IEEE Spectrum April 2003
Listening In

Submarines prowl the ocean floor, while ships above carefully skirt the
limits of international waters. On dry land, guards patrol high fences
surrounding acres of huge golf ball- shaped radar domes. In the skies,
airplanes knife through the stratosphere,
while higher up orbiting electronic ears listen to whispers from the
planet below. They're all trolling a vast sea of electromagnetic signals
in hopes of catching a terrorist plot in the making, a shady arms deal,
economic intelligence, or a rogue nation building a weapon of mass
destruction.

This so-called signals intelligence, or Sigint, has been vital to the
United States and its allies for decades. But, in the wake of 9/11 and
the failure to capture Osama bin Laden, the shortcomings of the world's
biggest interception system are apparent. The ships, planes, antennas,
and satellites are the result of a triumph of Cold War engineering,
designed to keep tabs on the Soviet Union and its allies. The question
now is: how useful is the system against terrorists who know not to
trust their satellite phones? How effective can it be in an age when
almost untappable fiber-optic lines carry information at stupefying
rates and cheap, off-the-shelf encryption systems can stump the most
powerful supercomputers on earth?

Given the veil of secrecy drawn by nations around their intelligence
operations, these questions might seem unanswerable, but even top-secret
agencies have to operate in the real world, making it possible to draw
some conclusions. Those findings paint an intriguing picture of modern
Sigint, in which the best way past a tough problem can be to
solve a different one. Rather than the creation of ever more sensitive
receivers or code-breaking computers, the hot areas of cloak-and-dagger
information gathering include tapping fiber-optic cables (even at the
bottom of the sea); using tiny bugging devices and old fashioned
bribery, blackmail, and burglary to get at data before it has been
encrypted; exploiting software flaws and poorly configured
communications systems to bypass datasecurity measures; and
automatically winnowing the vast amounts of intercepted communications.

Big brother or white elephant?

The old workhorse surveillance system described above is run by the
United States-with the United Kingdom, Canada, Australia, and New
Zealand as junior partners-under the secret 1947 UKUSA agreement. Often
referred to as Echelon in the popular press, some fear it as the
ultimate Big Brother: listening in on every telephone conversation,
reading every e-mail, tracking every Web surfer around the globe. But
these fears are greatly exaggerated, explains Gerhard Schmid, vice
president of the European Parliament and rapporteur of a 2001 report to
the parliament on the UKUSA system. Schmid notes an obvious fact that
many seem to forget: only those communications that the system has
access to in some way can be intercepted. "There is no special magic
physics for secret services….The rest is movie stories, rumors, and
nonsense," says Schmid.

In effect, whether or not the Sigint system is of value boils down to a
technical question: in the face of a telecommunications explosion that
has brought e-mail, cellphones, beepers, instant messaging, fiber-optic
cables, faxes, videoconferencing, and the World Wide Web to every corner
of the globe, can the UKUSA intelligence agencies attain enough access
to know what's going on?

Of course, some communications are easier to access than others.
Wireless communications in particular offer two key advantages-you can
intercept them without physically tapping into the target's
communications system, and there is no way to detect that they have been
intercepted. "Microwave, radio, telephone, walkie-talkie-communications
that are in the air are all interceptible by some sort of antenna in the
right place," says Jeffrey T. Richelson, author of The U.S. Intelligence
Community (Westview Press, Boulder, Colo., 1999).

Much of the UKUSA system's physical assets around the world and orbiting
above it are devoted to making sure there is an antenna in the right
place. Listening posts of varying scale dot the earth- including on top
of every U.S. embassy. Many are attached to military installations,
while some are operated remotely. Others are mobile, on navy ships and
submarines and on specially modified planes such as the EP-3 that
crash-landed in China in 2001. For decades these eavesdroppers provided
much of the intelligence community's Sigint.

But, for tactical and technical reasons, the well began to dry up at the
start of the 1990s. The biggest tactical problem was that the Soviet
Union's collapse kicked the legs out from under a monitoring network
built up over decades. "There were some easy things about the Soviet
Union," says James Bamford, author of Body of Secrets: Anatomy of the
Ultra-Secret National Security Agency (Doubleday, New York, 2001).

"The first one was you always knew where it was. You could invest a lot
of money in a big listening post in Japan near Vladivostok because the
Soviet navy was always going to be there." Apart from being easily
located on a map, the USSR also generated a steady stream of routine
radio and microwave transmissions to provide grist for the intelligence
wheel. "It's completely different when you're going after sporadic
miniwars and terrorism," says Bamford.

The technical issues arose from the Internet-driven telecommunications
explosion, the most serious consequence of which is the ever increasing
shift toward fiber-optic-based international communications. The shift
was due to the commercially attractive fact that one fiber can carry 128
times as much digital traffic as a satellite transponder-over 240 000
channels, each carrying 64 kb/s.

Breaking into Davy Jones's locker

Before the widespread use of fiber-optic cables, geosynchronous
satellite constellations such as Intelsat and the Russian- sponsored
Intersputnik carried much of the international communications traffic.
Such links can be comprehensively monitored by placing a receiving
station in each satellite's transmission footprint. And thanks to the
global range of the territories belonging to the UKUSA countries,
exactly such a collection of stations was built, from Pine Gap in
central Australia to Morwenstow in England and Sugar Grove in Virginia
[see map, p. 36].

In contrast, cables have to be tapped directly. While this is easy
enough to do if the cable makes landfall in a territory controlled by a
UKUSA country, someone has to visit the cable clandestinely if it
doesn't, typically in a submarine. Fiberoptic cables are the toughest to
crack: fibers don't radiate helpful electromagnetic fields (as did the
old metal cables) that can be detected with an inductively coupled
pick-up collar.

Eavesdroppers first solved this problem by targeting the signal-boosting
repeater stations strung along the cables. Early repeaters had to
convert the signal from light into electricity and back again in order
to amplify it, and in its electronic stage, the signal could be tapped
externally in much the same way as a metal cable. But the development of
erbiumdoped fiber amplifiers, in which the signal is boosted without
ever being converted into electricity, called for a new approach.

In theory, it's easy to find out what's being transmitted along a fiber.
"All you have to do is put a little bit of a bend in the fiber and look
at the light that comes off it," says Jim Hayes, president of the Fiber
Optic Association, a professional society for the industry. The signal
loss in the fiber would be just a few tenths of a decibel, making the
tap undetectable. "But practically," he adds, "it's not so easy." The
problem, Hayes explains, is that, in a typical cable, the fiber in
question is one of a dozen hair-thin strands of glass, which are
embedded inside a laserwelded, hermetically sealed, 3-mmdiameter
stainless steel tube. This tube is in turn covered by a few centimeters
of reinforcing steel wire and cables carrying 10 kV of dc power, all at
a depth of a couple of thousand meters.

"It's not impossible-but it certainly pushes the definition of
practical," Hayes notes. The easiest interception technique is to open
up one of the repeaters to get at the fibers, but, Hayes cautions, "the
whole issue of resealing it is quite difficult because you have to do it
perfectly." Parts must either be sourced from the manufacturer or
duplicated exactly. Despite these challenges, "the U.S. has been
reconfiguring the submarine USS Jimmy Carter for [ fiber-optic
tapping]," says Richelson. The Jimmy Carter, one of a new Seawolf class,
is being extensively modified for a range of covert missions by the
introduction of a new hull section, which will facilitate the use of
remotely operated vehicles, surveillance equipment, and the transport of
Navy Seals, the U.S. Navy's special operations warfare specialists. The
sub is also being fitted with an advanced communications mast, which
will allow it both to eavesdrop on radio signals and transmit
information back to base. The Jimmy Carter should be fully operational
by mid-2005.

Bond, James Bond

But a big remaining challenge, according to John Pike, a defense expert
and founder of GlobalSecurity.org, are fiberoptic cables that stay on
land. "I think that one of the things that [Navy Seals] spend a fair
amount of time doing is [going] ashore…and walking to the nearest land
line," says Pike. "They were doing that in Iraq a decade ago." Pike
believes that this may also be how fiber-optic communications in North
Korea and other countries are monitored: "It's cat and mouse, we try to
see how many taps we can put on [chief of state Kim Jong II's]
fiber-optic network, and the Dear Leader runs around and tries to catch
them."

Another, more aggressive approach to the land-line problem is to force
an opponent onto the airwaves. "One of the things the United States has
been doing since the middle of 2002 is systematically taking apart
Iraq's land-line communications with air strikes, to force them to
communicate via channels that are more readily compromised," says Pike.
Indeed, this may be the reason why U.S. Secretary of State Colin Powell
was able to present incriminating Iraqi telephone conversations to the
United Nations last February.

When a more subtle approach than aerial bombardment is called for,
agencies like the U.S. National Security Agency (NSA) and the Central
Intelligence Agency (CIA) can call upon organizations such as the
Special Collection Service (SCS), a joint NSA-CIA covert group
headquartered in Beltsville, Md. "What this group does is the more
surreptitious black-bag operations," explains Wayne Madsen, who
previously worked at the NSA and is now a senior fellow at the
Electronic Privacy Information Center (Washington, D.C.).
Black-bag operations can include breaking into embassies or facilities
of communications
providers and stealing information or installing bugs.

By bugging a computer or communications system, information can be
captured before it's sent through a fiberoptic cable, author Bamford
observes. A tiny microphone dropped into a keyboard can pick up the
sound made by the keys as they are struck and transmit
the sounds to a nearby receiver. Different keys, according to Bamford,
"sound different-each has a specific signature." Those signatures can be
used to reconstruct what was typed.

The SCS also allows the Sigint community "to be proactive, to go after
information rather than sit and wait," explains Bamford. Another
important SCS mission is to recruit people who work for targeted
governments, like cryptographic clerks or systems administrators, to
ensure access to sensitive information, such as cipher keys. When
successful, such activities also allow the NSA to avoid another steep
hurdle: encryption.

Say what?

The NSA claims to be the world's largest single employer of
mathematicians and has always projected an image of being a
code-breaking outfit par excellence, in the mold of the legendary
British Bletchley Park, which succeeded in breaking the German Enigma
and other ciphers during World War II. But these days, there may be some
misdirection in that image.

The NSA has "covered up some quite spectacular successes at breaking
into cipher systems…by pretending that they were simply better at
mathematics and computer science, whereas what was usually happening was
some form of sabotage, blackmail, theft, corruption, or whatever," says
Ross Anderson, a reader in security engineering at the University of
Cambridge and cryptographic systems expert. (When contacted by Spectrum
for this article, a spokesperson for the NSA said that it does not
comment on operational matters.)

NSA's code-breaking efforts began to run into serious trouble relatively
early in the Cold War. According to Bamford, immediately after World War
II the NSA captured German code-breaking machines that allowed them to
read advanced teleprinter ciphers that the Soviets were using at the
time. But because of a suspected spy, the Russians found out and in 1948
changed all their ciphers overnight. The next day became known as Black
Friday, reports Bamford. "From that date on, it's been extremely
difficult to break Russian ciphers. Most of what the NSA got, they got
from occasional busts."

A bust is a mistake in the implementation or operation of a cipher
system. "Sometimes they don't know they're making a mistake. A clerk is
typing away and all of a sudden the crypto system disengages," explains
Bamford. This can give a code-breaker enough of an opening to be able to
go back and read the entire message.

The solution was to go around the problem. To divine Soviet diplomatic
plans, the UKUSA agencies might track a meeting between a third-world
diplomat and the Kremlin. When the diplomat sent a coded report back to
the home government, the spooks would go after this target's weaker
encryption. "Big governments like the United States and Russia use
home-brewed [cipher systems]. But they've learned through 50 years of
experience to do that well," says Brian Gladman, a former deputy
director of the NATO Shape Technical Center who has worked with
Government Communications Headquarters (GCHQ), the British equivalent of
the NSA. "Smaller countries don't have that experience, and [when they]
build home-brewed ciphers, they don't do very
well."

Countries-including Middle Eastern nations-have also purchased
commercial cryptographic machines, but may not have always operated them
properly. (There are also rumors that the NSA obtained the default keys
to some units prior to delivery.) In any case, the rise of ubiquitous
computer communications has allowed the emergence of widely available
strong cipher systems, such as public key cryptography, which rely on
mathematical functions that would take the greatest supercomputer on
earth millennia to break.

Initially, this caused something of a panic in intelligence circles and
sparked the so-called crypto wars of the 1990s, when the U.S. government
arrested Phil Zimmerman, the creator of one popular public key program,
Pretty Good Privacy, and attempted to impose stringent export controls
on cryptographic software. But the underlying mathematics was already
freely circulating. Non-U.S. companies threatened to take over the
expanding market for online security products and the government
eventually relented. But even with theoretically unbreakable encryption
available to anyone with Internet access, all is not lost for the
codebreakers; once again the solution is to go around the problem.

Nowadays, "exploits against cipher systems involve failures in design
and implementation rather than in the underlying cryptographic
algorithms," as during World War II, explains Anderson. The same kind of
flaws and foul-ups -buggy software, poorly configured systems-that allow
computer worms to wreak havoc on the Internet, combined with SCS-style
activities, give agencies like the NSA a continuing window of access to
the activities of rogue nations and the businesses they deal with.

Indeed, the adoption of new telecommunications technologies has not been
all bad for the intelligence agencies. Actually, the widespread
deployment of cellphones in countries with historically underdeveloped
communications infrastructures has made surveillance easier, especially
of nongovernment targets, like terrorists. "There's more and more
cellphone coverage, even in places like Pakistan," says Madsen.

Pike agrees: "Incomes rose faster than land lines could be put in….Since
so much of the economic activity in these emerging economies was focused
in a few primary cities, it was relatively easy to overlay a cellphone
system." And it is exactly these cities that are likely to host an
eavesdropping U.S. embassy or consulate. Cell- and satellite phones can
also reveal a caller's location. In cooperative countries, such
information may be extracted directly from the cellphone network, while
in other regions the location may be determined if multiple listening
stations (possibly including satellites) can pick up the phone's
transmissions. It was by pinpointing the origin of a satellite phone
call that the United States determined the coordinates for the 1998
cruise missile attack on one of Osama bin Laden's camps in Afghanistan.

Drowning in data

But these successes in keeping 21st century communications an open book
have just compounded the biggest issue of all: volume. "It's hard to
comprehend the enormous increase in communications in the last 15
years….You're talking two million pieces of communication an hour from
one listening post," says Bamford.

More and more of the NSA's vast computer resources are devoted to simply
storing and cataloging the torrent of raw Sigint that pours into its
Fort Meade, Md., headquarters. The agency's ultimate problem is that
there are just too many people on earth to monitor everyone. The only
solution is to throw away as much as possible of the information as soon
as possible after it's been collected.

"The electrical engineers and computer scientists at NSA spend a lot of
their time developing [automatic] filter systems," says Bamford.
Strategies like focusing on telephone calls from a particular
installation, searching for specific words and phrases in e-mails, or
using voice recognition techniques [see "Getting the Message," pp.
38-42] are all deployed in the hope of picking up a terrorist giving
orders rather than someone arguing with their significant other.

While it is unlikely that any government, army, or terrorist group will
ever again have its plans as comprehensively exposed as the Nazi war
machine's, Sigint should still be effective against specific
targets-but, as 9/11 and the search for Osama bin Laden prove, only as
part of an integrated intelligence strategy that prevents it from
turning a deaf ear.

To Probe Further
The European Parliament's report on the
Echelon eavesdropping network can be
found online at http://www.europarl.eu.int/
tempcom/echelon/rrechelon_en.htm.