18 October 2012

FC7: Intel Network

From, "Insurgent Tactics, Techniques, and Procedures. Vol III" published by the Imperial Canadian University, War Division, 2088. 

What follows is the summary of a former insurgent intelligence director based on an interview conducted by his grandson as part of the "Living History" Project.

First thing I did was set up the room.  The room held ten laptops because they consumed less power than desktops.  The internet connection was provided through a DSL modem, ran through a Linksys commercial router running a DD-WRT operating system with firewall settings maxed, wireless radio turned off.  An ethernet switch connected all the computers to the router.  I figured that having an internet connection was enough, no need to let the bastards know which room the router was in.

Each laptop was set to consume minimal power, and ran from a flash drive version of Ubuntu Linux.  The "raid" signal would cause everyone to pull the flash drive, throw it into the blender, and hit "frappe."  Booting back into Windows and logging on to World of Warcraft gave a plausible excuse for a lan party.

On each computer an IRC client linked analysts to observers all over the continent.  I remember when two military aircraft taking off from a southern base were noted by a retired flight mechanic and his two daughters.  That family took shifts watching the flightline.  Once the rebels had taken out the aerial refueling tankers it became much easier to predict the useful combat radius and time of the aircraft.  Except for rotary wing assets that could refuel pretty much anywhere ground support existed.  In that case we tried to have people in place to monitor FARP operations.

The single desktop acting as a server showed updates as the analysts input the data.  Unit locations, composition, strength, and any notes about them all accessible through an SQL database linked to an HTML map.  A hot swappable drive allowed rapid removal of any data stored on site, and a magnet and drill would hopefully erase anything incriminating.  Believe it or not programmers in India, Indonesia, or Singapore were more than willing to provide custom software for pennies on the dollar, and provide the source code along with the program.

Open source intelligence kept piling on too.  New reports, bloggers, twitter users, facebook updates, we tried to monitor everything we could, and correlate it with events on the ground to paint a clear tactical picture.

The biggest problem wasn't that there was a shortage of analysts, but that there was a lot of data to sort through in real time to provide tactical intelligence back to commanders.  Each of these cells I helped set up was focused on their own geographic commander, but often the thugs had their own concept of geography.  Recognizing when cross talk was needed between regions was key to staying synchronized. 

Building networks of observers took time, and each network set up their own method of communication.  Email, IRC, one network used a changing list of code words and Twitter to pass information, one used dead drops at a coffee shop and dog walking park.  No one wants to stick their hand in the dog poo bin to get a USB stick or handwritten note.

Finding people who lived near bases, stations, and depots was easy, sometimes it took a little while to earn their trust and secure their assistance.  Over time the network grew, sometimes in fits and starts, like when the thugs bombed a school and tried to blame it on insurgents jamming GPS.  Anyways, slowly but surely maps of patrol routes became clear, as were the rotating duties of the thug Quick Reaction Force. All sorts of data came pouring in, and we had to sift it, sort it, and file it away in real time plus talk to everybody else who needed to know about it.

After the third year my intel sections were very good at tracking the thugs, knowing where they were based, and pushing that to operational cells to maximize their chances of successful mission completion.  Files on thug commanders, their families, and personal lives were filed away in fat digital folders for future exploitation.  Sun Tzu talked a lot about knowing yourself and your enemy, and my intel sections made that happen.

6 comments:

Anonymous said...

The bad news is that while a drill will render a drive unusable it won't provide any protection from serious forensic attack, nor will an externally applied magnetic field from any readily accessible consumer grade magnet.

Hard Drive Data Destruction

The good news is that heating hard disk drive to the Curie Temperature is secure and easy to do in many different ways. One of the more dramatic methods involves the use of a small thermite charge.

hard-drive-anti-forensic-destruction

Thermite Experiments

Calcium Sulfate Thermite

--

John Smith

AM said...

John Smith,

You are correct about deep level forensics. However, there aren't a lot of common methods to heating something to 770 degrees in a safe and controlled manner.

Thermite is nasty stuff to have go off inside a building. That being said old radio dogs should be very familiar with the thermite plates we used to put on top of our radios for "utter destruction" in event of being over run.

A drill and a magnet is a combination of destruction and corruption. Drill enough holes in a hard drive and I don't care how good you are, you can't recover enough of the contents to matter.

Anonymous said...

FYI: PostgreSQL, PostGIS and some of the open mapping project stuff.

A bulk tape eraser (remember reel-to-reel?) can be had at used tech places, experiment before needed. Ordinary magnets will not do. Acid? Hmm. Experiments needed.

To AM, even one or two recovered sectors, a name, part of an email, could compromise someone. I don't trust any amount of drilling.

AM said...

Anon at 9:58

There is no such thing as "perfect security" and if a part of an email compromises a source that isn't a failure of data storage, it is a failure of proper fieldcraft to use a foreign email server with anonymous re-mailers.

If you aren't encrypting your hard drive as a matter of course then that is your business.

It isn't about getting "perfect" it is about executing "best practices" and if you can afford to experiment to create a field expedient hard drive destruction method that is utterly foolproof, go for it and have my thanks.

AM

Anonymous said...

Wouldn't high voltage do the trick?

Anonymous said...

Traffic analysis. Given a group of islands and the boats traveling between them, identify the HQ.