90-year-old Cryptanalytic Efforts Must Stay Secret, says NSA | Hacker News Reader

90-year-old Cryptanalytic Efforts Must Stay Secret, says NSA

nsarchive.wordpress.com

198 pointswolframio82 comments

It's easy to imagine scenarios where this continued classification could be appropriate. Remember, classification doesn't just attach to facts; it also attaches to how that information was obtained.

If, for example, the censored paragraph was "a US agent placed within the Soviet Communist Party participated in the design of Soviet ciphers and deliberately weakened them", and that agent continued working in the USSR for several decades, then it could only be declassified if everything that agent had ever been involved with was no longer sensitive.

Perhaps but it's far easier to imagine it's the result of knee jerk over classification which is well understood to be a terrible problem through the organs of the body politic.

"Perhaps but it's far easier to imagine it's the result of knee jerk over classification which is well understood to be a terrible problem through the organs of the body politic."

It's the NSA. It's espionage.

These things tend to be classified by default.

So, I'm not suspicious it's some arbitrary thing, like the type of ham sandwiches agent Boy Scout was eating.

>These things tend to be classified by default.

"Classified by default" is semantically equivalent to "knee-jerk reaction". Nobody is claiming it's arbitrary. The claim is instead that it's systematic, and stupidly so to the point where it may well be the type of ham sandwiches agent Boy Scout was eating. Wouldn't be the first time...

I'd call it "a matter of principle" rather than "knee-jerk reaction".

There are more important principles. Needs of the many; for example.

And you'd be arguing semantics.

It's "classified by default" out of concern for a certain principle, ergo the act of classification is applied in a knee-jerk (i.e. thoughtless, reflexive) manner.

Semantic argument is semantic.

In my opinion, "classified by default" is not a thoughtless, reflexive policy when discussing espionage and counter-espionage work. It's a principle that you'll come up with after pondering the risks and benefits of other processes.

As a concept, it's similar to policies in corporate offices where doors are locked and guests can only walk in through a reception, accompanied by a trusted employee. Yes, you're applying a process that is unnecessary in 95 % of cases, but still it's one of the "best practices" in the business.

I didn't say it was. I said it precipitates the act of reflexive classification by the body politic of whatever three-letter agency we're talking about.

The process is as follows:

1) Rational, principled decision: "when in doubt, classify"

2) Conservative application: "I'll just classify everything to avoid 'misses'"

3) Everything gets classified because nobody ever got fired for classifying

Treat it as a signal detection problem. There's obvious incentive to avoid "misses" (i.e. not classifying things that should be classified) so people produce many false alarms (i.e. classifying things that should be public knowledge).

This hi-lights a problem with current doctrine: "classify by default" has unintended consequences, namely a creeping increase in non-transparency.

Further, and returning to the original point: since reflexive classification happens as a result of official doctrine, the two are semantically equivalent and this discussion is officially running around in circles.

Normally I lean towards the more cynical viewpoint with these matters. But I think you're right here, only in that the records still exist and are very old.

So you're saying that a 91 year old (I'm being conservative in assuming your hypothetical agent was at least one years old at the time of their mission) is a good reason to maintain the classification of state secrets that have most assuredly out-lived anyone else involved?

That 91 year old also likely had family, colleagues and other acquaintances who are still alive today. People at some distance from the 91 year old would be okay, but closer would be under suspicion, could have their lives disrupted, be deported etc.

Exactly and in the UK military (or military like structure), it's easy to get in if you have relatives in.

Also, just because the originator may be dead, it doesn't mean the work won't have knock on effects.

And finding a hole in security for old material may trigger a search through all newer ciphers - something I'm sure they don't want.

There are plenty of reasons, correct or not, why they may wish to keep this a secret.

If the methods were still in use, they might be, even if the agents were not. For example, that secret ink they give as an example might still be in use.

That said, there's plenty of reason to believe that some of the things they're still withholding are nonsense.

The statement is that that person could have also subverted other methods currently in use, not that that particular person would be impacted.

Methods from the pre-computer era, from well before the second world war, still in use nearly 100 years later? Is that really plausible?

Scenario: In 1925 an agent is deployed to Russia, infiltrates an intelligence agency, and does something cryptologically noteworthy. It is mentioned in this 'top secret umbra' document. In 1955, said agent, while still acting covertly in Russia, makes further cryptologic "contributions" to Russian intelligence agencies. In 1975 the ciphers from 1955 are still in use, and the USA intercepts information and identifies Soviet spies. In 1995, the USA feeds misleading information to those formerly Soviet spies. In 2016, the USA still cares about the misinformation provided in 1995 to spies identified in 1975 thanks to ciphers from 1955 which were broken by a long-dead agent who started work in 1925.

Seems plausible enough to me.

Now that's a great scenario! There's actually convoluted stuff like that in the non-fiction. They're also still trying to misdirect people on stuff decades old to justify current positions.

Plus it causes the Russians to continue to view others from the time period with possible suspicion. They can't go "oh, that happened 75 years ago and the Anericans have said nothing about it so we must be able to trust that guy and his work"

No the agent that did something 90 years ago, was still there and did something 60 years ago. Which influenced something 30 years ago, which led to something 5 years ago and is still in use.

It's a stretch, but there could be a chain of events that they want to remain hidden. They don't want to hide what happened 90 years ago, they want to hide who did it and what else he may have done in the future or had an effect on.

Okay I can buy that type of scenario. Something along the lines of cperciva's sibling comment. This could be such a case. But I still think it's a stretch. I wonder if they ever redact random things just to distract.

Yep one time pads are still in use and those where invented way before ww1

Hypothetical timeline: An agent born in 1904 tainted a Soviet cipher in 1926. That agent then recruited other assets before retiring in 1973. Unlikely? Sure. Outlandish? Nah.

More like that that agent, if they were involved in this 90-year-old crypto action, may later have been involved in something else (a mole in the Russian nuclear program, say) in such a way that their exposure as an American agent would compromise the result of that other thing as well (in my hypothetical example, maybe they'd embedded a remote kill switch in all Russian nuclear ICBMs, which would still be there today).

Or they just had a protege, another American agent. Think starting a 'dynasty'.

yes because you want your Intelligence officers to be able to say to agents they are recruiting today that we will look after you

I wonder if it's a chain of secrets which leads to the present day? It would seem unlikely there'd be that long a continuity, but I don't know.

Yeah no this is knee jerk laziness on the part of the NSA. Snowden has probably already put everyone who could be into harms way.

> It's easy to imagine scenarios

Except, in the government's case, they are imagining scenarios for me, and my family, and my friends, etc. Their job is to protect us, not speculate wildly FOR us. We didn't elect them to do that, and it's not their job.

If someone is sitting there speaking for my speculations, I'd sure as shit like to know they aren't going to be doing it more than generationally. That's terribly concerning.

I'm not suggesting that they're sitting around speculating about possible scenarios. To the contrary, they know the exact details of why they decided to keep this paragraph classified.

My point is that since there are readily imaginable scenarios where it would be necessary to keep this classified, we shouldn't be sitting here accusing them of keeping secrets just for the sake of keeping secrets. The fact that we don't know why it should be kept secret doesn't imply that they don't have a good reason.

In fact, if we did know why it should be kept secret, then it wouldn't really be secret anymore!

> The fact that we don't know why it should be kept secret doesn't imply that they don't have a good reason.

True, but when Tom Blanton comes out and agrees that "90 percent" of it doesn't need to be classified, that more than implies they don't have a good reason.

Actually you said "imagine scenarios" which is basically visualizing scenarios that might happen. That's speculation, pure and simple, given the "screen" they are running these on are internal to the people running them.

"Readily imaginable" is just blaming based on prior history of the one being blamed. In some cases, the expansion of who can be blamed is easier than the not blaming part. Unfortunate.

And, FWIW, I'm not disagreeing with you here. Just trying to get us out of the knee deep rationalization pit of shit that is the government.

Democracy dies behind closed doors.

Any supposed advantage we gain by spending our resources and credibility flooding the world with spies is far less then what we lose by having our society, our rights, and our freedoms completely subverted by the primacy of "national security".

You are all over thinking this. It was almost certainly just a mistake. Very few things unrelated to current day-to-day operations need to be secret.

No one (well, almost no one) ever got fired keeping something confidential. Agencies always get referred to as "The NSA" or something, as if the collective consciousness of everyone working there should be merged.

Let's replace "The NSA" with "Joe, who happens to work at the NSA, doing a spot check".

Joe, who happens to work at the NSA, while doing a spot check decides to keep redactions in 20-year-old document confidential doesn't sound like as much of a headline, though.

The very ordinariness of the institutionalised bias against declassification and its predictable result of large numbers of things remaining unnecessarily classified is the whole point.

Point, but there is generally a specific timeframe for documents to combat that tendency. Usually ~25 years. The document in question here is only 20 years old, even if the information it references is older.

I thought anything written past 72 year should ago is declassified? Or is that just for the census?

In government and other large bureaucracies, it's difficult to get into trouble because even a half witted person can deflect blame around to make it difficult to actually censure anyone.

With stuff like this or filling out time sheets/expense reports, it's really clear cut. Employee X signed the form to declassify document Y.

Since people in charge of bureaucracies like to figuratively torture and execute bearers of bad news, it's easier to err on the side of inaction.

Government agencies should be held responsible for the actions of their members. All kinds of bad things happen if they're not.

It cuts both ways:

And bosses should be held responsible for the actions of their companies / agencies. All kinds of bad things happen if they're not.

They should, yes. Are you saying those are mutually exclusive?

This seems like a good thread to ask this: is there any way to find out if a document has been declassified? I ask this because I came into possession of a document from 1945 which is marked classified (it is a prototype computer user manual) and I would like to make sure that it is actually declassified. If it isn't, then even asking about it seems... problematic. I expect that it would be, but with the amount of overclassification that occurs, I can't bet on it.

At some point I'd love to donate it to the ACM museum or something, but I don't want to get in trouble over a historical document, so I'm just keeping it for now.

It looks like they redid classification markings in 2006, so what I thought I knew (and likely the same for plenty of people here) is probably not applicable. In particular, there's a release date now, or a statement saying how the declassification is handled.

Here's the newer instruction so you can see if any of it is applicable to what you found: https://www.fas.org/sgp/othergov/dod/af053006.pdf

I one time saw a story on 60 Minutes many years ago that was either about the CIA or the NSA. It doesn't really matter. During the interview, the reporter asked what the oldest thing still classified was. It's from World War I, and refers to sources and methods. When pressed that everyone involved is dead, and the former enemies are now allies, the answer came back that it was sources and methods.

Apparently, it's recipe for invisible ink.[0]

[0] http://www.fas.org/sgp/news/jmpoldest.html

I think Vatican archives might have some older classified documents.

On a related note, is anyone familiar with the blank segments on ITAR? I have been puzzling over what they could be reserved for for a few years now.

Could you be more specific? If so, please be.

§120.43 is marked [Reservered]

§120.50 and §120.51 are marked XXX

§121.1 : e-f and j-w after "Note to Paragraph (d)" in Category IV are Reserved

  d and h-w in Category VI are reserved

etc.

[1]https://www.pmddtc.state.gov/regulations_laws/itar.html

Time travel coordinates.

I am confident this is the only reasonable conclusion. Congress being so practical and all...

This blog post is the reason why the NSA or any other government agencies do not want to declassify documents at all.

What the blog post fail to understand is that:

a) Intelligence operations run for years and decades, you wouldn't be hard pressed to find 5 documents over a period of 90 years which are cross referenced / linked by CODEWORD level programmes. So if this document was referring "SPRING CRICKET" which references "SPRINGROLL" which references "CHINATOWN" which references "BOUNCY CASTLE" which might reference "PRISM" for all we know. You don't give people bread crumbs.

b) Intelligence operations involve human assets, even if it was in the 1920's it can still have human assets who are alive or their descendants, and it doesn't have to be a US agent, it could be some soviet mathematician who passed information to the US (willingly or not) that has living descendants in modern day Russia and there is absolutely no reason to colossally fuck up their lives today by revealing that fact.

Declassifying information is a very expensive process you need to do a full impact analysis on every word in every paragraph and cross reference it with any other materials that are revealed, considering the age of these documents many of them might not be digitized which makes this process even more expensive and time consuming.

Beyond that once a document is set for release a very expensive process of document recovery is kicked off, all copies and revisions of the document must be collected to ensure that no revisions other than the approved for declassification and no unredacted copies remain to be found or leaked.

And once you release some document which is redacted if by some coincidence it is missed by the OSINT departments of foreign intelligence agencies some 'BuzzFeed' "reporter" that his next meal of cup ramen noodles is dependant on his daily blogspam quota will dig it up and make a click bait out of it and depending on how sensational they make out to be going to be picked up by some bigger news outlets and by then every counterintelligence outfit will step up their game if only to have a response to this for their next oversight hearing and if they kick their bug sweeps and mole hunts into high gear they might actually find something even it's completely unrelated.

The likelihood of a tool/method/source that has been used in 1925 being relevant today is about zero, the likelihood of them not being able to complete an impact analysis on that paragraph and hence having to redact it or not wanting to get the grandchild of some Russian asset harassed by the FSB the media and the immediate public is considerably more likely.

>> "Details of what was thought to be a Bolshevik code used in Java in 1928"

What a rich history Java has. Wonder if they were developing trusty ol' JavaScript back then too... ;)

Of course, JavaScript has been around for a long time. https://en.m.wikipedia.org/wiki/Javanese_script

I suspect there are psychological reasons for this. Excessive classification projects more power than may actually exist. The longer the redaction lasts, the more credence is lent to vast conspiracy theories: aliens, illuminati, take your pick.

Either way, the message is clear: "don't fuck with us."

That said, the more classified stuff you have the more it will cost you to keep track of. There's literally a dollar cost for classifying information. I'm sure there's a few people at the NSA who would rather use the money spent on storing classified information to circumvent the constitution.

I don't think this is right. I worked in military intelligence and for a civilian agency.

Tons of stuff is classified, sits in a safe for years and years, and eventually just gets shredded. Probably 99.99% of it. There is a cost to declassify documents, but for the mountains of stuff that never gets declassified (because it just goes into the memory black hole) there is no cost.

Honestly I think there is just a CYA mentality to just slap SECRET on documents rather than trying to thread the needle and figure out the exact correct classification. In theory these documents should be classified at the paragraph level, and in that case things like public statements by public figures would be unclassified even if they were a part of a highly classified document.

People will properly classify things if there is some reason to, but day to day it's not trivial to do and in the end nobody sees their goal as 'get the exact right classification on everything' vs 'find a terrorist or figure out what russia is planning'.

Would one be correct in suspecting that many classified documents are operational reports? ISTM there could be personal reasons to keep the public from ever finding out what its agents have done in secret. Look at all the shit we give public servants whose deeds are public, e.g. Robert Moses.

Actually most "classified" documents generated by such agencies are pretty mundane they aren't any different than the tons of BAU paper work produced by any any other corporate/office entity.

We had a joke that each birthday card has to either go to the security office and the personnel office to get stamped [secret] or straight into the shredder. And that's simply because by the time it goes around and everyone sings it you get a list of individuals, any list of individuals according to the regulation counts as a roster, and all rosters are classified.

The cost of classifying documents isn't in keeping them secret as the only cost of that is your storage space, the cost is in the man hours required to go over each line and paragraph and determine if it exposes any classified material, source or method and then classify it accordingly, beyond that you also have the added cost of tracking the dissemination of classified material as distribution and access lists have to be maintained and approved, copies tracked (most importantly tracked down for EOL/recovery) and you also have to do an impact analysis every time you change the classification or declassify it.

So to simplify things you shred everything you don't want to keep and give the highest baseline classification you/your department is operating under to any other document you might want/need to keep for the future regardless if it's an actual intelligence product or a group lunch order.

>The cost of classifying documents isn't in keeping them secret as the only cost of that is your storage space, the cost is in the man hours required to go over each line and paragraph and determine if it exposes any classified material, source or method and then classify it accordingly, beyond that you also have the added cost of tracking the dissemination of classified material as distribution and access lists have to be maintained and approved, copies tracked (most importantly tracked down for EOL/recovery) and you also have to do an impact analysis every time you change the classification or declassify it

This. You have warehouses A, B and C full of documents. Let's assume that B and C are full of birthday cards and stuff that doesn't need to be classified. There's an operational cost to those two warehouses. With classified info it's not just some 12.50/hr security guards and lighting. You have tons more compliance auditing and other policy stuff that pushes up the cost. When some unlikely event finds a bug in your security protocol that results in a revision it costs 3x as much (because you have 3x as much to secure). If it's mixed material there's a huge cost associated with periodically determining what's what. It's no expensive compared to other things but it's a big unnecessary cost. Imagine if FedEx's policy was "employees should be hard on equipment whenever possible". It's not all that expensive compared to employees themselves but broken equipment costs money and slows things down. Classified info is the same way. Stuff should be classified per a "need to classify" standard the same way classified info is shared per a "need to know" standard.

That said, the NSA loves looking for patterns and/or needles in haystacks and may be worried about other organizations doing this to them. It would not surprise me if a lot of the stuff that seemingly needlessly stays classified stays that way to make it harder to build a big picture view. They may see the same kind of scaling problem as the one between non-networked license plate readers on toll booths (few data points, hard to build big picture) networked license plate readers on every police car and traffic light (tons of data points, easy to build accurate picture).

That's an exaggeration it's considerably cheaper to over classify or simply shred any documents that are not needed (or as far as the US goes do not fall under the records act since you can't shred those AFAIK) than to do a full impact analysis and declassify them. Even if you do need to build whole new warehouses and staff them it is still cheaper than allocating the manpower for reviewing each document.

Yes but shredded stuff is lost (for the most part). Digitizing is expensive. It's the typical "the truck is going there anyway so one more item is practically free" problem. If you're very liberal about declassifying stuff then it's cheap. Retroactively declassifying is expensive. The system to handle classified stuff (the truck) already exists so the marginal cost is little even if the system isn't cheap. The savings can't be realized until you figure out a way to get rid of what's already there (everything else on the truck) so just classifying by default is a local maximum.

Regardless, there's much lower hanging fruit when it comes to government inefficiently using $.

Declassifying stuff is never cheap you can't be "liberal" unless you insist on being careless.

When you declassify a document you need to go over every word, check if it related to any source or material that cannot be declassified or ad hoc declassify additional material (which is why many times when there is a FOIA request for a document you can get more than what you ask for) go over every codeword and dig up everything that relates to that and run the same process on that material also. After that once you accepted the declassification you go on a hunt and collect all copies and revisions to ensure that there are no copies other than the final "declassified" one.

Declassifying documents is like pulling a string on a sweater you start pulling it and if end up unraveling the entire thing this is why the often redact whole paragraphs and even pages since the effort is too great and you don't want to risk leaving breadcrumbs. Counter intelligence and OSINT agencies often practice on investigating declassified material and to see if they can gain any "unintended" intelligence from it and often they do and the declassification procedures are updated.

Governments need some level of secrecy to run, the level is dependant on the department and the subject but it secrecy is important none the less, people often don't realize just how many things can easily be screwed up by a tiny leak.

And the price for some misclassification can be high.

"Leaking" small pieces of information that doesn't seem relevant, over time, might help someone construct/discovery something big.

Example,exagerated: person A studies genetic deficiences. Person B studies some new yeast. Person C works as voluntary in vaccination campains in Asia. A "dinner receipt" gets desclassified revealing that now they are working together. A person D, Asian descendant, dies with some new untreatable disease while working with the former 3, and his death is also declassified with more details than necessary...

All these facts with a 10 year span. Could ring some bells, no?

The program to which you refer [0] was a horrible idea. Whoever thought it up, whoever approved it, whoever fucked it up the way they did, all of those people should be fired, rather than resting comfortably in the public blind spot created by exaggerated classification. If a similar fuck-up had been perpetrated by a truly public agency, heads would have long since rolled. The CIA has never accomplished a similar operation and actually kept it secret, so it's clear that all this secrecy is focused on the American public rather than our so-called "enemies". So, thanks for bringing up this example!

[0] http://www.npr.org/sections/thetwo-way/2014/05/20/314231260/...

I would like to point out that WHO vaccination programmes were touted as "CIA/Zionist" conspiracies way before the CIA actually used them.

Polio vaccination in Pakistan is utterly hindered because the "village elders" and the usual suspects spread nonsense that the vaccines were donated by Israel and it's a Zionist propaganda to turn the male population gay and sterile.

Is this meant as some sort of defense of this tawdry stupid CIA bullshit? The fact that a particular vaccination effort faced this particular challenge should have been a reason not to make the situation with respect to the health of poor children worse for no benefit whatsoever. When inbred goat enthusiasts harbor some zany prejudice, it is not CIA's mission to confirm that prejudice.

Potentially classified material gets burned first, and then the ash and smoke go through a shredder before being burned again, with feeling this time.

After that, it gets vented out through at least three different chimneys--with armed guards on each one, to shoot anyone that sniffs too deeply.

All because of something that probably happened in the 80s, when someone was able to recover secret information from a paper document that had been burned in an insecure way. I mean, if the Soviets could eavesdrop on a mechanical typewriter, and all methods and practices are always classified on all sides, how would we ever know whether anyone can use packing tape and a relatively abundant type of medical scanner to read words off a burned page or not?

(the fictional portions of this post are based on an amalgam of true stories)

I would argue that, at least for NSA, there is significant value in having information not improperly over-classified. I used to work at an institution that did research on some NSA projects, and almost no one was willing to touch a project that was all classified to hell. Popping in the SCIF for some background info was all well and good, but no one wanted to spend 40-60 hours a week in an office with short hours, no windows, and no music.

Similarly, there is real tactical advantage to hide the fact that there is nothing interesting behind the curtain. It keeps the enemies guessing. This is why they say "I can neither confirm nor deny..." (Source: a podcast I listened to)

That's the Glomar Response. You're probably thinking of this podcast http://www.radiolab.org/story/confirm-nor-deny/

Also it adds plausible deniability for the times they do have some interesting McGuffin behind said curtain. "Sorry guys, it's just some moth-eaten old folders but gotta follow procedures, ya know..."

As in 'The Art of War': "Appear weak when you are strong, and strong when you are weak."

> reasonably be expected to cause identifiable or describable damage to national security.

So they're holding out for ... indescribable damage? ;)

Essentially, yes. If you can't describe the damage it doesn't count. Isn't that what we want?

I understand. That was the time of the star gate chasm, with those secrets de-classified, the location of the translerion will be revealed, and the wrong candidate will be elected president.

Yeah they don't want to reveal to Red Skull that they've located the Tesseract.

Is this some reference I'm not getting?

Hey at least my goofy words are googleable. "Translerion", that's some top-shelf secret voodoo right there. We're probably all on a very exclusive and soon-to-be very unfortunate list, now.

ad-hoc fiction writing, right here on hacker news! Join in and tell us about your secret base in the Agoricon!

Man that must be one shell of a cipher.

Reply on news.ycombinator.com