11 ms·
How Bin Laden Sent and Received Email
- luigi 15y agoOnly slighty more roundabout than RMS's system for browsing the web.
- macrael 15y agoThere doesn't seem to be a mention of encryption anywhere. I'm surprised they didn't avail themselves of a little PGP. If a giant notorious terrorist organization isn't using public key cryptography, who is?
- clistctrl 15y agoI wonder if that would actually work against them. Assuming the government has some system that is reading all emails sent to country x, they may specifically sniff emails that match a certain signature... such as one that was encrypted. Its probably less revealing to setup a code around every day language and problems.
- davidbanham 15y agoThat's a good argument for sending the actual emails in plaintext, but it doesn't explain why the storage drives weren't heavily encrypted.
- bcaulf 15y agoThat's exactly right. I am dumbfounded that they didn't protect everything.
- tokenadult 15y agoCan any foreign terrorist organization count on having encryption that would defeat the National Security Agency's efforts to break the encryption? Surely the first thing for anyone hiding from the United States government to do is simply practice good tradecraft (as bin Laden and his group have long done) and never let the message be accessible to the United States government in the first place. I wouldn't count on PGP or any other software solution for encryption that is readily available worldwide to be secure against NSA attempts to decrypt it. That's especially what any "high value" terrorism suspect should keep in mind.
- yummyfajitas 15y agoPGP encrypted emails protect the contents of the email. They don't prevent eavesdroppers from knowing an email was sent, or where it came from.
- runjake 15y agoIn the past, Al Qaeda operatives have expressed a belief that PGP is tainted/backdoored/etc by the US government, so they generally shun it. It's probably better for attempting to elude the NSA, as well. Get lost in the mix, as opposed to having big large red flags in your messages.
- ericmoritz 15y agoWhy not GPG? It's open source, unless there's some crazy obfuscation in the source code it would be pretty hard to hide a backdoor in plain sight.
- alexg0 15y agoOne would hope terrorist organizations don't have technical expertise to code review PGP.
- aasarava 15y agoYet several had the expertise to fly commercial airliners. A number of top Al Qaeda leaders went to college in the U.S. It wouldn't be implausible for some terrorists to take courses in computer science.
- ceejayoz 15y agoWhile I don't doubt Al Qaeda has some skilled technical folks, piloting a commercial airliner isn't much of a feat if you don't intend to land the thing.
- jrockway 15y agoLanding in good weather is not particularly difficult. What's difficult is handling error conditions: the landing gear won't go down, an engine has failed, some instruments are out or misbehaving. Landing the airliner, safely, under those conditions require critical thinking, good flying skills, and practice. If you are planning on only taking one flight, you don't need to be good at this stuff, because it's unlikely that you will encounter any problems on that particular flight. (Lots of people have died because of inadequate training in these areas. Eastern Flight 401 is a good example: http://en.wikipedia.org/wiki/Eastern_Air_Lines_Flight_401 http://en.wikipedia.org/wiki/Eastern_Air_Lines_Flight_401. The crew was so busy debugging a faulty light bulb that they forgot to fly the plane. It crashed into a swamp.)
- maqr 15y agoIt is absolutely amazing to me that terrorist organizations would not use encrypted email.
- abbasmehdi 15y agoCan't rely on encryption because hard to know when and how it is cracked (you only find out after its too late). Much easier to just create an account to send just one email and then delete the account (after it is sent), or just never use it again.
- swaits 15y agoWhat?
- smhinsey 15y agoI think the basic argument is "use a one-time pad" but it assumes that an unencrypted but unique email account meets the same requirements as a cryptographic one-time pad, which I don't think I agree with. That being said, I probably wouldn't use encryption anyway. I wouldn't do anything that might cause my correspondence to receive any further scrutiny whatsoever.
- maqr 15y agoYou use encryption every day already, you just don't think about it. For all of HTTPS's faults, it's so transparent that you don't even think of it as encrypted communication. If PKI apps and MUAs didn't suck so much, we'd probably all treat email the same way.
- smhinsey 15y agoI would definitely use HTTPS, but that's not really what I had in mind. When I said I wouldn't use encryption I was thinking specifically about PKI stuff like PGP, precisely because like you say, it sucks to use it. Badly enough that I think it would make you stick out and receive additional scrutiny if you did.
- kloncks 15y agoI remember watching the movie "Traitor" a few years back and wondering if Al Qaida used something similar to what the fictional terrorists were using in that movie. (From what I remember, they were merely writing messages and saving them as drafts. Then others would log on and read the drafts. No emails were sent.) Interesting though how much he relied on couriers.
- shazow 15y agoI recall that this was the strategy that the 9/11 terrorists used to communicate. I suppose that the Richard Stallman approach is the next evolution of it.
- kloncks 15y agoWhat's the Richard Stallman approach to it?
- astrodust 15y agoSomething involving EMACS.
- shazow 15y agoSynchronizing mail (and other online assets) offline via a periodic push/pull process, similar to the USB-stick process. For personal reasons, I do not browse the web from my computer. (I also have not net connection much of the time.) To look at page I send mail to a demon which runs wget and mails the page back to me. It is very efficient use of my time, but it is slow in real time. http://article.gmane.org/gmane.os.openbsd.misc/134979 http://article.gmane.org/gmane.os.openbsd.misc/134979 Also elsewhere he says that he rarely has an active internet connection, so presumably the demon runs and mailserver flushes during the window that his internet is on.
- dguido 15y agoLots of malware actually uses this to communicate with infected hosts now-a-days. You see it a lot in the backdoors used for more targeted attacks. AFAIK, going wayyy back, this strategy was first talked about by Sophsec at an infosec conference in 2006. They made a library called libomg that would log into social networks and webmail to communicate with infected bots and they had various strategies for doing so. The most hilarious was the myspace module which automatically set up networks of teen girls who chatted in uh teen-speak, which were actually hidden commands for the other bots to log in and retrieve. It was awesome.
- tejaswiy 15y agotl; dr: Write email. Copy to USB. Give it to courier who takes it to a distant internet cafe and sends it out. Incoming email is copied into the same USB and delivered back.
- MikeCapone 15y agoThat was so anti-climactic. I was expecting something a bit more sophisticated after all the hype at the beginning of the article. ROT13 at least...
- dave1010uk 15y agoROT13 is easily reversible. It looks like he used 2ROT13. http://www.mobikom.at/2rot13.pdf http://www.mobikom.at/2rot13.pdf
- MikeCapone 15y agoI was kidding about ROT13. I would have expected at least AES-256 hidden via steganography inside photos or sound files..
- dave1010uk 15y agoI knew you were joking; just get reminded of that paper when I see ROT13 mentioned.
- MikeCapone 15y agoSorry, I misread your comment. Good one :)
- known 15y agothanks teja
- rl41 15y agoTurns out the most spectacular part of it was how dedicated he was to it, with apparently hundreds of flash drives full of emails. Even that isn't so spectacular though, considering this is someone dedicated enough to his cause to successfully plan and execute terrorist acts as a career.
- cynusx 15y agoAccording to my girlfriend who grew up in Africa, this is normal behavior when you have to pay for internet by the minute.
- kragen 15y agoWhat software is most popular for doing this? I wrote my own when I was in Venezuela, but I imagine there's some popular stuff already out there?
- darklajid 15y agoI cannot help but think of the recent story about Knuth and his secretary, reading (and replying to) mail by proxy as well..
- ericmoritz 15y agoSMTP over sneakernet
- mcdowall 15y agoThis doesn't surprise me, having 100+ USB's lying around with content does.
- magoghm 15y agoSame here. That part makes me question if the information from that "counterterrorism official" is reliable.
- aohtsab 15y agoA simple SOCKS proxy would have saved him a lot of trouble.
- nikcub 15y agoIn effect he was using a proxy, just one that he knew he could trust
- ramdac 15y agoor thought he could. Isn't that what ultimately took him down?
- nikcub 15y agoyes. but apparently he had a group of couriers, so we don't know if the couriers who were running the USB disks to internet café's were the same as the two brothers who owned the house apparently he had a number of trusted couriers, and judging from what I have read on tracking these couriers down[1], it wouldn't surprise me if he had multiple levels of courier for his email [1] apparently the couriers were so good at counter-surveillance that even when the CIA had tracked one of the brothers down to Pakistan, it took them two years to link them to the compound, since they both took exhaustive counter-intelligence measures to make sure they were not tracked. amazing story
- deleted 15y ago[deleted]
- zwieback 15y agoSurely the lamest thing I read today. I was expecting some elaborate multiple encryption and obfuscation scheme involving proxies and anonymisers in addition to sneaker net in and out of the hideout.
- arkitaip 15y agoPretty lo-tech solution but it worked for many years so why not. What's surprising is that they left behind so many usb flash drives; with them being so cheap why not buy hundreds of low capacity drives and destroying them after each dispatch.
- ciupicri 15y agoWhy should they destroyed them? I think they wanted to keep them.
- gfodor 15y agoFor all the cheering about Bin Laden's demise, its this trove of information that people really should be cheering about. It sounds like they basically got a full snapshot of the Al Quada organization at the time of the raid. Intelligence analysts right now must be the having the most thrilling yet most critically intense time of their careers.
- Super_Jambo 15y agoThis flags up all sorts of wrong. A counter terrorism official demands anonymity to tell us some very mundane facts: 1) Bin Laden sent e-mail. 2) He sent it via a very simple if slow method. 3) The US has these e-mails including the receiving address. Why would they publish this tipping off their targets? Why does the official require anonymity? A nasty thought does occur which is that this makes an excellent reason for governments to insist that ISPs and email providers hold all emails indefinitely for future investigations.
- joezydeco 15y agoI would think the targets got tipped off when news of the Bin Laden raid was announced.
- carussell 15y agoThe hype-to-content of this article is ridiculous. It was a slow, toilsome process. And it was so meticulous that even veteran intelligence officials have marveled at bin Laden's ability to maintain it for so long. Really? Really? It's still more efficient than traditional post, and I'm guessing there wouldn't be this level of hullabaloo if that had been the mode of communication.
- ArcticCelt 15y agoAlso, the www became more or less mainstream in the mid 90s and mainly for college students and young professionals or tech workers in western countries. He went in full hiding in 2001 but was already hard to find since a couple of years and living in Afghanistan. For how long did he really used email? The answer is probably anything from zero years to five. Like you said, looks to me that the system he was using was a faster and more efficient system than the classic pen and paper he used all his life.
- mahmud 15y agoWhy did they use USB sticks and not something that courier can chew/swallow, like MicroSD?
- jrockway 15y agoWhy rely on digesting electronics when cryptography is just as secure?
- mahmud 15y agoDeniable. Cryptography doesn't do you any good if there are guys with a car battery asking you very pointed questions, like "where did you get this encrypted disk"? With MicroSD in your mouth, they wont even get the idea to question you.
- jrockway 15y agoWe didn't exactly give bin Laden a lot of time to answer any questions. We found him and shot him. Encrypted documents would have remained safe after his death, but that MicroSD would be a goldmine of information that will compromise his other operatives.
- mahmud 15y agoI was addressing the transportation step of the message, not its long term storage. From OBL to net-cafe, the dude carrying it would be safer with a MicroSD, encrypted or otherwise.
- dude_abides 15y agoI doubt if the computers in most internet cafes in remote parts of Pakistan would have MicroSD readers.
- mahmud 15y agoMicroSD to USB adapter costs $0.75 per unit to produce. I sold them out of China in 2007.
- jrockway 15y agoI think strong crypto + several VPN providers would be as safe and easier to automate. (This, BTW, is why I am generally against anti-piracy enforcement actions and warantless wiretapping. When you force normal people to use strong cryptography and VPN providers or mesh networks, the terrorists are much harder to pick out. They just look like kids downloading movies.)
- nickmolnar2 15y agoDoesn't this system still lead to a large trail of emails going back to Pakistan (assuming the courier didn't go all the way into Afghanistan to send each email). Presumably, some of the computers that were on the receiving end of those emails have been seized by US intelligence in various raids. The IP of the sender would be easy to trace for the CIA, and the content of the emails would have at least indicated that the sender was in a key decision-making position within the organization. Without some other security steps, like VPNs or proxies, the US would have certainly been able to trace the country of origin of these communications.
- karlzt 15y agothis article doesn't even mention email!