US based folks may be more interested in the privacy implications of the recent AT&T/NSA “gate”. I am too, but what interests me even more is the detailed technology disclosed on how AT&T implemented sniffing on fiber optics, how ISP’s handle the logistics of answering the legal call of wiretap needs, as well as analyzing possible security fail points in the NSA’s operation (if indeed it was theirs).
Why the NSA did good
It’s been known for years that listening to optical lines is possible. It has been known for years the NSA listens to the Internet. It has been known for years that much of the Internet’s backbone sits in the US and AT&T is a big part of that. It’s been known that US citizens also use the Internet.
No one really wrote about how listening to optical lines is possible until now, or how, but my most serious reply to that is carbon-copied from a friend: DUH.
How else did the American citizens expect the NSA to do this? There are naturally other ways which we will not discuss today, but the backbone sits on American soil, are you telling me the NSA should not use it? That is just plain silly.
The NSA’s mandate as far as I understand it, especially after the 70’s fiasco’s, is SIGINT on everything except US citizens/companies/etc. I bet it is very difficult to filter out such possible domestic communication, but that is why they have such brilliant minds working for them. Which brings us to the FBI and Carnivore -
Why the FBI f*cked up working with ISP’s
I should probably point out that if I was a major ISP often asked to answer the call of law enforcement with legal wiretaps, this could be very annoying as well as technologically a killer to my network architecture.
Just sticking some hub somewhere in my network may not cut it, and will certainly not cover all of the communication. What about different lines and locations?
As a large provider, AT&T probably had to find better solutions to the call of the law, or reply on the law’s technology to not kill their business.
This indeed happened before. According to one NANOGer at the FBI’s Carnivore presentation a few years ago, “sticking” just such a hub is what caused his network to break-down.
Creating a centralized wiretapping point under strict security may be just the thing to both comply and save costs, not to mention staying on the air.
The technology
Unlike with copper lines where you can use the EM emissions to “listen in” to the lines, or even cut them in half and connect them to a sniffer, with fiber optics you simply can’t. As you must be aware of, optical lines work by “transmitting” light. In order to listen in on that communication one must somehow see some of that light.
Without going too much into how this actually works, the protocols using this layer-1 and layer-2 optical hardware beams a lot of redundant light, which bounces off the “walls” in different directions in the tube until at least one of the beams in the data stream reaches the next repeater/switching point/routing point. A single sustained beam of light is often used in bigger pipes, but these also have a lot of redundancy.
Being able to use one photon for each bit of data is what everyone wants to do, but isn’t happening quite yet outside the lab. This would get even more interesting in the future with Quantum Cryptography.
In this paper released by Wired detailing the spying operation from the perspective of an AT&T employee, there are also a couple of other papers attached which detail the network architecture AT&T used to enable sniffing of the information, as well as some interesting information from a related “legal wiretapping” technology conference, ISS World.
Operational f*k-ups?
Ignoring the privacy and US legal issues for a moment, the NSA does not seem that stupid to me, as to trust the operation and technology to be developed by a third-party localized organization.
My guess is that AT&T was asked to prepare the infrastructure where the NSA could use their own gear from. Perhaps even under certain guidelines, conditions and rules (such as even security clearance for employees and key-pad combination locks, as the paper mentions).
Writing a paper about it so that it can be recreated seems like a good idea.
A security issue which comes to mind here is how the information was handled. This reminds me of an incident in Israel where IBM was contracted to do a certain job with The Arrow anti-missile project, and some of the code in the system was legacy code which was originally developed in the Egypt IBM office. This was a serious security concern in the Israeli military industry, and was the result of lack of supervision over third-party contractors.
I don’t see “TOP SECRET” on the AT&T document, which would at least mean this was meant to stay quiet. If it was, than AT&T obviously wasn’t very much following the NSA’s wishes on security. We do see on some of the pages “AT&T Proprietary” and “Use Pursuant to Company Instructions”.
On the physical security level the “secret” room used for the spying seems to be somewhat in paranoid security mode with quite a bit of physical security measurements, probably by NSA decree… therefore I don’t know where the security breach occurred, but was this document supposed to be released? If not, who is at fault? AT&T, the NSA or a traitor?
Maybe non of the above. This doesn’t seem like a security breach to me.
I tend to believe this information was not a secret, but just a technical solution to a business problem with complying to a potentially hazardous technical requirement by the law.
It is possible although unlikely that the NSA decided the existence of the physical wiretap was not a secret (hey, congressional hearing?), nor was the fact that fiber optics can be sniffed. If that is the case I see no security implications here either.
However, if everything but the existence of the room was to be a secret, from what happens there (physical wiretapping for SIGINT purposes) to how (breaking the optical line), security was indeed breached.
Was this breach critical? Not in the slightest.
I doubt the NSA as a serious western intelligence organization, as well as a secretive one would want even that known. Still, we don’t know what their technology to gather the data was, how the information was processed, how and where it was saved and where it was relayed to. Then we don’t know which of it was actually seen by a human. We don’t know what their interest was, except a vague indication of “terrorism”.
Seems like this was run smoothly after all, and we, due to lack of information, run to make the wrong conclusions.
My opinion
Privacy implications.. what exactly was done with the wiretap, etc. we don’t know. It is far from me to even guess. It is well within the realm of possibility it was all used legally, but the infrastructure needed to exist for that. I am sure the different investigation bodies who will look into it will come to some sort of conclusions and find some scape-goats if indeed something evil was done.
They will probably even look into better monitoring of what the NSA does (i.e. more people in the know).
I don’t know much about the particulars of this case, nor what President Bush instructed. That is for the high-paranoia privacy guys in the US to find out.
I doubt the NSA, FBI and others on their own have any reason to spy on or allow spying of US citizens and/or businesses. Than again, I am not a US citizen, what do I know?
I know about logistics with network service providers, the business need to stay on the air and the problems of complying to such requests. I also know such wiretapping is possible and I know that the backbone sits on US soil.
What else do I need to know except that every other country in the world tries the same thing? Well, that the Internet is not a secure medium and people need to secure themselves. Surprise people show sometimes shocks me.
Gadi Evron,
ge@linuxbox.org.
Subscribe
Subscribe