Sometimes, encryption isn’t enough

One of the advantages of using encrypted email, is that your message won’t trip some piece of mindless data mining software. Remember, a few years ago, when the FBI was running around investigating an Elementary School Teacher because profiling software picked her as a potential terrorist?

Well, using encryption may not be enough.

An article in PC Pro discusses plans in the UK to do profiling based on who you communicate with:

As with the original scheme, the actual content of the phone calls and messages won’t be recorded, just the dates, duration and location/IP address of messages sent.

From this information, they’ll pick the next set of Elementary School Teachers that need to be investigated for possible links to terrorists. It makes me wonder; how many of us are only a few degrees of separation away from someone under suspicion?

Sadly, encryption alone isn’t going to help you here. You’ll need encryption and anonymity.

NSA Wiretapping – Followup

Wired had a couple of interesting articles about the NSA wiretapping program. While I recommend both of them, there were a couple of points that call into question the value of the NSA’s wiretapping and data mining activities.

In NSA Whistleblower: Wiretaps Were Combined with Credit Card Records of U.S. Citizens they discuss some of the claims made by Russell Tice, the NSA whistle blower:

“This is garnered from algorithms that have been put together to try to just dream-up scenarios that might be information that is associated with how a terrorist could operate,” Tice said. “And once that information gets to the NSA, and they start to put it through the filters there . . . and they start looking for word-recognition, if someone just talked about the daily news and mentioned something about the Middle East they could easily be brought to the forefront of having that little flag put by their name that says ‘potential terrorist’.”

Now, compare this to what is discussed in CIA Spy Enlisted Son to Collect Espionage Debts, Feds Say, where they quote the following coded message sent to Russian agents:

SUBJECT LINE: Hola Nancy!
Hello Sweety! How are you? I’m good. Sorry for taking so long to write to you…you know how work is and all. Any7ways, things are good. It looks like I will still be able to go on that vacation! I will keep you updated on that though. I am very much looking forward to it, and to seeing you again! Well hon, I just thought I’d say “hi” since I had the time!

As I mentioned previously, it is difficult to see how widespread data mining is going to be a useful tool in the fight against terrorists.

How do you build algorithms that distinguish innocent conversations (from people with nothing to hide) from the carefully coded messages sent by terrorists?