Hacker News Reader

Comment by macrael | Hacker News Reader

There doesn't seem to be a mention of encryption anywhere. I'm surprised they didn't avail themselves of a little PGP. If a giant notorious terrorist organization isn't using public key cryptography, who is?

View on HN

In the past, Al Qaeda operatives have expressed a belief that PGP is tainted/backdoored/etc by the US government, so they generally shun it.

It's probably better for attempting to elude the NSA, as well. Get lost in the mix, as opposed to having big large red flags in your messages.

Why not GPG? It's open source, unless there's some crazy obfuscation in the source code it would be pretty hard to hide a backdoor in plain sight.

It's remarkably easy to hide backdoors in plain sight.

http://cm.bell-labs.com/who/ken/trust.html

One would hope terrorist organizations don't have technical expertise to code review PGP.

Yet several had the expertise to fly commercial airliners. A number of top Al Qaeda leaders went to college in the U.S. It wouldn't be implausible for some terrorists to take courses in computer science.

While I don't doubt Al Qaeda has some skilled technical folks, piloting a commercial airliner isn't much of a feat if you don't intend to land the thing.

Landing in good weather is not particularly difficult. What's difficult is handling error conditions: the landing gear won't go down, an engine has failed, some instruments are out or misbehaving. Landing the airliner, safely, under those conditions require critical thinking, good flying skills, and practice. If you are planning on only taking one flight, you don't need to be good at this stuff, because it's unlikely that you will encounter any problems on that particular flight.

(Lots of people have died because of inadequate training in these areas. Eastern Flight 401 is a good example: http://en.wikipedia.org/wiki/Eastern_Air_Lines_Flight_401. The crew was so busy debugging a faulty light bulb that they forgot to fly the plane. It crashed into a swamp.)

I think the biggest mistake the first world can make in securing its future is assuming that it has a monopoly on knowledge, intelligence, and expertise.

The nuances that make an open source tool like GPG attractive to us are unlikely to make much of an impact on terrorists that believe in vast US/West conspiracies.

PGP encrypted emails protect the contents of the email. They don't prevent eavesdroppers from knowing an email was sent, or where it came from.

Can any foreign terrorist organization count on having encryption that would defeat the National Security Agency's efforts to break the encryption? Surely the first thing for anyone hiding from the United States government to do is simply practice good tradecraft (as bin Laden and his group have long done) and never let the message be accessible to the United States government in the first place. I wouldn't count on PGP or any other software solution for encryption that is readily available worldwide to be secure against NSA attempts to decrypt it. That's especially what any "high value" terrorism suspect should keep in mind.

I wonder if that would actually work against them. Assuming the government has some system that is reading all emails sent to country x, they may specifically sniff emails that match a certain signature... such as one that was encrypted. Its probably less revealing to setup a code around every day language and problems.

That's a good argument for sending the actual emails in plaintext, but it doesn't explain why the storage drives weren't heavily encrypted.

That's exactly right. I am dumbfounded that they didn't protect everything.

Reply on news.ycombinator.com