7 ms·

China Spying on Undersea Internet Cables

150 points by hsnewman 8y ago

EastToWest 8y ago
"As I have repeatedly said, we need to decide if we are going to build our future Internet systems for security or surveillance. Either everyone gets to spy, or no one gets to spy. And I believe we must choose security over surveillance, and implement a defense-dominant strategy." Can't agree more!
- w8vY7ER 8y ago
  hear, hear
- dogma1138 8y ago
  Even if you encrypt all traffic they can still spy you can't prevent physical attacks nor can you prevent government spying trought warrants or by compromising the service and content providers. It doesn't matter if Facebook is going to be accessible trough TOR only or not if the NSA or any other capable intelligence agency can compromise Facebook. Even if you do somehow manage to put all physical transport links in the hands of some impenetrable organization the US and China would just send a sub to the ocean and tap the cables. And just like it's granted that AT&T cables can be accessed by US authorities China can access anything that a Chinese company lays down and likely even with more ease.
  - dontbenebby 8y ago
    >Even if you encrypt all traffic they can still spy you can't prevent physical attacks Yes but a vast swathe of attacks are stopped with good encryption. Recall for example that TLS ("HTTPS") provides integrity verification, not just encryption.
    - dogma1138 8y ago
      Yes they are but it also doesn't have anything to do with this attack vector where the ISP/backbone is the point of compromise.
      - vlovich123 8y ago
        A) If the traffic going over the backbone is properly encrypted compromise of the backbone doesn't accomplish anything. B) Why can't the backbone nodes be encrypted too so that any attempt to splice the fiber would result in a break of the connection?
        dogma1138 8y ago
        Some quantom cryptography can work but it's very iffy and expensive, there are ways to detect taps and even when a cable is bent. Simply cutting the connection because the signal was interupted won't work, not to mention that many taps can be inserted without interruption and it's not like the NSA can't figure out how to work around maintenance windows. But in this case it's not even a covert unauthorized tap it's a Chinese company ofc they'll cooperate with the Chinese government. But again encryption doesn't prevent physical attacks of this sort they can still suck all the data out and while it maybe useless unless they can decrypt it this vector has nothing to do with building a secure internet. The problem is that even if you encrypt everything state actors can simply go one step up the chain at the end of the day someone needs to be able to decrypt your packets besides you.
  - burfog 8y ago
    It does seem odd that traffic between nations is apparently not encrypted by agreement of those nations, with nation-pair crypto keys. For example, a link from Vatican City to San Marino should be protected from Italy. A link from Bolivia to Switzerland should be protected from all the other countries along the route.
ttul 8y ago
I wonder how much value there is in tapping undersea cables anymore. HTTPS is pretty well established and companies are encrypting traffic between data centers.
- deleted 8y ago
  [deleted]
- kitotik 8y ago
  Metadata and DPI is still pretty informative.
  - sgt101 8y ago
    Depends where in the network you are and what transport you are using. WAN is a different game to access.
  - dnautics 8y ago
    it seems like the obvious solution would be to buy bandwidth on those and just send a continuous bytestream over the cable, as a transport layer, say between "2" and "3" and someone would just have to implement the standard protocols (tcp/udp) over a subscription service to the moving bytestream.
- Gpetrium 8y ago
  I will try to exemplify internet cables with a fisherman going into the ocean. The person can take a variety of strategies to achieve their goals, here are a few: - Fisherman goes to X location because he knows at that time he will be able to catch tuna & mackerels. - Fisherman goes to a random location capturing whatever he can. He can later decide what is of value or not, whether he will throw it back into the ocean or not is up to the captain. - Fisherman goes to a random location and captures everything. There seems to be some stuff he doesn't know if it is edible or not, but it doesn't matter. He can store the catch and see if he can cook it later. Some of the catches will spoil before you are able to figure out whether it is edible or not, others can be useful decades later.
- TheSpiciestDev 8y ago
HAL9000Ti 8y ago
I'm already being spyed on by the USA, and have been for probably decades, what's the difference?
- DennisP 8y ago
  As the article says, "This shouldn't surprise anyone. For years, the US and the Five Eyes have had a monopoly on spying on the Internet around the globe. Other countries want in."
  - kurthr 8y ago
    Yes, but now China can check to be sure that the data they have tunneled out of the Five Eyes stores are accurate... see that's getting real intelligence information :^)
  - dsl 8y ago
    Which has a bad taste of whataboutism. The huge difference is the NSA collects to achieve political goals. China spies for political and economic benefit. Foreign businesses are frequently targeted with the singular goals of IP theft or gaining leverage in business negotiations.
    - DennisP 8y ago
      Usually "whataboutism" is an attempt to deflect blame; I doubt that was Schneier's intent. The NSA claims it doesn't do economic espionage but there's evidence suggesting otherwise. Google brings up plenty of articles. For example: https://theintercept.com/2014/09/05/us-governments-plans-use-economic-espionage-benefit-american-corporations/ https://theintercept.com/2014/09/05/us-governments-plans-use... https://www.techdirt.com/articles/20150629/16134031494/nsa-despite-claiming-it-doesnt-engage-economic-espionage-engaged-economic-espionage.shtml https://www.techdirt.com/articles/20150629/16134031494/nsa-d...
    - A2017U1 8y ago
      Wow. I'm always astonished by the people who think economic espionage isn't a huge part of Western intelligence services. It is. The Americans just hide it better and it's entirely within their mandate. China couldn't care less if the world finds out. France is absolutely running wild and has been for decades. Australia has been caught planting bugs in foreign leaders offices for the sole purpose of an oil companies business deal.
BurningFrog 8y ago
I always wonder how big the spy traffic is? How many times is the average packet on the internet copied for surveillance purposes, and how much does it slow down the net as a whole?
fisherwithac 8y ago
Security has been the red-headed stepchild of software and, in some cases, hardware innovation for a long time. And I agree that it's important to take steps to ensure that changes. I think two simple principles should be remembered to facilitate this: 1. Most end users will choose convenience over security 2. Security without usability is a compromise to security If developers of these innovative technologies take the time to implement tried-and-tested security/privacy controls while providing easy-to-undersatnd education for non-technical users, then I believe things can certainly improve.
chrisseaton 8y ago
I'm sure all large countries are spying on undersea internet cables.
chris_mc 8y ago
Are we just making China the Boogeyman now on hacker news? I'm not trying to be a whataboutist, but literally everything China is doing had been done for decades by everyone else capable of doing that thing. Why are we suddenly up in arms about China?
- turtlecloud 8y ago
  elites attempting to distract population and create scapegoat for impending economic/sociological/demographic crisis.
- FakeComments 8y ago
  Because the US is engaged in a strategic struggle with China over ideological dominance and influence on world events. You can see the conflict spanning the South China see to trade relations and economic investment to accusations both directions of misconduct in technology manufacturing. China has been getting more aggressive due to perceived US weakness, and this kind of PR is part of a multi-pronged US response. As are increased prosecutions for financial crimes and kicking up a fuss over the trade deal.
trpc 8y ago
much of the internet traffic is served over TLS these days, DPI and such equipment are becoming more and more useless. But hey, up to L4 is still plaintext!
Leary 8y ago
So where in the article does it say that China is spying on the cables?
sandworm101 8y ago
They aren't spying on "undersea cables". They aren't sending subs down to split fibers or plant taps. Those days are long gone. They are perhaps tapping at point where cables leave the shore, but even that is old hat. With everything being encrypted, and the sheer volume of traffic, intel agencies these days find it much easier to go to the source. If the NSA or China want to read your email, they don't tap undersea cables. They go directly to your email/text/cell service and siphon only the data they want. Or, for things like meta data/location tracking, they can just buy the data like any other company. That is the real future: the commoditization of espionage.
- smokeyj 8y ago
  > and siphon only the data they want All of it. If they can't decrypt it now they'll save it until they can.
  - onetimemanytime 8y ago
    >> If they can't decrypt it now they'll save it until they can. Save it on what? Can someone do a back of the envelope calculation on what it takes to back "all of it" for an indeterminate amount of time?
    - marssaxman 8y ago
      Someone could, someone did, and this was the result: https://en.wikipedia.org/wiki/Utah_Data_Center https://en.wikipedia.org/wiki/Utah_Data_Center
    - paulmd 8y ago
      Hard drive production is about 400 million drives per year. https://www.statista.com/statistics/275336/global-shipment-figures-for-hard-disk-drives-from-4th-quarter-2010/ https://www.statista.com/statistics/275336/global-shipment-f... In 2017, global IP traffic was 1.5 ZB per year, or 1.5 billion terabytes. So assuming you were using 10TB drives you'd need 150 million hard drives per year, or about 37% of global production. https://www.cisco.com/c/en/us/solutions/collateral/service-provider/visual-networking-index-vni/white-paper-c11-741490.html https://www.cisco.com/c/en/us/solutions/collateral/service-p... You can dump any traffic that originates from a bulk traffic provider like Netflix, Youtube, Prime, Xbox Live Download, etc - it would be sufficient to collect metadata if you were interested in this at all. This source suggests that content makes up about 33% of global IP traffic, with unspecified media providers (probably porn) making up another 15% or so, so on the whole you can probably round that up to between 40 and 50%. https://www.cbronline.com/news/internet-encryption-sandvine https://www.cbronline.com/news/internet-encryption-sandvine From there the numbers get a little squishy depending on your estimates of various categories of traffic and how conservative you want to be about discarding content. In theory you can discard anything that you can collect from another source - i.e. stuff like gmail, you can get from google directly, no need to capture that. If you are not interested in retaining un-encrypted content, you could dump a bunch more. Only about 50% of traffic is encrypted, although that is probably weighted towards non-bulk content being the encrypted stuff. If you can dump, let's say 75% of all non-bulk content then you'd be looking at retaining about 12.5% of total IP traffic, 187.5 million terabytes per year, which would require 18.75 million drives per year, or about 4.69% of global production. You could, of course, blow it all down to tape filed according to cipher, and then read it back in when you have broken it. No need to keep everything online forever when it's not broken yet. LTO-8 tapes are 12 TB each (encrypted data will not compress), so the numbers work out similarly to 10 TB drives. LTO tape production is a lot smaller though, about 20 million tapes per year, so there is not enough tape sold to do that, unless you are doing a private factory to produce your own tapes. But at that scale, it would probably be more affordable than drives. Some people speculate that Amazon Glacier is actually a library of BDXL discs and that they are purchasing big batches from factories. That's about 125 GB per disc, but in bulk they are probably also cheaper than drives as well. https://en.wikipedia.org/wiki/Linear_Tape-Open#/media/File:LTO_cartridge_sales.svg https://en.wikipedia.org/wiki/Linear_Tape-Open#/media/File:L... FWIW Snowden's docs suggested that they were only retaining data for a month (iirc) and then dumping it, but it's possible they could be selectively retaining encrypted data for longer. Presumably the Utah datacenter was built for a reason. I would assume that at this point they have "high-risk" selectors that automatically get pulled out but that they are probably not collecting everything everything and keeping it forever. Also, a footnote here is that this would be a logistically significant operation, you would either need your own parallel data links with a significant fraction of the capacity of the primary backbone (far beyond what SIPRNET/NIPRNET likely can support), or you would need to be moving shipping containers of drives/tapes back to Utah like Amazon Snowmobile. You'd also need people regularly going into those tap rooms to change out the drives and so on. It would be high maintenance to attempt this.
stebann 8y ago
How do they analyze the traffic? Is it possible to get something from these actions?

150 points by hsnewman 8y ago

"As I have repeatedly said, we need to decide if we are going to build our future Internet systems for security or surveillance. Either everyone gets to spy, or no one gets to spy. And I believe we must choose security over surveillance, and implement a defense-dominant strategy." Can't agree more!

w8vY7ER 8y ago
hear, hear
dogma1138 8y ago
Even if you encrypt all traffic they can still spy you can't prevent physical attacks nor can you prevent government spying trought warrants or by compromising the service and content providers. It doesn't matter if Facebook is going to be accessible trough TOR only or not if the NSA or any other capable intelligence agency can compromise Facebook. Even if you do somehow manage to put all physical transport links in the hands of some impenetrable organization the US and China would just send a sub to the ocean and tap the cables. And just like it's granted that AT&T cables can be accessed by US authorities China can access anything that a Chinese company lays down and likely even with more ease.
- dontbenebby 8y ago
  >Even if you encrypt all traffic they can still spy you can't prevent physical attacks Yes but a vast swathe of attacks are stopped with good encryption. Recall for example that TLS ("HTTPS") provides integrity verification, not just encryption.
  - dogma1138 8y ago
    Yes they are but it also doesn't have anything to do with this attack vector where the ISP/backbone is the point of compromise.
    - vlovich123 8y ago
      A) If the traffic going over the backbone is properly encrypted compromise of the backbone doesn't accomplish anything. B) Why can't the backbone nodes be encrypted too so that any attempt to splice the fiber would result in a break of the connection?
      - dogma1138 8y ago
        Some quantom cryptography can work but it's very iffy and expensive, there are ways to detect taps and even when a cable is bent. Simply cutting the connection because the signal was interupted won't work, not to mention that many taps can be inserted without interruption and it's not like the NSA can't figure out how to work around maintenance windows. But in this case it's not even a covert unauthorized tap it's a Chinese company ofc they'll cooperate with the Chinese government. But again encryption doesn't prevent physical attacks of this sort they can still suck all the data out and while it maybe useless unless they can decrypt it this vector has nothing to do with building a secure internet. The problem is that even if you encrypt everything state actors can simply go one step up the chain at the end of the day someone needs to be able to decrypt your packets besides you.
- burfog 8y ago
  It does seem odd that traffic between nations is apparently not encrypted by agreement of those nations, with nation-pair crypto keys. For example, a link from Vatican City to San Marino should be protected from Italy. A link from Bolivia to Switzerland should be protected from all the other countries along the route.

ttul 8y ago

I wonder how much value there is in tapping undersea cables anymore. HTTPS is pretty well established and companies are encrypting traffic between data centers.

deleted 8y ago
[deleted]
kitotik 8y ago
Metadata and DPI is still pretty informative.
- sgt101 8y ago
  Depends where in the network you are and what transport you are using. WAN is a different game to access.
- dnautics 8y ago
  it seems like the obvious solution would be to buy bandwidth on those and just send a continuous bytestream over the cable, as a transport layer, say between "2" and "3" and someone would just have to implement the standard protocols (tcp/udp) over a subscription service to the moving bytestream.
Gpetrium 8y ago
I will try to exemplify internet cables with a fisherman going into the ocean. The person can take a variety of strategies to achieve their goals, here are a few: - Fisherman goes to X location because he knows at that time he will be able to catch tuna & mackerels. - Fisherman goes to a random location capturing whatever he can. He can later decide what is of value or not, whether he will throw it back into the ocean or not is up to the captain. - Fisherman goes to a random location and captures everything. There seems to be some stuff he doesn't know if it is edible or not, but it doesn't matter. He can store the catch and see if he can cook it later. Some of the catches will spoil before you are able to figure out whether it is edible or not, others can be useful decades later.
TheSpiciestDev 8y ago

HAL9000Ti 8y ago

I'm already being spyed on by the USA, and have been for probably decades, what's the difference?

DennisP 8y ago
As the article says, "This shouldn't surprise anyone. For years, the US and the Five Eyes have had a monopoly on spying on the Internet around the globe. Other countries want in."
- kurthr 8y ago
  Yes, but now China can check to be sure that the data they have tunneled out of the Five Eyes stores are accurate... see that's getting real intelligence information :^)
- dsl 8y ago
  Which has a bad taste of whataboutism. The huge difference is the NSA collects to achieve political goals. China spies for political and economic benefit. Foreign businesses are frequently targeted with the singular goals of IP theft or gaining leverage in business negotiations.
  - DennisP 8y ago
    Usually "whataboutism" is an attempt to deflect blame; I doubt that was Schneier's intent. The NSA claims it doesn't do economic espionage but there's evidence suggesting otherwise. Google brings up plenty of articles. For example: https://theintercept.com/2014/09/05/us-governments-plans-use-economic-espionage-benefit-american-corporations/ https://theintercept.com/2014/09/05/us-governments-plans-use... https://www.techdirt.com/articles/20150629/16134031494/nsa-despite-claiming-it-doesnt-engage-economic-espionage-engaged-economic-espionage.shtml https://www.techdirt.com/articles/20150629/16134031494/nsa-d...
  - A2017U1 8y ago
    Wow. I'm always astonished by the people who think economic espionage isn't a huge part of Western intelligence services. It is. The Americans just hide it better and it's entirely within their mandate. China couldn't care less if the world finds out. France is absolutely running wild and has been for decades. Australia has been caught planting bugs in foreign leaders offices for the sole purpose of an oil companies business deal.

BurningFrog 8y ago

I always wonder how big the spy traffic is? How many times is the average packet on the internet copied for surveillance purposes, and how much does it slow down the net as a whole?

fisherwithac 8y ago

Security has been the red-headed stepchild of software and, in some cases, hardware innovation for a long time. And I agree that it's important to take steps to ensure that changes. I think two simple principles should be remembered to facilitate this: 1. Most end users will choose convenience over security 2. Security without usability is a compromise to security If developers of these innovative technologies take the time to implement tried-and-tested security/privacy controls while providing easy-to-undersatnd education for non-technical users, then I believe things can certainly improve.

chrisseaton 8y ago

I'm sure all large countries are spying on undersea internet cables.

chris_mc 8y ago

Are we just making China the Boogeyman now on hacker news? I'm not trying to be a whataboutist, but literally everything China is doing had been done for decades by everyone else capable of doing that thing. Why are we suddenly up in arms about China?

turtlecloud 8y ago
elites attempting to distract population and create scapegoat for impending economic/sociological/demographic crisis.
FakeComments 8y ago
Because the US is engaged in a strategic struggle with China over ideological dominance and influence on world events. You can see the conflict spanning the South China see to trade relations and economic investment to accusations both directions of misconduct in technology manufacturing. China has been getting more aggressive due to perceived US weakness, and this kind of PR is part of a multi-pronged US response. As are increased prosecutions for financial crimes and kicking up a fuss over the trade deal.

trpc 8y ago

much of the internet traffic is served over TLS these days, DPI and such equipment are becoming more and more useless. But hey, up to L4 is still plaintext!

Leary 8y ago

So where in the article does it say that China is spying on the cables?

sandworm101 8y ago

They aren't spying on "undersea cables". They aren't sending subs down to split fibers or plant taps. Those days are long gone. They are perhaps tapping at point where cables leave the shore, but even that is old hat. With everything being encrypted, and the sheer volume of traffic, intel agencies these days find it much easier to go to the source. If the NSA or China want to read your email, they don't tap undersea cables. They go directly to your email/text/cell service and siphon only the data they want. Or, for things like meta data/location tracking, they can just buy the data like any other company. That is the real future: the commoditization of espionage.

smokeyj 8y ago
> and siphon only the data they want All of it. If they can't decrypt it now they'll save it until they can.
- onetimemanytime 8y ago
  >> If they can't decrypt it now they'll save it until they can. Save it on what? Can someone do a back of the envelope calculation on what it takes to back "all of it" for an indeterminate amount of time?
  - marssaxman 8y ago
    Someone could, someone did, and this was the result: https://en.wikipedia.org/wiki/Utah_Data_Center https://en.wikipedia.org/wiki/Utah_Data_Center
  - paulmd 8y ago
    Hard drive production is about 400 million drives per year. https://www.statista.com/statistics/275336/global-shipment-figures-for-hard-disk-drives-from-4th-quarter-2010/ https://www.statista.com/statistics/275336/global-shipment-f... In 2017, global IP traffic was 1.5 ZB per year, or 1.5 billion terabytes. So assuming you were using 10TB drives you'd need 150 million hard drives per year, or about 37% of global production. https://www.cisco.com/c/en/us/solutions/collateral/service-provider/visual-networking-index-vni/white-paper-c11-741490.html https://www.cisco.com/c/en/us/solutions/collateral/service-p... You can dump any traffic that originates from a bulk traffic provider like Netflix, Youtube, Prime, Xbox Live Download, etc - it would be sufficient to collect metadata if you were interested in this at all. This source suggests that content makes up about 33% of global IP traffic, with unspecified media providers (probably porn) making up another 15% or so, so on the whole you can probably round that up to between 40 and 50%. https://www.cbronline.com/news/internet-encryption-sandvine https://www.cbronline.com/news/internet-encryption-sandvine From there the numbers get a little squishy depending on your estimates of various categories of traffic and how conservative you want to be about discarding content. In theory you can discard anything that you can collect from another source - i.e. stuff like gmail, you can get from google directly, no need to capture that. If you are not interested in retaining un-encrypted content, you could dump a bunch more. Only about 50% of traffic is encrypted, although that is probably weighted towards non-bulk content being the encrypted stuff. If you can dump, let's say 75% of all non-bulk content then you'd be looking at retaining about 12.5% of total IP traffic, 187.5 million terabytes per year, which would require 18.75 million drives per year, or about 4.69% of global production. You could, of course, blow it all down to tape filed according to cipher, and then read it back in when you have broken it. No need to keep everything online forever when it's not broken yet. LTO-8 tapes are 12 TB each (encrypted data will not compress), so the numbers work out similarly to 10 TB drives. LTO tape production is a lot smaller though, about 20 million tapes per year, so there is not enough tape sold to do that, unless you are doing a private factory to produce your own tapes. But at that scale, it would probably be more affordable than drives. Some people speculate that Amazon Glacier is actually a library of BDXL discs and that they are purchasing big batches from factories. That's about 125 GB per disc, but in bulk they are probably also cheaper than drives as well. https://en.wikipedia.org/wiki/Linear_Tape-Open#/media/File:LTO_cartridge_sales.svg https://en.wikipedia.org/wiki/Linear_Tape-Open#/media/File:L... FWIW Snowden's docs suggested that they were only retaining data for a month (iirc) and then dumping it, but it's possible they could be selectively retaining encrypted data for longer. Presumably the Utah datacenter was built for a reason. I would assume that at this point they have "high-risk" selectors that automatically get pulled out but that they are probably not collecting everything everything and keeping it forever. Also, a footnote here is that this would be a logistically significant operation, you would either need your own parallel data links with a significant fraction of the capacity of the primary backbone (far beyond what SIPRNET/NIPRNET likely can support), or you would need to be moving shipping containers of drives/tapes back to Utah like Amazon Snowmobile. You'd also need people regularly going into those tap rooms to change out the drives and so on. It would be high maintenance to attempt this.

stebann 8y ago

How do they analyze the traffic? Is it possible to get something from these actions?