Assumption – You are a typical American.
Question –
Is the FBI reading your encrypted email?
Answer – Probably not.
Now
the same question, but this time a different assumption.
You are an American
under surveillance by the FBI.
Question – Are they reading your
encrypted email?
Answer – Yes. Absolutely.
How surveillance is triggered...
If
you are involved in anything like advocacy, dissent, or protest, then you are
inviting surveillance. Anything that challenges the status quo – no
matter how mild – is viewed with suspicion by the authorities.
Sometimes the simple act of expressing an honest opinion or writing a letter to
the editor is all it takes for a security service like the FBI or BATF to start
nosing around. Independent thought is becoming a rare – and dangerous –
attribute in America. Bureaucrats don't understand that dissent poses no danger
to the country. On the contrary, it is the conformist who poses the
greatest danger to freedom.
There are
thousands of regulations, prohibitions, rules, restrictions, laws, bylaws,
codes, and statutes designed to regulate your behavior. It's common knowledge
that any cop worth the badge can find something to arrest you for.
More than ever, ordinary Americans are finding it necessary to shield their
activities from a government whose red tape can prevent you from earning a
living, developing your land, etc. etc. etc.
The
Thought-Police. Once you're under surveillance, the simple act of
encrypting your email is all it takes for the FBI to label you dangerous,
perhaps a threat to national security.
Like
many repressive regimes worldwide, the US government doesn't understand that
people who want privacy aren't necessarily hiding anything. You put
letters inside envelopes, don't you? Well then, doesn't it make sense to
encrypt your email? Otherwise it's like sending a postcard. Anybody can read
it along the way.
PGP is under attack.
PGP is considered the best encryption software available for use with email.
But despite its robustness, PGP is regularly beaten by the FBI. Surveillance
teams routinely read PGP-encrypted email.
That's
because most people aren't using PGP correctly. If you are one of them, you are
vulnerable. The FBI possesses the means to mount a sophisticated covert
campaign against you. They can choose from an arsenal of proven methods for
cracking your PGP-encrypted email. Those methods are described in this
document.
Assessing the threat. When
the FBI succeeds at decrypting your messages, it is unlikely you will realize
that you have been compromised. But having your email decrypted and read is not
the prime threat. You face an even greater danger from an FBI surveillance team
– especially if you are a member of a group that is targeted by the FBI.
The
FBI has decades of experience. They have learned to wring every possible
advantage from each situation. They play by Big Boys' Rules. The FBI's
goal is not only to get you, their goal is to wreck your entire group.
How
do they manage to do this? By deception. Once they've cracked your PGP email,
they will begin to create forged messages. They will impersonate you.
The FBI team will send bogus email messages that seem to come from you. They
will systematically work to create confusion, suspicion, and paranoia throughout
your group.
This is the real nature of the
threat. If the FBI cracks your communication they won't stop at getting you.
They want the whole group – or organization, team, cell, family, squad, or
whatever it's called.
How they do it.
In this tutorial you're going to learn about the different methods that the FBI
uses to crack your PGP system. Some of these attacks may come as a surprise to
you. Many of these attacks are also used by other agencies like the BATF, DEA,
CIA, and even local police.
What you can
do about it. This tutorial will show you different ways you can use PGP.
These protocols reduce – and occasionally eliminate – the ability of
the goons to crack your messages. And as a bonus, you're going to learn how you
can use your email to conduct aggressive antisurveillance against the
FBI – perhaps exposing a surveillance team that you didn't realize was
watching you..
How the FBI cracks PGP email...
The
FBI has resources and expertise. Their methods fall into four categories.
Method 1 relies on their ability to break into your home or office undetected.
Method 2 relies on their ability to bug your home or office. Method 3 uses
electronic equipment that detects signals your computer makes. Method 4 is used
in cases involving national security, where they rely upon the cryptanalysis
capabilities of NSA.
Know where you're
vulnerable. The weakest part of your email security is you, the user. The
mathematical algorithms that form the underpinnings of PGP are very robust. It
is the manner in which you use them that creates vulnerabilities.
The
most vulnerable point is the manner in which you create and store your original
plaintext message. The next weakest element is your passphrase. Next are the
PGP files on your computer's hard disk. (From now on we'll refer to your hard
disk drive as HDD).
In a typical surveillance
operation, the FBI will utilize the attacks described here. The ten attacks are
listed in approximate order of increasing difficulty. It is standard operating
procedure for the FBI surveillance team to use the simplest attacks first. In
practice, their choice depends on the circumstances of the case.
Attack
#1 – Plaintext recovery. An FBI or BATF surveillance team will break
into your home or office without your knowledge. Once inside, the
agents will read the plaintext files on your hard disk, diskettes, or paper
printouts. Local police also use this method. It is very effective.
If
you're like most people, you're probably thinking to yourself, "Aww,
there's no way they could get in here without me knowing. I'd spot it right
away."
Yeah, right. That's exactly
the attitude the FBI wants you to have. So dummy up. FBI penetration agents
love people like you. You are the ideal target. Over confident. Easy to
deceive.
This is important enough for us to
pause for a few moments and talk a bit about how surveillance teams really
operate. What you are about to read has never been published before.
The government does not want you to know this.
Background – How they get inside. Many people
are amazed to learn their home or office can be entered without their knowledge.
And not just once, but repeatedly. A surveillance team often requires
multiple entries in order to thoroughly pick through all your stuff.
Good
quality locks on your doors and windows are generally useless. The penetration
team ignores them. They've found an easier way to get inside. Perhaps
an example is the best way to illustrate the point.
The setup. Our former office
was situated in an industrial park. We were located in a cindercrete masonry
building equipped with high-security locks. We concluded it would be difficult
for an FBI surveillance team to conduct a surreptitious entry without our
knowledge.
Our building abutted a similar
cindercrete building next door – a welding shop. The bathroom cabinet sink
is located against this wall. The arrangement provided a perfect
opportunity for surreptitious entry.
The
photos tell the story. It's easy for FBI agents to enter a building next door
and remove a few cindercrete blocks from two sets of exterior walls – and
then enter our office through the back of the bathroom cabinet.
Repair
experts. Most people aren't aware that surveillance teams routinely break
in through walls, ceilings, and up through floors. This is standard
operating procedure. The FBI's restoration specialists can repair a damaged
area in under 90 minutes using patch drywall, quick-drying compound, and
special paint. Apartments and houses are a snap for these guys. This is your
own government doing this to you, folks.
My
first experience with this sort of entry was when I was helping Vickie deal with
24-hour surveillance by US Naval Intelligence. (Return to our home page and
click on About Us for more on this.) I showed her how to seal her house
– doors, windows, attic panel, everything.
But
they tunneled over from the house next door. They came in under the driveway
and broke through behind a false wall next to a fireplace in the downstairs
family-room. They moved along a short crawlspace and entered the livingspace
just behind the furnace.
Their cover was
clever. They used a ruse of major renovations next door to conceal the sound
the tunnel crew made.
Their mistake? Not
enough attention to detail. They didn't match the original panel when they
replaced the wall behind the furnace. Vickie and I had done a complete
inspection of her house two months earlier. We both spotted the bogus panel
immediately. She still becomes furious when she talks about it.
The
reason the goons like to break in through walls is simple – it's extremely
difficult to defend against. But simply being able to detect that you've been
penetrated gives you an advantage, especially if you don't reveal you're on to
them.
Now that you've got a better
understanding of how resourceful and cunning these government agents
are, let's return to the different attacks they use to crack your encrypted
email. We've already covered Attack #1, plaintext recovery.
Attack #2 – Counterfeit PGP program.
After breaking into your home or office, FBI agents will install a counterfeit
copy of PGP on your HDD. Encrypted messages created by this modified
program can be decrypted with the FBI's master key. It can still be
decrypted by the recipient's key, too, of course.
A
variation of this attack is the FBI's bot. Acting similar to a virus,
the bot is a
key-trap program. (Bot is an abbreviation of robot.) The bot
intercepts your keystrokes without your knowledge. When the opportunity arises,
the bot uses your Internet dial-up connection to transmit your
passphrase to the surveillance team. FBI agents often hide bots in counterfeit
copies of your word processing program, and so on.
Attack
#3 - PGP's working files. After entering your premises in your absence, FBI
agents will make copies of certain PGP files on your HDD, especially the files
containing your secret keys. The agents will then attempt to find where you've
written down your passphrase. They'll methodically search your papers, desk,
safe, filing cabinets, kitchen drawers, and so on. They'll use deception to
gain access to your wallet, purse, money belt, briefcase, and pockets.
Their
goal is to grab your secret key and your passphrase so they can use any copy
of PGP to read your encrypted email messages whenever they want.
If
their search fails to turn up your passphrase, they'll use cracker software
to deduce it. This works because most people use passwords and passphrases
consisting of words and numbers with special meaning like birth dates or pet
names. Unfortunately, it's a simple matter for the FBI to collect information
about you like your birth date, your mother's maiden name, the number of a PO
Box you rented 10 years previous, the license plate of your vehicle, names of
pets past and present, and so on.
Here's how
the FBI's cracker software works – it combines and recombines all these
words and numbers and keeps submitting them to the PGP program. (They copy your
entire HDD and do this work at their office.) They routinely crack the
passphrases of PGP-users who fail to use random characters in their passphrase.
Attack
#4 – Video surveillance. After breaking into your home or office
without your knowledge, FBI specialists will install a miniature video
surveillance camera above your work area. The lens is the size of a pinhead.
It's extremely difficult to detect. The FBI surveillance team watches your
fingers on the keyboard as you type in your passphrase. Local police and
private investigators have also been known to use this method.
Attack
#5 – Audio surveillance. This method is a variation of Attack #4. FBI
technicians install an audio bug near your computer. The sounds generated by
the keyboard can be analyzed. By comparing these sounds with the noises made
during generation of a known piece of text, the FBI can often deduce
your passphrase – or come so close that only a few characters need to be
guessed.
Attack #6 – AC power
analysis. Using equipment attached to your outside power lines, the
FBI can detect subtle changes in the current as you type on your computer's
keyboard. Depending on the user profile in your neighborhood, the FBI's
equipment can be located some distance from you.
Attack
#7 – EMT analysis. EMT is an acronym for electromagnetic transmission.
Computer CPUs and CRTs operate somewhat like radio transmitters. CPU is an
acronym for central processing unit. This is your Pentium chip. CRT is an
acronym for cathode ray tube. This is your display.
The
FBI surveillance team uses a communications van (or motor home) parked across
the street to capture the electromagnetic transmissions from your computer.
This threat can be eliminated by a shielding system called Tempest. In
many jurisdictions you need a special permit to buy a Tempest system, however.
Attack
#8 – Coercion. The previous seven attacks are quite easy for the FBI
to implement. In fact, they use almost all of them on a routine basis. Even
the local police in major US cities have access to vans that can pick up your
computer's EMT.
From this point on, however,
things start to get very time-consuming and expensive for the FBI in their
attempt to crack your PGP-encrypted email. So they may decide to take a more
direct approach.
They'll simply bend your
thumb back. Until it breaks, if that's what it takes. Before they
start, they'll make sure they've got enough biographical leverage on you
to blackmail you into becoming an informant. Biographical leverage is spy-talk
for blackmail information.
The main defense
against this threat is deception. An appropriate strategy is discussed later in
this tutorial.
Attack #9 – Random
numbers. After breaking into your home or office without your knowledge,
FBI agents will make a copy of PGP's randseed.bin file. PGP uses the
pseudorandom data in this file to help it generate a unique block that it uses
for creating a portion of the ciphertext. This type of attack borders on true
cryptanalysis. It is time-consuming. It is expensive. It is generally
worth neither the FBI's nor NSA's time, except in cases of national security.
Attack
#10 – Cryptanalysis. It is ridiculously easy for anyone, including the
FBI, to intercept email on the Internet. After collecting a sampling of your
encrypted email, the FBI submits the data to NSA for cryptanalysis.
Cryptanalysis is egghead-talk for using mathematics, logic, and problem-solving
skills to crack an encrypted message. It's all done with computers – and
NSA has some monster computers.
The
best information available to us indicates that NSA can indeed crack PGP email,
but a
brute force attack is required. A brute force attack involves a lot of
informed guessing. It's mostly just trial-and-error. Cracking a message can
take weeks, months, years, or decades depending on the content, format, and
length of your message. Later in this tutorial you'll see how to make your
messages more resistant to this attack.
Very
few domestic cases warrant the involvement of NSA. Besides, FBI agents are
usually successful in cracking your email using one of the other attacks,
especially
break-and-enter. So NSA devotes its resources to cracking the messages
of other countries' governments and their intelligence agencies.
Thinking outside the box...
The
preceding ten attack-scenarios are based on thinking inside the box. When we
use this type of reasoning, we are staying within a set of fixed assumptions.
We are, in effect, boxed in by our rigid assumptions – hence the phrase,
thinking inside the box.
The preceding
attack-scenarios make two assumptions. First assumption – You've got an
authentic copy of PGP. Second assumption – NSA has not yet discovered a
mathematical method for decrypting PGP ciphertext. Neither assumption is
necessarily correct.
Counterfeit software.
We have received one report about this. We must caution you that it is only
one report, and we have been unable to verify it through other sources. Our
contact says an FBI agent bragged to him that the CIA has been distributing
doctored copies of PGP freeware over the Internet. According to our source, the
FBI routinely decrypts messages encrypted with these doctored copies.
It
is our view that if this happened it was not over a wide-scale. Many copies of
PGP are digitally signed by the manufacturer, who is no dummy. We believe that
the fragmentary and decentralized character of the Internet prevents this type
of ruse from succeeding – especially against savvy targets like the folks
at PGP.
Mathematical algorithm. It is
unlikely that NSA has developed a mathematical algorithm for decrypting PGP
ciphertext – not impossible, but unlikely. Because the algorithm and the
source code for PGP are widely known and freely available, PGP has been
subjected to rigorous testing and attacks by some of the brightest minds in the
scientific community. This is called a review by your peers. It is a
powerful method for vetting new ideas and methods. None of these bright
scientific minds have come close to cracking the PGP algorithm, which is based
on a complicated
one-way math function.
Sizing up your adversary...
Clearly,
FBI and BATF surveillance teams are a force to be reckoned with. They possess a
lethal arsenal of capabilities that they can bring to bear against you and your
email privacy. Their methods range from the simple to the sublime. They can
break into your home or office without your knowledge and use your computer.
They can use sophisticated electronic equipment to read your keystrokes –
over the AC electrical connection, over the telephone line, or over the
airwaves. And, finally, if these types of methods fail – which isn't very
often – NSA will be called in to crack your PGP-encrypted message.
Is
the FBI difficult to beat? Yes. They've been at this game a long time.
They've learned many lessons over the years.
Can
the FBI be beaten? Yes, you can beat them. It is easy? No, not at
first, but it gets easier as you build up self-discipline. Beating the FBI
requires that you stop thinking inside the box.
Part
2 of this tutorial will show you how.
To stop
the FBI from reading your PGP-encrypted email, return to our home page now and
click on Uncrackable Email 2.
