Obfuscation

by Finn Brunton

  Initially culled from RSS feeds, these terms evolve so that different users develop different seed lists. The precision of the imitation is continually refined by repopulating the seed list with new terms generated from returns to search COre CaSeS

  13

  queries. TrackMeNot submits queries in a manner that tries to mimic real users’ search behaviors. For example, a user who has searched for “good

  wi-fi cafe chelsea” may also have searched for “savannah kennels,” “freshly pressed juice miami,” “asian property firm,” “exercise delays dementia,” and

  “telescoping halogen light.” The activities of individuals are masked by those of many ghosts, making the pattern harder to discern so that it becomes much more difficult to say of any query that it was a product of human intention rather than an automatic output of TrackMeNot. In this way, TrackMeNot

  extends the role of obfuscation, in some situations, to include plausible

  deniability.

  1.5 Uploads to leak sites: burying significant files

  WikiLeaks used a variety of systems for securing the identities of both visitors and contributors. However, there was a telltale sign that could undercut the safety of the site: uploads of files. If snoops could monitor the traffic on WikiLeaks, they could identify acts of submitting material to WikiLeaks’ secure server. Especially if they could make informed guesses as to the compressed sizes of various collections of subsequently released data, they could retroac-tively draw inferences as to what was transmitted, when it was transmitted, and (in view of failures in other areas of technical and operations security) by whom it was transmitted. Faced with this very particular kind of challenge, WikiLeaks developed a script to produce false signals. It launched in the

  browsers of visitors, generating activity that looked like uploads to the secure server.19 A snoop would therefore see an enormous mob of apparent leakers

  (the vast majority of whom were, in actuality, merely reading or looking

  through documents already made available), a few of whom might really be

  leakers. It didn’t seek to provide particular data to interfere with data mining or with advertising; it simply sought to imitate and conceal the movements of some of its users.

  Even encrypted and compressed data contain pertinent metadata,

  however, and the proposal for OpenLeaks—an ultimately unsuccessful variant on WikiLeaks, developed by some of the disaffected participants in the original WikiLeaks system—includes a further refinement.20 After a statistical analysis of the WikiLeaks submissions, OpenLeaks developed a model of fake uploads

  that would keep to the same ratios of sizes of files typically appearing in the upload traffic of a leak site. Most of the files ranged in size from 1.5 to 2

  14

  Chapter 1

  megabytes, though a few outliers exceeded 700 megabytes. If an adversary can monitor upload traffic, form can be as telling as content, and as useful in sorting real signals from fake ones. As this example suggests, obfuscation mechanisms can gain a great deal from figuring out all the parameters that can be manipulated—and from figuring out what the adversary is looking for, so as to give the adversary a manufactured version of it.

  1.6 False tells: making patterns to trick a trained observer

  Consider how the same basic pattern of obfuscation can be called to service in a context lighter than concealing the work of whistleblowers: poker.

  Much of the pleasure and much of the challenge of poker lies in learning

  to infer from expressions, gestures, and body language whether someone is

  bluffing (that is, pretending to hold a hand weaker than the one he or she actually holds) in hopes of drawing a call. Central to the work of studying one’s opponents is the “tell”—some unconscious habit or tic that an opponent displays in response to a strong or a weak hand, such as sweating,

  glancing worriedly, or leaning forward. Tells are so important in the informational economy of poker that players sometimes use false tells—that is, they create mannerisms that may appear to be parts of a larger pattern.21 In

  common poker strategy, the use of a false tell is best reserved for a crucial moment in a tournament, lest the other players figure out that it is inaccurate and use it against you in turn. A patient analysis of multiple games could separate the true tells from the false ones, but in the time-bound context of a high-stakes game the moment of falsehood can be highly effective. Similar

  techniques are used in many sports that involve visible communication.

  One example is signaling in baseball—as a coach explained to a newspaper

  reporter, “Sometimes you’re giving a sign, but it doesn’t even mean

  anything.”22

  1.7 Group identity: many people under one name

  One of the simplest and most memorable examples of obfuscation, and one

  that introduces the work of the group in obfuscation, is the scene in the film Spartacus in which the rebel slaves are asked by Roman soldiers to identify their leader, whom the soldiers intend to crucify.23 As Spartacus (played by Kirk Douglas) is about to speak, one by one the others around him say “I am Spartacus!” until the entire crowd is claiming that identity.

  COre CaSeS

  15

  Many people assuming the same identity for group protection (for example, Captain Swing in the English agricultural uprisings of 1830, the ubiquitous “Jacques” adopted by the radicals in Dickens’s A Tale of Two Cities, or the Guy Fawkes mask in the graphic novel V for Vendetta, now associated with the hacktivist group known as Anonymous) is, at this point, almost a cliché.24

  Marco Deseriis has studied the use of “improper names” and collective identities in the effacement of individual responsibility and the proliferation of action.25 Some forms of obfuscation can be conducted solo; others rely on

  groups, teams, communities, and confederates.

  1.8 Identical confederates and objects: many people in one outfit

  There are many examples of obfuscation by members of a group working in

  concert to produce genuine but misleading signals within which the genuine, salient signal is concealed. One memorable example from popular culture is the scene in the 1999 remake of the film The Thomas Crown Affair in which the protagonist, wearing a distinctive Magritte-inspired outfit, is suddenly in a carefully orchestrated mass of other men, dressed in the same outfit, circulat-ing through the museum and exchanging their identical briefcases.26 The

  bank-robbery scheme in the 2006 film Inside Man hinges on the robbers’ all wearing painters’ overalls, gloves, and masks and dressing their hostages the same way.27 Finally, consider the quick thinking of Roger Thornhill, the protagonist of Alfred Hitchcock’s 1959 film North By Northwest, who, in order to evade the police when his train arrives in Chicago, bribes a redcap (a

  baggage handler) to lend him his distinctive uniform, knowing that the crowd of redcaps at the station will give the police too much of something specific to look for.28

  Identical objects as modes of obfuscation are common enough and suffi-

  ciently understood to recur in imagination and in fact. The ancilia of ancient Rome exemplify this. A shield ( ancile) fell from the sky—so the legend goes—

  during the reign of Numa Pompilius, Rome’s second king (753–673 BCE), and

  was interpreted as a sign of divine favor, a sacred relic whose ownership

  would guarantee Rome’s continued imperium.29 It was hung in the Temple of

  Mars along with eleven exact duplicates, so would-be thieves wouldn’t know which one to take. The six plaster busts of Napoleon from which the Sherlock Holmes story gets its title offers another example. The villain sticks a black pearl into the wet plaster of an object that not only has five duplicates but also 16

  Chapter 1

  is one of a larger class of objects (cheap white busts of Napoleon) that are ubiquitous enough to be invisible.30

  A real-world ins
tance is provided by the so-called Craigslist robber. At 11

  a.m. on Tuesday, September 30, 2008, a man dressed as an exterminator (in a blue shirt, goggles, and a dust mask), and carrying a spray pump, approached an armored car parked outside a bank in Monroe, Washington, incapacitated

  the guard with pepper spray, and made off with the money.31 When the police arrived, they found thirteen men in the area wearing blue shirts, goggles, and dust masks—a uniform they were wearing on the instructions of a Craigslist ad that promised a good wage for maintenance work, which was to start at

  11:15 a.m. at the bank’s address. It would have taken only a few minutes to determine that none of the day laborers was the robber, but a few minutes was all the time the robber needed.

  Then there is the powerful story, often retold though factually inaccurate, of the king of Denmark and a great number of Danish gentiles wearing the

  Yellow Star so that the occupying Germans couldn’t distinguish and deport

  Danish Jews. Although the Danes courageously protected their Jewish popu-

  lation in other ways, the Yellow Star wasn’t used by the Nazis in occupied Denmark, for fear of arousing more anti-German feeling. However, “there

  were documented cases of non–Jews wearing yellow stars to protest Nazi

  anti–Semitism in Belgium, France, the Netherlands, Poland, and even Germany itself.”32 This legend offers a perfect example of cooperative obfuscation: gentiles wearing the Yellow Star as an act of protest, providing a population into which individual Jews could blend.33

  1.9 excessive documentation: making analysis inefficient

  Continuing our look at obfuscation that operates by adding in genuine but misleading signals, let us now consider the overproduction of documents as a

  form of obfuscation, as in the case of over-disclosure of material in a lawsuit.

  This was the strategy of Augustin Lejeune, chief of the General Police Bureau in the Committee of Public Safety, a major instrument in the Terror phase of the French Revolution. Lejeune and his clerks produced the reports that laid the groundwork for arrests, internments, and executions. Later, in an effort to excuse his role in the Terror, Lejeune argued that the exacting, overwhelmingly detailed quality of the reports from his office had been deliberate: he had instructed his clerks to overproduce material, and to report “the most minor COre CaSeS

  17

  details,” in order to slow the production of intelligence for the Committee without the appearance of rebellion. It is doubtful that Lejeune’s claims are entirely accurate (the numbers he cites for the production of reports aren’t reliable), but, as Ben Kafka points out, he had come up with a bureaucratic strategy for creating slowdowns through oversupply: “He seems to have recognized, if only belatedly, that the proliferation of documents and details presented opportunities for resistance, as well as for compliance.”34 In situations where one can’t say No, there are opportunities for a chorus of unhelpful

  Yeses—for example, don’t send a folder in response to a request; send a

  pallet of boxes of folders containing potentially relevant papers.

  1.10 Shuffling SIM cards: rendering mobile targeting uncertain

  As recent reporting and some of Edward Snowden’s disclosures have revealed, analysts working for the National Security Agency use a combination of

  signals-intelligence sources—particularly cell-phone metadata and data

  from geolocation systems—to identify and track targets for elimination.35 The metadata (showing what numbers were called and when they were called)

  produce a model of a social network that makes it possible to identify particular phone numbers as belonging to persons of interest; the geolocative properties of mobile phones mean that these numbers can be situated, with varying degrees of accuracy, in particular places, which can then be targeted by

  drones. In other words, this system can proceed from identification to location to assassination without ever having a face-to-face visual identification of a person. The closest a drone operator may come to setting eyes on someone

  may be the exterior of a building, or a silhouette getting into a car. In view of the spotty records of the NSA’s cell-phone-metadata program and the drone

  strikes, there are, of course, grave concerns about accuracy. Whether one is concerned about threats to national security remaining safe and active, about the lives of innocent people taken unjustly, or about both, it is easy to see the potential flaws in this approach.

  Let us flip the situation, however, and consider it more abstractly from the perspective of the targets. Most of the NSA’s targets are obligated to always have, either with or near them, a tracking device (only the very highest-level figures in terrorist organizations are able to be free of signals-generating technology), as are virtually all the people with whom they are in contact. The calls and conversations that sustain their organizations also provide the

  18

  Chapter 1

  means of their identification; the structure that makes their work possible also traps them. Rather than trying to coordinate anti-aircraft guns to find a target somewhere in the sky, the adversary has complete air superiority, able to

  deliver a missile to a car, a street corner, or a house. However, the adversary also has a closely related set of systemic limitations. This system, remarkable as it is in scope and capabilities, ultimately relies on SIM (subscriber identity module) cards and on physical possession of mobile phones—a kind of

  narrow bandwidth that can be exploited. A former drone operator for the Joint Special Operations Command has reported that targets therefore take measures to mix and confuse genuine signals. Some individuals have many SIM

  cards associated with their identity in circulation, and the cards are randomly redistributed. One approach is to hold meetings at which all the attendees put their SIM cards into a bag, then pull cards from the bag at random, so that who is actually connected to each device will not be clear. (This is a time-bound approach: if metadata analysis is sufficiently sophisticated, an analyst should eventually be able to sort the individuals again on the basis of past calling patterns, but irregular re-shuffling renders that more difficult.) Re-shuffling may also happen unintentionally as targets who aren’t aware that they are

  being tracked sell their phones or lend them to friends or relatives. The end result is a system with enormous technical precision and a very uncertain rate of actual success, whether measured in terms of dangerous individuals eliminated or in terms of innocent noncombatants killed by mistake. Even when

  fairly exact location tracking and social-graph analysis can’t be avoided, using obfuscation to mingle and mix genuine signals, rather than generating false signals, can offer a measure of defense and control.

  1.11 tor relays: requests on behalf of others that conceal

  personal traffic

  Tor is a system designed to facilitate anonymous use of the Internet through a combination of encryption and passing the message through many different

  independent “nodes.” In a hybrid strategy of obfuscation, Tor can be used in combination with other, more powerful mechanisms for concealing data. Such a strategy achieves obfuscation partially through the mixing and interleaving of genuine (encrypted) activity. Imagine a message passed surreptitiously

  through a huge crowd to you. The message is a question without any identifying information; as far as you know, it was written by the last person to hold it, COre CaSeS

  19

  the person who handed it to you. The reply you write and pass back vanishes into the crowd, following an unpredictable path. Somewhere in that crowd, the writer receives his answer. Neither you nor anyone else knows exactly who

  the writer was.

  If you request a Web page while working through Tor, your request will

  not come from your IP address; it will come from an “exit node” (analogous to the last person who hands the message to its addressee) on the
Tor system, along with the requests of many other Tor users. Data enter the Tor system and pass into a labyrinth of relays—that is, computers on the Tor network

  (analogous to people in the crowd) that offer some of their bandwidth for the purpose of handling Tor traffic from others, agreeing to pass messages sight unseen. The more relays there are, the faster the system is as a whole. If you are already using Tor to protect your Internet traffic, you can turn your computer into a relay for the collective greater good. Both the Tor network and the obfuscation of individuals on the network improve as more people make use

  of the network.

  Obfuscation, Tor’s designers point out, augments its considerable protec-

  tive power. In return for running a Tor relay, “you do get better anonymity against some attacks. The simplest example is an attacker who owns a small number of Tor relays. He will see a connection from you, but he won’t be able to know whether the connection originated at your computer or was relayed

  from somebody else.”36 If someone has agents in the crowd—that is, if

  someone is running Tor relays for surveillance purposes—the agents can’t

  read a message they pass, but they can notice who passed it to them. If you are on Tor and not running a relay, they know that you wrote the message you gave to them. But if you are letting your computer operate as a relay, the message may be yours or may be just one among many that you are passing

  on for other people. Did that message start with you, or not? The information is now ambiguous, and messages you have written are safe in a flock of other messages you pass along. This is, in short, a significantly more sophisticated and efficient way to render particular data transactions ambiguous and to

  thwart traffic analysis by making use of the volume of the traffic. It doesn’t merely mix genuine signals (as shaking up SIM cards in a bag does, with all the consequent problems of coordination); it gets each message to its destina-tion. However, each message can serve to make the sources of other mes-

  sages uncertain.

  20

  Chapter 1