Hacker News Reader

Comment by lifeisstillgood | Hacker News Reader

Being a spy is only getting harder. I remember reading a few years back how biometric scanning meant the CIA spy could not enter CountryX as a Textiles importer one week and a Olive salesman the next. They had to bribe people at the passport office into fixing their biometrics etc.

Now this sort of thing must make it almost impossible. You can't even leave your mobile at home accidentally - that would trip alarm bells, especially if your contact does it at the same lunch hour.

Spying seems to be a necessary part of how States understand one another. If human level intelligence work simply gets blown apart by technology then yeah we can keep track on what the other side is doing, but so very often we want to know why.

View on HN

What the consequences of an ever-tighter control over identity to the intelligence community will likely be interesting, and it's already presenting problems.

Among possibilities:

- Individuals not closely associated with the IC will be increasingly utilised (knowingly or not) for intelligence work.

- Intel collection will shift from human intelligence to technical / signals intelligence (humint vs. sigint). This creates its own knock-on effects.

- Active development of countermeasures and practices, including creating and deploying cultivated identities and personas online, possibly with cooperation by online services, possibly through manipulation of them.

There's some existing coverage of this, e.g. https://foreignpolicy.com/2019/04/27/the-spycraft-revolution... (https://news.ycombinator.com/item?id=19970339) https://archive.is/vlJYo

What are some knock-on effects of having a predominance of sigint and not much humint?

In an instance I'm vaguely familiar with, early in the War on Terrorism, US intelligence agencies, which rely very heavily on signals-based intelligence, especially the ability to intercept cables (including encrypted ones, thanks to a backdoor in Crypt AG's devices), telephone and satellite communications, radio/broadcast, and digital / computer communications ... were apparently stymied in trying to gather intelligence on Al Qaeda as that adversary avoided use of modern communications, relying strongly on personal messengers and physical media. Humint capabilities of penetrating cells or converting individuals were said to be underdeveloped.

Effectively, the NSA had excellent vision where Al Qaeda did not exist, and was blind where they did.

The quantity and low cost of sigint can often lead to a deprecation of humint. It's not sexy, it's slow, it's low-volume, it's expensive, it doesn't generate large support contracts with government suppliers.

But it can put precisely the right eyes and ears in precisely the right place in ways sigint often has difficulty in achieving.

Mind: this is based on open-sources discussion at the time. How much this reflected actuality vs. speculation or public campaigning / turf wars between intelligence camps (CIA tends to be more humint, NSA more sigint AFAIU) I'm not sure.

This is a much more recent article (I'm referring mostly to the 2000--2005 period), but makes similar points:

https://www.aei.org/research-products/report/enhanced-human-...

Otoh, wasn’t trusting human intel the reason the US claimed Iraq had WMD? (There are pitfalls to human intel too)

My understanding is that it was more a case of what the US administration wanted to hear and believe.

The actual on-the-ground investigation was done by an at least nominally-independent UN team (UNSCOM).

Scott Ritter specifically rejected WMD claims: https://en.m.wikipedia.org/wiki/Scott_Ritter

The investigation lead by Hans Blix found some violations but AFAIR no indications of a significant WMD capability. The Wikipedia article has more information (I've skimmed it): https://en.m.wikipedia.org/wiki/Iraq_and_weapons_of_mass_des...

I don't think this maps well to the Humint/Sigint division. Inspectors relied somewhat on both, though non-covert on-site visits played a large role.

(Sigint and Humint are more typically covert.)

You've seen this right? https://www.wired.com/2007/06/st-cia/ There was a more detailed presentation about it from Defcon or somewhere, and one of the details that apparently gave them away was that the cellphones used only communicated with each other and not with anyone outside the group, aside from the odd screw-up.

Something similar happened to the CIA in Lebanon as well. One hopes they've improved their tradecraft in the decade since.

https://www.gawker.com/5861484/iran-and-hezbollah-caught-all...

A fun thought experiment: how can one own and use two phones without the authorities being able to correlate their ownership?

It would have been hard to avoid ten years ago. Unless you use both phones very infrequently (which is of no use to most people) I think it's nearly impossible now.

Living in a dense city, sending your phone to be driven around on the bus are my immediate thoughts.

But where does it sleep at night? Where does it sleep on holidays? Near you? Or do you leave it home on a table, and the motion sensors say it’s on a table?

Well, step 0 is obviously to use a device that won't blab its sensor readings to all and sundry. The only thing you should have to worry about is cell phone tower records and call/traffic logs.

> step 0 is obviously to use a device that won't blab its sensor readings to all and sundry

Which phone is that these days?

Well, not being a nation-state, I'd have to content myself with a LineageOS phone with no Google Play, or maybe a PinePhone. If I were a real spy, I've no doubt my employers would have the resources to provide me with something.

Look at that guy, what an unusual phone he uses

Being much more open, I would imagine spoofing could be much easier.

Also a modern spy difficulty is people post social media photos that countries can scrape and identify. By the time a ~20 year old decides the three letter something is their career of choice, a profile, facial recognition and history is stored.

I don't think someone like this would actually get hired…

At some point they'll have to hire Gen-Z. By consent or not, this entire generation is documented on the Internet.

Special operations are only a small part of what the intelligence community does. Most of it is really mundane and is done by very official attaches at the embassies.

It's compiling reports on what is happening, meeting with the other countries officials about bilateral relations, meeting your own citizen to know what they are doing. A lot of it is above board. I will hasard that most of the information which end up being classified is actually acquiried legally but becomes interesting through cross-referencing or exclusivity.

I have no doubt that being a spy is harder, the biometrics on border crossing sounds legit, but I don't imagine needing to have a different phone for different cover identities is particularly onerous.

It's also not super difficult to cross most borders without checking in the authorities.

Admittedly, it's not a risk you want to take if you don't have to, but if you have no other option, it's workable.

You can't even leave your mobile at home accidentally - that would trip alarm bells, especially if your contact does it at the same lunch hour.

This is straightforward to spoof. A single programmer could do it if they cared enough. It is possible to change the GPS (GNSS?) HAL to send any information you want [1].

[1] https://www.pathpartnertech.com/all-you-need-to-know-about-g...

You would need to also consistently fake location data inferred from cell towers, which I guess is a bit more difficult to spoof.

I am dubious - not that I can't learn to alter my (android) phone so it thought it was in London when really it is in NY - but that I would not be tripped up by correlations. It would have to be a slow sensible variation, it would have to be within the correct cell - London / NY would not work - plus other dumb stuff that I simply don't know about radio propagation or being seen on a CCTV camera etc.

Nothing about spying is ever going to be simple. Especially building those vital human relationships.

The motion sensor has to keep moving. Apps don’t need permission for the motion sensor, they can freely send it over, it’s not private data.

In android they have to ask for it first ?

Pokémon GO had that problem. Lots of "flyers" hacked their GPS for fun and profit.

> Spying seems to be a necessary part of how States understand one another.

The country under your feet does the same. Every civilization has used spies throughout history. A greedy, hungry or desperate neighbor might get ideas that threaten your security.

That can be bad for global peace.

there can only be one spy now.

>You can't even leave your mobile at home accidentally - that would trip alarm bells, especially if your contact does it at the same lunch hour.

sometimes I do wonder whether if i'll be going to US to steal some faang jobs, then TSA will mark me as a terrorist/spy internally cuz I don't have smartphone?

Reply on news.ycombinator.com