Schneier on Security

Clive Robinson • July 19, 2019 4:43 AM

@ George,

The far south isn’t quite out the reach of USA hands, nor is its quasi-legal framework to freedom.

That implies a “functioning US Government within international norms”.

The book and what SHTF-Prepers are plsning for is a Government that is not functioning within international or social norms.

What you might call the “Zombie Apocalypse Scenario” where some one has in effect given the old maritime cry of “Everyman for himself” where “the law of the sea” is assumed suspended, but to Society and Governance.

As any honest law enforcment officer will tell you they only have control by what is in effect a confidence trick. That is the notion of “endless pursuit” by fellow law enforcment officers. Where that is of no concern to an individual then the law officers “badge” becomes a convenient aim point.

The simple fact is there can never be sufficient law officers or soldiers or other types of Guard Labour to stop a civilian population that decides it’s better off without them. It’s something that very few want to have discussed let alone discuss it. Instead they talk of “Force Multipliers” and “Technology Solutions” that in reality are no more than a variation on the same confidence trick.

The reason authoritarian leaders like these force multiplying technology solutions is that they get the illusion of removing “unreliable humans” from their “ultimate control loop” thus having more direct control. Hence the idea of an uncontrolable “Madman with their finger on the button” of some kind of doomsday device. Which has been standard “movie plot” meme since the movies started.

However things tend not to work that way for various reasons, not least because human trust has limits… that is people maintain personal power not just against those below them in the hierarchy but also to protect them from those above. As noted threatening those below is only effective when they believe it can be enforced against them or they care. When using it for protection from those above, you make sure as best you can that those above can only make threats, and not enforce them, thus not only do you have protection you also enforce their reliance on you in your place of power.

The game Peter Theil and Co are playing with Palantir is to become what is in effect “the power behind the throne”. If they take over the collection of data for the Government entities by under bidding the Governments own entities, then the Government by the usual political rules ends up going with the cheapest option, especially if it offers more than they can do themselves. In that way the Government becomes dependent on those that control Palantir, thus a reliance structure comes into place. As long as Peter Theil and Co can maintain control of the information flow then they are in effect safe.

If someone worked for Palantir they to if they had any sense would ensure that they had leverage on those above… Thus it becomes an interesting game of who can outsmart who and more importantly what they do with such power and when.

From a security and psyhchological aspects this all becomes rather interesting, if you can of course retain your freedom of identity from it.

Clive Robinson • July 20, 2019 10:29 AM

@ gordo,

How Peter Thiel’s Secretive Data Company…

The article confirms what I had heard from other sources, hence the concerns I have expressed.

The big things it does confirm is,

1, GIGO applies big time as does the automation of discrimination.

2, Nobody gets to see the raw data or processing algorithms just results. So nobody gets legall standing to gain remidies.

3, The “Nothing succeds like failure” original Microsoft business model is still alive and well.

4, Big Tech are still the biggest “Welfare Momers” on the planet to fat and lazy to do anything except connive to hang off the tax dollar teat, sucking society dry.

But it’s not all Palantir’s fault, those with the money failed to fix sensible terms of service. Whilst I know this can be difficult, simple things like “data ownership” and “how” and in what format it is to be maintained such that the rights pertaining to ownership can be maintained across service provider transition are considered “primary requirments” these days, as is tracability of usage such that fees for use by third parties can be levied etc. Also the basic rules about how to not get “locked-in” in the way IBM pionered in the 1960’s and 70’s which so many suppliers followed which is one of the prime risks of “X As A Service” of cloud style operations.

Sadly the whole thing reads like a story of some rube getting gulled and stripped by artfull shyster con artists (just as PayPal does).

But if you read the article carefully there is also that old Microsoft “Throw in new bells and whistles, but fix only the minimum of problems, to keep the upgrade cash flowing in” model at work.

There is also the bit in there about “users having to be programmers to get Palantir systems to be of use…” This begs a question as to “Appart from fancy graphics displays is Palantir offering anything that could not be done by an object oriented database and a good set of query writers?”

All in all Palantir sounds like an overly hyped system upgraded by marketing “bells and whistles” supported by a rapacious drain on public resources.

Oh and that “Drug Dealer build dependency” trick. Federal Grants only for “high tec” etc, getting exploited untill dependancy holds the public service organisation veins wide open. You would think that Federal Grant funders would have woken up to this by now… Which begs the question of if they are getting paid in some way not to notice…

Clive Robinson • July 21, 2019 7:57 AM

@ George,

Collection of data does not remotely imply achieving the power to effectively apply it.

But the control of information does, which is what Peter Theil and Plantir are working towards.

For many millennia the accepted wisdom has been “He who controls the high ground…” which is why we have so many “hill forts” and “cliff and mountain top castles” in places with multi-millennia civilisations and histories.

However by the time of the Tudors half a millennium ago it was realised that “controling trade routes” was actually as important. Hence Henry VIII built what some historians considered “The First Modern Navy” where the notion of “floating castles” or “Battle ships” that could “project power” by cannon came to be.

A little over a century ago what some historians consider the prototype-scientific or technical war the use of force multiplers (engines) and range multipliers (communications) evolved into effective battle field devices. Thus a little less than a century ago, those Generals that had been defeated, put their minds towards how to win the next war, whilst the victorious generals as usual did not think of new methods to wage war or how to defend against them. What those defeated generals realised was that strong points such as castles or embedded fortifications were effectively weak points in battle planning. That is highly mobile forces that fortifications were not designed to deal with were key, with that mobility the issue of command and control rested on effective communications. Not just between brigade commanders and troops as it had been by phone line in WWI, but troops to troops and especially aircraft and infantry.

Thus the notion of blitzkrieg, that was used to destroy fixed points in roads, railways and telephone communications and broadcasting stations. Denying not just mobility and communications to the targeted forces but also the civilian population, whilst also sowing as much fear or in more modern parlance “Shock and awe” into both thus effectively creating paralysis in the targeted forces and population.

By the end of WWII it was clear to all that the “new high ground” was information or the effective usage of it. That is still very much true today, especially when trying to fight in an asymetric warfare environment. A small attacking force survives by denying information to the larger force. The appear then disappear with as little trace as possible and effectively hide in plain sight in the general populous. The only way a larger force can engage with the small force and neutralize them is by the gathering of any and all information, processing it and extracting actionable intelligence from it, which is an involved and resources intensive process, often needing specialised personnel often called analysts.

So it’s not the person who collects data that is critical to this function it’s the people that control the flow of information and process it. Thus “Information control and processing is the new high ground” and not just in warfare.

Law enforcment and civil control are all about “asymetric warfare” activities. Whilst LEO numbers are very large when compared to criminal or other groups they are very small thus dispersed when compared to the general population in which the criminal and other groups hide in plain sight. Thus their success is critically dependent on “Information control and processing”. Which in this current political climate decides the future not just of organisations but people as well.

The likes of CCTV and the information it provides has enabled “directed policing” that for petty and street crime helps reduce the numbers of crimes, or alows the politicians dream of reduced numbers of police officers, whilst also appearing “tough on crime”. Importantly though it is only the “bottom feeder” type criminals and their crimes that have been effected. Other crime figures due to reductions in policing numbers and experience are getting worse.

As has been known for years most criminals who get caught, get caught due to “information received” or in their vernacular “somebody grassed them up” quite often it’s because they are stupid and “big it up” in some way. As war time posters used to say “loose lips cost ships”, thus whilst these criminals are not quite the dregs of the criminal classes they are mainly being caught through their own stupidity. Which means that the slightly smarter criminals are not being caught.

Whilst there is evidence that LEO’s will “frame” or “fit up” individuals usually it is because whilst they have sufficient “information received” to know who repeate offenders are, those who are slightly smarter and don’t “big it up” and have better planing for their activities don’t produce the evidence the police reduced resources can find. Thus acceptable by court evidence is unavailable to convict such criminals, so it is made up in some way, which is why plea bargaining is such a strong part of some judicial systems as is false “taking into account”.

As “fitting up” does not work as well as it used to, especially with the more intelligent criminals who take security seriously, other more modern but equally as questionable methods are being developed and used. One such method has been called “parallel construction”, it’s used where the “information received” has been obtained by methods that are not legal or highly questionable. Thus the information has to be “processed” in some way to make it legaly acceptable to a court as evidence[1].

Whilst there are not laws as such about the use of “traffic analysis” of communications meta data, meta data of all forms when processed correctly can produce actionable intelligence, that can for other reasons not be used in court as it’s not generally explainable to a jury or judge. For instance geographical information of mobile phone use reveals all sorts of information not just about who has it in their possession but the usage patterns reveal if it is being used as a “borrower”[2] or “burner” phone, which are indicators of “activities of interest” but are not direct evidence of criminal behaviour thus at best only circumstantial evidence, even though highly indicative to a specialist analyst.

Thus how to get from “indicative intelligence” to court admisable evidence that is more than circumstantial.

This can be done in a number of ways however the way that is easiest is also questionable if not illegal. The “indicative” or “actionable” evidence is then used to asign limited resources such as questionable / illegal wire taps or questionable / illegal surveilence to gather further intelligence. This might involve going from “technical” to “human” surveillance, the latter being significantly more resource intensive. Or it might lead to the ability to get evidence by searching “Third Party Records” that do not require warrants or other court controled evidence gathering techniques. However a more modern method is to take questionable / illegal inteligence and feed into a parallel construction process, that hides the questionable / illegal inteligence gathering from not just the court but the defence as well.

What Palantir is designed to do is not “collect data” but “process data” into “actionable intelligence” what they are doing is getting those who buy there services to enter data into Palantir’s systems, record the types of searches those purchasors make and turn both the data and search methods into their “intellectual property” that they then sell to others to “wash, rinse, spin and repeate”. As part of that they take the knowledge of specialists and devolve it down to less and less specialised users at each stage. But as part of this just like drug dealers they give discounts and other incentives ti get their buyers not just hooked but addicted to the point of near total dependency on their services at which point that opaque pricing structure becomes a blood letting process where by they bleed their customers almost to the point of being dry. Certainly to the point where the customer can not get their own data and take it somewhere else, or build up an inhouse specialist group or other expertise.

But there is also the “Mystique of AI” that makes the likes of “Parallel Construction” not just way way easier to do it also makes it almost entirely opaque if not invisable to oversite. It also enables Palantir to steal both customer data and methods and by a proces of highly questionable “conversion” turn it into their own “Intellectual Property” which they can privately benifit from without as would be usually required paying royalties to the originators who at the end of the day are payed for by the tax payer. So Palantir are defrauding the public.

Why you have not seen this I don’t know but it’s what Palantir are clearly doing.

Worse we actually know they are not doing it in either a secure or workman like manner. People who should not get access to highly confidential data are, there are significant uncorrected errors in the data and the methods are in effect stolen and reused without consideration for the level of reliability or bias involved.

All of which is being used on the civilian population who have no recourse civil or criminal if they are harresed, incorrectly treated or falsely criminalised…

[1] The idea of the procesing of not legaly usable intel via “Parallel Construction” can be easily seen with the following overview of an event known to have happened. A vehical gets pulled over by a police vehical for a minor and unquantifiable reason such as “driving without due care and attention”. The police vehicle just happens to be “the dog patrol” and the dog gives signs of drugs etc. A search is carried out and significant quantities of illegal drugs get found hidden in the pulled over vehicle. An acceptable series of events to a court, but what was the reality… It started with what would be an illegal wiretap or surveillance operation that got information about a drugs run timing etc. Thus the dog patrol vehicle was deployed at the right time and place with knowledge of exactly which vehical to pull over and search. Other units were also deployed incase the suspect vehical tried to make a getaway etc. We know this goes on because of a loop hole that UK law enforcment exploited but tried to keep quiet. The laws on surveillance in some EU countries are very different than the UK so smuggling operations could be legaly put under surveillance etc, but if the evidence was used in a UK court, not only would it get challenged it would alert other criminal gangs to what had happened and they could learn from it. Thus “subterfuge” was used to protect the real information abd questionable Dutch source. Further we know from a case where a police survailance operative who had tresspassed on private property and been stabbed by the property owner that illegal surveillance techniques are emoloyed. We also know from a paternity / child support case that the UK Met Police used “deep undercover officers” who routienly carried out immoral and illegal activities whilst trying to get into and stir up otherwise peacefull protest groups that were although behaving quite legaly were politically inconvenient, thus had to be dealt with… This also led to revelations that the Met Police were gathering intel on the protesters and handing it over to private organisations with the purpose of them provoking activities that would give rise to civil or criminal court action.

[2] Whilst most are aware that “burner phones” are those purchased anonymously used for only extreamly limited use then disposed of, not as many are aware of the idea of “tweener” and “borrower” phones. To deal with burner phones some authorities have regulated the market such that no phones can be purchased or connected anonymously to a network. Which makes burner phones problematical unless you have certain technical expertise. Thus the “smart minds” on the other side have realised that you can use non anonymous phones anonymously if you “borrow” them in some way. This idea goes back long before mobile phones to cars and other licensed road vehicles such as commercial haulage. When a car was sold to a dealer, the dealer did not “re-register” the car so the old “one carefull owner” statment could be used. Thus for a period of time a dealer had possession of a vehicle that was to “official records” not theirs. They had in effect got it “borrowed” from the actuall registered keeper, and got the use of it “between” registered keepers. Back when it was easy to “wind the clock back”, “hot wire” or “dip the door lock” on vehicles this proved an attractive option to certain types of criminals for moving around stolen goods or going to covert meeting etc. Provided they were carefull nobody other than themselves would ever know. Well the second hand phone market provides the same opportunity to “borrow” in “between” phone owners such that carefull use does not show up as anomolous, thus you get the anonymity of a “burner” without having to burn it[3].

[3] We also know that alledged terrorists used a similar technique to “tweener” phones to avoid drone strikes. They would obtain a phone and service use it once or at most twice then give it away or sell it on the cheap. If a drone strike happened then it also gave free propaganda about the US targeting and murdering innocent civilians.

Clive Robinson • July 26, 2019 7:42 PM

@ gordo,

Suprise surprise, the research shows that Palantir systems for the LAPD are not good news. Thus it’s likely they are not worth the money etc…

I’m not surprised Palantir are so secretive, the more we learn about them, the mote obvious it is we would be better off without their activities.

A thought still occurs to me as to who the real customers of all this data realy are. The LAPD are putting in their data and we know it’s being used by others.

The question is as LAPD are at the bottom of the Palantir food chain, who is at the top. Knowing where their original seed money came from, it leaves me with the worrying feeling that contrary to what they are supposed to be about, the CIA is now bigtime into domestic surveillance through the likes of Palantir and others…