<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Nov 2, 2018, at 4:29 PM, Evan Erickson <<a href="mailto:evan.s.erickson@gmail.com" class="">evan.s.erickson@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class=""><div dir="auto" class="">Why would they fire him?</div></div><div dir="auto" class=""><br class=""></div><div dir="auto" class="">More than 20 people died in China because of this. </div><div class=""><br class=""><div class="gmail_quote"><div dir="ltr" class="">On Fri, Nov 2, 2018 at 10:26 AM Arnold Reinhold via cryptography <<a href="mailto:cryptography@metzdowd.com" class="">cryptography@metzdowd.com</a>> wrote:<br class=""></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><a href="https://www.yahoo.com/news/cias-communications-suffered-catastrophic-compromise-started-iran-090018710.html" rel="noreferrer" target="_blank" class="">https://www.yahoo.com/news/cias-communications-suffered-catastrophic-compromise-started-iran-090018710.html</a><br class="">
<br class="">
This article describes a massive CIA communication system failure from 2008 to 2013, with continuing issues. It seems the CIA used a series of phony web sites to communicate with agents in hostile countries. The Iranians apparently found some by tracking down moles based on who knew about information that had leaked, e.g. their underground enrichment facility. They then analyzed the sites they knew about and developed signatures that could be used to successfully find similar sites using Google searches. They likely shared the information with other countries including China. Large portions of CIA networks in many countries were compromised and dozens of sources executed. Some sources were likely turned, creating ongoing problems as to who is still trustworthy. An interesting quote form the article:<br class="">
<br class="">
'Within some corners of the intelligence world, “there was widely held belief that technology was the solution to all communications problems,” according to one of the former officials. Proponents of older methods — such as chalk marks, burst communications, brush passes and one-time pads — were seen as “troglodytes,” said this official.’<br class="">
<br class="">
A defense contractor, John Reidy, detected and reported problems in 2008 but was then reassigned and later fired. Apparently no one has been held accountable.<br class="">
<br class="">
Arnold reinhold<br class="">
<br class=""></blockquote></div></div></div></blockquote><br class=""></div><div>Well, that is indeed the question. It’s not uncommon in bureaucracies, where it is much easier to fire someone than it is to admit you are completely screwed. One of my favorite books, Leo Marks’ "Between Silk and Cyanide," deals with a similar situation in WW II, though the author manages not to get fired by knowing when to shut up. Many OSS agents sent into the Netherlands were captured and executed because managers refused to believe their network was compromised even though prearranged signals, in the form of specific message mistakes, were detected by Marks.</div><div><br class=""></div><div>We spend a lot of time worrying about how many bits to use for this and that, important stuff to be sure, but nowhere near enough time worrying about the dangers of security monocultures and the need for effective monitoring, with backup plans that are usable and get used promptly. </div><div><br class=""></div><div>Arnold Reinhold</div><br class=""></body></html>