6 ms·

It is absolutely amazing to me that terrorist organizations would not use encrypted email.

by maqr 15y ago

abbasmehdi 15y ago
Can't rely on encryption because hard to know when and how it is cracked (you only find out after its too late). Much easier to just create an account to send just one email and then delete the account (after it is sent), or just never use it again.
- swaits 15y ago
  What?
  - smhinsey 15y ago
    I think the basic argument is "use a one-time pad" but it assumes that an unencrypted but unique email account meets the same requirements as a cryptographic one-time pad, which I don't think I agree with. That being said, I probably wouldn't use encryption anyway. I wouldn't do anything that might cause my correspondence to receive any further scrutiny whatsoever.
    - maqr 15y ago
      You use encryption every day already, you just don't think about it. For all of HTTPS's faults, it's so transparent that you don't even think of it as encrypted communication. If PKI apps and MUAs didn't suck so much, we'd probably all treat email the same way.
      - smhinsey 15y ago
        I would definitely use HTTPS, but that's not really what I had in mind. When I said I wouldn't use encryption I was thinking specifically about PKI stuff like PGP, precisely because like you say, it sucks to use it. Badly enough that I think it would make you stick out and receive additional scrutiny if you did.
  - deleted 15y ago
    [deleted]
  - abbasmehdi 15y ago
    The idea for a criminal is to mix in with the world not enter in a technological arm wrestling match with a superpower. Their strength is obscurity, not tech muscle - and if they try to fight from that angle then it’s just a matter of time till they lose. The US army cannot hide itself (the pentagon has an address) but it can apply a lot of money in cracking their encryption. Al-Qida cannot invest heavily in R&D but can keep the US army confused by mixing in and out with the general public. This is why a criminal tries to act and behave just like you, a non-criminal, so they mix in with the crowd and get attention off them so they can engage in what they do best, jumping jacks and monkey bars. ;)
    - MikeCapone 15y ago
      You can do all that they did AND add encryption on top.
      - abbasmehdi 15y ago
        Uncle Al once said: The best way to get caught is to send an encrypted email from a dusty little Pakistani town's internet cafe once a month (from where no one ever sends encrypted emails). It is like shooting a flare on a dark night.
        weavejester 15y ago
        And sending a plain-text email discussing terrorist plots is somehow less conspicuous?
        abbasmehdi 15y ago
        Yes. Been to the mall with a ski mask on during the holiday season before? ;)
        weavejester 15y ago
        You seem to assume that encrypted communications are somehow rare or unusual. A large proportion of internet traffic is encrypted.
trotsky 15y ago
Hiding in plain sight has a lot of different meanings. Cryptography stands out a lot more than bickering among old men. Besides, which tools to trust? The PRC clearly distrusts many western crypto systems, why would AQ feel any differently?
- mail2345 15y ago
  If I remember correctly, there was at least one homemade cryptographic system they used in the past, but the US got a hold of it(and probably found a hole in it).
- JoachimSchipper 15y ago
  Those are good points, but he could still have, at least, used something like TrueCrypt for his archives.
  - troels 15y ago
    How do you know that CIA don't have a backdoor to TrueCrypt?
    - eneveu 15y ago
      Who cares if the CIA has a backdoor? It's still better to encrypt his archives than using plaintext. The chance the CIA might have a backdoor is lower than the chance the CIA might decipher plaintext. Of course, you'd have to use a non-networked computer for this, in case Truecrypt phones home...
      - troels 15y ago
        Well, the article didn't say that they were archived in plain text. For what we know, it may have been encrypted with TrueCrypt, and it may be readable by CIA.
andrewcooke 15y ago
well they probably were using a code (not a cipher). "when will the next batch of loaves be ready?" etc. [i am disappointed the article doesn't even mention that kind of detail; never mind describing how they avoid traffic patterns (presumably they have protocols for changing email addresses, times and subjects)]
scrod 15y ago
>It is absolutely amazing to me that terrorist organizations would not use encrypted email. This is excellent observation, especially as so much of the justification for limiting, restricting, or circumventing encryption on the part of intelligence agencies has been that "terrorists" would employ it to communicate.

It is absolutely amazing to me that terrorist organizations would not use encrypted email.

by maqr 15y ago

It is absolutely amazing to me that terrorist organizations would not use encrypted email.

Can't rely on encryption because hard to know when and how it is cracked (you only find out after its too late). Much easier to just create an account to send just one email and then delete the account (after it is sent), or just never use it again.

swaits 15y ago
What?
- smhinsey 15y ago
  I think the basic argument is "use a one-time pad" but it assumes that an unencrypted but unique email account meets the same requirements as a cryptographic one-time pad, which I don't think I agree with. That being said, I probably wouldn't use encryption anyway. I wouldn't do anything that might cause my correspondence to receive any further scrutiny whatsoever.
  - maqr 15y ago
    You use encryption every day already, you just don't think about it. For all of HTTPS's faults, it's so transparent that you don't even think of it as encrypted communication. If PKI apps and MUAs didn't suck so much, we'd probably all treat email the same way.
    - smhinsey 15y ago
      I would definitely use HTTPS, but that's not really what I had in mind. When I said I wouldn't use encryption I was thinking specifically about PKI stuff like PGP, precisely because like you say, it sucks to use it. Badly enough that I think it would make you stick out and receive additional scrutiny if you did.
- deleted 15y ago
  [deleted]
- abbasmehdi 15y ago
  The idea for a criminal is to mix in with the world not enter in a technological arm wrestling match with a superpower. Their strength is obscurity, not tech muscle - and if they try to fight from that angle then it’s just a matter of time till they lose. The US army cannot hide itself (the pentagon has an address) but it can apply a lot of money in cracking their encryption. Al-Qida cannot invest heavily in R&D but can keep the US army confused by mixing in and out with the general public. This is why a criminal tries to act and behave just like you, a non-criminal, so they mix in with the crowd and get attention off them so they can engage in what they do best, jumping jacks and monkey bars. ;)
  - MikeCapone 15y ago
    You can do all that they did AND add encryption on top.
    - abbasmehdi 15y ago
      Uncle Al once said: The best way to get caught is to send an encrypted email from a dusty little Pakistani town's internet cafe once a month (from where no one ever sends encrypted emails). It is like shooting a flare on a dark night.
      - weavejester 15y ago
        And sending a plain-text email discussing terrorist plots is somehow less conspicuous?
        abbasmehdi 15y ago
        Yes. Been to the mall with a ski mask on during the holiday season before? ;)
        weavejester 15y ago
        You seem to assume that encrypted communications are somehow rare or unusual. A large proportion of internet traffic is encrypted.

trotsky 15y ago

Hiding in plain sight has a lot of different meanings. Cryptography stands out a lot more than bickering among old men. Besides, which tools to trust? The PRC clearly distrusts many western crypto systems, why would AQ feel any differently?

mail2345 15y ago
If I remember correctly, there was at least one homemade cryptographic system they used in the past, but the US got a hold of it(and probably found a hole in it).
JoachimSchipper 15y ago
Those are good points, but he could still have, at least, used something like TrueCrypt for his archives.
- troels 15y ago
  How do you know that CIA don't have a backdoor to TrueCrypt?
  - eneveu 15y ago
    Who cares if the CIA has a backdoor? It's still better to encrypt his archives than using plaintext. The chance the CIA might have a backdoor is lower than the chance the CIA might decipher plaintext. Of course, you'd have to use a non-networked computer for this, in case Truecrypt phones home...
    - troels 15y ago
      Well, the article didn't say that they were archived in plain text. For what we know, it may have been encrypted with TrueCrypt, and it may be readable by CIA.

andrewcooke 15y ago

well they probably were using a code (not a cipher). "when will the next batch of loaves be ready?" etc. [i am disappointed the article doesn't even mention that kind of detail; never mind describing how they avoid traffic patterns (presumably they have protocols for changing email addresses, times and subjects)]

scrod 15y ago

>It is absolutely amazing to me that terrorist organizations would not use encrypted email. This is excellent observation, especially as so much of the justification for limiting, restricting, or circumventing encryption on the part of intelligence agencies has been that "terrorists" would employ it to communicate.