C.I.A. Lacing (2014) | Hacker News Reader

C.I.A. Lacing (2014)

fieggen.com

218 pointsscrps89 comments

How covert is staring at someone’s shoes trying to identify slight variations?

Take a picture, it will last longer

I sometimes wonder if FBI and other agencies release fake information so we all look out for them rather than their actual secret methods.

True story : I was devastated to learn that eating carrots for enhancing night vision was a WWII British hoax to confuse the Germans.

I spent the better part of my teenage years eating raw carrots to be a better Ninja!

That's true! To be more specific, the British had just invented the ground interception radar to spot incoming aircraft, and didn't want the Germans to think they had developed a technological solution.

I don't know if they ever thought the myth would catch on as well as it did, but it's still widely believed today. (Perhaps because there's no downside, eating carrots is still good for you, it just doesn't improve your eyesight.)

Additionally, sugar was also heavily rationed, while carrots (which are quite high in sugars) IIRC weren't.

Carrot cake also had a surge in popularity at the time (if the great show "Supersizers eat..." is to believed).

Huh. Didn't know. Proof http://www.carrotmuseum.co.uk/ww2carrots.html

> Decades later rumors swirled that the British Royal Air Force pushed that message as a cover-up for the recently adopted radar technology they were secretly relying on for their nighttime skirmishes.

> whilst the [British] Air Ministry were happy to go along with the story [of carrot-improved vision], they never set out to use it to fool the Germans.

> The German intelligence service were well aware of our ground-based radar installation and would not be surprised by the existence of radar in aircraft. In fact, the RAF were able to confirm the existence of German airborne radar simply by fitting commercial radios into a bomber and flying over France listening to the various radio frequencies!

Link: https://www.scientificamerican.com/article/fact-or-fiction-c...

I wasn't however able to find if there is any reason for the british to push such a message if it wasn't to confuse the germans.

> I wasn't however able to find if there is any reason for the british to push such a message if it wasn't to confuse the germans.

Could it have had something to do with rationing? Perhaps they were trying to increase carrot consumption.

Yep, that's what I thought too, but had no way of confirming it.

It can also be that they wanted citizens to cultivate more of it in their home gardens for its nutritional values. But either way, I have no data to confirm it.

Hell, it could have been a stupid reason. Maybe someone actually thought carrots improved vision; maybe someone just thought it was hilarious to make people thinks that; maybe someone needed another poster to make to meet quota and ran out of ideas; maybe someone had a bet on whether they could get a carrot campaign approved.

Actually carrots are good for your vision, but not your night vision.

You and me both! I mean, I like carrots, so I was eating them as a snack (my preferred method was to get a full carrot, eat around the core, and then eat the sweet core by itself), but I remember thinking whenever I got one "I wonder how much this will end up helping my vision" some day.

They absolutely do. And they might release very good information along with a carefully planted piece of terrible advice. So you might see a tutorial about how to send drugs through the mail that is 99% good advice, and one piece of intentionally bad advice that police officers are currently watching extra carefully. You don't have to get very high up in government to see examples of people planting false information to lead people astray about how things really work.

Probably knew which variations to look for on top of looking for slight hints, while trying to show a lacking sign of confidence by looking down.

If you scroll down to the "CIA Lacing Gallery" you can see that on men's dress shoes the different lacing techniques would be pretty obvious with a quick glance. The laces are either - or X

Direct link to one of the photos: https://www.fieggen.com/Dont_Link/CIALacing1a.jpg

It depends where it happens : if it's a sitting meeting yes it would look strange. But in the street do you even look at passing people shoelaces ?

If you're a spy and one of your assets is passing you a message, then of course you would.

And if that's not the case, you're probably not looking at other people's shoelaces - which is the entire point.

Well, don't stare at them. You know in advance that your contact will be walking down Merriweather Lane at 11:30am. If his shoes sport a single "X" near the bottom, that means the dead drop has the microfilm ready for pickup. If it doesn't have that "X", then try again next Tuesday.

If you see two X's in his lacing, the package is at the alternate drop site.

If he has 3 X patterns, you're burned! Make your way to the safehouse after losing any potential tails.

Glance quickly, agent, and keep moving.

Thanks for explaining like this. It seems from the downvotes to my comment most people don’t see it as a valid question.

Par for the course here. Glad your question was answered, I was curious as well.

This setup reminds me of operation PIMLICO:

> Every Tuesday, shortly after 7:00, a British MI6 officer would take a morning stroll at the Kutuzovsky Prospekt in Moscow. He would pass outside a designated bakery at exactly 7:24 a.m. local time. If he saw Gordievsky standing outside the bakery holding a grocery bag, it meant that the double agent was requesting to be exfiltrated as a matter of urgency. Gordievsky would then have to wait outside the bakery until a second MI6 officer appeared, carrying a bag from the Harrods luxury department store in London. The man would also be carrying a Mars bar (a popular British candy bar) and would bite into it while passing right in front of Gordievsky. That would be a message to him that his request to be exfiltrated had been received.

https://intelnews.org/tag/operation-pimlico/

This seems either unlikely or questionably competent. Gordievsky was well known to the KGB and loitering pointlessly outside a bakery would only have aroused suspicions - which would have been confirmed by the second agent, because anyone carrying a Harrods bag in Soviet Moscow would have stood out like a very obvious person of interest.

It could be a matter of routine: Leave your house at 7:00AM every morning. Walk 15 minutes to the bakery. Order and be out the bakery door by 7:20AM. In normal circumstances, you just leave and go about your day. Only once would you stand around for an extra 4 minutes - say reading a paper, or eating what you just bought. Otherwise it looks like a normal routine.

That was poorly conceived. They'd have to keep those things stored somewhere for as long as the spy was active. What if a rat ate the last Mars bar at 6:00am?

Tell the rats that the Mars bars are off limits and they can stick to the Cadbury chocolates.

Obviously HN always knows better, this reminds me of the Dropbox post.

There's a great book that covers every single aspect of this escape, "The Spy and the Traitor" by Ben Macintyre. Rest assured that the British embassy had plenty of Mars bars and Harrods bags for this signal!

I've read that the embassy folk have nothing to do most of the time so they spend months planning and preparing for this type of thing

I'm sure international spies are competent enough to keep the rats out of their tactical mars bars.

Just read the same in Wikipedia. This is extremely strange. Harrods bag and Mars candy in 1985 Moscow would be a telltale the size of Kremlin tower. Kutuzovsky avenue was a KGB owned turf, lots of Communist apparatchik lived there, including late Secretary General Brezhnev.

It reminds me a joke about Soviet spy arriving in Berlin and caughting stares from everyone around. What's wrong with my cover? Is something gives me out? Maybe it is a parachute? Or AK-47? Ah, it should be blue Slavic eyes! And he wears a sunglasses just in case.

> Harrods bag and Mars candy in 1985 Moscow would be a telltale the size of Kremlin tower. Kutuzovsky avenue was a KGB owned turf, lots of Communist apparatchik lived there, including late Secretary General Brezhnev.

I took it to mean that the MI6 agents were under diplomatic cover. It would not be strange for British diplomats to carry or eat British things, right? And it's also a decent defense against an accidental signal, since non-agents would naturally not have Mars bars nor bags from Harrods.

This is correct. The KGB had several known agents working out of their embassy during the Cold War. Diplomatic cover gave them protection for their activities.

Like I said, Kutuzovsky avenu was (and probably still is) under massive state surveillance. English MI6 agent with diplomatic (under)cover will be spotted in minutes and their engagement and eye contact with highly ranked GRU officer will not pass below radar.

I think choosing a street chock-full of high level Soviet functionaries might have been genius. How many of them would the MI6 agent "interact" with during a walk down the street? Would opening the Mars bar wrapper as he passes some general be the signal? Or the bite in front of the bakery? Or disposing the wrapper? Or the cough as the agent crosses paths with a Soviet diplomat? That's a very high noise floor. I suspect counter-intelligence would never figure it out until long after exfiltration was completed, unless they knew exactly what the signal was.

Now, that makes sense. I didn't think of it.

The whole point of this signalling scheme is to prevent eye contact, or any engagement. To an observer who's unaware of the system, it just looks like a local embassy official out for a stroll. Or doing some other routine thing that a lot of other diplomats also do. Meanwhile, Gordievsky is probably never even at that bakery. Or he is, but at random times that rarely overlap with British diplomats in the area. The only reason he would visit it at 7:24am on a Tuesday would be to signal for exfiltration. If and he's doing that, then the risk is worth it.

It's also only once a week that the timing is enforced, so they can vary things up throughout the week to hide that pattern in noise.

And the candy bar/Harrod's bag doesn't come into play unless Gordievsky needs an exfiltration. So it's not like they're noticing this weird thing where British diplomats always eat Mars bars every Tuesday. It would only happen once at most.

They know they're being surveilled. They can't change that. So they make their signal as mundane as possible.

Not every agent has to conceal their national identity, the UK had an embassy in the USSR so there were plenty of known Brits wandering around for one to randomly walk through the area. Embassies are classic points to run out of because there's an official reason for being in the country and some protection against retribution.

Sit at a cafe reading a paper or the menu, but look past it at the ground?

Use the standard issue prop newspaper with holes cut out for the eyes.

I’d also recommend against the dark sunglasses. Almost as bad as the newspaper holes.

We met a celebrity once on a ferry. The only reason I even spotted her is because she was wearing a trench coat and ridiculous dark sunglasses like some sort of B movie operative. I happened to glance across the cabin just as she was walking past heading the same direction I was seated. Just a blink in full profile. After a moment of thinking, “no... she doesn’t live around here,” I turned to my wife and said, “was that?” And then looked at the woman across from us who had big eyes. When she passed outside the window it was definitely her. (Turns out her mother lived around there.)

Lady, you gotta work on your disguises. That outfit made you stick out like a sore thumb.

Staring depressed on the ground wouldn't have looked out of place.

Excellent description. Love it. I couldn't understand the website description of this technique.

The X as a signal is a big deal.

https://www.youtube.com/watch?v=6JMHrrSshgc

You’ve clearly never been in the Eastern European countries. Eye contact is... iffy.

There is an old joke. How do you tell an extroverted Estonian from an introverted Estonian? He stares at your shoes, not his own.

There are (at least now) plenty of “extroverted” Estonians, but I’ve heard dozens and dozens of stories of the “don’t make eye contact, just keep walking” variety during the USSR.

Also, staring at either party’s shoes may mean their own smartphone these days...

Well, there's the answer for whether Estonia is a Nordic country.

For the reference: https://images-cdn.9gag.com/photo/aj6MYgw_700b_v1.jpg

https://external-preview.redd.it/UMjBaFaE-dFYMu_VZ8nKO4_tj0E...

http://www.linkbcit.ca/wp-content/uploads/2016/02/Finland-bu...

Those images are much more commonplace these days

They perfected social distancing before it was cool.

>> someone’s shoes trying to identify slight variations?

If you have a military background it is completely normal. Beyond boot polishing, how one ties one's shoes can identify their nationality, background and even trade. They don't think twice about looking at someone's shoes.

There is an old method for spotting a US marine: Ask them to change their socks. The guy who takes one sock off at a time, changing one sock before even untying the second shoe, that's a probable marine. The guy who doesn't actually tie his laces, that does a strange wrap-around-then-tuck thing... US army. The guy who skips a few holes in the middle: air force.

Think I am exaggerating? search youtube for military shoe tying vids: https://www.youtube.com/results?search_query=military+shoe+l...

Well that sounds like a very specific scene.

In fact, Ian's Shoelace website mentions several lacing and tying methods used and prescribed in the military of different countries.

> The guy who doesn't actually tie his laces, that does a strange wrap-around-then-tuck thing... US army.

That’s this lacing technique: https://www.fieggen.com/shoelace/commando-lacing.htm

The system MI6 used to communicate with Oleg Gordievsky was that, had he decided to escape, he would stand near a bread shop in Moscow carrying a Safeway's bag and an MI6 handler (who had never seen him before keep in mind) would walk past eating either a mars bar or a kit kat.

these types of signals can be assigned different meanings, from day to day depending on briefings.

it is also possible to depict roman numerals with lace patterns, and using under/over eyelet lacing to further increase to combinations or provide a bit of stego in the mix. you can send a shill signal with X's and a real signal with laces through eyelets.

these sorts of things are used popularily and certain affiliations creedos or type of date your looking for in a fetish bar are often communicated by display of accessories.

so its not a big secret anymore its just a matter of getting the context of the signal. so how you lace your shoes has different meaning in a night club than in front of the embassy

> type of date your looking for in a fetish bar

Yeah this reminded me of the "hanky code". Either the asset is requesting immediate extraction, or signalling he's into watersports!

The CIA needs to be stricter about enforcing their trademark.

The Pentagon is good at that - just try marketing something with “US Navy Seals” or “US Marine Corps.” You’ll be hearing from their lawyers fast.

CIA in the other hand ... all sorts of weird internet ads use the CIA name.

It gives the CIA deniability and obscurity

Every third thing you hear about the CIA is made up on the spot, makes it hard to know what's true, that's just the way the CIA likes it.

Because of all the covert operations that involve secret agents wearing CIA branded gear?

What sort of lacing should someone wear if someone is not voting for Joe Biden? <g>

Barely related, but if you haven’t learned how to tie shoelaces instantly, you should:

https://www.fieggen.com/shoelace/ianknot.htm

I’ve been doing this for nearly 20 years.

I learned about that knot (and about how the directionality of the traditional shoelace knot we learn matters for how secure it is) a year or two ago from HN. Unfortunately, I probably haven't worn anything with laces in more than 9 months. I'm a flip-flip kinda guy most the time, and when you combine that with me getting some boat shoes a while back and shelter-in-place...

May I ask, why do you say "flip-flip"? I thought the name of that footwear is "flip-flop"?

Maybe because "i" is right next to "o" on qwerty?

That would be the correct answer. :)

Cheers. I was wondering whether you only needed one footwear item. I guessed that in that case you might call that item a "flip-flip" since it wouldn't alternate.

“Thongs” as my mother calls them.

Thanks for the tip. A while back I tried the Straight European Lacing on my hiking shoes and I swear it's the little things. I catch myself staring at those laces all the time and realized that it's kinda nice to have some pleasant new lacing style to look at while on a difficult hike.

not loading at the moment: https://web.archive.org/web/20200808231030/https://www.fiegg...

This led me down quite a rabbithole, because this is how I was taught to tie my shoes in preschool and had no idea anyone did it any other way.

I had to use the secure knot: https://www.fieggen.com/shoelace/secureknot.htm

Not sure why, but single knots always come undone for me pretty quickly - including the Ian Knot you linked. I used to do a double knot and now the secure Ian Knot.

>Not sure why, but single knots always come undone for me pretty quickly

Since you've read about knots I'm sure you know this, but it's worth mentioning for others in the same situation - if you find your laces come undone very easily with a simple traditional knot it may be that you're not balancing the starting knot and the finishing bow, leading to a "granny knot" - https://www.fieggen.com/shoelace/grannyknot.htm

This. I've been tying my shoes this way for 15 or 20 years and they essentially never come untied unintended while still being able to be pulled open with just a single tug. The security of a double knot with the convenience of the standard knot.

There is a TED video about this that changed my life. I've been doing it all wrong for a long time.

https://www.ted.com/talks/terry_moore_how_to_tie_your_shoes?...

I believe today you just say "hey, the drop is ready" over Signal.

Do you also send "the drop isn't ready" on other days? If not the fact that you sent a message tells the attacker everything without knowing the content.

Also can anything be inferred by the length of the signal message? Do they pad they out or will all of the sudden sending a 2kb vs 3kb message give you away that something is different?

Personally if my life is on the line, I'd stick with the shoelaces.

Especially handy if you don't know the number of the person you need to contact or know their device has been compromised. No need to rely on technology when a simple trick will do the... erm, trick.

Instead of using Signal you can just upload a specific meme to /r/wallstreetbets

Didn't the 9/11 hijackers communicate by uploading images of basketball players to sports discussion boards?

Source if you have it please.

Suggestions of coded messages/steganography were made, but I'm struggling to find anything concrete:

> Suspected ringleader Mohamed Atta was seen repeatedly by witnesses using his Hotmail account at public libraries in Florida to surf the Internet, downloading what appeared to be pictures of children and scenes of the Middle East.[1]

> Many of the hijackers were frequent visitors to libraries and internet cafes in Florida, where they are believed to have received their final orders in coded message.[2]

Pre-9/11:

> Through weeks of interviews with U.S. law-enforcement officials and experts, USA TODAY has learned new details of how extremists hide maps and photographs of terrorist targets — and post instructions for terrorist activities — on sports chat rooms, pornographic bulletin boards and other popular Web sites.[3]

[1] https://web.archive.org/web/20011005232014/https://abcnews.g...

[2] https://www.theregister.com/2001/10/11/iomart_cashes_in_on_w... ([1] and [2] found via https://www.giac.org/paper/gsec/3494/steganography-age-terro...)

[3] https://web.archive.org/web/20030606200613/http://www.usatod... (found via https://core.ac.uk/download/pdf/11308369.pdf)

I wouldn't doubt they used stenography too, was just curious if you had a source. Thanks for the effort.

Nitpick intended to be helpful, "steganography" is hiding data within other data, "stenography" basically just means writing something down. Confusingly similar terms.

I assume that 99% of the point of techniques like in the article is to make the communications graph unobservable. If two people have regular communication over Signal, and one is suspected to be a mole or spy, then the other one is suspicious too. But shoelace patterns in a busy city aren't traceable like that.

Nope you can actually do it through traceroute far better.

Do tell.

This is a joke, right? Shoes laced like this are immediately noticeable and suspicious.

Are they really that noticeable? Assume black laces--the yellow in the illustrations is a callout effect rather than actual lace color.

And if someone does notice, it seems a stretch that they would be suspicious. You could say you were feeling a creative streak. This is for message passing, not for wearing to GRU interviews...

Yes, they are that noticeable because literally nobody is using irregular patterns on their shoelaces. And it’s a well known fact that especially women often check men’s shoes at first sight.

This is the first time I’ve heard this...

I am greatly enjoying the concept of "suspicious shoelaces"

Reply on news.ycombinator.com