4 ms·

The question is, why did they need an informal communication channel? What made this easy, and why was using a correct channel considered too difficult? Maybe E

The question is, why did they need an informal communication channel? What made this easy, and why was using a correct channel considered too difficult? Maybe Edward Tufte will write about this someday, as this might be another example where user interface design ended up having a big impact on world history (Tufte has written about John Snow using a clever map to end the cholera epidemic in London in 1853 and the Challenger shuttle disaster of 1986, the launch being allowed partly because the engineers from Thiokol were not able to present their information in a comprehensible way). The article says: "But the rest of the agency had become too reliant on the system, which was originally intended to only be a temporary communications channel, and had left the relatively insecure site up far longer than intended and used it to send information that should have been reserved for more secure channels. "It was never meant to be used long term for people to talk to sources," the report quotes one official as saying." So why did it last so long? What did it offer that the more official channels did not? What kept the agency from developing technology that might have allowed better protected communication channels that might have also been easy to use? Protected communication is not a sideline for the CIA, it is the core competency. This is something the CIA is supposed to be good at.

ardy42 8y ago
> The question is, why did they need an informal communication channel? What made this easy, and why was using a correct channel considered too difficult? My understanding is that this channel was used for "un-vetted" sources, which I take to mean sources the CIA didn't yet fully trust with their main communications systems. I'm sure they're constantly approached by double-agents looking for information about how they communicate with their sources, so they need more "throwaway" systems for people who potentially could be double agents to use. The original reporting is better than this Register summary: https://www.yahoo.com/news/cias-communications-suffered-catastrophic-compromise-started-iran-090018710.html https://www.yahoo.com/news/cias-communications-suffered-cata.... I think Ars Technica had a better summary: https://arstechnica.com/tech-policy/2018/11/how-did-iran-find-cia-spies-they-googled-it/ https://arstechnica.com/tech-policy/2018/11/how-did-iran-fin....
- platz 8y ago
  This makes sense. Poor contingent hires couldn't even get basic auth, eh
boomboomsubban 8y ago
>So why did it last so long? What did it offer that the more official channels did not? What kept the agency from developing technology that might have allowed better protected communication channels that might have also been easy to use? It hadn't been broken, so why bother? Sure one of our employees is telling us that it's dangerously insecure, but if its so bad why hasn't it been compromised?
dorfsmay 8y ago
> So why did it last so long? "It's temporary unless it works" - Red Green. I always fight temporary solutions because there is a perception that one does not need to be as rigorous with temporary solutions. Then there is no sense of urgency for a replacement because this one works, it becomes a "technical debt", a "nice to have", and never gets fixed. In some cases, lack of rigour is the one functionality everybody loves that cannot be removed (security vs convenience). https://en.wikipedia.org/wiki/The_Red_Green_Show#Red_Green https://en.wikipedia.org/wiki/The_Red_Green_Show#Red_Green https://www.youtube.com/watch?v=pY7nx5Z6Kzo&t=3m41s https://www.youtube.com/watch?v=pY7nx5Z6Kzo&t=3m41s
- chrisfinne 8y ago
  Wow, that Red Green show is hilarious. Plan to waste the rest of the morning on it.
- TearsInTheRain 8y ago
  Broken code gets fixed, bad code lasts forever
spdionis 8y ago
For the same reason POCs or unfinished software runs in production.
alexandros 8y ago
A Greek saying goes: Ουδέν μονιμότερον του προσωρινού. (There is nothing more permanent than the temporary) I keep thinking about it when building out information system architectures, especially ones that interface with end users. Bad design is metastatic and unbelievably hard to get out of. Whatever the cost of reversing a bad design decision you have in mind, 10x it and you still might not be truly there.

ardy42 8y ago

> The question is, why did they need an informal communication channel? What made this easy, and why was using a correct channel considered too difficult? My understanding is that this channel was used for "un-vetted" sources, which I take to mean sources the CIA didn't yet fully trust with their main communications systems. I'm sure they're constantly approached by double-agents looking for information about how they communicate with their sources, so they need more "throwaway" systems for people who potentially could be double agents to use. The original reporting is better than this Register summary: https://www.yahoo.com/news/cias-communications-suffered-catastrophic-compromise-started-iran-090018710.html https://www.yahoo.com/news/cias-communications-suffered-cata.... I think Ars Technica had a better summary: https://arstechnica.com/tech-policy/2018/11/how-did-iran-find-cia-spies-they-googled-it/ https://arstechnica.com/tech-policy/2018/11/how-did-iran-fin....

platz 8y ago
This makes sense. Poor contingent hires couldn't even get basic auth, eh

boomboomsubban 8y ago

>So why did it last so long? What did it offer that the more official channels did not? What kept the agency from developing technology that might have allowed better protected communication channels that might have also been easy to use? It hadn't been broken, so why bother? Sure one of our employees is telling us that it's dangerously insecure, but if its so bad why hasn't it been compromised?

dorfsmay 8y ago

> So why did it last so long? "It's temporary unless it works" - Red Green. I always fight temporary solutions because there is a perception that one does not need to be as rigorous with temporary solutions. Then there is no sense of urgency for a replacement because this one works, it becomes a "technical debt", a "nice to have", and never gets fixed. In some cases, lack of rigour is the one functionality everybody loves that cannot be removed (security vs convenience). https://en.wikipedia.org/wiki/The_Red_Green_Show#Red_Green https://en.wikipedia.org/wiki/The_Red_Green_Show#Red_Green https://www.youtube.com/watch?v=pY7nx5Z6Kzo&t=3m41s https://www.youtube.com/watch?v=pY7nx5Z6Kzo&t=3m41s

chrisfinne 8y ago
Wow, that Red Green show is hilarious. Plan to waste the rest of the morning on it.
TearsInTheRain 8y ago
Broken code gets fixed, bad code lasts forever

spdionis 8y ago

For the same reason POCs or unfinished software runs in production.

alexandros 8y ago

A Greek saying goes: Ουδέν μονιμότερον του προσωρινού. (There is nothing more permanent than the temporary) I keep thinking about it when building out information system architectures, especially ones that interface with end users. Bad design is metastatic and unbelievably hard to get out of. Whatever the cost of reversing a bad design decision you have in mind, 10x it and you still might not be truly there.