7 ms·

This might get a little longwinded. Sorry. The following is from http://www.salon.com/2015/09/26/how_to_explain_the_kgbs_amazing_success_identifying_cia_agents

by Arnt 8y ago

This might get a little longwinded. Sorry. The following is from http://www.salon.com/2015/09/26/how_to_explain_the_kgbs_amazing_success_identifying_cia_agents_in_the_field/ http://www.salon.com/2015/09/26/how_to_explain_the_kgbs_amaz... and describes the way the Russians implemented SELECT * WHERE CIA FROM EMBASSY_EMPLOYEES: "differences in the way agency officers undercover as diplomats were treated from genuine foreign service officers (FSOs). The pay scale at entry was much higher for a CIA officer; after three to four years abroad a genuine FSO could return home, whereas an agency employee could not; real FSOs had to be recruited between the ages of 21 and 31, whereas this did not apply to an agency officer; only real FSOs had to attend the Institute of Foreign Service for three months before entering the service; naturalized Americans could not become FSOs for at least nine years but they could become agency employees; when agency officers returned home, they did not normally appear in State Department listings; should they appear they were classified as research and planning, research and intelligence, consular or chancery for security affairs; unlike FSOs, agency officers could change their place of work for no apparent reason; their published biographies contained obvious gaps; agency officers could be relocated within the country to which they were posted, FSOs were not; agency officers usually had more than one working foreign language; their cover was usually as a “political” or “consular” official (often vice-consul); internal embassy reorganizations usually left agency personnel untouched, whether their rank, their office space or their telephones; their offices were located in restricted zones within the embassy; they would appear on the streets during the working day using public telephone boxes; they would arrange meetings for the evening, out of town, usually around 7.30 p.m. or 8.00 p.m.; and whereas FSOs had to observe strict rules about attending dinner, agency officers could come and go as they pleased." I read the book. When a CIA agent's cover was blown, the CIA had a spare care and apartment and the agent's replacement needed just that, so they tended to reuse the car and apartment. And wondered why the replacement was then identified so quickly. So. After that long digression, here comes a hypothesis: Organisations that can keep their mistakes secret, can make themselves seem much more capable than other, similarly large organisations.

AlexCoventry 8y ago
> Organisations that can keep their mistakes secret, can make themselves seem much more capable And also much slower to learn from their mistakes. The history of the CIA is pretty depressing, in this regard. https://en.wikipedia.org/wiki/Legacy_of_Ashes_(book) https://en.wikipedia.org/wiki/Legacy_of_Ashes_(book)
- ryanmarsh 8y ago
  Legacy of Ashes does a pretty good job to that end... https://www.amazon.com/Legacy-Ashes-History-Tim-Weiner/dp/0307389006 https://www.amazon.com/Legacy-Ashes-History-Tim-Weiner/dp/03...
commandlinefan 8y ago
> SELECT * FROM EMBASSY_EMPLOYEES WHERE CIA ftfy
stevew20 8y ago
TL;DR
dorfsmay 8y ago
> SELECT * WHERE CIA FROM EMBASSY_EMPLOYEES Although I personally don't find this type of humour funny I can understand why beginners use it. However, if you are going to use it, please make an effort and get it right. In your attempt to showing off, you're just showing you don't know basic SQL.
- danharaj 8y ago
  Care to guess what you've said about yourself with this critical comment? :^)
- brrt 8y ago
  This is actually (almost) legal in teradata sql, which doesn't enforce clause order, but it doesn't accept an identifier as a predicate.
closeparen 8y ago
My understanding is that official cover is more a matter of politeness than secrecy. An embassy employee is obviously a foreign agent in some capacity. The real game is preventing the host country from discovering links between official-cover and non-official-cover agents, since the latter group’s affiliation is actually secret.
std_throwawayay 8y ago
So, they were basically relying on metadata to inspect an organization. If anything, this shows the power of metadata.
dev_dull 8y ago
> The CIA does appear to have lucked out when it comes to Russia. The Intelligence Agency ring fences its Russian activities and the report states that intel chiefs were quick to harden up its Russian communications channel at the first sign of trouble. Your post makes a lot of sense for that above line in the article. Maybe Russia would rather keep tabs on them as known-people rather than murder them. China seemed to have taken it personally, which is ironic given their vast purported corporate espionage spy networks.
- 3pt14159 8y ago
  China is much less pluralistic than Russia. It's more important to send a message to locals than it is to poison the information.
- unchocked 8y ago
  These are different kinds of agents. Those described in the above comment were US nationals in Russia operating under diplomatic cover, and are not subject to Russian law. They would be deported. Russian nationals working for the CIA would not be found by that search. The agents in the story were Chinese/Iranian/etc. nationals working for the CIA. They had no diplomatic protection, which is why they were killed.
  - Arnt 8y ago
    Different, certainly. What about it? Do you mean that the people who were careless with one group would be careful with the other? That the people who issued one car model to the real cultural attachés and another model to the CIA agents would be very careful about the agents who risk their lives?
EliRivers 8y ago
Adam Curtis has a piece, in the style of Adam Curtis, wondering if spies (well, in this particular case, mostly spy catchers) simply aren't very good at their job; http://www.bbc.co.uk/blogs/adamcurtis/entries/3662a707-0af9-3149-963f-47bea720b460 http://www.bbc.co.uk/blogs/adamcurtis/entries/3662a707-0af9-...
- gniv 8y ago
  Wow. Thanks for posting this. It's a better read than anything currently on the front page of HN.
- Gibbon1 8y ago
  Also possible corrupt, Aldrich Ames was living way beyond his means for a decade before he got caught. And the CIA knew it. My assumption has been the CIA turns a blind eye when it's high level agents pass information to 'friendly' governments and corporations, and so were gobsmacked when they found Ames was selling critical information to the Soviets. Which is itself deranged and stupid.
DonHopkins 8y ago
At the University of Maryland, our network access was through the NSA's "secret" MILNET IMP 57 at Fort Mead. It was pretty obvious that UMD got their network access via NSA, because mimsy.umd.edu had a similar "*.57" IP address as dockmaster, tycho and coins. https://emaillab.jp/dns/hosts/ https://emaillab.jp/dns/hosts/ HOST : 26.0.0.57 : TYCHO : PDP-11/70 : UNIX : TCP/TELNET,TCP/SMTP,TCP/FTP : HOST : 26.0.0.57 : DOCKMASTER.NCSC.MIL,DOCKMASTER.DCA.MIL, DOCKMASTER.ARPA : HONEYWELL-DPS-8/70 : MULTICS : TCP/TELNET,TCP/FTP,TCP/SMTP,TCP/ECHO,TCP/DISCARD,ICMP : HOST : 26.1.0.57 : COINS-GATEWAY,COINS : PLURIBUS : PLI :: HOST : 26.2.0.57, 128.8.0.8 : MARYLAND,MIMSY,UMD-CSD,UMD8,UMCP-CS : VAX-11/780 : UNIX : TCP/TELNET,TCP/FTP,TCP/SMTP,UDP,TCP/ECHO,TCP/FINGER,ICMP : https://multicians.org/site-dockmaster.html https://multicians.org/site-dockmaster.html Whenever the network went down (which was often), we had to call up a machine room at Fort Mead and ask them to please press the reset button on the box labeled "IMP 57". Sometimes the helpful person who answered the phone had no idea which box I meant, so I had describe to him which box to reset over the phone. ("Nope, that didn't work. Try the other one!" ;) They were even generous enough to issue us (CS department systems staff and undergrad students) our own MILNET TACACS card. On mimsy, you could get a list of NSA employees by typing "grep contact /etc/passwd", because each of their courtesy accounts had "network contact" in the gecos field. Before they rolled out TACACS cards, anyone could dial up an IMP and log in without a password, and connect to any host they wanted to, without even having to murder anyone like on TV: https://www.youtube.com/watch?v=hVth6T3gMa0 https://www.youtube.com/watch?v=hVth6T3gMa0
- DonHopkins 8y ago
  There were rumored to be "explosive bolts" on the ARPA/MILNET gateways (whether they were metaphorical or not, I don't know). Here's something interesting that Milo Medin wrote about dual homed sites like NSA and NASA, that were on both the ARPANET and MILNET: To: fair@ucbarpa.berkeley.edu (Erik E. Fair) Cc: Hackers_Guild@ucbvax.berkeley.edu, ucdavis!ccohesh@ucbvax.berkeley.edu Subject: Re: a question of definition Date: Thu, 29 Jan 87 15:33:35 PST From: Milo S. Medin (NASA ARC Code ED) <medin@orion.arpa> Right, the core has many gateways on it now, maybe 20-30. All the LSI's will be stubbed off the core however, and only buttergates will be left after the mailbridges and EGP peers are all converted. Actually, I think DARPA is paying for it all... Ames is *not* getting a mailbridge. You are right of course, that we could use 2 gateways, not just 1 (actually, there will be a prime and backup anyways), and then push routing info appropriately. But that's anything but simple. Firstly, the hosts have to know which gateway to send a packet to a given network, and thus have to pick between the 2. That's a bad idea. It also means that I have to pass all EGP learned info around on the local cable, and if I do that, then I can't have routing info from the local cable pass out via EGP. At least not without violating the current EGP spec. Think about it. It'd be really simple to create a loop that way. Thus, in order to maximize the use of both PSN's, you really need one gateway wired to both PSN's, and just have it advertise a default route inside. Or use a reasonble IGP, of which RIP (aka /etc/routed stuff) is not. I'm hoping to get an RFC out of BBN at this IETF meeting which may go a long way in reducing the use of RIP as an IGP. BTW, NSA is an example of a site on both MILNET and ARPANET but without a mailbridge... There is no restriction that a network can only be on ARPANET or MILNET. That goes against the Internet model of doing things. Our local NASA gatewayed nets will be advertised on both sides. The restriction on BARRNet is that the constituent elements of BARRNet do not all have access to MILNET. NSF has an understanding with DARPA and DCA that NSFnet'd sites can use ARPANET. That does not extend to the MILNET. Thus, Davis can use UCB's or Stanford's, our even NASA's ARPANET gateways, with the approval of the site of course, but not MILNET, even though NASA has MILNET coverage. Thus we are required to restrict BARRNet routing through our MILNET PSN. If we were willing to sponsor UCB's MILNET access, for some requirement which NASA had to implement, then we would turn that on. But BARRNet itself will but cutoff to MILNET (and probably ARPANET too) at Ames, but not cut off to other NASA centers or sites that NASA connects. There is no technical reason that prevents this, in fact, we have to take special measures to prevent it. But those are the rules. Anyways, mailbridge performance should improve after the conversion, so UCB should be in better shape. And you'll certainly be able to talk to us via BARRNnet... I have noticed recently that MILNET<-> ARPANET performance has been particularly poor... Sigh. The DCA folks feel that in case of an emergency they may be forced to use an unsecure network to pass certain info around. The DDN brochure mentions SIOP related data for example. Who knows, if the balloon goes up, the launch order might pass through Evans Hall on its way out to SAC... :-) Milo
baybal2 8y ago
Totally true. That Fogle guy was standing out like a white crow among the rest of the "geriatric ward" that US embassy in Russia was. Moreover, to a Russia person, it would be totally unbelievable that such pipsqueak could get to the position of a "third secretary" of anything in his short, only 5 years long career.
fit2rule 8y ago
> Organisations that can keep their mistakes secret, can make themselves seem much more capable than other, similarly large organisations. Organizations gain only corruption through secrecy. Fix the reason for having to keep a secret, and you build a strong organization.
- TallGuyShort 8y ago
  Software projects that can keep the implementation details (and bugs) of their security secret, can make themselves seem much more secure than other, similarly large projects.
nyolfen 8y ago
you should put these together as a blog post
- Arnt 8y ago
  There's a book already, https://isbn.nu/0374536279 https://isbn.nu/0374536279. It's dreadful. Well, the book is good, even great. What's dreadful is the mistakes one can commit when the consequences are secret. The CIA would send a 35-year-old spy out with a cover job that only accepted applicants up to the age of 28, and then send a polite letter to the Russians informing them of his arrival. Meanwhile there was a giant search for the mole at CIA HQ, because there had to be one, how else would the Russians unmask so many agents so quickly?
aaron695 8y ago
Salon is crap, borders on fake news if you believe in that term. I really wish there was a way to read articles without giving click (Then give one if it was even marginally good, which here, as usual, it's awful) There is nothing in this article of note. Here's a hint, CIA agents are just journalists that don't report in the open. They are often pretty stupid to average, but merely knowing the local language and reading newspapers is enough to have high value. This is what they do..... It's pretty boring stuff. Knowing who's CIA in a embassy and who's not is pretty useless info. Obviously everyone is a security risk. What the Russians did that rocked was fool the US into thinking they had more info than they did. Low level terrorism. The alleged killings in OP will only be locals, and locals passing on info that any local bilingual person could. Spy sounds fancy, but in RL it's not. (I guess it can get you killed, which is kinda fancy, but it'd be a pretty boring killing 99.99% they drive to your house and arrest you like a common criminal)

by Arnt 8y ago

AlexCoventry 8y ago

> Organisations that can keep their mistakes secret, can make themselves seem much more capable And also much slower to learn from their mistakes. The history of the CIA is pretty depressing, in this regard. https://en.wikipedia.org/wiki/Legacy_of_Ashes_(book) https://en.wikipedia.org/wiki/Legacy_of_Ashes_(book)

ryanmarsh 8y ago
Legacy of Ashes does a pretty good job to that end... https://www.amazon.com/Legacy-Ashes-History-Tim-Weiner/dp/0307389006 https://www.amazon.com/Legacy-Ashes-History-Tim-Weiner/dp/03...

commandlinefan 8y ago

> SELECT * FROM EMBASSY_EMPLOYEES WHERE CIA ftfy

stevew20 8y ago

TL;DR

dorfsmay 8y ago

> SELECT * WHERE CIA FROM EMBASSY_EMPLOYEES Although I personally don't find this type of humour funny I can understand why beginners use it. However, if you are going to use it, please make an effort and get it right. In your attempt to showing off, you're just showing you don't know basic SQL.

danharaj 8y ago
Care to guess what you've said about yourself with this critical comment? :^)
brrt 8y ago
This is actually (almost) legal in teradata sql, which doesn't enforce clause order, but it doesn't accept an identifier as a predicate.

closeparen 8y ago

My understanding is that official cover is more a matter of politeness than secrecy. An embassy employee is obviously a foreign agent in some capacity. The real game is preventing the host country from discovering links between official-cover and non-official-cover agents, since the latter group’s affiliation is actually secret.

std_throwawayay 8y ago

So, they were basically relying on metadata to inspect an organization. If anything, this shows the power of metadata.

dev_dull 8y ago

> The CIA does appear to have lucked out when it comes to Russia. The Intelligence Agency ring fences its Russian activities and the report states that intel chiefs were quick to harden up its Russian communications channel at the first sign of trouble. Your post makes a lot of sense for that above line in the article. Maybe Russia would rather keep tabs on them as known-people rather than murder them. China seemed to have taken it personally, which is ironic given their vast purported corporate espionage spy networks.

3pt14159 8y ago
China is much less pluralistic than Russia. It's more important to send a message to locals than it is to poison the information.
unchocked 8y ago
These are different kinds of agents. Those described in the above comment were US nationals in Russia operating under diplomatic cover, and are not subject to Russian law. They would be deported. Russian nationals working for the CIA would not be found by that search. The agents in the story were Chinese/Iranian/etc. nationals working for the CIA. They had no diplomatic protection, which is why they were killed.
- Arnt 8y ago
  Different, certainly. What about it? Do you mean that the people who were careless with one group would be careful with the other? That the people who issued one car model to the real cultural attachés and another model to the CIA agents would be very careful about the agents who risk their lives?

EliRivers 8y ago

Adam Curtis has a piece, in the style of Adam Curtis, wondering if spies (well, in this particular case, mostly spy catchers) simply aren't very good at their job; http://www.bbc.co.uk/blogs/adamcurtis/entries/3662a707-0af9-3149-963f-47bea720b460 http://www.bbc.co.uk/blogs/adamcurtis/entries/3662a707-0af9-...

gniv 8y ago
Wow. Thanks for posting this. It's a better read than anything currently on the front page of HN.
Gibbon1 8y ago
Also possible corrupt, Aldrich Ames was living way beyond his means for a decade before he got caught. And the CIA knew it. My assumption has been the CIA turns a blind eye when it's high level agents pass information to 'friendly' governments and corporations, and so were gobsmacked when they found Ames was selling critical information to the Soviets. Which is itself deranged and stupid.

DonHopkins 8y ago

At the University of Maryland, our network access was through the NSA's "secret" MILNET IMP 57 at Fort Mead. It was pretty obvious that UMD got their network access via NSA, because mimsy.umd.edu had a similar "*.57" IP address as dockmaster, tycho and coins. https://emaillab.jp/dns/hosts/ https://emaillab.jp/dns/hosts/ HOST : 26.0.0.57 : TYCHO : PDP-11/70 : UNIX : TCP/TELNET,TCP/SMTP,TCP/FTP : HOST : 26.0.0.57 : DOCKMASTER.NCSC.MIL,DOCKMASTER.DCA.MIL, DOCKMASTER.ARPA : HONEYWELL-DPS-8/70 : MULTICS : TCP/TELNET,TCP/FTP,TCP/SMTP,TCP/ECHO,TCP/DISCARD,ICMP : HOST : 26.1.0.57 : COINS-GATEWAY,COINS : PLURIBUS : PLI :: HOST : 26.2.0.57, 128.8.0.8 : MARYLAND,MIMSY,UMD-CSD,UMD8,UMCP-CS : VAX-11/780 : UNIX : TCP/TELNET,TCP/FTP,TCP/SMTP,UDP,TCP/ECHO,TCP/FINGER,ICMP : https://multicians.org/site-dockmaster.html https://multicians.org/site-dockmaster.html Whenever the network went down (which was often), we had to call up a machine room at Fort Mead and ask them to please press the reset button on the box labeled "IMP 57". Sometimes the helpful person who answered the phone had no idea which box I meant, so I had describe to him which box to reset over the phone. ("Nope, that didn't work. Try the other one!" ;) They were even generous enough to issue us (CS department systems staff and undergrad students) our own MILNET TACACS card. On mimsy, you could get a list of NSA employees by typing "grep contact /etc/passwd", because each of their courtesy accounts had "network contact" in the gecos field. Before they rolled out TACACS cards, anyone could dial up an IMP and log in without a password, and connect to any host they wanted to, without even having to murder anyone like on TV: https://www.youtube.com/watch?v=hVth6T3gMa0 https://www.youtube.com/watch?v=hVth6T3gMa0

DonHopkins 8y ago
There were rumored to be "explosive bolts" on the ARPA/MILNET gateways (whether they were metaphorical or not, I don't know). Here's something interesting that Milo Medin wrote about dual homed sites like NSA and NASA, that were on both the ARPANET and MILNET: To: fair@ucbarpa.berkeley.edu (Erik E. Fair) Cc: Hackers_Guild@ucbvax.berkeley.edu, ucdavis!ccohesh@ucbvax.berkeley.edu Subject: Re: a question of definition Date: Thu, 29 Jan 87 15:33:35 PST From: Milo S. Medin (NASA ARC Code ED) <medin@orion.arpa> Right, the core has many gateways on it now, maybe 20-30. All the LSI's will be stubbed off the core however, and only buttergates will be left after the mailbridges and EGP peers are all converted. Actually, I think DARPA is paying for it all... Ames is *not* getting a mailbridge. You are right of course, that we could use 2 gateways, not just 1 (actually, there will be a prime and backup anyways), and then push routing info appropriately. But that's anything but simple. Firstly, the hosts have to know which gateway to send a packet to a given network, and thus have to pick between the 2. That's a bad idea. It also means that I have to pass all EGP learned info around on the local cable, and if I do that, then I can't have routing info from the local cable pass out via EGP. At least not without violating the current EGP spec. Think about it. It'd be really simple to create a loop that way. Thus, in order to maximize the use of both PSN's, you really need one gateway wired to both PSN's, and just have it advertise a default route inside. Or use a reasonble IGP, of which RIP (aka /etc/routed stuff) is not. I'm hoping to get an RFC out of BBN at this IETF meeting which may go a long way in reducing the use of RIP as an IGP. BTW, NSA is an example of a site on both MILNET and ARPANET but without a mailbridge... There is no restriction that a network can only be on ARPANET or MILNET. That goes against the Internet model of doing things. Our local NASA gatewayed nets will be advertised on both sides. The restriction on BARRNet is that the constituent elements of BARRNet do not all have access to MILNET. NSF has an understanding with DARPA and DCA that NSFnet'd sites can use ARPANET. That does not extend to the MILNET. Thus, Davis can use UCB's or Stanford's, our even NASA's ARPANET gateways, with the approval of the site of course, but not MILNET, even though NASA has MILNET coverage. Thus we are required to restrict BARRNet routing through our MILNET PSN. If we were willing to sponsor UCB's MILNET access, for some requirement which NASA had to implement, then we would turn that on. But BARRNet itself will but cutoff to MILNET (and probably ARPANET too) at Ames, but not cut off to other NASA centers or sites that NASA connects. There is no technical reason that prevents this, in fact, we have to take special measures to prevent it. But those are the rules. Anyways, mailbridge performance should improve after the conversion, so UCB should be in better shape. And you'll certainly be able to talk to us via BARRNnet... I have noticed recently that MILNET<-> ARPANET performance has been particularly poor... Sigh. The DCA folks feel that in case of an emergency they may be forced to use an unsecure network to pass certain info around. The DDN brochure mentions SIOP related data for example. Who knows, if the balloon goes up, the launch order might pass through Evans Hall on its way out to SAC... :-) Milo

baybal2 8y ago

Totally true. That Fogle guy was standing out like a white crow among the rest of the "geriatric ward" that US embassy in Russia was. Moreover, to a Russia person, it would be totally unbelievable that such pipsqueak could get to the position of a "third secretary" of anything in his short, only 5 years long career.

fit2rule 8y ago

> Organisations that can keep their mistakes secret, can make themselves seem much more capable than other, similarly large organisations. Organizations gain only corruption through secrecy. Fix the reason for having to keep a secret, and you build a strong organization.

TallGuyShort 8y ago
Software projects that can keep the implementation details (and bugs) of their security secret, can make themselves seem much more secure than other, similarly large projects.

nyolfen 8y ago

you should put these together as a blog post

Arnt 8y ago
There's a book already, https://isbn.nu/0374536279 https://isbn.nu/0374536279. It's dreadful. Well, the book is good, even great. What's dreadful is the mistakes one can commit when the consequences are secret. The CIA would send a 35-year-old spy out with a cover job that only accepted applicants up to the age of 28, and then send a polite letter to the Russians informing them of his arrival. Meanwhile there was a giant search for the mole at CIA HQ, because there had to be one, how else would the Russians unmask so many agents so quickly?

aaron695 8y ago

Salon is crap, borders on fake news if you believe in that term. I really wish there was a way to read articles without giving click (Then give one if it was even marginally good, which here, as usual, it's awful) There is nothing in this article of note. Here's a hint, CIA agents are just journalists that don't report in the open. They are often pretty stupid to average, but merely knowing the local language and reading newspapers is enough to have high value. This is what they do..... It's pretty boring stuff. Knowing who's CIA in a embassy and who's not is pretty useless info. Obviously everyone is a security risk. What the Russians did that rocked was fool the US into thinking they had more info than they did. Low level terrorism. The alleged killings in OP will only be locals, and locals passing on info that any local bilingual person could. Spy sounds fancy, but in RL it's not. (I guess it can get you killed, which is kinda fancy, but it'd be a pretty boring killing 99.99% they drive to your house and arrest you like a common criminal)