijk toch bepalen of een bericht waardevol is. Signals intelligence- organisaties worden tijdens een crisis overspoeld met massa’s intercepts. CIA-analisten waren niet in staat om de oorlog in het Midden-Oosten in 1973 te voorspellen, omdat er honderden Communications intelligence-rapportenvan de National Security Agency op hun bureau landden: daardoor werd het overzicht verloren.

De directeur van National Security Agency in 1995, admiraal McConnell, verklaarde bijvoorbeeld dat de ‘National Security Agency’s capability to intercept far exceeds its capability to decode, analyze and report. The goods news is the agency can decode and analyze a million messages a day; the bad news is the agency must decide which million, of the billions of messages sent globally, to decode.’ Omstreeks 1995 verwerkte de National Security Agency inderdaad slechts ongeveer één procent van alle intercepts die het hoofkwartier in Fort Meade bereikten; in de jaren tachtig was dat nog twintig procent. Tekenend voor de verhouding tussen binnenkomende intercepts en uitgaande intelligence bij de National Security Agency is daarbij dat de huidige directeur van de National Security Agency, generaal Hayden, moest toegeven dat de National Security Agency inmiddels weI minder produceerde aan intelligence dan tien jaar geleden. Bij de intelligence-productievan de National Security Agency hielp ook niet – zoals een interne studie in het voorjaar van 1995 onthulde dat er voortdurend bureaucratische gevechten binnen de National Security Agency plaatsvonden, tussen de militaire en de civiele delen van de Divisie Operaties van deze organisatie. Dat vertraagde de stroom van intelligence naar andere diensten aanzienlijk; veel afnemers van het intelligence-productvan de National Security Agency klaagden midden 1995 dat de National Security Agency niet in staat bleek te zijn om aan hun behoefte te voldoen.

Een negende nadeel is de inherente kwetsbaarheid van verbindingsinlichtingen. Verbindingen worden beveiligd, codes kunnen plotseling veranderd worden, er kan frequency hopping plaatsvinden bij de zenders; daarbij springt de zender volgens een, aIleen bij de legitieme ontvanger bekend, patroon tussen verschillende frequenties. Ook kunnen er zogeheten bursttransmissies optreden, waarbij in enkele seconden enorme hoeveelheden informatie wordt verzonden. En er kan sprake zijn van spread spectrum, waarbij de te verzenden informatie verdeeld over simultaan uitgezonden frequenties wordt uitgezonden. Een andere voor de hand liggende manier om de verbindingsinlichtingen te storen door degene wiens berichtenverkeer wordt onderschept, is om opzettelijk valse berichten te verspreiden, in de hoop dat die opgevangen worden. Ook cryptografie is een uitstekend middel om het berichtenverkeer te beschermen. Millis noemde dit een van de grotere bedreigingen voor de inspanningen van de National Security Agency: Signals intelligence verkeerde volgens hem door deze factoren in een crisis, en de wereld van het communicatieverkeer was niet langer Signals intelligence-vriendelijk te noemen.

AIle inspanningen kunnen natuurlijk ook tenietgedaan worden door spionage of verraad. Sovjet-spionnen als William Weisband, William H. Martin en Bernon F. Mitchell hebben enorme schade toegebracht aan de Amerikaanse pogingen om verbindingsinlichtingen te verwerven. Versprekingen van de Amerikaanse president kunnen hetzelfde resultaat opleveren. Zo onthulde president Richard M. Nixon in 1969 tijdens een persconferentie dat de National Security Agency in staat was om het communicatieverkeer van de Sovjet-Unie en Noord-Korea te lezen. Na die verklaring veranderden Moskou en Pyongyang hun cryptografische systernen, en was de National Security Agency direct ‘doof’. De National Security Agency had maanden nodig om de schade die veroorzaakt was door Nixons verspreking te herstellen.

Een tiende nadeel is dat Signals intelligence vanwege de beperkte verspreiding ook voor eigen politieke doeleinden aangewend kan worden. Dat deed Henry Kissinger als National Security Advisor van Nixon; bepaalde gevoelige intercepts werden niet met de ministers van Defensie en Buitenlandse Zaken gedeeld. En in 1986 weigerde de National Security Agency zelfs Signals intelligence over de Iran-Contra-affaire te delen met de minister van Defensie, Weinberger: de redenering was dat het Pentagon geen ‘need-to-know’ had.

Als elfde nadeel geldt soms het ontbreken van gecoordineerde Signals intelligence-verzamelactiviteiten. Tijdens de Koude Oorlog waren de verschillende Signals intelligenceorganisaties van de drie Amerikaanse krijgsmachtonderdelen en van de diverse inlichtingendiensten vaak bezig met hetzelfde doel. Er ontstond zo een enorme verdubbeling van verbindingsinlichtingen. Ook na de Koude Oorlog kwam dat voor, bijvoorbeeld bij de jacht op drugskoning Pablo Escobar in 1992-1993: de National Security Agency, de Signals intelli- gence-eenhedenvan de CIA en de Amerikaanse krijgsmacht opereerden toen volstrekt onafhankelijkvan elkaar, om aan te tonen dat hun personeel en materieel ‘beter’ waren dan die van de andere organisatie. Ook in de Sovjet-Unie werkten de KGB en de militaire inlichtingendienst GRU vaak langs elkaar heen, en dit fenomeen deed zich niet aIleen voor bij deze twee grote mogendheden: in Duitsland vochten de Bundesnachrichtendienst en de Duitse militaire inlichtingendienst meer dan twintig jaar over de vraag wie er zeggenschap over Signals intelligence zou krijgen. In hoofdstuk 3 kwam al aan de orde dat er ook in Nederland drie afzonderlijke militaire organisaties bestonden voor verbindingsinlichtingen; van samenwerking of serieuze pogingen tot integratie was amper sprake. Pas in 1996 werden deze drie diensten geintegreerd tot de Afdeling Verbindingsinlichtingen.

Tot slot zijn ook technische obstakels een zekere belemmering bij Signals intelligence. Atmosferische storingen, ruis, zwakke ontvangst en het af en toe wegvallen van verbindingen kunnen een goede onderschepping in de weg staan. De gesteldheid van het terrein kan eveneens een belemmerende factor zijn. Dichtbewoonde gebieden, maar ook bergen en vaIleien, maken een goede interceptie van veraf vaak onmogelijk. Ten slotte kunnen storingen worden veroorzaakt door industriele activiteiten die de interceptie onmogelijk maken.

Samengevat: Signals intelligence is een belangrijke, veilige, sneIle, permanent inzetbare, kostbare, productieve en zeer betrouwbare methode om intelligence in de vorm van verbindingsinlichtingen te vergaren. Er kleven evenwel ook nadelen aan waarvan de belangrijkste zijn: de stortvloed aan onderschepte gegevens, het ontbreken van voldoende analysecapaciteit, de beperkte mogelijkheden van interceptie vanwege cryptografie, beveiligde verbindingen via landlijnen, de terreingesteldheid en atmosferische omstandigheden.

[…]

EOF

‘Chief of NSA/USCYBERCOM Eyes Deterrence in Cyberspace’ — here is a list of readings on deterrence

According to a report by DefenceTalk, the chief of the NSA and USCYBERCOM, Mike Rogers, is eyeing deterrence to fight adversarial behavior in cyberspace. The article quotes from Rogers’ response to the newly revealed reports that allege malicious behavior from Chinese and Russian actors: “Right now, if you are a nation-state, if you are a group, if you are an individual, my assessment is that most (hackers) come to the conclusion that [attacking U.S. targets in cyberspace] is incredibly low-risk, that there is little price to pay for the actions that they are taking”. Furthermore: “[it is] not in our best interests in the long term as a nation to have that perception”. No information is provided concerning a strategy for such deterrence. For inspiration, here is a list of readings on deterrence in cyberspace (covers various kinds of actors):

EOF

The Dutch Defense Cyber Command: A New Operational Capability

UPDATE 2017-05-23: reportedly (mirror: .html and .pdf) there is a longer-running partnership between the Dutch Defense Cyber Command (DCC) and the U.S. Army 780th Military Intelligence Brigade (aka ‘Cyber Brigade’). The partnership includes “sending U.S. cyber Soldiers and civilians to the Netherlands to attend the DCC Cyber Security Insight Course (CSIC)”. In October 2016, the Dutch participated in the “Bold Quest” training exercise at Fort Stewart, Georgia.

UPDATE 2016-11-30: the Dutch MoD announces that the DCC will be mission-ready in the first part of 2017; it has some 80 personnel, spanning defensive and offensive capabilities. (Note: that number represent just the DCC; obviously, more personnel with IT security knowledge and skills is present throughout the MoD, e.g. at DefCERT, Ivent and military intelligence.)

UPDATE 2016-06-xx: article, in Dutch, about the DCC: Defensie Cyber Commando, een nieuwe loot aan de defensieboom (.pdf, by BGen Hans Folmer, published in Intercom 2016-1, i.e., the magazine of the association of Dutch army signals officers)

UPDATE 2016-05-03: the Dutch MoD reports that it works with Thales to set up an advanced cyber training & test facility in the Du Moulin Barracks in Soesterberg.

UPDATE 2014-11-05: for illustrative purposes I added two tables on cyber vs physical/conventional topics from Cyberspace: The Ultimate Complex Adaptive System (.pdf, 2011) by Dr. Paul W. Phister Jr. (AF Research Laboratory, USA).

UPDATE 2014-10-23: added budget data, more context, and a chart from 2011 visualizing the implementation the Dutch Defense Cyber Strategy of 2012.

Colonel Hans Folmer, the Commander of the newly established Dutch Defense Cyber Command (DCC), wrote a short article (.pdf, in Dutch) for “Magazine Nationale veiligheid en crisisbeheersing 2014, nr. 5” entitled “The Dutch Defense Cyber Command: A New Operational Capability” (my translation). The magazine was published online by the Dutch government on October 22nd 2014. A translation of Folmer’s article follows in the body of this post.

Cyber can be used by the military to carry out — with varying cost/risk/yield ratios — defense, attack and intelligence. For instance, to deny, disrupt, degrade or destroy enemy capability involving digital systems; whether on land, sea, air, space, or in the digital domain itself. To illustrate the use of cyber in the conventional military objective of antiaccess/area-denial, consider the following table published by Harry Foster, Deputy Director of the USAF Center for Strategy and Technology at Air University, in JFQ-72 (4.2MB .pdf, 2014):

usaf-cyber-example

Two other illustrations can be found in Table 1 and Table 2 in Cyberspace: The Ultimate Complex Adaptive System (.pdf, 2011) by Dr. Paul W. Phister Jr. First, Table 1 maps the conventional domains — sea, ground, air and space — to the cyber domain:

phister2011-table-1-cyber-vs-conventional

Second, Table 2 maps attributes of the physical environment to those of the cyber environment:

phister2011-table-2-cyber-vs-physical

Now, on to the Dutch DCC. The Dutch DCC formally resides within the Royal Netherlands Army, the land forces element of the Dutch armed forces (in Dutch: “Commando Landstrijdkrachten” (CLAS)), but involves officers from all military domains. The DCC is primarily tasked with defense, but will also work on offense and, to a lesser extent, intelligence. The DCC will cooperate with the MIVD and the Joint Sigint Cyber Unit (JSCU). The JSCU is a joint organization of the General Intelligence & Security Service (AIVD) and the Military Intelligence & Security Service (MIVD) that is tasked with the collection of data from technical sources, making it accessible and searchable, perform analysis (correlation, data mining), and delivering sigint and cyber capability in support of the intelligence requirements of the AIVD and MIVD (possibly on-site in military deployment areas). Roughly put, the DCC is the Dutch smaller equivalent of USCYBERCOM, and the JSCU is the Dutch smaller equivalent of the NSA.

No organizational chart is available of the current situation (AFAIK), but in 2011, the following chart was used to visualize the implementation of the Dutch Defense Cyber Strategy, and still seems applicable:

dcc-ontwerp-organogram-2011

As of 2016, the annual budget of the DCC is estimated to be some EUR 21M. According to the budget (2.2MB .pdf, in Dutch) of the Ministry of Defense (MoD) for 2015, the investment budget for “cyber weapons” is EUR 5M in 2015, EUR 7M in 2016 and EUR 9M from 2017 onward. (Note: the document does not define “cyber weapons”.) The annual budget is divided in investments, exploitation and personnel as follows (in million euro):

defensie-budget-cyber-2015

Some 40% of this budget is assigned to the MIVD, some 40% to the DCC (including DCEC), and the remainder to Joint IV Command (JIVC), the Netherlands Defence Academy (NLDA) and Directorate of Operations (DOPS). The MIVD has some 800 employees, the AIVD has some 1500 employees. The JSCU will have 350 employees, mostly from the AIVD and MIVD. The number of employees residing under the DCC and DCEC is not known (to me), but it is reported that sixty new employees were acquired, and that fourteen military officers are will be trained in hacking by Fox IT.

Just like other parts of the armed forces, the operational use of the DCC will be controlled by the Chief of Defence (CHOD), the highest ranking military officer in the Dutch armed forces. This position is currently held by Tom Middendorp. (His predecessor, Dick Berlijn, has been Cybersecurity Advisor at Deloitte Netherlands since resigning in 2008.)

Here is a translation of Folmer’s article about the DCC (hyperlinks are mine):

The Defense Cyber Command, a new operational capability
By Colonel Hans Folmer
Commander of the Dutch Defense Cyber Command

On September 25th 2014, the Minister of Defense, Jeanine Hennis-Plasschaert, established the Defense Cyber Command in The Hague. She rightfully called [.pdf, in Dutch] the launch of a new operational unit and the final addition of the cyber weapon to the toolkit of the Dutch armed forces a historic event.

The nature and character of conflicts change. Maximum disruption of societies increasingly is the objective of malicious actors. Increasingly, better use is made of modern, easy to obtain technical digital means.

In military operations, the cyber domain is used effectively by all parties both for command and control, and propaganda. Weapons and sensory systems are digital systems. Attacks can now occur globally and in real time. The enemy does not even have to physically cross a border to attack us. On the other hand, the enemy can be grabbed at large distance, or disruptive activities can be counteracted. It is of crucial importance to recognize, understand and control this, and also to deploy cyber weapons ourselves. The Dutch armed forces draws conclusions from this and wants to play the prominent role that suits our country. To guarantee the ability to deploy the armed forces and to increase its effectiveness, the Ministry of Defense has been working on strengthening its digital defensibility for several years, and will in the coming years be developing the capability to carry out cyber operations.

The establishment of the Defense Cyber Command (DCC) was the final step toward embedding all cyber capabilities within the Ministry of Defense. In June 2012, the Minister of Defense, Hans Hillen, presented the Defense Cyber Strategy. The core of the strategy is that the digital domain, next to land, air, sea and space, has now become the fifth domain for military action. Digital means as weapon or means of intelligence will increasingly be an integral part of military action. However, the dependence on digital means also results in vulnerabilities that require urgent attention.

The strategy includes six priorities that will guide the Ministry of Defense in effectuating hear goals in the digital domain:

  1. the establishment of an integral approach;
  2. the strengthening of the digital defensibility of the Ministry of Defense (“defensive”);
  3. the development of the military capability to carry out cyber operations (“offensive”);
  4. the strengthening of intelligence in the digital domain (“intelligence”);
  5. the strengthening of knowledge position and innovative capability of the Ministry of Defense in the digital domain, including the acquisition and retaining of qualified personnel (“adaptive and innovative”);
  6. the intensification of national and international cooperation (“cooperation”).

In the establishment of the strategy, the strengthening of our own protection was prioritized (by the establishment of DefCERT, the Computer Emergency Response Team of the Ministry of Defense) and expanding the intelligence capability. In addition, the knowledge position has been worked on energetically, with the establishment of the Defense Cyber Expertise Center [as per May 214], and of course on the cooperation with public, private and international partners. The establishment of an operational capability was originally planned for the end of 2015, but in the memorandum “In het belang van Nederland” the urgency was recognized and the establishment of the DCC accelerated.

The Defense Cyber Command is the central entity within the Ministry of Defense for the development and use of military operational and offensive capability. For that purpose, the DCC, in addition to a small staff, has three departments.

  1. The Operations department consists of a pool of cyber advisers for the support of operational units. These cyber advisers will be used in small teams during actual operational deployment and exercises, and are tasked with advising the operational commander on the use of digital means, dependency, vulnerabilities and capabilities of the enemies and our own troops. They will also advise on the protection of our own means. The cyber advisers are the link between the operational unit in the deployment area and the cyber units in the Netherlands (DCC and DefCERT). These teams will be trained jointly with operational units, as preparation for cooperation during an operational deployment.
  2. The Technology department consists of cyber specialists that have the technical knowledge and skills to act offensively in the cyber domain, both to carry out an effective defense as well as to support operations. Offensive cyber capabilities are capabilities aimed at influences or disrupting enemy actions. This concerns the development of (knowledge about) complex and high-tech means and techniques specifically aimed at increasing our own military capability. A cyber attack on an air defense system, for instance, can increase the effectiveness of an air raid, while limiting the risk to collateral damage.
  3. The Defense Cyber Expertise Center (DCEC) is the central entity within the Ministry of Defense for strengthening our own knowledge position, and as a result the innovative capability in the cyber domain. The DCEC will supply practically applicable cyber knowledge, concepts/doctrines and Education&Training support to all parts of the Ministry of Defense, and thereby contributes to the strengthening of the three cyber capabilities. The DCEC cooperates with knowledge institutions, universities and other (international) knowledge centers.

The mere establishment of the DCC does not yet achieve our goals. The establishment of this command will take time. In this domain, a new world is still to be discovered and developed. Much is yet unclear, and we are but at the beginning of the development of new capabilities. Existing tactics and methods of acting must be reshaped in the cyber domain. To that end, a cyber doctrine is currently being developed. Learn, experiment and apply, that is the motto for the coming years.

Summarizing, it must be possible to support military operations with offensive cyber capabilities. For that purpose, the Defense Cyber Command has been established. Offensive cyber capabilities can be a force multiplier, and thereby increase the effectiveness of the armed forces. By developing a robust cyber capability, the Netherlands can play an important role on this area within NATO. It is important that it is not a silver bullet to our all-encompassing vulnerability. It is, however, a crucial addition to our existing conventional capabilities on land, sea and air. Not a substitute, but a very important force multiplier.

Folmer states that the Netherlands “can play an important [cyber] role within NATO”. DefCERT has an existing covenant with NATO Computer Incident Response Capability (NCIRC). Also, one of the three NATO Communications and Information Agencies (NCI Agencies) is located in The Hague, adjacent to the business unit Defence, Safety & Security of knowledge institute TNO. According to some Parliamentary Papers, the MoD cooperates with TNO on the area of big data.

Furthermore, the MoD is a funding partner in Small Business Innovation Research Programs (SBIR) on cyber security. So far, two such calls exist: SBIR Cyber Security I (Sep 2012 – Dec 2014) and SBIR Cyber Security II (May 2014 – Jul 2016). Both involving some EUR 2-3M in available funding. A list of projects funded during the first call is available here. One of the example requirements the Dutch MoD expressed (.pdf, Jan 2014, in Dutch) in a pitch for SBIR-II is Linux/Python-built software for network reconnaissance against target networks for the purpose of identification, localization and detection; specifically also soliciting ideas for IPv6-based explorations.

Related:

EOF

Dutch IRS uses the Dutch police’s (nearly) nation-wide ANPR camera network for state tax collection

UPDATE 2017-02-24: NRC Handelsblad reports that the Dutch supreme court (“Hoge Raad”) granted an appeal seeking that the Dutch IRS can, for privacy reasons not further explained in the news report, can not use the nation-wide ANPR camera network for the purposes of checking whether or drivers of leased company vehicles drive more than 500km per year privately (conceivably, that mass processing of nation-wide ANPR data is claimed to be disproportionate for that purpose). Persons who drive more than 500km per year for private reasons in a leased company care (effectively) have to pay more tax. The final ruling by the supreme court is expected later this year.

UPDATE 2014-10-22 #2: build your own vehicle license plate recognition using the DTK ANPR SDK v2.0 (kudos to unnamed person for the tip).

UPDATE 2014-10-22: similar news was covered several weeks ago in length by Maurits Martijn (De Correspondent). His reports have the attention of national politics. In 2013, Wilmer Heck (NRC Handelsblad) first reported on the existence of a covenant (.pdf, in Dutch) between police and IRS on the use of ANPR, a cooperation that turned out to exist since (at least?) 2011. Also see this document (.pdf, in Dutch).

Yesterday, Dutch news site GeenStijl reported (in Dutch) on information (.pdf, in Dutch) obtained through a FOIA request revealing that the Dutch police allows the Dutch IRS to use all Automatic Number Plate Recognition (ANPR) camera footage and data that is “fiscally relevant” to collection of state taxes. ANPR cameras are installed throughout the Netherlands: it essentially is a (nearly) nation-wide network of traffic cameras. The camera footage will be used to enforce, among others, the following Dutch tax laws:

Since journalist Wilmer Heck’s report in 2013 it is known that the IRS uses ANPR data since at least 2011. But up until last month, that “only” involved the 200ish camera’s on main traffic axes. This cooperation is now extended so that the IRS may use data collected through all ANPR camera’s. Here’s a translation of the report on GeenStijl (note: I rephrased bits to make it more clear for people not familiar with Dutch media & politics):

IRS will be fully watching ANPR camera footage

At the end of September, the Dutch Minister of Security & Justice, Ivo Opstelten, wrote that it is “technically and administratively feasible” to use the Dutch police’s ANPR cameras “more extensively” [in Dutch]. The letter was written in a way that suggests that expansion still had to take place. This was another creative view on the Hague reality of the senile old bastard: the month before, a covenant had already been signed between the police and the IRS. That covenant states that the IRS can “co-use” the “ANPR cameras that are in use by the police atmain thoroughfares“, but also that the IRS can extend this co-use to “other ANPR cameras that belong to the police’s ANPR network”. So, ALL of them. It’s very friendly of the police to allow the IRS to browse through number plate data of all Dutch citizens. Especially taking into account that the police really cannot store & retain the data, according the a law they have been violating for years [in Dutch]. And as opposed to car drivers who exceeded the speed limit by three kilometers per hour, the IRS does not even have to pay administrative costs to the police for using their stasi-cams. More friendly collegiality, that enables the government to more easily see behind the car doors of the unwitting driver. We asked the police and IRS for the implications regarding privacy. Their response, singing all together: “Privacy? Hahaha LOL!” Duly noted. (h/t)

The police and IRS are also legally allowed to carry out tasks on behalf of the Dutch intelligence & security services, such as the General Intelligence & Security Service (AIVD). If one can think of a plausible use of ANPR data to intelligence services, it can be safely assumed they use it as well (note: no specific evidence for that is known to me).

EOF

In early 2015, Dutch govt will ask parliament to grant hacking power to law enforcement

UPDATE 2017-10-30: the cybercrime bill (Computer Crime Act III, aka Wcc3) is still being handled by the Senate. Jan-Jaap Oerlemans posted a message on oversight on hacking & notice & takedown (NTD) in this bill. He also wrote an elaborate overview article (.pdf, in Dutch) of the bill.

UPDATE 2016-03-09: report on Wcc3 by the lowerhouse committee on Security & Justice.

UPDATE 2015-12-22: and here they are: the new cybercrime bill and MoU (in Dutch) as submitted by the cabinet to the House. Notably, the cabinet cancelled compelled decryption because of the right not to self-incriminate (nemo tenetur principle). Thus, the final bill, that will be discussed in the House, does not contain a power for LE to compel suspects of certain “very serious criminal offenses” to decrypt their data under penalty three years imprisonment or a fine of up to ~20k euro.

UPDATE 2015-11-27: the cabinet announced today that it submitted the cybercrime bill to the House of Representatives, as part of a series of bills relevant to counterterrorism. The bill should become available in the not-too-distant future; I’ll add the link here. The bill’s status has moved from “Raad van State” (Council of State) to “Tweede Kamer” (House of Representatives). NOS has a report (in Dutch).

UPDATE 2015-06-11: it is reported that the cabinet will submit the proposal after the parliamentary summer break, which ends on August 31st 2015.

In October 2012, the Dutch government announced its initiative to grant law enforcement the power to covertly and remotely access “automated works” (computers, phones, etc.), under certain circumstances. In 2013, draft legislation (Memorandum of Understanding) was published. The proposal concerning covert and remote access is part of a larger text — unofficial English summary available here — that criminalizes the trade in stolen (digital) data and that proposes the following powers:

  • Remote entry of automated works and the placement of technical means (such as software) for the purpose of investigation of severe forms of cybercrime. (Note 1: this applies to “serious criminal offenses”. Note 2: some hacking has already been carried out by Dutch police, for instance to take down Bredolab (2010) and to fight child porn on Tor (2011), under authorization of a magistrate.)
  • Remote search of data that is accessible from an automated work, regardless of the location of the automated work on which the data is stored and taking into consideration agreements and rules of international legal assistance;
  • Remotely making data inaccessible that is accessible from an automated work, regardless of the geographical location of the automated work on which the data is stored and taking into consideration agreements and rules of international legal assistance;
  • Compelling suspects of certain “very serious criminal offenses” to decrypt their data under penalty three years imprisonment or a fine of up to ~20k euro (at odds with nemo tenetur).

All of the proposed powers require authorization from a magistrate. The proposal was covered on Slashdot and criticized by Bits of Freedom. In May 2013, the Dutch government submitted the proposal for public consultation (in Dutch). Bits of Freedom submitted criticism, as many others did, including me (in Dutch). The government also submitted the proposal to the Dutch Data Protection Agency (CBP), who in February 2014 expressed concerns relating to the requirements of necessity and proportionality imposed by the European Convention on Human Rights (ECHR). That same month, the government submitted its proposal to the Dutch Council of State for further consultation.

It is publicly known that the Dutch national police (KLPD) had, and still has, active licenses for FinSpy (trojan horse that runs on Windows, OS X and Linux) and FinSpy Mobile (that runs on Android, Blackberry, iOS and Windows Phone): this was observed in WikiLeaks’ SpyFiles 4. The use of such methods is confirmed through the answers (in Dutch) given on October 6th 2014 to Parliamentary questions on this topic (h/t @rejozenger).

On October 18th 2014, the Dutch Minister of Security & Justice answered (.pdf, in Dutch) Parliamentary questions by MP’s Berndsen-Jansen and Verhoeven (both affiliated with the D66 party) concerning this proposal. The last answer indicates that the govt will submit its proposal to the Dutch Parliament in early 2015. Here is a translation of all six questions and answers:

Question 1:
Are the reports correct that a large international investigation is ongoing into Blackshades, software that can be used to create malware, among others? [Footnote 1: http://www.nu.nl/weekend/3858563/huiszoeking-aanschaffen-omstreden-software.html]
Answer 1:
The reports are correct to the extent that the US and Canada have ongoing criminal investigations in various European countries against buyers, sellers, distributors and/or creators of software primarily designed to commit, in short, computer crime as meant in Articles 138ab (first section), 138b and 139c of the Penal Code.

Question 2:
Does the Public Prosecution, in the context of investigation into Blackshades, commissioned the hacking of the Blackshades server? If so, can you explain the legal basis for that, and the grounds on which it is permissible?
Answer 2:
The Public Prosecution did not commission the accessing of the Blackshades server. Dutch law enforcement has, under the responsibility of the Public Prosecution, and after authorization of a magistrate, remotely accessed a server and searched this server to record data on the basis of Article 125i of the Code of Criminal Procedure.
Under certain circumstances, Article 125i, after authorization of a magistrate, permits remote access of a computer, for the sole purpose of searching the computer for predetermined data files and if necessary seize those by recording them. This occurred in two criminal cases involving very serious offenses. I refer to the answers to the questions by MP Gesthuizen (Socialist Party) to the Minister of Security & Justice on the use of controversial spying software by Dutch law enforcement (2014Z13948, submitted August 11th 2014).

Question 3:
How often did the Public Prosecution so far commissioned the police to hack servers and computers in the context of an investigation and what was the basis for the authority to hack?
Answer 3:
Police carries out investigations on the basis of the Code of Criminal Procedure. The term “hacking” is not present there. The police has, as mentioned in the previous answer, on the basis of Article 125i, only in several (exceptional) cases, with authorization from the magistrate, accessed an automated system and secured data from a server whose location and ownership were unknown. One of those investigations concerns Blackshades.

Question 4:
To what extent is the current Penal Code sufficient as a legal ground for the police to access servers and computers of suspects?
Question 5:
Is it true that your proposal to “Change the Penal Code and the Code of Criminal Procedure in relation to the improvement and strengthening of investigation and prosecution of computer crime (Computer Crime III)” aims to provide a legal basis for Justice to hack servers and computers for the purpose of an investigation? If so, how does the current practice of commissioning hacking for the purpose an investigation relate to this proposal?
Answers 4 and 5:
As explained in answer 2, the current legislation must be supplemented, which the Computer Crime III proposal aims to do. The purpose of that legislative proposal is to tailor the legal framework for investigation and prosecution of cybercrime towards the investigation and prosecution of computer crime and new methods used by criminals. Today’s society and the fast changes of technology for communicating and sharing or storing information globally require that law enforcement keeps pace (also see my letter to Parliament of October 15th 2012 concerning legislation for fighting cybercrime).

Besides various changes and supplements, the legislative proposal provides a new power that allows an investigating officer, following an order of a prosecutor, to covertly and remotely access an automated work to exercise certain investigatory powers in that automated work. Accessing an automated work is a more infringing power than searching an automated work, and necessary for the investigation of many forms of internet crime.

Question 6:
When do you expect to submit the Computer Crime III proposal, that has been in consultation since May 2013, to Parliament?
Answer 6:
The legislative proposal will be submitted to Parliament in early 2015.

One important aspect will be to what extent the government addressed the concerns expressed by the Dutch Data Protection Authority (CBP). Notably, the CBP advised that logging of police actions through malware for the purpose of accountability requires that the precise way in which the software works must be known — including the source code (although that probably won’t fly IRL).

EOF

 

 

A critique of the balancing metaphor in privacy and security (Mitchener-Nissen, 2014)

Timothy Mitchener-Nissen, during his affiliation with the University College London as a Teaching Fellow in Sociology of Technology, published an article entitled Failure to collectively assess surveillance-oriented security technologies will inevitably lead to an absolute surveillance society (Surveillance & Society Vol 12 Issue 1, p.73-88). In this post I quote paragraphs from that article with the purpose of sharing, and for my own reference purposes.

First, here’s the abstract:

The arguments presented by this paper are built on two underlying assertions. The first is that the assessment of surveillance measures often entails a judgement of whether any loss in privacy is legitimised by a justifiable increase in security. However one fundamental difference between privacy and security is that privacy has two attainable end-states (absolute privacy through to the absolute absence of privacy), whereas security has only one attainable end-state (while the absolute absence of security is attainable, absolute security is a desired yet unobtainable goal). The second assertion, which builds upon the first, holds that because absolute security is desirable new security interventions will continuously be developed each potentially trading a small measure of privacy for a small rise in security. When assessed individually each intervention may constitute a justifiable trade-off. However when combined together these interventions will ultimately reduce privacy to zero. To counter this outcome, when assessing the acceptability of any surveillance measure which impacts upon privacy (whether this constitutes a new technology or the novel application of existing technologies) we should do so by examining the combined effect of all surveillance measures currently employed within a society. This contrasts with the prevailing system whereby the impact of a new security technology is predominantly assessed on an individual basis by a subjective balancing of the security benefits of that technology against any reductions in concomitant rights, such as privacy and liberty. I contend that by continuing to focus on the effects of individual technologies over the combined effects of all surveillance technologies within a society, the likelihood of sleepwalking into (or indeed waking-up in) an absolute surveillance society moves from being a possible to the inevitable future.

In the body of the paper, the author defines surveillance-oriented security technologies (SOSTs) as follows:

These are technologies intended to enhance the security of citizens via some inherent surveillance capability either operated by or accessible to the state. They facilitate the monitoring, screening, or threat assessment of individuals, groups, or situations, and are based on live-events, past events or the processing of data.

The author is skeptical about the effectiveness of Privacy Impact Assessments (PIAs) that have become mandatory for governments in various countries (including the Netherlands: see this):

PIAs also employ balancing through cost/benefit analyses of different actions and values, the production of business cases justifying both privacy intrusions and the resulting implications, and when public acceptability of the proposed project is analysed [Wright et al. 2011: Precaution and privacy impact assessment as modes towards risk governance. In Towards Responsible Research and Innovation in the Information and Communication Technologies and Security Technologies Fields]. Again, the focus is on the specific project to hand. There is the possibility here to take a more collective view within such assessments; however, for our purposes this would require knowledge of the current state of SOSTs operating within a society so as to form a clear picture of the status quo. It is doubtful those undertaking the PIA would have access to such information or the resources to acquire it. Recently the concept of Surveillance Impact Assessment (SIA) has been developed, described as a ‘methodology for identifying, assessing and resolving risks, in consultation with stakeholders, posed by the development of surveillance systems’ [Wright and Raab 2012: Constructing a surveillance impact assessment. Computer Law & Security Review 28(6): p.613-626]. The SIA concept seeks to increase stakeholder engagement, minimise the impact of surveillance technologies, and improve upstream development. However, this initial conceptualisation still appears to focus on the individual technology and not the collective assessment of other existing SOSTs within its methodology. Whether this changes in practice remains to be seen.

The author then argues against the “ubiquitous balancing metaphor” that expresses privacy and security as a trade-off:

[The balancing metaphor] is arbitrary and subjective, lacking in meta-rules, and purports to successfully compare objects (such as privacy and security) which possess different intrinsic characteristics.

Furthermore:

Focusing and expanding upon this final point, one of the fundamental differences between privacy and security is that only one of them has two attainable end-states. Privacy (P) exists as a finite resource on a quantifiable spectrum with two attainable end-states; that being absolute privacy (P=1) at one end through to the absolute absence of privacy (P=0) at the other. Whereas security (S) also exists as a finite resource but on a quantifiable spectrum with only one attainable end-state; that being the absolute absence of security (S=0). However, as discussed earlier, absolute security (S=1) can never be achieved and therefore must exist as a desirable yet ultimately unobtainable goal always equating to something less than 100 per cent (S=<1); hence the absence of a second attainable end-state.

The second assertion, which follows from and builds upon the first, holds that one consequence of absolute security being unobtainable yet desirable is that new SOSTs will continuously be developed in a futile search for this unobtainable goal. These technologies each potentially trade a small measure of privacy for a small rise in security. This production process is driven by a variety of internal and external sources beyond the conflicting internal characteristics of security and privacy. These include; the nature of fear and risk, pressure by politicians and police, the availability of funding, push by the security industry, and public support for these technologies. These factors operate together to ensure a fertile environment exists for the research and development processes of the security industry to thrive.

The author concludes his paper with an elaboration and several proposals. I quote it entirely, and added bold emphasis.

6. Complementing individual with collective assessment

By collective assessment I refer to a process whereby the acceptability of a new SOST is determined by assessing its effects in combination with other SOSTs already operational to determine both the necessity of this new entrant and the resultant quantum of proportionality of the new technology was adopted [Footnote 13: Being the proportionality of all operating SOSTs, including the proposed technology being assessed, given the security they afford and the resultant infringement of privacy]. This collective approach is not intended as a replacement for existing assessment methodologies which determine the acceptably of each individual technology, rather it would complement them by forming a secondary assessment step. Hence if the technology is individually unacceptable it would be rejected outright without the need for collective assessment.

Any adoption of a collective assessment methodology for the purpose of retaining privacy would be premised on a number of requirements. Firstly it requires citizens (or at least the majority) not wanting to actually live in a surveillance society where their physical, communication, location, and personal data is routinely collected and/or processed so as to maximise their individual and collective security. This position entails the concomitant acceptance of insecurity as the natural condition; i.e. the conscious understanding and acceptance that absolute security can never be achieved regardless of how many security measures are introduced. This also needs to be coupled with an appreciation of the value of other rights and freedoms (besides security) to temper the temptation to introduce ever more SOSTs. I must stress here that this desire by citizens to oppose a total surveillance society is by no means given. Privacy and security are social constructs; the different weights assigned to them exist differently across societies, are contextual, and change over time [Solove, D. 2009: Understanding Privacy, Ch.3]. It is completely conceivable that a given society at a given time and/or under given circumstances, may desire to live in a surveillance society. At this point they may still wish to adopt a collective assessment methodology for the purpose of identifying areas of social existence requiring additional surveillance as opposed to the purpose of preserving privacy.

Secondly, collective assessment requires a general acceptance that privacy has to be retained; that once privacy levels are reduced to a certain level, any further reductions cannot be justified regardless of the competing right. If this consensus does not exist (regardless of where these levels are set) then the total surveillance society envisioned within my paper will occur. If there is nothing within the act of living within a society that most/many citizens believe should remain off limits to surveillance, then this view represents tacit approval for a total surveillance society; if nothing is off-limits then everything becomes a valid target.

On the assumption however that a society wishes to preserve a certain level of privacy, this could conceivably be achieved through different methods and protections. I have set out three below which could operate either individually or in combination.

The first option is to designate certain objects as prima facie ‘off-limits’ to surveillance. This could include; certain geographical locations (individual homes, wider community spaces, streets, work-spaces, etc.), certain data (geographical, communication, internet, etc.), and/or certain physical actions (correspondence, physical interactions, etc.). In the event of reasonable suspicion that an individual is committing offences within one of these restricted areas a surveillance warrant could be issued by a judge.

The second option is to ban certain actions by law enforcement agencies. This might include:

  • any form of stop-and-search without reasonable suspicion (and suspicion could not be inferred simply because somebody is physically present within a certain geographical location[Footnote 14: Thus requiring a repeal of Section 44 UK Terrorism Act 2000]);
  • any form of data-mining where it either equates to a fishing expedition or where if the data being sifted was not digitally available a warrant would be required to gain access to it;
  • and prosecutions based on targeted surveillance where no prior reasonable suspicion existed justifying that surveillance.

A third option is to use citizen juries in conjunction with political and/or judicial bodies to monitor and limit the current surveillance options available to law enforcement agencies within a society. They would be afforded complete oversight such that only SOSTs and measures approved by these bodies would be lawful. No surveillance, or prosecution based on surveillance, outside of these designated limits would be permissible.

There are challenges with all these options, with each raising difficult questions. On the idea of setting surveillance limits, who would decide where these limits are set and how would they go about doing this? How easy would it be to modify these limits, and under what circumstances would this occur? On the option of fettering the activities of law enforcement agencies, how would this be policed and what would happen if officers discovered information pertaining to a crime whilst themselves engaging in illegal surveillance activities? And on the option of citizen juries, how would these be empanelled, who could sit on them, and what oversight would exist?

The presence of such challenges does not automatically negate the viability of any of these options. This is merely an acknowledgement that any method adopted should be done so with caution and considerable foresight. That said, the ideas set out above are achievable for they reflect values and norms that are currently observable within UK society. Despite the preoccupation with security leading to the spread of SOSTs throughout society, both UK citizens and their government still protect certain areas from interference and consider certain actions unacceptable. The home and bedroom are still somewhat protected from intrusion in that police are not (yet) allowed to randomly enter homes to search for evidence of crimes without prior suspicion or evidence of an offence. Written and oral communication between suspects or prisoners with their legal representatives is still largely protected, and the use of torture is thankfully still considered beyond the pale for the majority of citizens. And yet all of these actions have the potential to uncover evidence of criminal offences.

These examples show UK citizens are not yet willing to sacrifice every concomitant right on the altar of security, and while this holds true the opportunity remains to introduce measures for protecting privacy and scaling back the surveillance society. Collective assessment is a step down this path in that it makes explicit the current overall balance between security and privacy, thereby raising citizen awareness of the state of their society. Nevertheless, if privacy is valued at least as much as security is valued then this collective assessment needs to be backed up with protection measures such as those outlined above. Without these measures any such assessment is merely an exercise in collecting and collating information. It will tell us how far away we are from the oncoming train that is the absolute surveillance society without affording us the wherewithal to change its direction before we find ourselves forever wedged firmly under its wheels.

Jeroen van der Ham (Twitter: @1sand0s), a former colleague of mine, shares his criticism of Mitchener-Nissen’s article (my translation, switching to American English):

In the definition Mitchener-Nissen uses for “privacy”, he attempts to make privacy expressible on a scale, where I think that is not possible. His definition of privacy is also limited by only looking how it relates to security, while many security measures do not have to stand in the way of privacy, and it is one-sided not to take that into consideration. Furthermore, privacy is subjective, and bound to time and context. What we do and share on the internet today, still feels like sufficient privacy, but 50 years ago everyone would be out on the streets trying to stop it.

The approach that he proposes does not completely follow from his arguments. In addition, I think the solutions he proposes are not very promising, or redundant. By the European Convention on Human Rights we already have certain things that are clearly off-limits; we do not need additional legislation for that. To me it also seems totally infeasible to restrict certain things as completely off-limits. We are likely to always have an intelligence agency that can look at certain things, but with the right safeguards. That same applies to police having an injunction granted by a court.

Lastly, I also doubt whether the current assessment of new measures do not already take into account the context of existing measures. Perhaps currently the right knowledge and science exists to determine the real impact of various measures in conjunction. But I do not see him argue that.

EOF

New Dutch intelligence oversight report: the (il)legality of SIGINT carried out by the AIVD in 2012-2013

On October 7th 2014, the Dutch Review Committee on the Intelligence and Security Services (CTIVD) published a new oversight report (.pdf, in Dutch) concerning the use of intercept powers by the Dutch General Intelligence & Security Service (AIVD) between August 2012 and September 2013. The AIVD has two interception powers: first, Article 25 Wiv2002 permits the AIVD to specify an individual or organization and, after Ministerial approval, carry out targeted interception (e.g. internet tap, phone tap, microphone). Second, Article 26 Wiv2002 and Article 27 Wiv2002 permit the AIVD to intercept non-cablebound communications (such as satellite and HF radio) in bulk and, after Ministerial approval, select data from it using telecommunication characteristics (e.g. phone number, fax number, email address, IP address; called “selectors” hereafter). Article 26/27 Wiv2002 are informally referred to as “sigint powers”; Article 25 Wiv2002 is not, and neither is hacking ex Article 24 Wiv2002.

Similar to previous oversight reports concerning Article 25 Wiv2002 (targeted interception), the new oversight report confirms that the AIVD generally uses Article 25 Wiv2002 (targeted interception) carefully and heedfully (in a legal sense, as evaluated within the framework of Dutch law). In individual cases, issues exist that the CTIVD states to be careless or illegal; for instance cases where privileged persons are tapped (lawyers, doctors).

Similar to previous oversight reports concerning Article 27 Wiv2002 (sigint selection by keywords, by identity of person or organization, and/or by telecommunication characteristics), the new oversight report confirms that the AIVD often acts careless (in the legal sense), and that the legally required motivation for the use of the power (necessity, proportionally, subsidiarity) is often insufficient. Strangely, up to 2013, the CTIVD systematically withheld itself from judging such practices to be illegal, even though the practice obviously did not comply with the law: proper motivation is a legal requirement, and that requirement has largely not been met for years.

Because of this, in November 2013 I stated that sigint oversight in the Netherlands is broken. Taking into account the developments concerning a possible extension of the sigint powers such that the AIVD can also carry out sigint on cablebound communications (think of GCHQ’s Tempora, NSA’s DANCINGOASIS and BND’s cooperation in the Eikonal program), this is a very serious issue. And at least as important as the issues concerning (il)legality of the acquisition of intelligence from of social media in 2011-2014 through hacking, human sources and exchange with foreign agencies: at least in nearly all those cases the CTIVD found that the activities met the requirement of necessity (though not necessarily also the requirements of proportionality and subsidiarity). As of June 15th 2014, all hacking and sigint is formally carried out by the Joint Sigint Cyber Unit.

As of January 1st 2014, two out of the three committee positions within the CTIVD are held by new persons. Former Chairman of Attorneys General Harm Brouwer replaced Bert van Delden as chair, and former Rotterdam police chief Aad Meijboom replaced Eppo van Hoorn, who resigned in Q3/2013. The third person is formerpublic prosecutor Liesbeth Horstink-Von Meyenfeld: she joined in 2009, and will be legally required to resign or be reappointed in 2015. (After an insanely complex selection process, a position is filled by Royal Decree for a six year period, and members can be reappointed once.) As shown below, the “new” CTIVD has turned out to be willing to conclude that lack of legally required motivation constitutes illegality. This seemingly changed standpoint solves one part of the oversight problem. The next question is: does the practice change in reality? This remains to be seen; the CTIVD itself has no formal means to intervene with AIVD activities. This is left up to the Minister, who typically defends the AIVD and who probably doesn’t spend a lot of time critically assessing the request for permission to interception, and to the Parliament, which historically showed scarce interest in intelligence — this has only slightly changed since Snowden.

Interestingly, the CTIVD decided to disclose statistics concerning the use of Article 25 Wiv2002 and Article 27 Wiv2002 in the report, and the Minister of the Interior chose to censored the statistics in the final publication. This is basically offending the CTIVD. Dutch readers should read this and this. I suggest that the CTIVD in response initiates an investigation into the use of Article 27 Wiv2002 to select by keywords. No oversight report is yet available that addresses this in length. The Minister of the Interior annually approves a list of topics for sigint selection by keywords; the keywords are then chosen by the AIVD itself. One always wonders about the dynamics of keyword-based surveillance. For instance, whether the keywords are limited to, say, export-controlled chemicals, or that the AIVD also selects using general keywords (“bomb”); and also, what the thresholds and conditions are for someone (e.g. an activist) to become a person of interest to the AIVD’s a-task (National Security) or d-task (Foreign Intelligence).

The remainder of this post is a translation of the part of the new oversight report that specifically addresses sigint selection ex Article 27 Wiv2002:

WARNING: this is an unofficial translation

12 Usage of the power to select sigint

12.1 Introduction

A request for approval for the use of the power to select sigint consists of two parts. First, the motivation for using the power. This details the specific investigation within which the power is used, and needs to discuss aspects of necessity, proportionality and subsidiarity. Second, the motivation has an appendix that lists the telecommunication characteristics (hereafter: list of selectors). The list of selectors describes the telecommunication characteristics that will be used as selectors (for instance, name of person or organization, phone numbers, email addresses). In the list of selectors, a column is included with a (very) brief description of the reason the selector is included. This description can also be a reference to the AIVD’s internal information system. The list of selectors is sent to the Minister of the Interior for approval, together with a summary of the motivation. Similar to the use of the interception power [ex Article 25 Wiv2002], approval can be given for a period of up to three months. The CTIVD has examined both the motivation of the use of the power to select sigint, and the (justification for the) list of selectors.

12.2 Selection of sigint in previous oversight reports

In oversight report 19, the CTIVD found that the AIVD did not deal with sigint selection in a careful manner. Often it was not explained whom the numbers and other telecommunication characteristics belong to, or why this telecommunication needed to be selected. The CTIVD concluded that it had insufficient knowledge about the motivation of the selection, and thereby could not judge whether the power was used in a legal manner in accordance with Article 27 Wiv2002. The CTIVD urgently recommended that requests for the use or for the extension of the use the sigint selection power should include a specific motivation. The Minister of the Interior responded by stating he agreed with the CTIVD, but also expressed worries about the practical feasibility of that recommendation. The Minister agreed to further consult with the CTIVD on this matter.

In oversight report 26, concerning the AIVD’s foreign intelligence task, the CTIVD found that in the application of Article 27 Wiv2002 for foreign intelligence purposes, in many cases it still was not specified whom a characteristic belonged to and why it is important to selection the information that can be acquired through this specific characteristic. The CTIVD did notice, however, that once sigint operations ran for a longer period, the AIVD was better able to explain whom telecommunication characteristics belong to, and could better argue why the use of the power was justified against these persons. The CTIVD emphasized that the AIVD seriously must strive to better specify against which person or organization sigint is used.

In oversight report 28, concerning the use of sigint by the Military Intelligence & Security Service (MIVD), the CTIVD has further elaborated the legal framework for the entire procedure of the processing of sigint. In that report the CTIVD once again concluded, this time concerning the MIVD, that it could not judge whether the use of sigint was legal in accordance with Article 27 Wiv2002 because the CTIVD had insufficient knowledge about the motivation. In oversight report 38, the CTIVD repeated her earlier findings.

In oversight report 35, the CTIVD has examined one specific operation that involved selection of sigint, and judged aspects of to be illegal.

The current investigation constitutes the first time since oversight report 19 that the CTIVD has assessed the legality of the use of sigint selection in general concerning the AIVD.

12.3 Search for the purpose of selection in previous oversight reports

In certain cases the AIVD uses its sigint search power [ex Article 26 Wiv2002] prior to sigint selection [ex Article 27 Wiv2002]. The AIVD hereby aims to identify whether a relevant person of interest is present within the communication intercepted in bulk. In this case, the AIVD attempts to establish the identity of the person, and whether a relation exists to the field of investigation. This constitutes search for the purpose of selection. The use of sigint search supports better targeted sigint selection.

In oversight report 28, the CTIVD described the practice of sigint search by the MIVD, and in oversight report 38 the CTIVD repeated its conclusions. The CTIVD distinguishes three forms of search aimed at selection, that involve taking note of the contents of communication. In short, this involved the following forms:

  1. Searching bulk intercepts to determine whether Ministerially approved selectors can in fact generate the desired information;
  2. Searching bulk intercepts to identify or describe potential `targets’;
  3. Searching bulk intercepts for data that, in the context of an anticipated new area of investigation, future selectors can be retrieved from.

In oversight report 28, the CTIVD only found the first form of sigint search for the purpose of sigint selection to be legal, because only that form has safeguards for privacy infringement, that is, through the prior approval of the Minister to use sigint against the person or organization involved. This use of sigint search supports the sigint selection for which permission was obtained. This is necessary because Article 13 of the Dutch Constitution requires authorization by a competent body prior to infringements of phone secrecy and telegraph secrecy. The CTIVD finds the second and third form of search to be illegal, because it has no legal ground, and privacy infringement is not safeguarded by the requirement of Ministerial permission prior to using sigint selection against a person or organization.

The CTIVD left the legislator to consider whether it is necessary that the MIVD (and AIVD) be granted the power to search for the purpose of selection, taking into account the right to privacy. In his response, the Minister of Defense stated that he would cooperate with the Minister of the Interior to establish a future-proof legal framework. During the General Meeting that addressed, among others, oversight report 28, the Minister of Defense stated that he agrees with the CTIVD’s conclusion considering the sigint search power, but that while waiting for the intended change of law, the current practice, for reasons of national security, will continue. In their response to oversight report 38, both Ministers stated that the practice that was found to be illegal, will be taken into account in an intended change of law. During a plenary meeting on eavesdropping by the NSA, that addressed oversight report 38, the Minister of Defense stated that the third form of sigint search has stopped, and repeated that the MIVD continues to carry out the second form of search while waiting for a change of law. In oversight report 38, the CTIVD announced that it will address sigint search by the AIVD in the ongoing investigation into the use of interception power [ex Article 25 Wiv2002] and the power to select sigint [ex Article 27 Wiv2002] by the AIVD.

12.4 Methods of AIVD concerning search for the purpose of selection

The CTIVD has taken notice of an internal method of the AIVD concerning the use of sigint search and sigint selection powers. This method is set out in writing and approved by management. The method provides for the possibility that an operational team examines whether a telecommunication characteristic, such as a phone number or email address, that no Ministerial permission is available for yet, is relevant to the investigation. The method is aimed as establishing the identity of the communicating party associated with this telecommunication characteristic. The CTIVD noticed that the AIVD interprets the identification of the communicating party in a broader sense than only establishing the name of the involved party. The AIVD also assesses whether the party is relevant for the investigation carried out by the operational team. One can think of establishing that a person has a certain function, relevant to the investigation, within an organization.

The department that facilitaties bulk interception, can at the request of, and in cooperation with, the operational team carry out a metadata analysis to determine how the telecommunication characteristics relates to other persons and organizations that are included in the investigation (who/what has contact with who, how long, how often, from what location, etc.). To establish the identity of the communication parties and determine their relevancy for the AIVD’s investigation, it can be necessary to also take note of the contents of communication. The possibility is then offered to examine the nature of the communication that has already been intercepted. This can involve stored bulk intercepts for which no Ministerial permission has yet been obtained to select from. It can also involve communication that has been previously selected from the bulk, and is thus already accessible by the team; or information that is in the possession of the AIVD through other (special) powers, such as hacking or acquisition of a database.

The team’s data processor is given the opportunity to briefly see (or hear) the contents of the communication that can be related to the telecommunication characteristic to determine whether the telecommunication characteristic is relevant. This allows the team to determine whether it is useful to obtain permission and include the telecommunication characteristic on the list of selectors so that the communications can be fully known to the team. The CTIVD understood that not all teams use this method equally.

According to the AIVD’s internal policy, it is not intended that the processor exploits the information obtained without obtaining permission from the Minister.

The CTIVD depicts this method as follows.

AIVD  sigint method in practice

12.5 Assessment of the methods

The CTIVD considers the question whether the AIVD’s method is legal.

Insofar the method is used concerning telecommunication characteristics that Ministerial permissions was obtained for, the CTIVD finds the method to be legal, because the privacy infringement is safeguarded by the Minister’s permission. The CTIVD also considers this method legal concerning the MIVD.

The CTIVD finds the AIVD’s method, insofar it concerns telecommunication characteristics that the Minister has not yet approved, is equivalent to the second form of sigint search described in section 12.3. The CTIVD thus concludes that this method is illegal.

This conclusion will be upheld as long as the anticipated legislation does not yet exist.

The CTIVD notes that the Minister of Defense, under the announcement of an intended change of law – in consultation with Parliament – stated that the MIVD’s practice will continue. Although the Minister of Defense only mentioned the MIVD, the CTIVD notes that the AIVD, that applies the same method, awaiting a change of law, also continues with this practice. Now that this is the current practice, the CTIVD considers it to be important to evaluate the compatibility between the practice and the right to privacy.

The CTIVD notes that the AIVD uses this method for the purpose of carefully establishing of list of selectors, and avoid that unnecessary permissions are requested. The CTIVD recognizes that the described method can support this. Moreover, the CTIVD can conceive of the possibility that this also supports implementation of the previous recommendation to improve the motivation of sigint selection. The CTIVD also expects that this could result in fewer infringement on the right to privacy, because the pre-investigation allows a more targeted use of sigint.

The right to privacy requires that the following safeguards are present:

  1. The only purpose of briefly peruse the contents of communication can be the determination of the identity of communicating parties and the relevance of the communication to the ongoing investigation. Other use of is not permitted until permission has been obtained from the Minister. A requirement for briefly peruse of contents of communication is that an adequate separation of duties exists between the department that facilitates bulk interception and the operational team, in that sense that the operational does not itself obtain access to the communication.
  2. To ensure this separation of duties, it is important to provide an adequate written registration and reporting of having peruses the communication. It must be recorded what communication has been seen/heard, and what the outcome was. The CTIVD consides this registration and reporting to be important for internal accountability and external control, as well as for carefulness.

The CTIVD notes that the second safeguard is currently insufficiently implemented by the AIVD. The CTIVD notes that insufficient reporting is performed on what communication has been seen/heard and what the outcome was.

12.6 Usage of the sigint selection power

The CTIVD has examined the AIVD operations that between September 2012 and August 2013 involved the use of sigint selection. Concerning the examined operations, the CTIVD has several remarks. Insofar necessary this is elaborated on in the classified appendix.

The CTIVD finds that sigint selection is used in varying ways by the various operational teams of the AIVD. Specifically, a difference is seen between the teams of the National Security unit and the teams of the Foreign Intelligence unit. The use of this power by Foreign Intelligence teams is generally broader, as can be observed in the size of the list of selectors. The operations of the National Security teams are largely more targeted. Considering that the legal definition of the a-task [National Security] is focussed on individual persons and organizations, and the d-task [Foreign Intelligence] provides for carrying out investigations on countries, this is not surprising. The CTIVD finds that the lists of selectors vary in size between several selectors to thousands selectors.

The CTIVD notes that for each person or organization that emerges during the investigation, it must be motivated why sigint selection is necessary. In must be stated what the purpose of the sigint selection is within the context of the investigation, and what the grounds are for the expectation that yields of selection will contribute to that purpose. There hence must be a link between the broader investigation that is carried out and the necessity of the selection of communication from the specific person or organization. This is different for every person or organization.

In a request for extension, the yields of the selection and the added value to the investigation must be considered, not in general terms but specific to the person or organization. General statements that the use of the special power contributed to the intelligence need, or resulted in (unspecified) reports, or confirmed current believes, are insufficient. In addition to necessity, a request for permission must state in what way the requirements of proportionality and subsidiarity are met. The CTIVD notes that absence of yields can be a result of the nature of sigint. Communication can possibly not be intercepted because of the range [sic] of the satellite dishes. The CTIVD is of the opinion that it is permissible to uphold [selection by] telecommunication characteristics as long as periodically it is reconsidered whether upholding the characteristics still complies with the legal requirements for the use of the power, and that this consideration is written down. Insofar the selection of certain telecommunication characteristics yielded communication but this communication turned out to be irrelevant, the AIVD must remove the characteristics from the list of selectors that permission is requested for.

The CTIVD finds that the extent to which the motivation for use of the power to select sigint established a framework from which it can be foreseen which persons or organizations are within the scope of the operation, varies from operation to operation. In certain operations it is made clear whom the AIVD is interested in, and the motivation clearly states which persons and organizations are within the scope of the operation. The CTIVD notes that it is important that the motivation provides sufficient clarity about which persons and organizations can be selected, under which conditions, and why. A direct and clear link must exist between the motivation and the persons and organizations that are included in the list of selectors. The CTIVD finds that this link is absent in three operations, or made insufficiently clear by the AIVD. The CTIVD finds this to be illegal. Moreover, the CTIVD finds that in one operation, non-limitative enumeration are used in the motivation. An example of this is the phrase “persons and institutions such as [.], et cetera”. The CTIVD finds this to be illegal.

The CTIVD finds that in two operations, persons or organizations with a special status (e.g. non-targets, sources, occupations that have professional secrecy) were included on the list of selectors, without specific attention being paid on this in the motivation. This CTIVD notes that special categories of persons or organizations must be explicitly mentioned in the motivation if they are included on the list of selectors, and that attention must be paid to the legal requirements of necessity, proportionality and subsidiarity in relation to these telecommunication characteristics. The CTIVD notes that it is not, or insufficiently, apparent what considerations were made concerning these requirements. Considering the special status of these persons or organizations, the CTIVD find this to be illegal. A number of telecommunicatino characteristics are related to a person with whom is being cooperated by the AIVD, and whose interception [ex Article 25 Wiv2002] by the AIVD is found to be illegal by the CTIVD. The CTIVD also finds the sigint selection against this person to be illegal.

The CTIVD finds that in the motivation that the Minister based his approval for, in two cases no attention was paid to the requirements of necessity, proportionality and subsidiarity. In the internal motivation, the AIVD does pay sufficient attention to this. The CTIVD finds this to be careless. Although the AIVD is not required to provide the Minister an exhaustive motivation considering necessity, proportionality and subsidiarity, the CTIVD notes that the permission request must provide sufficient clarity about the considerations to allow the Minister to assess the request.

The CTIVD finds that the AIVD in multiple cases incorrectly explains the requirements of proportionality and subsidiarity. Deliberating on subsidiarity, for instance, in one operation the AIVD stated that sigint selection “could possibly yield change for exchange with other foreign agencies”. In a different operation, it has been stated sigint selection allows the AIVD to “carry out investigations in a relatively simple and efficient manner, involving limited risks”. The CTIVD notes that this does not constitute a correct deliberation in terms of the requirements of proportionality and subsidiarity. Correct deliberation on proportionality implies, after all, a deliberation on interests that explicitly involves the interests of the target. This also applies to the requirement of subsidiarity, on the basis of which the AIVD is required to use the means that are least infringing on rights. The CTIVD finds that the outcome of this deliberation can result in the AIVD having to use an inefficient and relatively complex means. The CTIVD did not find evidence that indicates that the operations involved do not meet these requirements. The CTIVD thereby finds that the motivation by the AIVD is lacking and thus careless, but not illegal.

The way in which the list of selectors is structured, varies from team to team. The list of selectors includes a (very) brief motivation of why the characteristic is included. The CTIVD finds that the motivation in various operations is done in very different ways. The CTIVD observed cases in which the list of selectors refers to an internal document of the AIVD that explains the relevance of the characteristic to the operation. In addition, the CTIVD observed cases in which a short explanation of the relevance is included. In one operation, the motivation does not include more than a brief indication of the function of the person, or other indications of the characteristic. This indication can comprise a single word (e.g. biologist, toxicologist, phone number, fax). The CTIVD finds this method of motivation, that only includes a single word and no further explanation, to be illegal. The CTIVD notes that the latter cases are insufficiently traceable to the motivation of the request for permission, and that the framework must be included in that. The CTIVD notes that concerning every characteristic, at least the relevance of the characteristic must be (briefly) included in the list of selectors, and where necessary, a clear reference must be included (to an internal document) on the basis of which the relevance of the characteristic can be further assessed.

The CTIVD finds that in a certain list of selectors, multiple telecommunication characteristics have been included with the remark that these “probably” belong to a person that the Minister has approved sigint selection for. The CTIVD notes that the use of the first form of sigint search, as described in section 12.3, could help limit the characteristics included of the list of selectors to characteristics that the AIVD has determined could actually be related the person of interest.

The CTIVD finds that the list of selectors in certain operations has substantially increased over time. In one operation, the CTIVD observed telecommunication characteristics that were obtained through legal use of a different special power (such as phone numbers or email addresses). The CTIVD finds that all these characteristics where used for sigint selection by the AIVD. In nearly all cases, it was not indicated whom the number belongs to are what the specific relevance is. In fact the only link to the AIVD investigation was the circumstance that the persons associated with the characteristics have contacted a person of interest to the AIVD, without any indication of the nature of the contact or other relevant clues. The CTIVD notes that the mere contact with a person of interest, without the relevance of this contact to the AIVD’s investigation, is insufficient justification for including it in the list of selectors. The CTIVD considers it the be likely that it is possible to use less infringing means to determine what contacts are evidently irrelevant. The CTIVD thus finds the selection based on these telecommunication characteristics to be illegal.

EOF

Dutch Hosting Provider Association (DHPA) opposes Dutch govt’s sort-of-voluntary internet censorship plan

In August 2014, the Dutch government proposed a 38 step action plan (.pdf, in Dutch) to fight jihadism. As explained here, the proposal included voluntary cooperation-based internet censorship with the purpose of reducing jihadist use of the internet. Today, the Dutch Hosting Provider Association (DHPA / @stichtingDHPA) posted a press release explaining that it, representing its members, opposes the current proposal. Here is my translation of that press release:

Dutch Internet industry and Ministry of Justice collide over fight against jihadism

Law enforcement agencies increasingly force internet companies to remove radicalizing content without court order. This leads to an impossible situation, says Michiel Steltman, director of the Dutch Hosting Provider Association (DHPA), on behalf of the internet sector. ‘Does the government want to force companies, for instance, to include jihadism in the general conditions? And how does a hoster decide what content is undesirable?’

According to the companies, the underlying problem is that the Public Prosecution does not judge many of the suspicions of the Ministry of Justice as criminal, and because of that reason refuses to prosecute, meaning that no judicial review takes place. If the Ministry of Justice still believes that the videos or documents must be removed, no other option remains than to pressure companies into complying with the request. But they say they can’t and won’t judge if something is a criminal offense.

Not a censorship agency

Steltman mentions the recent example of a group of shooting men around a campfire shouting ‘allahu ahkbar’, with some lines in Arabic. ‘Did they just kill someone, are they made because someone was killed, or are they having a party and has a goat just been slaughtered’?

In addition, Alex de Joode, company lawyer Government affairs at Leaseweb, the largest business hosting provider of the Netherlands, does not like the methods of the Ministry of Justice: ‘We are not an age verification or censorship agency. The government has a fine legal instrument to remove content, but chooses to not use that in alleged jihadism’.

Pay damages

The sector is afraid of being held responsible by eventual victims. De Joode: ‘suppose that we are wrong and illegally take down a site without a court order. That can cause us a lot of damage.’

Ever more internet companies disclose the number of demands by law enforcement agencies, including Xs4all and Leaseweb. In the US, mostly Google set this trend, following by companies such as Microsoft and Twitter.

Responsibility of companies

Dick Schoof, National Coordinator Counterterrorism and Security (NCTV), considers it to be a responsibility of companies to, ‘on the basis of interpretation by the NCTV, assess the content of the website against their own general conditions. Hereby we appeal to the responsibility of the providers.’

Steltman emphasizes that internet companies are willing to establish better procedures in cooperation with the Ministry of Justice. Schoof describes the ‘currently ongoing conversation with internet companies and social media companies as very constructive’.

EOF