9 ms·

You’re assuming leaker is not actively being monitored, mail carriers’ non-public methods of identifying anonymous/fake senders do not overlap OpSec failure of

You’re assuming leaker is not actively being monitored, mail carriers’ non-public methods of identifying anonymous/fake senders do not overlap OpSec failure of sender, assuming printer & content steganography doesn’t apply, unusual device tracking counter surveillance techniques are not a red flag, leaker understands counter biological forensic identification measures, etc. Point is OpSec is HARD — and telling someone “just physically deliver it” is a recipe for failure.

vorpalhex 4y ago
The theory that if you ever leak something that you are going to be positively identified by CSI style forensic science and it is basically impossible to leak something without spy agency level methods is, itself, a tool to stop leaks. We know your printer! We track you everywhere! We have your fingerprints! We can pull your DNA from a letter! It is beneficial to the powers that be that ordinary citizens believe they are good at their jobs and omniscient. They are not. Yes, to a great degree, this matters on your adversary. The truth is that most whistleblowers are not Edward Snowden. They are whistleblowing on their employer, who is probably a private company or small government org. The bar to exceed detection does not require you to be James Bond or to understand quantum cryptography. It requires gloves, a cheap printer, and maybe a trip to the thrift store and the post box. If your adversary is the NSA/FBI/KGB/Whoever, well, you know, plan accordingly. But that probably isn't your adversary. Your adversary is probably a mediocre IT security company that has trouble getting their techs to change their passwords and struggles to analyze whatever data they do collect from client endpoints. Don't under-estimate your adversary but also don't over-estimate them either.
- O__________O 4y ago
  You are doing threat and risk assessments, which is 101 of basic OpSec. What is not basic OpSec is making blanket statements without context.
  - vorpalhex 4y ago
    Risk is not binary. It's a statistical function predicting the likelihood of an outcome. We can bucket that risk in most cases. There are schelling points. People, regular boring unsophisticated people, frequently successfully mail hardcore drugs through the postal system. This is with the postal system having an actual objective to stop them. Overwhelmingly the postal service fails at this, and even when it does interdict the drugs, it almost never identifies the sender. How much more quaint is it to send documents. The goal of "OpSec" is to achieve the goal. If "OpSec" acts as a forever barrier because it can't successfully predict real life risk, you're doing it wrong.
    - O__________O 4y ago
      In my experience you’re wrong. Most OpSec failures are not magical or require massive resources but minor single mistake. Beyond that, OpSec is a skill that requires practice. If you only apply only when needed, odds of failure significantly increase. Since you claim to know so much about what national mail systems know about a piece of mail, what specifically is your understanding of what they know?
      - vorpalhex 4y ago
        Mail enters postal services from multiple points. This can be postboxes, collection and so on, but also other vendors, non-national post offices (universities, big corps), and international entries. These are batched, scanned (OCR applied), with method of entry tagged to the mail piece. Pieces are risk scored using an unknown to us algorithm. Pieces that trigger being suspicious can be x-ray'd, CT scanned or imaged (eg TSA style scanning) and may also be opened by the postmaster. There's a whole long bit of what happens once a package is found to actually be contraband that I am going to skip because it's long. Any piece of mail has attached to it the information on it, it's weight, dimensions and entry point into the system. Your collection point will potentially capture more materials, depending. Mail offices are government offices and behave like it - security footage, ID checks when doing business, cameras typically behind the desk to capture faces. That footage is typically housed locally unless there is a reason to send it. There is a standard retention policy but variances exist per office. Mail from other points is much, much less secured and may have no additional security. Mailboxes, in the US especially, do not get government operated video monitoring. Private parties such as HOAs or cities may add their own.

vorpalhex 4y ago

The theory that if you ever leak something that you are going to be positively identified by CSI style forensic science and it is basically impossible to leak something without spy agency level methods is, itself, a tool to stop leaks. We know your printer! We track you everywhere! We have your fingerprints! We can pull your DNA from a letter! It is beneficial to the powers that be that ordinary citizens believe they are good at their jobs and omniscient. They are not. Yes, to a great degree, this matters on your adversary. The truth is that most whistleblowers are not Edward Snowden. They are whistleblowing on their employer, who is probably a private company or small government org. The bar to exceed detection does not require you to be James Bond or to understand quantum cryptography. It requires gloves, a cheap printer, and maybe a trip to the thrift store and the post box. If your adversary is the NSA/FBI/KGB/Whoever, well, you know, plan accordingly. But that probably isn't your adversary. Your adversary is probably a mediocre IT security company that has trouble getting their techs to change their passwords and struggles to analyze whatever data they do collect from client endpoints. Don't under-estimate your adversary but also don't over-estimate them either.

O__________O 4y ago
You are doing threat and risk assessments, which is 101 of basic OpSec. What is not basic OpSec is making blanket statements without context.
- vorpalhex 4y ago
  Risk is not binary. It's a statistical function predicting the likelihood of an outcome. We can bucket that risk in most cases. There are schelling points. People, regular boring unsophisticated people, frequently successfully mail hardcore drugs through the postal system. This is with the postal system having an actual objective to stop them. Overwhelmingly the postal service fails at this, and even when it does interdict the drugs, it almost never identifies the sender. How much more quaint is it to send documents. The goal of "OpSec" is to achieve the goal. If "OpSec" acts as a forever barrier because it can't successfully predict real life risk, you're doing it wrong.
  - O__________O 4y ago
    In my experience you’re wrong. Most OpSec failures are not magical or require massive resources but minor single mistake. Beyond that, OpSec is a skill that requires practice. If you only apply only when needed, odds of failure significantly increase. Since you claim to know so much about what national mail systems know about a piece of mail, what specifically is your understanding of what they know?
    - vorpalhex 4y ago
      Mail enters postal services from multiple points. This can be postboxes, collection and so on, but also other vendors, non-national post offices (universities, big corps), and international entries. These are batched, scanned (OCR applied), with method of entry tagged to the mail piece. Pieces are risk scored using an unknown to us algorithm. Pieces that trigger being suspicious can be x-ray'd, CT scanned or imaged (eg TSA style scanning) and may also be opened by the postmaster. There's a whole long bit of what happens once a package is found to actually be contraband that I am going to skip because it's long. Any piece of mail has attached to it the information on it, it's weight, dimensions and entry point into the system. Your collection point will potentially capture more materials, depending. Mail offices are government offices and behave like it - security footage, ID checks when doing business, cameras typically behind the desk to capture faces. That footage is typically housed locally unless there is a reason to send it. There is a standard retention policy but variances exist per office. Mail from other points is much, much less secured and may have no additional security. Mailboxes, in the US especially, do not get government operated video monitoring. Private parties such as HOAs or cities may add their own.