untold story 11/26

In May of 2013, the eyes of the world were opened to the electronic mass surveillance which is being carried out by the US, the UK, and their allies. Through the efforts of former NSA-contractor Edward Snowden, journalist Glenn Greenwald, and filmmaker Laura Poitras, it became known that everyone with a cell phone or a laptop is a target of electronic surveillance. The complexity of the surveillance technologies make it difficult to understand their impact. I wanted to inform people through a series of puzzles about espionage and electronic surveillance tactics.

A few decades ago the eavesdropping by governments was limited to tapping telephones, opening snail mail, and intercepting radio traffic. The worldwide adoption of internet and cell phones has created tremendous opportunities for signals intelligence gathering. Government intelligence agencies like the NSA (US) and GCHQ (UK), who are in charge of spying on foreign communication in the interest of national security, have begun to collect bulk digital communication from both citizens and military, both domestic and abroad.

MJOLNIR, OLYMPUSFIRE, AND MYSTIC

The immense power of electronic surveillance is reflected in the names of the NSA’s operations. Having the world’s secrets at your disposal has led to names like: Darkthunder, Mystic, Godsurge, Halluxwater, Mjolnir, Olympusfire, and Waterwitch. The history of secret writing has always been associated with the occult and the religious. Names of gods and holy places were encrypted to protect their sanctity. In Roman times an amulet with the triangular typography of the incantation ‘Abracadabra’ was worn in an amulet to ward off disease and misfortune. The phrase is from Aramaic and means “I create as I speak”. In Iran, ‘Abjad’ diagrams used religious numerology. Indian mathematics (400-1200 AD) used geometry for religious and magic Vedic rituals.

THE BLACK CHAMBERS

Throughout history, encryption has been used to communicate state and military secrets. Julius Caesar used encryption to protect military messages, with a system which we now call the Caesar cipher. Herodotus mentions the Greek Histiaeus who shaved the head of his most trusted slave and tattooed a message on it. As soon as the hair had grown back, the slave was sent to deliver the message. The Spartans used a scytale, a strip of parchment with a message on it. Only those who possessed a stick of the right diameter could read the message by winding the parchment around the stick.

In the 1700s city states and countries in Europe were in a constant state of rivalry. Secret codes were used for diplomatic communication, and each tried desperately to decipher each other’s messages. Diplomatic mail was read and deciphered in secret rooms called ‘black chambers’. The Geheime Kabinets-Kanzlei of Vienna was supposedly the best in Europe. Diplomatic letters that arrived at 7 a.m. were opened, copied, resealed with forged seals, and returned to the post office at 9:30 a.m.

TOO MANY SECRETS

Cryptography is the process of communicating in, or deciphering, secret writings. In cryptography the original message is called ‘plaintext’ and it is encrypted into unreadable text called ‘ciphertext’. For example the Caesar cipher is a simple substitution cipher that shifts the alphabet, so for example A=B, R=S and Z=A, etc. The plaintext ‘SECRET’ becomes ciphertext ‘TFDSFU’. In order to read the message the recipient has to know the key. This code is easy to break, but the more variables you add, the more difficult it becomes. Modern ciphers use large prime numbers to withstand decryption by powerful computers.

The form of cryptography that hides messages is called steganography. In ancient Greece, Herodotus mentions inscribing a message in wood, covering it with wax, and inscribing the wax with an innocent message. Invisible inks and microdots are both examples of steganography which were used during World War II. Digital steganography can be done by adding a message to the source code of images, songs, or videos, and uploading them, hiding them in plain sight. Another form of digital steganography was used by the Taliban in Afghanistan. Recovered laptops showed that the Taliban masked their e-mails as spam so they would not be searched by surveillance filters.

SATELLITES AND ZERO DAYS

The possibilities of electronic surveillance has led intelligence agencies to try all possible methods. Cell phone providers and internet companies are pressured to give their data to intelligence agencies, or to give secret access into their software. Intelligence agencies design special programs that use vulnerabilities in operating systems and browsers (called zero days) to intercept e-mails, chats, and voice IP calls. Undersea communication cables that connect continents to the internet are directly tapped into. The NSA even developed tiny spy hardware, which is secretly installed into intercepted laptops and cell phones that people had ordered online.

Both the NSA and the GCHQ deny that they spy on their own citizens, while Edward Snowden’s documents have proved otherwise. The documents also showed that these agencies spy on their allies as well as their adversaries. Courts have ruled since then that both agencies were guilty of illegally collecting phone records and bulk internet communication. In addition, software companies have stepped up and promised to use encryption for communication platforms, so government agencies can no longer read them.

PUZZLES AND PRIVACY

The leaks by Edward Snowden and the history of cryptography formed the basis for a series of ‘Spy Puzzles’. Dutch newspaper NRC Next published one puzzle every week starting February 2014. Every Tuesday, Dutch readers could find a new spy puzzle in their newspaper and try their puzzling skills, while learning something about the impact of electronic surveillance. One year later I had made more than 52 puzzles with different topics such as satellite surveillance, man-in-the-middle attacks, Russian electronic surveillance, and face recognition.

Support a more secure internet by using PGP e-mail encryption, the Tor browser, or support your local digital rights activists Electronic Frontier Foundation (US), EDRi (EU), and Bits of Freedom (NL).

The collected puzzles were translated into English and German and exhibited at the Science Gallery in Dublin (IR), June to November 2015, MOTI in Breda (NL), September 2015 to March 2016, and the ZKM in Karlsruhe (DE), October 2015 to May 2016. Thanks to NRC Next for the cooperation, and Vincent Meertens for making three of the puzzles.