Hacker News Reader

I simply do not believe that the NSA actually catches anyone using these advanced methods. The few terrorist prosecutions we've seen released almost always involve some low-hanging nut soliciting someone online for bomb materials with zero "gnome morse code" or other gimmicks. The idea that you can datamine everything running over the internet is a fool's errand and this errand is costing us billions in wasted tax dollars and millions of instances of violated human rights. Meanwhile, organizations like NASA are clearly underfunded.

Terrorism is the root password to everything from our constitution to our tax load. Playing up these charlatans and lifelong federal bureaucrats as some kind of saviors against the mythical hacker terrorist is a little much in my book. These are pork programs that go nowhere and do nothing but enrich the inside players and connected defense contractors.

> The idea that you can datamine everything running over the internet is a fool's errand and this errand is costing us billions in wasted tax dollars and millions of instances of violated human rights.

Agreed.

> Terrorism is the root password to everything.

Terrorism is pretty scary stuff, it's intended to be scary. No way are people in government singing hallelujah everytime innocent people are killed, look we can fund more nefarious shit! They're honestly trying to do the right thing and simply went overboard with collecting too much data.

Pardon my cynicism but your second statement makes you sound like a shill for those same people. Making such terrible actions sound like well-intentioned 'overstepping' only excuses such horrendously insidious activity (which is deserving of nothing but the strongest criticism).

Why does he sound like a shill? Do you know what a shill is?

Could it be that he just supports or believes an opinion you don't?

The pernicious thing about a culture of shills and agent provocateurs is that it undermines trust in others and civil society in general. It leads to endless questioning of motives and to a complete stoppage of debate on some topics.

Think back to 2003 and the run-up to the Iraq war; which was the first time we saw what a domestic propaganda initiative on the internet looked like. Think about how much more sophisticated those tools are today. How defining and shaping issue oriented discourse can be viewed as a zero-sum game where one side "wins" and all other viewpoints are neutralized.

The thing is; once the suspicion has been planted that not all of the people one is talking to are honest participants it is impossible to ignore; impossible to disprove; and very difficult to act against.

Do you really believe that "doing the right thing" is the primary goal, or the secondary? Obviously that's how it's sold to the public, but it's hard to deny that espionage isn't the real goal.

If preventing deaths was anywhere close to the primary goal they'd be funneling money towards stopping traffic accidents.

Terrorism is a convenient trope to get people to willingly relinquish their liberties, just like "for the children" but with the goal of deploying ubiquitous scanners, drones, and microphones instead of censorship schemes.

Might I remind you?

https://en.wikipedia.org/wiki/Project_for_the_New_American_C...

>They're honestly trying to do the right thing and simply went overboard with collecting too much data.

I agree with the mission. Just not with their methods.

Actually, I do think some of them are happy when it happens. Why is that so far fetched? For example, the leaders that jumped at the chance for WWI were clearly not hoping for peace. They wanted an excuse for a war. It does happen. Could it happen that there are extremists in the NSA just waiting for someone to pick a fight with them? Of course.

Hell, you can see this kind of behavior in tower defense games; people build a great power and dare anyone to cross them. The only difference is that real lives are at stake, but I think the government has proven they don't see the real lives in their game. For example, they don't even tally civilian casualties. They only even seem to care about such things because they don't want to anger the public.

>No way are people in government singing hallelujah everytime innocent people are killed, look we can fund more nefarious shit!

I disagree with you on this one. I know this is a crazy conspiracy theory video, but please take the 30 minutes to watch it.

When you say nobody in "government" is excited, you need to refine the meaning of the term "government": Look at the players who have been at the center of this for the last 3 decades: GHW Bush and Carlyle group CIA drugsters.

http://www.youtube.com/watch?v=yJDFHd5eEzw

Terrorism is pretty scary stuff, it's intended to be scary.

I'm not scared of acts of terrorism. I am much more concerned about vehicles killing cyclists and, really, the brain dead response the non terrorists will/have had when it comes to terrorism, like taking away our freedoms, wasting my tax dollars, and general stupid panic.

I get the same impression. To me this all seems like an organization having the same delusions as John Nash when he tried to find geometric patterns in the movement of pigeons. They are so self-consumed in their intelligence community bubble chamber that they are convinced that there are all sorts of terrorists to be found in in every single corner of every place that ever was.

Are there terrorists? Yes, some. But to them it's like a boogeyman under every bed and in every closet.

> MMO's are packed with possible communication channels in addition to chat. Ever wonder if that annoying gnome in the auction hall is jumping in morse code? Could signals be sent with bids? Could a character's inventory contents be arranged to leave a message to someone else who shares the login info? Is that nonsense coming from what you presume to be a bot-controlled gold-farming crew really nonsense?

Precisely. WOW itself is the first level of steganography ("I'm not communicating, I'm gaming"), but one can think of many more, inside and outside of MMOs.

Given proper use of steganography, small groups will always be able to communicate with low risk of detection. But for obvious reasons, you will always have to roll your own scheme, and may end up overlooking aspects that render it insecure.

Is anyone aware of articles or books that deal with the creation of these types of systems? I'm guessing some sort of cryptography text would lead to it, but the last sentence of your post has me particularly interested. What kind of considerations need to be made when creating such a system, especially in today's age?

Nope, cryptography != steganography. The situation with stego, currently, is much the same as the situation with crypto was before the invention of public key encryption: truly high-grade stego is only available to governments, mostly because nobody knows how to do it in a secure way. In other words, stego is an art, not a science, just like crypto was before PKE. There are no good texts as far as I'm aware.

Your best bet is to read whitepapers on stego. See https://news.ycombinator.com/item?id=6843575 for related discussion.

>>stego is art not science

what about "provably secure steganogrpahy"? there seems to be some papers on this. isn't is by definition science, not art?

Passing information through channels not explicitly intended to carry that information is called a covert channel attack. Lots of links from the wikipedia page:

http://en.wikipedia.org/wiki/Covert_channel

It's important to realize that any system of any size will be packed with covert channels; the thing to do is try to identify them all and drive their bandwidth down to an acceptable level.

If you have organized group you can probably use methods like codebook with Huffman coding to reduce message length a lot. Plain text is very sparse form of communication, compared to good codebook which suits the needs. Btw. This is over 20 years old stuff. MUDs in very early 90s were used for all kind of communication. - Nuff said. Also utilizing chaffing and winnowing allows you to use almost any kind of service to transfer your data. You'll just hide it in the junk. Only receiver will know what's meaningful and what's not.

Here's a great place to start:

https://www.schneier.com/cgi-bin/mt/mt-search.cgi?tag=stegan...

One must be careful with it. IIRC, Anna Chapman was a pro among Russian spies, but at one point she got so confused by the steganography software on her laptop that she asked another known spy for help in using it ... before she realized she was talking to a CIA agent trying to figure her out.

http://en.wikipedia.org/wiki/Anna_Chapman

http://news.cnet.com/8301-13578_3-20009101-38.html

Bruce Schneier's articles -- and his readers' comments -- provide fascinating details and analysis of these topics.

https://www.schneier.com/blog/archives/2010/07/cryptography_...

https://www.schneier.com/blog/archives/2013/07/protecting_e-...

al Qaeda is known to have used steganography within porn videos.

http://arstechnica.com/business/2012/05/steganography-how-al...

Funny that you mention steganography and WoW. Turns out that Blizzard watermarks your screen as you play with information like your server, user info, etc.

http://www.tomshardware.com/news/watermark-screenshots-World...

Not adding to the discussion in any way, but I really enjoyed scanning through this, knowing the information had already been decoded, and seeing people post 'you're all morons, it's just a jpg artifact!'

Of course you can use online gaming as an avenue of steganography.

The whole point of steganography is that you're supposed to transmit information while simultaneously concealing the fact that information even exists in the first place.

As long as you have a premeditated code, you can use practically anything to facilitate such communication, and the chances of it being uncovered are dubious.

This does not justify such ridiculous intelligence operations.

There was a sad time where one (or more) of the gold sellers was suiciding their characters such that the bodies on the ground formed the letters for a URL. It was a very strange thing to see but if you were flying above the dead bodies you could pretty clearly see the URL.

>>The NSA makes military spending look frugal!

Amazing too that we can't find money for food assistance (SNAP) to poor people but we can pay NSA agents for fools' errands in video games. I'm waiting for the revelation that Gen. Alexander's NSA underwrote "The Mists of Pandaria" with tax dollars.

There's got to be a name for when someone complains about a tiny expenditure, and compares it with an unrelated huge societal issue. You can criticize anything this way: we're delivering mail while people starve. We're giving people parking tickets while killer asteroids go undetected.

It is the fallacy of relative privation, or appeal to worse problems:

http://en.wikipedia.org/wiki/Fallacy_of_relative_privation

Opportunity costs are a real thing. It's a legitimate argument. See using dead children as a unit of currency:

http://www.raikoth.net/deadchild.html

Prime example, I recently had someone on Twitter literally tell me that by supporting NASA I must want children to die.

https://twitter.com/NASA_SLS/status/401818661931208704

"I love space exploration, but the expenditure simply cannot be justified when kids die for lack of clean water"

"But as we're discussing children's lives only someone lacking a moral compass would consider it an issue here"

I'm not complaining about space exploration expenditures when we still haven't accomplished world peace.

I'm complaining about us wasting money on COMPLETE NONSENSE. If you think "investigating" whether Al Quaeda is communicating versus gnomes jumping on top of the auction house is a valuable use of taxpayer resources, why aren't we investigating whether terrorists are using kebab interval-spacing as a communications medium?

Funding SNAP will feed my fellow hungry humans. Funding the NSA will... Who knows? We just have to take their lying word for it.

Usually I treat posts like yours with a base modicum of respect, but I'd really think twice the next time if I were you.

You appear to have misunderstood the post that you're replying to.

I doubt it, he replied to himself.

I couldn't reply to a post below mine, which is why I replied to my own post.

The inline "reply" link doesn't show up until a while after a comment has been posted; but you can simply use the permalink for the comment, there you will always find a reply box.

Cheers!

Well, that's just a weird way to use HN.

At first read I actually thought he was arguing with himself ... Jeff Dunham, anyone?

http://www.youtube.com/watch?v=ntQkgeko_i8

The nation does not have money to support public health care but has enough to support public spying.

It's plausible if they simply subvert the servers. If you take World of Warcraft, say, the options are basically text chat and voice chat. (Sure, you can send morse code or whatever, but that kind of sophistication generally assumes a more detailed communication has already taken place and applies everywhere -- "let the phone ring three times and then hang up", steganography, etc.)

A better option for covert communication would be a more open platform such as Second Life, where you can upload custom content. But, frankly, there are so many options if you have any imagination... If what they're really worried about is recruiting and outreach then they at least only need to worry about reasonably popular alternatives.

I was thinking about Minecraft. The options for covert communication are limitless.

shrug if you want to communicate one-on-one covertly there are simply too many options to cover.

Took them forever to discover Ft. Longcat in Second Life

>MMO's are packed with possible communication channels in addition to chat. Ever wonder if that annoying gnome in the auction hall is jumping in morse code? Could signals be sent with bids?

There would be trillions of possible outlets for such communication, making looking for those specifically in MMO extremely futile.

> I find the task of finding terrorist communications in MMO's so daunting that I'd never even consider making an attempt at it.

I suppose the bigger bang for the buck would be in the metadata. Knowing who is playing at the same time, or who is looking at each other's profile or whatever.

Privacy concerns aside, this is a "half a loaf of bread is equivalent to no bread at all" argument. Yes, catching progressively more sophisticated signals gets progressively harder. That doesn't mean basic mining is useless. It reminds me of the argument that banning soda sales in schools is useless because kids could just go to a store across the street. They could, and some will, but taking care of the path of least resistance can go a surprisingly long way.

I would suggest that "a horde of undercover Orcs" in WoW no longer qualifies as "the path of least resistance"...

This is why it's literally impossible to track and analyze all real-time possible channels. Even if you have equal computing power analyzing every world activity, the ability to interpret every "hit" or suspicious pattern (which I think would be impossible to see.. e.g. the morse code used would likely be encrypted / non-standard ... which would lead to needing 1000x the computing power at minimum to even put a dent in keeping up in pattern tracking real-time). You'd be much better off spending that money on taking care of people, being kind, compassionate, etc..

> Seriously... The NSA makes military spending look frugal!

That isn't something you can decide by waving your hands at games. WoW is cheap compared to even simple things purchased by the military on a regular basis.

A WoW subscription maybe, but the computing power to analyze character actions to extract meaning (such as the jumping example above) and the people come up with that idea is not cheap.

WoW might be cheap but a signal intelligence team to monitor a video game isn't.

The NSA is part of the military.

You can send bits of information like that, but not that many. Sending a message like a time or gps coordinates would be easy, but having a full conversation would be very time consuming and require a ton of those short messages. It is also difficult to decode, especially manually.

But it could be a good way for a case officer to keep in contact with a source none of that hanging about in parks dead letter drops and embarrassing wifi enabled rocks.

Would they have caught Anna Chapman if she had met her case handler virtually instead of a coffee shop.

All I'm imagining is a group of folks snickering that their project proposal went through as now they'll get paid to play World of Warcraft all day.

Wow never would have thought of that - for some reason thinking of a bad guy playing Runescape to discuss their evil plans makes me laugh

From what I read, NSA is not spending that much. Apparently snooping is more effective than sending an army.

Sending an army where? What are you talking about?

I can't wait to see a title that reads "Newest NSA revelations show that the Al Qaeda transmits information through MMO 'World of Warcraft' with in-game Gnomes jumping in morse code".

This reminds me of the kids chat world used in the comedy-terrorism film "4 Lions".

Eh, I don't find it terribly hard to imagine that America is the Kingdom of Azeroth and Al Qaeda are the Forsaken. Just map place names and unit compositions and you have a fairly large vocabulary already. Wouldn't even make it hard to just swap out different races for the current code key.