China Spying on Undersea Internet Cables

Supply chain security is an insurmountably hard problem. The recent focus is on Chinese 5G equipment, but the problem is much broader. This opinion piece looks at undersea communications cables:

But now the Chinese conglomerate Huawei Technologies, the leading firm working to deliver 5G telephony networks globally, has gone to sea. Under its Huawei Marine Networks component, it is constructing or improving nearly 100 submarine cables around the world. Last year it completed a cable stretching nearly 4,000 miles from Brazil to Cameroon. (The cable is partly owned by China Unicom, a state-controlled telecom operator.) Rivals claim that Chinese firms are able to lowball the bidding because they receive subsidies from Beijing.

Just as the experts are justifiably concerned about the inclusion of espionage “back doors” in Huawei’s 5G technology, Western intelligence professionals oppose the company’s engagement in the undersea version, which provides a much bigger bang for the buck because so much data rides on so few cables.

This shouldn’t surprise anyone. For years, the US and the Five Eyes have had a monopoly on spying on the Internet around the globe. Other countries want in.

As I have repeatedly said, we need to decide if we are going to build our future Internet systems for security or surveillance. Either everyone gets to spy, or no one gets to spy. And I believe we must choose security over surveillance, and implement a defense-dominant strategy.

Tags: backdoors, China, espionage, national security policy, supply chain

Posted on April 15, 2019 at 6:30 AM • 28 Comments

Comments

Winter • April 15, 2019 6:48 AM

“This shouldn’t surprise anyone. For years, the US and the Five Eyes have had a monopoly on spying on the Internet around the globe. Other countries want in.”

Pot, meet kettle.

We see all kinds of local people on the TV news here warning us of Chinese espionage on telecommunications. But the one big case of states spying on European telcos was the UK breaking into Belgacom to spy on the EU and Nato partners.

And before that, there was Echelon, which saw all the ones now complaining loudly about Huawei spying on their friends.

So, indeed, it is the 5 eyes complaining about the Chinese competing with them.

Marcel • April 15, 2019 7:03 AM

If you were the Chinese, would you want to send all your communications over US/5 Eyes controlled submarine cables? This development is totally to be expected.

Personally I don’t believe the Chinese are doing this to spy. They just want to make money and build their economic empire. This is pure capitalism with a communist long-term plan.

I hope we’ll end up with a diverse internet, with a choice in who controls what and no single party who has all the power. As a user I don’t want to be spied on by anyone.

Regular Person • April 15, 2019 7:08 AM

Isn’t most traffic encrypted these days? Not sure how valuable it is to look at to/from IP addresses in packet headers if you don’t know the message contents.

Plus it’s like drinking from a firehose — TBs of data but most it useless. When the USG does this I don’t think, “Wow, what an incredible feat of engineering and symmetric advantage in spycraft” I think, “Wow, what a colossal waste of money chasing after a needle in 10 trillion daily haystacks.”

eireoldeboy • April 15, 2019 7:37 AM

This is nothing new…

https://cryptome.org/nsa-lynn.htm

Petre Peter • April 15, 2019 7:56 AM

I understand that the way to communicate securely over an insecure channel is through encryption. However, I don’t own my keyes, and ITAR regulates encryption as a munition. Encryption also breaks my searches and I don’t want to deal with folders anymore. The channel is insecure, and encryption is inconvenient. This reminds me of Tannenberg.

Thursday • April 15, 2019 8:55 AM

I believe we would be naive to think this sort of thing is only for the purposes of spying. Not unique to large empires, the Chinese government cultivates a roadmap that includes influencing, dominating, and controlling as much of the world as possible. Controlling key internet infrastructure like how and when it operates, especially during future power conflicts, edges China closer to the top of the world-stage dominance hierarchy. Leveraging capital markets for instance is useful here and not just because of the prospect of building capital in one’s favor; it is quite possibly a means to an end.

Thursday • April 15, 2019 9:02 AM

Encryption is no security from any future oppressive government who condemns the people without regard for the content, but simply by observing how or with whom they communicate. No content needed.

parabarbarian • April 15, 2019 9:08 AM

“Most nations and companies feel that better cell phone service is worth the security risks.”

That pretty well sums up how the majority of consumers see the “trade off” between security and surveillance.

David Rudling • April 15, 2019 9:31 AM

@Regular Person
It’s called metadata. People are targeted on the basis of that alone.

albert • April 15, 2019 11:30 AM

“…Either everyone gets to spy, or no one gets to spy….”

I like the “no one gets to spy” option, but it’s a false dichotomy. Spying will never be eliminated, so if it can be eliminated electronically(unlikely), it will be done the old fashioned way, by direct observation.

Just as the Internet has made many useful things so darn convenient for users, it has done the same for the abusers. Both sides like the convenience, the low cost, and the lack of security(abusers), and the users don’t seem to care about security at all.

In a system where criminals like Wells Fargo* stay in business, no amount of public outcry seems to have any effect on The Elite.

*Wells Fargo is offering 400USD to anyone opening an account with them. The account must contain at least 3000USD within 90 days, and after 45 days, the ‘incentive’ will be paid. No mention of any bridges in Brooklyn.
. .. . .. — ….

R.V.Klein • April 15, 2019 11:52 AM

This shouldn’t surprise anyone.
Certainly no surprises here.

For years, the US and the Five Eyes have had a monopoly on spying on the Internet around the globe. Other countries want in.
You can’t be certain that the Five Eyes have had a monopoly outright. For example, in China, perhaps they are or have been more worried about domestic issues or their neighbors, rather than international surveillance.

Just a small tidbit of food for thought.

Anders • April 15, 2019 1:49 PM

“As I have repeatedly said, we need to decide if we are going to build our future Internet systems for security or surveillance. Either everyone gets to spy, or no one gets to spy. And I believe we must choose security over surveillance, and implement a defense-dominant strategy.”

Sorry, Mr Schneier, no government will step into to this discussion. They WILL spy, period. They need information to stay in power. And while they are in power, they make sure that there are appropriate backdoors that suits for their need. Nothing we discuss here or somewhere else will change it.

Matt from CT • April 15, 2019 4:09 PM

Personally I don’t believe the Chinese are doing this to spy. They just want to make money and build their economic empire.

It.is.the.same.thing.

Less I be accused of unknowingly throwing stones in a glass house, the U.S. has a history of industrial espionage from Samuel Slater to high frequency trading today, with perhaps the only difference being today we publicly say we don’t use government assets to spy for economic advantage.

Clive Robinson • April 15, 2019 4:23 PM

@ Bruce,

My viewpoint is that “Any Nation that can will” that ha more recently been augmented by “For any Nation that can not, the US et al market place will sell them the tools”.

The only new difference I’m seeing is the move to “SaS in Cloud by tool vendors”. That is like Microsoft and Google, the companies supplying the tools see more longterm income from “rental” or “service supply” on a month by month payment than they do in a one off payment with open ended support.

With regards,

This shouldn’t surprise anyone. For years, the US and the Five Eyes have had a monopoly on spying on the Internet around the globe. Other countries want in.

There are two asspects to this,

1, Message content.
2, Message metadata.

The first can be solved by properly implemented symmetric encryption and possibly by suitably sized asymetric encryption. The issue in both cases beong the totally hopeless “Key Managment” (KeyMan) that no real progress has been made on in the last three decades or so with PGP being the last realy inovative approach away from the abject failure outsourced hierarchical KeyMan systems are and always will be (human nature being what it is).

Part of the second issue is called “Traffic Analysis”. After World War II right through into the 1990’s and even today the UK Government has tried to restrict any kind of real knowledge as to how to diminish “traffic analysis susceptability” and the US has likewise played along (unlike Russia that made some information effectively public domain). Put simplistically traffic analysis is a syatistical process based on a catalogue or database style library of collated information. Methods against both the statistics of traffic and how to make a library ineffective are actually known, but nobody appears to currently want to use them (efficiency-v-security issues yet again).

So on the message movment side we do know how to make the variois Commercial and Governmental SigInt techniques way less effective,if we wish to.

However people are their own worst enemies, they not only do not practice any kind of OpSec, they literally throw “Message text” at Corporates who are more than happy to sell it on, of not give it to their National Government with a little prompting.

But we also use very poorly developed applications and OS’s that are for all their pretty displays either incorrectly designed or risdled with vulnerabilities and frequently both.

Thus I can confidently predict that if we do strengthan, KeyMan, OpSec and Anti-traffic analysis the National Governments of all stripes will go to attacking the likes of “SaS in Cloud” and vulnerable OS’s and Apps…

In short “we are our own worst enemies, and we are to lazy to change”…

vas pup • April 15, 2019 4:24 PM

@R.V.Klein • April 15, 2019 11:52 AM
Yeah, you are right:monopoly on spying is over.
By the way, do you know that Chine built its electronic monitoring station (guess where?) in ARGENTINA (source: Science Channel US Cable)? Are we going to declare President of Argentina illegitimate for that reason? No answer required.
They do create their own kind of Echelon system of global spying.
Russia closed similar monitoring stations in Cuba and Vietnam.
Small tidbit of food for thought as well.

Clive Robinson • April 15, 2019 5:59 PM

@ vas pup,

Small tidbit of food for thought as well.

As they say “fair exchange is no robbery”, so a little “food for thought” in return.

As I noted above Nation States without the home grown ability thus skills to develop their own cyber-espionage, are “buying it in” or more correctly “rrnting it in these days” as private often secretive organisations provide “Cyber-Espionage as a Service” (something it appears the US Military / NSA are now involved in acorrding to a number of reports).

Raises the question of,

Why spy on a Nation State,
when you cam spy on those who spy for them?

As has been shown fairly frequently in the past those who basically spy in one way or another on individuals as “corporate or free enterprise” service suppliers, whilst secretive about their organisation tend to actually have fairly lousy security on the IT side of things. Often because a founder, gets too big for his boots and enters Dunning-Kruger territory, and insists that for their easy of use that various sensible security procedures are breached for them…

So if ordinary supposadly run of the mill crackers can get in and liberate 10’s if not thousands of gigabytes of data including sales databases and entire email server contents going back years… Think what a supposadly advanced SigInt agency with a secret stock of exploits could quietly get?

But more importantly “Who you spy on, tells how you are thinking thus planning”… One of the rrasons for “collect it all” for the larget SigInt agencies is not to fall into that trap. However small Nations “renting service” are likely to lack the resources as are their chosen service suppliers to do anything other than highly targeted spying.

Spying on those who are spying for nations, also gives the larger nations doing it, quite considerable deniability. Which is highly desirable. It also enables them to feed in false information thus making the small nation state an unwitting actor for the larger nation.

Thus “The Great Game” continues with the usual “Smoke and Mirrors” just a little more high tech these days…

Sancho_P • April 15, 2019 6:10 PM

@Bruce,

As often, a clickbait headline that doesn’t deliver. It lessens the value of the blog, that’s sad.

You try to twist a warhawk’s opinion (“Read my lips: NOBUS!”) to the very common topics “surveillance and security”.
Doesn’t work:
His topic is espionage to ensure western (oh, sorry, America first) dominance in our rush to the end.
And the pamphlet is regarding international communication channels.

No one needs to decide, “surveillance” (= spying) won’t go away because it’s the only way to maintain a leveled battlefield between criminals on both sides of the waters. As well as LE and ordinary people.
Transparency is the point.
In contrast, security (in communication) would mean secrets and potential advantage, also for criminals and the “axis of evil”. We can’t support that.
That’s kind a dilemma.

But, as @Clive Robinson mentioned, communication consists of metadata and content: This is our chance to have both, transparency and privacy.

With metadata transparency is nearly unavoidable (besides that “they” need it).
This is a severe danger for society and privacy, but it’s gone already, we unwittingly gave it away from the beginning of global communication.

But the content of our communication could be secure if our powers understand that everybody, from top to bottom, needs privacy, in business as well as at home.
It’s late, but still possible.

However, I concur with the defense-dominant strategy, on all levels.

PS: James Stavridis wrote: “Once Washington has real evidence of risks that it can share with allies, …”
– Remember Operation Iraqi Freedom!

Clive Robinson • April 15, 2019 6:35 PM

@ Bruce,

One thing I forgot to mention. It’s been known that for atleast two decades the Chinese have specially adapted submarines and the personnel required, not only to cut under sea cables (that’s easy even for terrorists). But to “tap the cable” to tee data off.

Both the UK and US have been known to have been developing undersea capabilities with respect to sub-sea cables to get at stuff up in the Baltic area back in the 1950’s and all through the cold war. So presumably they are still at it.

Also there were the early cold war tunnels put in by the UK miners and General Post Office “secret squirrel” staff under Vienna and Berlin. For the Berlin tunnle the UK Secret Inteligence Service (SiS/MI6) took the lead and forward end capabilities in Russian territory called it “Operation Stopwatch”. Whilst the CIA provided the back end allied side services including recording equipment and transcribing etc and they called it “Operation Gold”.

Alledgedly the Russian’s knew of the tunnels through a highly placed spy they had in the UK inteligence services (Blake). And the KGB rather than endanger their spy, they let the opperation go unchecked untill an opportune time to embarrass the British…

Thus others claim both Operation Silver (Vienna tunnels) and Gold as an intelligence success rather than an idea that was “sold out” by MI6 failing to spot what was to others an obvious spy in their midst.

However it might well be the case. As with “traffic analysis” it’s not so much the individual message conyents that are important. It’s the “meta-data” on the “order of Battle” and also the interpersonal relations between millitary officers especially at lower levels that is of longterm use in the “Registry Card Index” library.

It’s been said by some that as the Russian’s did not change their order of battle etc afterwards, that they did not know about traffic analysis. My feeling is that the usual Intel-v-Millitary rivalries, plus the actuall real shortage of resources in the CCCP (USSR) thst we are now aware of ment there was little that could be effectively done.

https://en.wikipedia.org/wiki/Operation_Gold

Clive Robinson • April 15, 2019 6:57 PM

@ Sancho_P,

With regards,James Stavridis who is a Bloomberg Opinion columnist, but apparently a retired admiral.

He appears to be highly UN-informed about a whole slew of publically known things.

First off it was the UK not the US that syarted spying on sub-sea cables, many of which came up in the UK in the south tip of Cornwall in places like Bude Bay not far from Goonhilly satellite ground station.

In the 1980’s it became transparently obvious that the UK Government was tapping every cable they had any interest in and all satellite and microwave links.

Further as anyone who cares to look will find out, the US Government had a cosy relationship with all international Telex companies operating in the US. And all “cable flimsies” that were in effect the “carbon copies” were not just made available by the companies in many cases they were carried to the awaiting analysts by staff working for the cable companies.

It was exactly the same “Don’t ask Don’t tell” arangment that was discovered in AT&T premises.

Thus how the admiral can pretend the US is not up to the eyeballs in illegal wire tapping and has been since before the second world war kind of mystifies me.

Thus I can only assume,

More FAKE NEWS from Bloomberg.

gordo • April 15, 2019 10:07 PM

@ Clive Robinson,

Re: “a whole slew of publically known things”:

https://electrospaces.blogspot.com/2014/05/nsas-largest-cable-tapping-program.html

https://electrospaces.blogspot.com/2014/11/incenser-or-how-nsa-and-gchq-are.html

https://electrospaces.blogspot.com/2013/08/nsa-has-also-arrangements-with-foreign.html

I suppose that another way to look at all of this might be to say that Balkanized data flows make the targeting of data flows for disruption more discrete and, thus, potentially, more dangerous. With that in view, what @ Bruce says about “a defense-dominant strategy” matters even more.

VinnyG • April 16, 2019 8:13 AM

@Thursday @David Rudling re: metadata incrimination – Any agency that would criminalize (I’m including non-judiciary punishment) individual behavior on the basis of content-free communications attributes is just looking for any possible excuse to persecute anyone whom they can possibly paint as an adversary – a pure exercise in power and dominance. Such creeps never have a problem in concocting such excuses. Unfortunately, the only real solution is mush more difficult than good security – a way must be found by NGP (non-governmental persons) to put aside other philosophical differences, create consensus, and truly marginalize the bastards.
@Clive re: Chinese telecom cable capabilities – Seems sort of obvious that any entity that has the capability to lay and maintain cable would of necessity have the ability to disrupt it or intercept traffic.

Clive Robinson • April 16, 2019 9:14 AM

@ Gordo,

With that in view, what @ Bruce says about “a defense-dominant strategy” matters even more.

Yes, I just wish more people would wake up to that rather important fact.

Unfortunatly certain self interested people, rely on the citizen in general not knowing that for their income to be as large as it is. It also does not help that legislators and the like, preffer to listen to such people due to various reasons… I don’t know about others but I personally find them and their reasons to be very reprehensible and in some cases way beyond dishonesty.

Clive Robinson • April 16, 2019 11:05 AM

@ VinnyG,

Seems sort of obvious that any entity that has the capability to lay and maintain cable would of necessity have the ability to disrupt it or intercept traffic.

Up to a point. The “lay and maintain” asspect has historically been anything other than “covert”.

In essence you aquire a ship with largish engines capable of fixing a position reasonably acurately then “dragging anchor” untill you snag the cable, then pull it upto the surface to work on. So far soe easy 😉 in very calm weather which is why they try their best not to need doing it.

The use of submarines was started by the British during WWII and very early on in the cold war as part of their SigInt efforts, and they developed very leading edge equipment to do it.

Basically during the war the British navy had very good relations with the Russian navy etc and obtained information about the location of cables in shallow waters etc fairl easily, along with SigInt monitoring on various supply vessels. Supposadly unknow to the British Admiralty a submarine with divers was sent out to find and examin the subsea cables for the ability to be exploited. The US were eventually informed of this under the BURSA arangnents for inteligence sharing, and as with the land based tunnels the US decided that they should likewise take on the challenge. They sent out two submarines in 1945 on a dry run to estimate the feasability of getting in, locating the cables and getting out again as part of a more wide ranging ElInt operation with regards Soviet missile tests. In 1949 they sent in the USS Cochino and USS Tusk. They had been fitted out by all thr latest submarine developments then known for diesel electric boats (from German U-Boat designs). However the top of the line ElInt equipment was designed and built in Britain and their SigInt Techs fited it in the Portsmouth Naval base in Southern England just noeth of the Isle of Wight, all to maintain “absolut secrecy”.

Unfortunatly the name “Cochino” had been selected, supposadly as denoting a speedy species of trigger fish, which would be inline with the submarines intent. But as some here will know in Spanish it means “The Pig”, which should have forewarned people… It’s main mission to intercept Soviet radio transmissions from missile tests involved having holes drilled not just in the tail fin but in the preasure hull as well, for the antennas along with others inovations such as a new design of snorkel. That main mission was not a success although the equipment worked well, there was not the sort of traffic they were looking for during it’s limited span first and as it turned out only run into the Barents Sea.

On the return leg they ran into a sorm and the crews misgivings about the holes in the tail fin and preasure hull were realised and a battery fire which is one of the most dangerous things on such diesel electric subs happened as a result of leaks in the snorkel. The result was explosions on board quite serve burns to some of the crew and the loss of the USS Cochino, a civilian Elint specialist and six members of the USS Tusk’s crew who went to rescue the Cochino crew. It is unclear if they actually tried to run up and find the subsea cables or not, due to the way the British still keep these things classified, and in this reapect where Britain Commands the US obays…

The point is that working on cables requires fair weather for ships, but even thirty or more feet down where bad weather generaly does not reach, there are many complications with submarines of that period. Thus knowing how to overtly find and maintain cables might well be known quite widely, however the extra knowledge of now to do it covertly under water at 180ft down etc is “hard won by” thus mostly classified.

But as I noted, the ability to drop an anchor in the right place and dredge up the cable is over a century old. Obtaining a sea going tug with precise positioning equipment is not difficult. Thus even terrorists could cut or put out of action subsea cables. In the Middle East for instance around Oman the loss of cables by vessels dropping and dragging anchor is not exactly unknown…

Originally this is what was thought the Chinese did when they made the point to the US some decades ago by cutting a couple of subsea cables. However later examination of satellite images showed no sign of surface vessles in the area. In effect this was the first public warning that China had developed the capability to cut the cables in the South China Seas at any time which would in effect cut most nations around the South China Seas primary communications. This includs Japan, Taiwan and South Korea in particular which until recently the US had vowed to defend to the hilt (but now noticeably especially to those nations, does not. Hence the illegal Chinese artificial island building continues along with the destruction and murder of orher nations fishing vessels and their crews).

If you look back on this blog you will find I’ve been waving a small flag on the subject for quite some time.

One consequence I suspect few have thought about is their domestic IoT devices, many of which will not work unless “They phone home to the Mothership” in China. This phone home has little or nothing to do with the Chinese State Agencies, it’s actually a for profit idea so that the IoT users can be “Snaged, bagged, and their data sold to the highest bidder”.

The fact that I fully suspect both the NSA and other Western SigInt agencies do monitor this traffic does not mean I in any way discount the fact that the Chinese State SigInt agencies do the same.

You only have to go back to the debacle with CarrierIQ to realise that all SigInt entities would see such a freebie floating by as a gift from the gods, with the benift of “full deniability”, i.e. something they would not pass over simply because it actually equated directly with “economic espionage”.

Z.Lozinski • April 17, 2019 11:44 AM

@Clive,

The US submarine operation to tap Soviet undersea cables in the 1970s is now well known as Operation IVY BELLS, and is the reason why USS Halibut received annual Presidential Unit Citations. The device, which was built by Bell Labs, was recovered by the Soviets based on information received from the Walker spy ring in the US Navy, and is on display in the Lubyanka in Moscow. You’d like it: a TDM demultiplexer with signal activated recorders in a 4m waterproof pod that sat on the sea bed. It is an impressive piece of engineering, but it is the concept that is impressive. There are several books that cover these operations: “Blind Man’s Bluff” was the first, “Red November” is another.

What’s more interesting, was the development by the USN of the capability for divers to work on the seabed under pressure for extended periods. Clearly important if you are planning on deploying complex telecom gear on the floor of the Sea of Okhotsk. One of the USN divers describes the working conditions when living a depth for a period. The NY Times covered the 30m extension plug fitted to the USS Jimmy Carter back in 2005, along with speculation on its purpose for cable tapping.

We’re back in Utah data centre territory. You just need to think through the implications of what is publicly known, and the capability of current technology.

I’m less worried what the major powers can do – in effect all of them can do this if they choose, and they all know it. The danger is what could a criminal enterprise or rogue state do?

Clive Robinson • April 18, 2019 12:18 AM

@ ,

What’s more interesting, was the development by the USN of the capability for divers to work on the seabed under pressure for extended periods.

I think I’ve mentioned before I was involved several decades ago with a similar capability development by the UK. Supposadly it was to get productivity in the North Sea oil industry up.

It became clear by the way they did not want some problems investigated, was because lowering a diving bell from a submarine does not have the same issues as doing it from a surface vessel.

Part of the testing was to put a deep saturation unit on Lowestoft docks and keep personnel in there for several months…

It is the farcical nature of an accident that happened which generally ammuses people.

Put simply, it’s fairly easy to get supplies like food and fluid into such a deep saturation system. What is not so easy is getting the waste out again, especially that from the toilet…

What was done was install a “vacuum toilet” similar to those on planes, which connected by an interlocked multiple valve system to a storage tank, that was kept at preasure but not as high as that in the deep saturation accomadation.

Obviously the stuff piles up fairly quickly so a commercial organisation that dealt with cesspits and the like were contracted to empty the container on a regular basis.

As you can appreciate there was a well defined proceadure to empty it safely. But as in many other things it appears to be part of the human condition that there are people who want to cut corners etc to make their life easier/quicker.

So there are a group of us standing on the docks next to the DSV we are installing some interesting equipment on. Due to one of those very many issues that come up in such projects we had been told to go and wait ashore whilst certain procedures were carried out. We were bored and the tea/coffee was cold turgid and less palatable than silage[1] so when the “cess tanker” turned up we were all idly watching it, whilst discussing matters of great importance, such as how long the manager at a well known football (soccer) team would survive…

So the “cess man” reverses up junps down from his cab and connects a hose between his tanker and the high preasure container. But… He did something wrong so that when he pulled the leaver, his hose detached from his tanker and flew around like an enraged snake with the man holding on for dear life. Whilst several hundred gallons of the most noxious and vile raw sewerage erupted out rather like one of those “Coke and Mentos” fountains on major steroids.

We stood their with some of us with mouths unwisely agape, not believing what we were seeing. Almost as quickly as it started it was over. The man was somewhere in the middle of a “cess pool” feabily moving and calling out for help with an obviously broken arm. He had tried to get to his feet but each time his footing lost and over he went again. Luckily for us the wind was blowing from us towards him and then onto the rest of the docks.

To cut a long story short both an ambulance and several fire engines turned up. The fire brigade had been told it was a major chemical spill… The ambulance men stood back whilst the fire brigade hosed the docks down with a great deal of presure and a greenish orange cloud drifted inland… Eventually the firebrigade hosed the man down at a lot less preasure but by this time I don’t think he was cognizant of what was happening. The look on his face suggested he had found himself in his own very personal hell and he was duely carted off by the ambulance.

Up untill that point hardly a word had been spoken. Then the voice of the sparks said with forced joviality “Now there’s something you don’t see every day”… Which was true enough.

Getting back to the actual mechanics of subsurface cable tapping, you are right I would be interested in seeing the kit involved, and yes my fingers would itch to have at it with a screw driver 😉

But my curiosity aside there is a much more serious issue as you note,

We’re back in Utah data centre territory. You just need to think through the implications of what is publicly known, and the capability of current technology.

I’m known for saying “What the laws of physics alow”, but I remember back prior to Ed Snowden going walkabout, our host @Bruce asked for peoples thoughts on what Utah could store. I get the feeling he was actually quite shocked as to what telecoms engineers thought and the implication that every key press and spoken word across the US communications networks was being idly hoovered up with loads of space to spare.

With regards,

The danger is what could a criminal enterprise or rogue state do?

Personally I think aside from physical attacks, actually not a lot. We joke about “sipping from a fire hose” but GCHQ Bude has tens of millions in technology in it, and that’s just in effect a switching center for the other tens of millions spent on the twenty or so “sub sea cable risers” that come up along the Cornish coast along with the satellite down channels just up the road. I doubt any criminal enterprise would be able to filter the data, let alone process it to get meaningful information out. Likewise those “second and third world” less than democratic countries, I don’t actually think the Five-Eye SigInt agencies are actually having much success with processing the data either… We were once told “Be careful what you wish for” as you might get rather more than you bargained for.

[1] For those that are not familiar with farming practice, silage is in effect “pickled hay” which is fed to cattle and other live stock over winter when for whatever reason they cannot be pastured. Silage is in effect an anerobic rotting process called ensilage, that not only retains the high nutritional value of “grass crops”, but unlike hay also retains most of the water content as well. Basically the process is to harvest and compact your “green” product into large bails where much of the air is pushed out, then wrap in black plastic to make an airtight seel. If you have ever been near a bail when it is opened it’s not a smell you are going to easily forget…

POPWeasel • April 20, 2019 3:06 PM

Full line rate link encryptors on every physical link…
– on by default
– keyed per link
– perfect forward security
– regular rekeying
– line rate silicon affords best traditional crypto xor with
– best post quantum algorithm
– thus modular agility only as ranked backup plan via chip socket
– no cleartext or other fallback
– full time line rate chaff fill in MACPHY before crypto, dynamically yielding to wheat traffic demand of upper layer, no more traffic analysis
– link, crypto, and fill anomaly detection
– IETF specification
– Opensource silicon

That IS what is needed.
Global cost… under $2 per port in silicon.
Ignore politics and politicians.
Start getting it done.
Now.

Clive Robinson • April 20, 2019 7:39 PM

@ POPWeasel,

That IS what is needed.

You’ve left out the words ‘some of” after “IS”.

There are other areas than encryption and traffic analysis you need to mitigate.

Firstly is “system transparancy” it’s a symptom of “efficiency-v-security”. Put simply the more efficient you make a system the more transparent it becomes. In effect you “open up the bandwidth” to things like covert side channels. As an example from Mat Blaze, network protocols can end up sending individual keypresses as network packets. Due to the way users work their keypress timing in words is random around a mean keypress rate. Thus the randomness is alowed redundancy which is where you can easily hide a spread spectrum coded side channel. Thus a key logger inside a keyboard can get it’s low bandwidth signal through the user PC or server.

Secondly is “active fault injection” many networks are asynchronous at the packet level and avove. Which means that one system can jam another system. One or both systems then wait for what appears to be a semi random time before re-transmitting. The problem is such timings can be very easy to determin thus you can selectively jam a systems datagrams. Eventually the jaming causes “errors and exceptions” back in the OS / Application code. These errors can propagate backwards through systems including the likes of data diodes. In effect systems are also transparent in the reverse direction, effectively backwards up the TX path all the way back to the data sorce.

Thus you have bidirectional communications paths back to before encryption is used…

Yes there are known mitigations but all they effectively do is reduce the bandwidth whilst leaving space for lower bit rate side channels.

There are other things to consider as well which “the laws of physics” more than alow.

Vytautas Butrimas • June 5, 2019 4:54 AM

Am considering all the news about China (Tiananmen anniversary), security with 5G, cables and who knows what is next. One can understand how the guards of Troy must have felt when they were suddenly woken during the night after that Horse was dragged into town.

Schneier on Security

China Spying on Undersea Internet Cables

Comments

Leave a comment Cancel reply