7 ms·

CIA 2010 covert communication websites

212 points by hosteur 3y ago

jgtrosh 3y ago
> WTF the CIA was doing in Brazil in the early 2010s! Wasn't the Military dictatorship in Brazil enough! Not to justify the CIA or anything, but that's exactly where I would most expect them to be actively conducting covert operations
- cm2187 3y ago
  These seems to be related to intelligence gathering. The CIA like all other intelligence services in the world gather intelligence on any country of interest. Including on most european allies.
  - KirillPanov 3y ago
    I'm going to start describing ransomware gangs as merely "gathering" cryptocurrency.
- fit2rule 3y ago
  [dead]
- cirosantilli 3y ago
  Why "most expect"? Certainly there would have been greater focus on dictatorships/war zones? The target of websites found so far support this. I can understand the desire to gather intelligence from every other nation, even allies. But I do believe it's a bad idea. E.g. Brazil seems to be aligning with China more and more... largely economic driven. But no need to also give it political backing.
  - deleted 3y ago
    [deleted]
  - oilchange 3y ago
    > I can understand the desire to gather intelligence from every other nation, even allies. But I do believe it's a bad idea. Intelligence agencies primarily spy on 'allies'. The biggest spy rings in the US are our "allies" - british, canadian, israeli, japanese, korean, etc. The biggest spy rings the soviet union had were in poland, ukraine, hungary, etc - aka their "allies". We have an infinitely larger spy ring in south korea than in north korea because holding onto an "ally" like south korea is far more important than converting an "enemy" like north korea. It's why we demanded all our "allies" stop using huwaei tech because it would prevent us from spying on our allies. It wasn't about china spying on our "allies". Who cares about that? It's about our ability to spy on them. The naive watch silly hollywood movies and think that's reality. Most of the spying during the cold war wasn't between the US and Soviet Union. It was mostly between warsaw pact "allies" and between NATO "allies". > Brazil seems to be aligning with China more and more... They should. Brazil's enemy is the US, not China. Might want to read up on the Monroe Doctrine. Think about it. The country that wants to keep brazil in check isn't china. It's the US. If Brazil has ambitions of being a major power, then it makes them our enemy and vice versa.
- closewith 3y ago
  To be clear, in the period in question, Brazil was (and is) a democracy. The military dictatorship mentioned is the 1964 _Golpe_ or coup, which may have been partially instigated by US intelligence services. The resulting military dictatorship was immediately recognised by the US and was responsible for innumerable human rights abuses until it fell in 1985. This dictatorship and the US support for it is one of the main reasons that Brazil remains suspicious of the US and a primary driver behind it's continuing courtship of Russia and China.
sigg3 3y ago
Show some love for archive.org for WBM: https://archive.org/donate/ https://archive.org/donate/
- cirosantilli 3y ago
  And also consider showing me some love! XD https://cirosantilli.com/sponsor https://cirosantilli.com/sponsor
possiblelion 3y ago
Has anyone decompiled the .jar files used for covert communication? Would be quite interesting to see how they work. On another note it is easy to shame the CIA for making such a basic mistake as using subsequent IP numbers/same file layouts on sites. Of course they should be, but funnily enough mistakes such as these happen in every intelligence service. As example would be the Russian military intelligence (GRU/GU) who have for years sent agents abroad with fake/cleaned Russian passports. Only problem being of course that the passport numbers were sequential and as in the case of the CIA websites, if you identified one agent and his passport, you could look up the next ones in line on databases and identify all the other active agents as well. Reference for GRU passports: https://www.voanews.com/a/russia-gru-operatives-unmasked/4602595.html https://www.voanews.com/a/russia-gru-operatives-unmasked/460...
- boomboomsubban 3y ago
  Do we know of a GRU officer that brought this flaw up and was fired for it? As that seems to be what happened to John Reidy.
- detrites 3y ago
  > but funnily enough mistakes such as these happen in every intelligence service There's advantage in appearing incompetent and creating traps to distract from actual active capabilities that are working.
  - eastbound 3y ago
    We have no element to let us think that the actual active capabilities are any better than that. Do you know any elite who goes working for agencies? How can they remain elite if they don’t write on their work, share it with others, recoup best practices during conferences, etc.?
    - detrites 3y ago
      I've no idea how to interpret your comment in way that isn't bizarre. You seem to state you think competitive advantage in intelligence activity - and in military activity for that matter, as they are deeply intertwined - doesn't exist. And that the reason it doesn't is because everyone involved has to constantly leak and brag all their confidential secrets out in the open so they will be considered hireable by other agencies tasked with secret-keeping? Have I read that right?
boomboomsubban 3y ago
I don't really see how so many of these ended up in the wayback machine. My understanding is that they were supposed to seem like fairly unremarkable websites, but were built for basically one person. So it seems surprising that so many were visited by unrelated people. Is there a log of who instigated a wayback archive? Could they have been a different group doing what this person was? >Given that we cannot rule out ongoing risks to CIA employees or assets, we are not publishing full technical details regarding our process of mapping out the network at this time I guess it's a hard thing to rule out, but I certainly hope the CIA isn't still using a communication method broken more than a decade ago.
- exikyut 3y ago
  > Is there a log of who instigated a wayback archive? Could they have been a different group doing what this person was? Yes, IA now has a "About this capture" popdown at the far right of the injected toolbar. The first ever capture and some of the subsequent captures for one of the sites was from Alexa Crawls, provided by Alexa Internet; some later captures were from a "Survey Crawl" based on "a list of every host in the wayback machine". So this is basically automated, long-tail vacuum cleaning work.
  - boomboomsubban 3y ago
    I apparently misunderstood how the wayback machine worked. I thought it only archived pages that a user requested, and most pages end up archived due to people with the browser add-on installed to archive every page they visit. Thanks to both people that cleared up my mistake, it has always seemed they had much stronger coverage than they should for my mistaken view of how it worked.
    - emikulic 3y ago
      You're thinking of archive.is
  - cirosantilli 3y ago
    I wonder how Alexa found those domains in the first place. Were there links to them, or did it use some kind of DNS dump?
sokoloff 3y ago
> democracies have to work together and build mutual trust, and not spy on one another. The first part seems true, but the second part doesn’t follow. Spying on allies seems an entirely reasonable, possibly even necessary, part of effective diplomacy. I trust what you are saying more when I can verify congruence with things I can observe.
- cumshitpiss 3y ago
  [dead]
- H8crilA 3y ago
  Sąd, but true. The sad part is that it can give "unfair" advantages to the party that is better at spying abroad and/or counterintelligence at home. After all every alliance has some points of conflict (see the Inflation Reduction Act vs Europe, as an example).
- cirosantilli 3y ago
  The problem is if these things are found and become public, it makes the targeted country really dislike the spying country. This creates a political pressure against aligning with the spying country. Many Brazilians are deeply distrustful of the USA, and are even willing to align themselves with dictatorships. Personally, I'll never support a dictatorship. But many people will just to have an alternative world power pole. Alliances are like friendships. If you spy one your friends, of course they are going to get mad and push you away. We have instead to make opt-in intelligence sharing programs with our allies.
- dingdongg 3y ago
  well, others may see it differently..
- wongarsu 3y ago
  A key part here is "democracies". Between dictatorships, mutual spying to establish trust can be a reasonable policy. But a democracy has to factor in the opinion of their citizens. People tend to dislike foreign countries spying on them, and will create incentives for their government to distance themselves from such countries. Even if you try to keep it on the down-low, it makes it really easy for a third country to drive a wedge in the relationship.
nailer 3y ago
This article was hard to follow, if you want to see what the actual website looked like, and how the informant would communicate back to the CIA, scroll about halfway down this Reuters article: https://www.reuters.com/investigates/special-report/usa-spies-iran/ https://www.reuters.com/investigates/special-report/usa-spie...
- ljf 3y ago
  Amazing article and well worth a read to discover how these sites would have worked in practice. It deserves a submission of its own.
  - bombcar 3y ago
    It's interesting to consider "how would you build it better" - especially when you realize that half of the equation is trained, educated, and safely in America, the other half is potentially anyone in the world anywhere. If both sides are educated and trained, you can do things like hiding messages in quasi-randomly selected posts on Hacker News; but that quickly breaks down if one side doesn't have the skillset needed to hide their actions that way. Things like TOR can help, but that can be difficult to completely hide, and so on.
    - cirosantilli 3y ago
      I think it is pretty safe to assume that essentially all opponents are capable. In particular, intelligence is one of the first things dictatorships will invest in, partly to spy on their own people, which the leaders fear above all else. The ideal communication mechanism is one that blends in with a huge number of other "legitimate" users. E.g. for Tor, it only works if many people are also using Tor for other non-spy things. I wonder why not just email.
      - bombcar 3y ago
        I'm honestly a bit surprised that they haven't really been pushing "using Tor for piracy" to create additional cover traffic. Email has many problems but may be better than most, but you need to use something like gmail which everyone is using, and even that may be noticeable. Once they suspect you, you're pretty much done for unless you find out that you're on the list and you stop communicating outbound. It's much harder to track one-way broadcast communications (many still think that there are/were communications to spies hidden in BBC shortwave broadcasts, and numbers stations are still a thing).
kekebo 3y ago
Darknet Diaries podcast covered this issue in this episode: https://darknetdiaries.com/episode/75/ https://darknetdiaries.com/episode/75/
iandanforth 3y ago
Anyone written a de-cringe browser plugin? Maybe there is interesting content here but the third person, exclamation point ridden, conspiracy thinking on display is too much.
- cirosantilli 3y ago
  Third person: https://cirosantilli.com/why-ciro-santilli-refers-to-himself-in-the-third-person https://cirosantilli.com/why-ciro-santilli-refers-to-himself... Conspiracy thinking: Example?
KRAKRISMOTT 3y ago
Why do they all redirect to https://wakatime.com/ https://wakatime.com/ Is wakatime ran by three letter agencies?
- deleted 3y ago
  [deleted]
- fivepis 3y ago
  The Wakatime.com domain was registered in 2013 around the same time these covert websites were all being replaced. Also the creator of wakatime is an American living in Vienna, known to be the city of spies.
- cirosantilli 3y ago
  Nice, I hadn't noticed that! I'll add a mention to the article. Some do fail DNS resolution though.
- cirosantilli 3y ago
  I have researched this now. According to https://tools.whoisxmlapi.com/whois-history-search https://tools.whoisxmlapi.com/whois-history-search the domains were registered June 11, 2023, shortly after my article came out. They are therefore likely just made by wakatime's founder Alan Hamlett: https://www.linkedin.com/in/alanhamlett/ https://www.linkedin.com/in/alanhamlett/ as a bit of Guerrilla Marketing. Fair play. When I saw on LinkedIn that he worked for a web security contractor until September 2013, I almost flipped. But appears unrelated however unfortunately except for his general interst in WEBSEC, so another dead end.
mahathu 3y ago
That entire website is quite a rabbit hole to fall into. https://cirosantilli.com/ciro-santilli https://cirosantilli.com/ciro-santilli
- faangsticle 3y ago
  This guy really likes his own name.
- MichaelZuo 3y ago
  Yeah it seems a bit odd, as if the author is intentionally trolling in some areas, or is easily susceptible to being trolled by random folks, and thus displaying some kind of compensation dynamic.
  - cirosantilli 3y ago
    Interesting psychological analysis XD
  - mahathu 3y ago
    I feel dirty having had some of those tabs open.
  - costanzaDynasty 3y ago
    Either Andy Kaufman the spy or flipped virgin.
joelcollinsdc 3y ago
Curious if the https certs for these sites have some common characteristics that could indicate what sites are related as well.
- cirosantilli 3y ago
  If anyone has any more precise information on this, do let me know. I do suspect there's some kind of "protocol legel" fingerprint, as I can't find anything in the content that would be searchable so far.
- cirosantilli 3y ago
  I have found that one of the communication mechanisms used does use HTTPS on subdomains, typically secure.*, as explained at: https://cirosantilli.com/cia-2010-covert-communication-websites#cgi-comms https://cirosantilli.com/cia-2010-covert-communication-websi... E.g.: https://secure.globalnewsbulletin.com https://secure.globalnewsbulletin.com However my quick and naive searches on https://search.censys.io/ https://search.censys.io/ for other certificates with the same public key failed.
hiidrew 3y ago
This Reuters article highlights how these were used by informants and compromised by other state security services https://www.reuters.com/investigates/special-report/usa-spies-iran/ https://www.reuters.com/investigates/special-report/usa-spie... Great article, it’s a shame that they don’t offer any more assistance to burned informants
EMCymatics 3y ago
Fuck.
phendrenad2 3y ago
I wonder what they're doing now that the entire internet has been converted to walled gardens.

212 points by hosteur 3y ago

> WTF the CIA was doing in Brazil in the early 2010s! Wasn't the Military dictatorship in Brazil enough! Not to justify the CIA or anything, but that's exactly where I would most expect them to be actively conducting covert operations

cm2187 3y ago
These seems to be related to intelligence gathering. The CIA like all other intelligence services in the world gather intelligence on any country of interest. Including on most european allies.
- KirillPanov 3y ago
  I'm going to start describing ransomware gangs as merely "gathering" cryptocurrency.
fit2rule 3y ago
[dead]
cirosantilli 3y ago
Why "most expect"? Certainly there would have been greater focus on dictatorships/war zones? The target of websites found so far support this. I can understand the desire to gather intelligence from every other nation, even allies. But I do believe it's a bad idea. E.g. Brazil seems to be aligning with China more and more... largely economic driven. But no need to also give it political backing.
- deleted 3y ago
  [deleted]
- oilchange 3y ago
  > I can understand the desire to gather intelligence from every other nation, even allies. But I do believe it's a bad idea. Intelligence agencies primarily spy on 'allies'. The biggest spy rings in the US are our "allies" - british, canadian, israeli, japanese, korean, etc. The biggest spy rings the soviet union had were in poland, ukraine, hungary, etc - aka their "allies". We have an infinitely larger spy ring in south korea than in north korea because holding onto an "ally" like south korea is far more important than converting an "enemy" like north korea. It's why we demanded all our "allies" stop using huwaei tech because it would prevent us from spying on our allies. It wasn't about china spying on our "allies". Who cares about that? It's about our ability to spy on them. The naive watch silly hollywood movies and think that's reality. Most of the spying during the cold war wasn't between the US and Soviet Union. It was mostly between warsaw pact "allies" and between NATO "allies". > Brazil seems to be aligning with China more and more... They should. Brazil's enemy is the US, not China. Might want to read up on the Monroe Doctrine. Think about it. The country that wants to keep brazil in check isn't china. It's the US. If Brazil has ambitions of being a major power, then it makes them our enemy and vice versa.
closewith 3y ago
To be clear, in the period in question, Brazil was (and is) a democracy. The military dictatorship mentioned is the 1964 _Golpe_ or coup, which may have been partially instigated by US intelligence services. The resulting military dictatorship was immediately recognised by the US and was responsible for innumerable human rights abuses until it fell in 1985. This dictatorship and the US support for it is one of the main reasons that Brazil remains suspicious of the US and a primary driver behind it's continuing courtship of Russia and China.

sigg3 3y ago

Show some love for archive.org for WBM: https://archive.org/donate/ https://archive.org/donate/

cirosantilli 3y ago
And also consider showing me some love! XD https://cirosantilli.com/sponsor https://cirosantilli.com/sponsor

possiblelion 3y ago

Has anyone decompiled the .jar files used for covert communication? Would be quite interesting to see how they work. On another note it is easy to shame the CIA for making such a basic mistake as using subsequent IP numbers/same file layouts on sites. Of course they should be, but funnily enough mistakes such as these happen in every intelligence service. As example would be the Russian military intelligence (GRU/GU) who have for years sent agents abroad with fake/cleaned Russian passports. Only problem being of course that the passport numbers were sequential and as in the case of the CIA websites, if you identified one agent and his passport, you could look up the next ones in line on databases and identify all the other active agents as well. Reference for GRU passports: https://www.voanews.com/a/russia-gru-operatives-unmasked/4602595.html https://www.voanews.com/a/russia-gru-operatives-unmasked/460...

boomboomsubban 3y ago
Do we know of a GRU officer that brought this flaw up and was fired for it? As that seems to be what happened to John Reidy.
detrites 3y ago
> but funnily enough mistakes such as these happen in every intelligence service There's advantage in appearing incompetent and creating traps to distract from actual active capabilities that are working.
- eastbound 3y ago
  We have no element to let us think that the actual active capabilities are any better than that. Do you know any elite who goes working for agencies? How can they remain elite if they don’t write on their work, share it with others, recoup best practices during conferences, etc.?
  - detrites 3y ago
    I've no idea how to interpret your comment in way that isn't bizarre. You seem to state you think competitive advantage in intelligence activity - and in military activity for that matter, as they are deeply intertwined - doesn't exist. And that the reason it doesn't is because everyone involved has to constantly leak and brag all their confidential secrets out in the open so they will be considered hireable by other agencies tasked with secret-keeping? Have I read that right?

boomboomsubban 3y ago

I don't really see how so many of these ended up in the wayback machine. My understanding is that they were supposed to seem like fairly unremarkable websites, but were built for basically one person. So it seems surprising that so many were visited by unrelated people. Is there a log of who instigated a wayback archive? Could they have been a different group doing what this person was? >Given that we cannot rule out ongoing risks to CIA employees or assets, we are not publishing full technical details regarding our process of mapping out the network at this time I guess it's a hard thing to rule out, but I certainly hope the CIA isn't still using a communication method broken more than a decade ago.

exikyut 3y ago
> Is there a log of who instigated a wayback archive? Could they have been a different group doing what this person was? Yes, IA now has a "About this capture" popdown at the far right of the injected toolbar. The first ever capture and some of the subsequent captures for one of the sites was from Alexa Crawls, provided by Alexa Internet; some later captures were from a "Survey Crawl" based on "a list of every host in the wayback machine". So this is basically automated, long-tail vacuum cleaning work.
- boomboomsubban 3y ago
  I apparently misunderstood how the wayback machine worked. I thought it only archived pages that a user requested, and most pages end up archived due to people with the browser add-on installed to archive every page they visit. Thanks to both people that cleared up my mistake, it has always seemed they had much stronger coverage than they should for my mistaken view of how it worked.
  - emikulic 3y ago
    You're thinking of archive.is
- cirosantilli 3y ago
  I wonder how Alexa found those domains in the first place. Were there links to them, or did it use some kind of DNS dump?

sokoloff 3y ago

> democracies have to work together and build mutual trust, and not spy on one another. The first part seems true, but the second part doesn’t follow. Spying on allies seems an entirely reasonable, possibly even necessary, part of effective diplomacy. I trust what you are saying more when I can verify congruence with things I can observe.

cumshitpiss 3y ago
[dead]
H8crilA 3y ago
Sąd, but true. The sad part is that it can give "unfair" advantages to the party that is better at spying abroad and/or counterintelligence at home. After all every alliance has some points of conflict (see the Inflation Reduction Act vs Europe, as an example).
cirosantilli 3y ago
The problem is if these things are found and become public, it makes the targeted country really dislike the spying country. This creates a political pressure against aligning with the spying country. Many Brazilians are deeply distrustful of the USA, and are even willing to align themselves with dictatorships. Personally, I'll never support a dictatorship. But many people will just to have an alternative world power pole. Alliances are like friendships. If you spy one your friends, of course they are going to get mad and push you away. We have instead to make opt-in intelligence sharing programs with our allies.
dingdongg 3y ago
well, others may see it differently..
wongarsu 3y ago
A key part here is "democracies". Between dictatorships, mutual spying to establish trust can be a reasonable policy. But a democracy has to factor in the opinion of their citizens. People tend to dislike foreign countries spying on them, and will create incentives for their government to distance themselves from such countries. Even if you try to keep it on the down-low, it makes it really easy for a third country to drive a wedge in the relationship.

nailer 3y ago

This article was hard to follow, if you want to see what the actual website looked like, and how the informant would communicate back to the CIA, scroll about halfway down this Reuters article: https://www.reuters.com/investigates/special-report/usa-spies-iran/ https://www.reuters.com/investigates/special-report/usa-spie...

ljf 3y ago
Amazing article and well worth a read to discover how these sites would have worked in practice. It deserves a submission of its own.
- bombcar 3y ago
  It's interesting to consider "how would you build it better" - especially when you realize that half of the equation is trained, educated, and safely in America, the other half is potentially anyone in the world anywhere. If both sides are educated and trained, you can do things like hiding messages in quasi-randomly selected posts on Hacker News; but that quickly breaks down if one side doesn't have the skillset needed to hide their actions that way. Things like TOR can help, but that can be difficult to completely hide, and so on.
  - cirosantilli 3y ago
    I think it is pretty safe to assume that essentially all opponents are capable. In particular, intelligence is one of the first things dictatorships will invest in, partly to spy on their own people, which the leaders fear above all else. The ideal communication mechanism is one that blends in with a huge number of other "legitimate" users. E.g. for Tor, it only works if many people are also using Tor for other non-spy things. I wonder why not just email.
    - bombcar 3y ago
      I'm honestly a bit surprised that they haven't really been pushing "using Tor for piracy" to create additional cover traffic. Email has many problems but may be better than most, but you need to use something like gmail which everyone is using, and even that may be noticeable. Once they suspect you, you're pretty much done for unless you find out that you're on the list and you stop communicating outbound. It's much harder to track one-way broadcast communications (many still think that there are/were communications to spies hidden in BBC shortwave broadcasts, and numbers stations are still a thing).

kekebo 3y ago

Darknet Diaries podcast covered this issue in this episode: https://darknetdiaries.com/episode/75/ https://darknetdiaries.com/episode/75/

iandanforth 3y ago

Anyone written a de-cringe browser plugin? Maybe there is interesting content here but the third person, exclamation point ridden, conspiracy thinking on display is too much.

cirosantilli 3y ago
Third person: https://cirosantilli.com/why-ciro-santilli-refers-to-himself-in-the-third-person https://cirosantilli.com/why-ciro-santilli-refers-to-himself... Conspiracy thinking: Example?

KRAKRISMOTT 3y ago

Why do they all redirect to https://wakatime.com/ https://wakatime.com/ Is wakatime ran by three letter agencies?

deleted 3y ago
[deleted]
fivepis 3y ago
The Wakatime.com domain was registered in 2013 around the same time these covert websites were all being replaced. Also the creator of wakatime is an American living in Vienna, known to be the city of spies.
cirosantilli 3y ago
Nice, I hadn't noticed that! I'll add a mention to the article. Some do fail DNS resolution though.
cirosantilli 3y ago
I have researched this now. According to https://tools.whoisxmlapi.com/whois-history-search https://tools.whoisxmlapi.com/whois-history-search the domains were registered June 11, 2023, shortly after my article came out. They are therefore likely just made by wakatime's founder Alan Hamlett: https://www.linkedin.com/in/alanhamlett/ https://www.linkedin.com/in/alanhamlett/ as a bit of Guerrilla Marketing. Fair play. When I saw on LinkedIn that he worked for a web security contractor until September 2013, I almost flipped. But appears unrelated however unfortunately except for his general interst in WEBSEC, so another dead end.

mahathu 3y ago

That entire website is quite a rabbit hole to fall into. https://cirosantilli.com/ciro-santilli https://cirosantilli.com/ciro-santilli

faangsticle 3y ago
This guy really likes his own name.
MichaelZuo 3y ago
Yeah it seems a bit odd, as if the author is intentionally trolling in some areas, or is easily susceptible to being trolled by random folks, and thus displaying some kind of compensation dynamic.
- cirosantilli 3y ago
  Interesting psychological analysis XD
- mahathu 3y ago
  I feel dirty having had some of those tabs open.
- costanzaDynasty 3y ago
  Either Andy Kaufman the spy or flipped virgin.

joelcollinsdc 3y ago

Curious if the https certs for these sites have some common characteristics that could indicate what sites are related as well.

cirosantilli 3y ago
If anyone has any more precise information on this, do let me know. I do suspect there's some kind of "protocol legel" fingerprint, as I can't find anything in the content that would be searchable so far.
cirosantilli 3y ago
I have found that one of the communication mechanisms used does use HTTPS on subdomains, typically secure.*, as explained at: https://cirosantilli.com/cia-2010-covert-communication-websites#cgi-comms https://cirosantilli.com/cia-2010-covert-communication-websi... E.g.: https://secure.globalnewsbulletin.com https://secure.globalnewsbulletin.com However my quick and naive searches on https://search.censys.io/ https://search.censys.io/ for other certificates with the same public key failed.

hiidrew 3y ago

This Reuters article highlights how these were used by informants and compromised by other state security services https://www.reuters.com/investigates/special-report/usa-spies-iran/ https://www.reuters.com/investigates/special-report/usa-spie... Great article, it’s a shame that they don’t offer any more assistance to burned informants

EMCymatics 3y ago

Fuck.

phendrenad2 3y ago

I wonder what they're doing now that the entire internet has been converted to walled gardens.