2295 lines
98 KiB
Plaintext
2295 lines
98 KiB
Plaintext
ComSec Letter
|
||
|
||
Editor: James A. Ross
|
||
|
||
YOGO 3
|
||
|
||
1987
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
COMSEC LETTER
|
||
|
||
|
||
The ComSec Letter was started in 1984, The Year Of George
|
||
Orwell, by Jim Ross. Initially it was mailed at no charge to
|
||
everyone on his mailing list, and it was later offered by
|
||
subscription. After the founding of the Communication Security
|
||
Association, the letter became its official organ. In 1989 the
|
||
association decided to create a new organ, Comsec Journal; and,
|
||
in order to minimize confusion, the name of this letter was
|
||
changed to Surveillance.
|
||
|
||
What follows is an edited version of the contents of one
|
||
year of the letter. (The letter has been edited to remove
|
||
topical, superfluous, and outdated items.)
|
||
|
||
|
||
|
||
Ross Engineering, Inc.
|
||
7906 Hope Valley Court
|
||
Adamstown, MD 21710
|
||
Tel: 301-831-8400; Fax: 301-874-5100
|
||
|
||
|
||
January, 1987
|
||
|
||
ANNOUNCING!
|
||
|
||
The ComSec Association announces its second annual meeting:
|
||
|
||
SURVEILLANCE EXPO '87
|
||
|
||
to be held at the Sheraton Hotel and Exhibition Center, New
|
||
Carrollton, MD (on the Washington, DC beltway) October 20 - 23,
|
||
1987.
|
||
|
||
Conference and Exhibits: October 20 - 22.
|
||
Membership meeting: October 23.
|
||
|
||
The conference and exhibits will feature the latest in the fields
|
||
of communications and information security, surveillance and
|
||
investigations technology. The ComSec Association will again
|
||
offer seminars and panel discussions featuring people with real,
|
||
current experience in their fields. We're billing it as a "nuts
|
||
and bolts" affair.
|
||
|
||
Although the program is not yet fully defined, we're arranging
|
||
for conference participants to be able to interact with "hands-
|
||
on" experts in areas such as:
|
||
|
||
DES vs. Other Standards
|
||
Defense against Hackers
|
||
Defense against Electronic Eavesdropping
|
||
Modern Methods of Phone Tapping
|
||
NSDD 145
|
||
Electronic Communications Privacy Act
|
||
Biometric Access Control Systems
|
||
Night Vision Equipment
|
||
and more, much more.
|
||
|
||
In order to tailor the conference to the needs of security
|
||
professionals, we're sending out a questionnaire to 25,000
|
||
qualified people, asking them to rate the desirability of many,
|
||
many subjects. Once those results are tabulated, we'll be
|
||
contacting the people who have volunteered. If you are interested
|
||
in making a presentation, send us a short note outlining your
|
||
topic and your qualifications.
|
||
|
||
For more information:
|
||
Shirley Henschel, Conference Coordinator
|
||
Surveillance Expo '87
|
||
9306 Wire Avenue Suite 701
|
||
Silver Spring, MD 20901
|
||
301-588-3929
|
||
|
||
ECPA
|
||
|
||
Electronic Communications Privacy Act. That's the new law that
|
||
decrees that there are some frequencies that we should not tune
|
||
to. If they want to enforce it, they'll have to create "Frequency
|
||
Police". (All calibrated at NBS to prevent accidental arrest due
|
||
to incorrect frequency readout.) Looks like "Thought Police" will
|
||
be the next step.
|
||
But let's be serious about this silly law.
|
||
We're still working on trying to understand all of its
|
||
provisions, and we've had some interesting discussions with Bob
|
||
Horvitz, Bob Jesse, Barbara Rowan and others. It looks like we'll
|
||
have a great panel discussion at our fall meeting!
|
||
Anyway, for this month our comments about this law relate to the
|
||
"jaw-dropper" that we heard in Beverly Byron's (our Congresslady)
|
||
office. As we picked up the material which tells how to amend the
|
||
old law we commented to the staff, "If the new law says what
|
||
we've been told it says, it will be illegal to listen to stereo
|
||
music on the radio, or to MUSAK." The response from the staff
|
||
was, "It doesn't matter what it says now. They always change the
|
||
words after a law passes to make it mean what they meant to make
|
||
it mean in the first place."
|
||
Now isn't that a fine kettle of fish!
|
||
Our elected representatives vote to create a new law, and then
|
||
somebody rewrites it after they vote on it, to change its
|
||
meaning!
|
||
|
||
|
||
PUBLICATION OF INTEREST
|
||
For some time now we've been reading Police and Security News
|
||
with some interest. The reason for this comment at this time is
|
||
that in the January-February issue a new column was introduced.
|
||
Written by Steve Uhrig, it relates to modern electronics as
|
||
applied to police work. The first column is entitled "James Bond
|
||
Electronics -- PRACTICAL for the Small Department".
|
||
Our hats are off to Dave Yaw, Publisher, and Steve Uhrig,
|
||
author. Good, practical, down-to-earth information of this kind
|
||
has been sadly lacking in our opinion -- especially in law
|
||
enforcement publications. As a matter of fact, good technical
|
||
information is really hard to come by in many of the popular
|
||
security and communications magazines. (One of the communications
|
||
magazines recently said that ISDN stood for Integrated Standard
|
||
Data Network; that you should have a "lightning rod to attract
|
||
and safely ground lightning"; and referred to bandwidths of 64
|
||
kilobits and 1.544 megabytes.) (In case you're not a
|
||
communicator, ISDN stands for Integrated Services Digital Network
|
||
[or Innovations Subscribers Don't Need, depending on your point
|
||
of view]; lightning rods create a field to try to prevent
|
||
lightning hits; and bandwidths are measured in Hertz (related to
|
||
bits or bytes per second, but not related to a number of bits or
|
||
bytes.)
|
||
Anyway, back to Steve's first column. Overall it should be of
|
||
value to the people it was aimed at -- law enforcement officers
|
||
in a small department. They don't have experts in electronics,
|
||
night vision, etc in their organizations, so they need all the
|
||
help that they can get. We're looking forward to seeing many more
|
||
columns like this in that publication. For subscription
|
||
information, P&SN, POB 330, Kulpsville, PA 19443.
|
||
|
||
|
||
SURVEILLANCE EXPO '87
|
||
How did we come up with that name? Well, as you may recall, our
|
||
first conference was entitled "ComSec EXPO '85", a good name for
|
||
a meeting of an association of folks who work in the field of
|
||
communication and information security. However, much of the
|
||
technology related to investigations so we called one track
|
||
"Investigations Technology". This year, in preparing for our
|
||
second meeting we went over our notes relating to the earlier
|
||
conference and found that surveillance was the one common thread
|
||
in all of the interesting panel discussions and exhibits. We
|
||
tried every way from Sunday to bring the ComSec name into the
|
||
title, but surveillance always was there.
|
||
So that's how the name, Surveillance Expo 87 came about.
|
||
By the way, potential exhibitors, there is no conflict with the
|
||
IACP meeting which starts in Toronto on the 24th. C'mon in and
|
||
show your wares. We are planning a great show, and expect that
|
||
attendance will be several time what it was during our first
|
||
show.
|
||
|
||
|
||
OTHER COMSEC ASSOCIATION NEWS
|
||
Your directors have decided to take the advice of some
|
||
membership association pros, and to fly in the face of some other
|
||
advice from some other pros.
|
||
The advice that was taken says that it is nonsensical to end
|
||
membership years one year from the date of joining; all
|
||
memberships should expire on the same date. Therefore, we have
|
||
decided that the end of our membership year will be September 30.
|
||
All current members will be asked to make a pro-rata dues
|
||
correction by Paul Bowling in the near future.
|
||
The advice that we did not take told us that life memberships
|
||
normally cost 20 time annual dues. We decided that we'd like to
|
||
offer life memberships to current members for a limited time at
|
||
10 times annual dues, and set Dec 31 1987 as the cutoff date.
|
||
That's right. If you are now a member, or ever have been a
|
||
member, you may become a life member for $500 anytime between now
|
||
and the end of this year. If you have never been a member, your
|
||
cost will be $550 during this year only. After December 31, life
|
||
membership will cost $1,000. (these rates are for USA, Canada,
|
||
and Mexico; other countries: $700 and $770 before December 31;
|
||
$1400 after that date.)
|
||
Also, we've done away with student memberships because of all of
|
||
the problems that they created. We want very much to have young
|
||
folks who are going to school involved and learning about this
|
||
technology, and we tried; but the problems of administering
|
||
student memberships were too much. Maybe one of our members will
|
||
devise a way that we can keep students involved. Let's hope so.
|
||
|
||
|
||
STARTING OUR FOURTH YEAR!
|
||
It's amazing how time flies when you're having fun. It's hard
|
||
for us to believe that this is the fourth year that we've been
|
||
turning out this letter. We've enjoyed it; hope you have too.
|
||
The first issues were typed on an IBM PC by a two-fingered
|
||
typist, and stored on floppy disks before being printed on a dot
|
||
matrix printer. Now they're stored on an almost-full 10 meg hard
|
||
disk before being printed on a laser printer. Some things never
|
||
change, though. They are still typed with two fingers.
|
||
|
||
|
||
NEW CORPORATE MEMBERSHIP PROGRAM
|
||
At a recent board meeting your directors decided to offer
|
||
corporate memberships at rates which relate to the size of the
|
||
corporation. (Actually, the program relates to any business or
|
||
association, whether incorporated or not.)
|
||
Here's the way it goes:
|
||
|
||
Number of employees Annual Dues Number of Members
|
||
|
||
1 to 5 $150 1
|
||
6 to 10 300 2
|
||
over 10 450 3
|
||
|
||
The members will be designated by the corporation, and may be
|
||
changed if an employee leaves or is transferred. The memberships
|
||
carry full membership benefits and full voting rights.
|
||
The corporation will receive a 10% discount on everything
|
||
purchased from the association such as advertising, booth space,
|
||
etc. In addition, the corporate members will be listed in various
|
||
publications as a sponsor of the association.
|
||
|
||
|
||
NEW CONTEST!
|
||
The grand prize is a mention in this letter, and doing the
|
||
research and compiling the results will be arduous; but maybe
|
||
somebody will take the challenge just for the fun of it.
|
||
What we're looking for is a listing of organizations,
|
||
businesses, etc. that routinely tape telephone calls without
|
||
notifying the caller. What comes to mind immediately are
|
||
stockbrokers, emergency services (fire, police, ambulance), hotel
|
||
hot lines (all Marriott hotels have a "guest hot line" for
|
||
problems), some private investigators, etc.
|
||
The next step in this research is, of course, to list the number
|
||
of criminal indictments for illegally recording telephone
|
||
conversations.
|
||
The serious intent of all of this work is to make available to
|
||
all (even lawmakers) real information on the real world.
|
||
All contributions welcomed with open arms. They don't have to be
|
||
fancy, just readable. Y'all come. Heah?
|
||
|
||
|
||
BY-LAWS; ELECTIONS
|
||
The founders of CSA pledged to always keep in mind that the
|
||
first duty of a membership association is to provide service to
|
||
the membership. At our organization meeting on October 23, 1987,
|
||
members will be asked to approve the By-laws created by the
|
||
current directors. Those By-laws specify that directors will be
|
||
elected by the members, and the officers will be chosen by the
|
||
elected directors. During that meeting, we will be electing some
|
||
new directors and installing a new slate of officers. You are
|
||
urged to attend, and to assist in the planning beforehand.
|
||
|
||
|
||
TAP, BACK ISSUES
|
||
Ben Harroll advises that back issues of TAP are available from
|
||
Pete G, PEI, POB 463, Mt. Laurel, NJ 08054 @ $100 for the full
|
||
set, which includes issues 1-83 and some schematics. We'd be glad
|
||
to pass on any comments from satisfied (or dissatisfied)
|
||
customers.
|
||
|
||
|
||
February, 1987
|
||
|
||
COMSEC ASSOCIATION ANNUAL MEETING
|
||
|
||
The second annual meeting of the ComSec Association
|
||
(details: page 2) will be held on October 23, 1987 in conjunction
|
||
with
|
||
|
||
|
||
SURVEILLANCE EXPO '87.
|
||
|
||
to be held at the Sheraton Hotel and Exhibition Center, New
|
||
Carrollton, MD (on the Washington, DC beltway) October 20 - 22.
|
||
|
||
Surveillance Expo '87 will feature three full days of
|
||
meetings, workshops, and seminars with lots of time available to
|
||
visit the exhibits. The conference and the exhibits will cover
|
||
the latest in the fields of:
|
||
|
||
SURVEILLANCE & COUNTERSURVEILLANCE
|
||
|
||
INVESTIGATIONS TECHNOLOGY
|
||
|
||
COMMUNICATIONS AND INFORMATION SECURITY
|
||
|
||
TECHNICAL SURVEILLANCE COUNTERMEASURES
|
||
|
||
RELATED TECHNO-SECURITY FIELDS
|
||
|
||
At SURVEILLANCE EXPO '87 we are dealing with many technical
|
||
subjects which, all too often, have been
|
||
|
||
sensationalized to the point of absurdity,
|
||
misunderstood by the press and public,
|
||
misrepresented by unscrupulous hucksters.
|
||
|
||
We are planning an event which presents detailed and factual
|
||
information which can be understood and appreciated by attendees
|
||
who are not technical experts. SURVEILLANCE EXPO '87 is intended
|
||
to be a "nuts and bolts" conference with heavy emphasis on real,
|
||
practical, down-to-earth information.
|
||
|
||
In order to tailor the conference to the needs of security
|
||
professionals, we're sending a questionnaire to qualified people,
|
||
asking them to rate the desirability of many, many subjects. Once
|
||
those results are tabulated, we'll be contacting potential
|
||
speakers. If you are interested in making a presentation, send us
|
||
a short note outlining your topic and your qualifications.
|
||
|
||
|
||
COMMUNICATIONS SECURITY ASSOCIATION
|
||
|
||
Objective. The objective of the ComSec Association is to enhance
|
||
professionalism in the information and communications security
|
||
field. The principal activity in support of this objective is to
|
||
provide accurate and unbiased information on the technologies
|
||
relating to protection of privacy. This means a heavy emphasis on
|
||
communications and information, but it also includes the field of
|
||
surveillance. The association encourages open and complete
|
||
interchange of information among members.
|
||
History. The ComSec Association was founded in 1984 as a
|
||
non-profit membership association. The first annual meeting took
|
||
place in December of 1985 in Washington, DC. No meeting was held
|
||
in 1986, so the 1987 gathering becomes the second annual meeting
|
||
of the members. There are currently about 300 members.
|
||
|
||
The founders, Arnold Blumenthal, James A. Ross, and Craig
|
||
Silver elected Ross to serve as president until By-Laws are
|
||
adopted, and a new board of directors is elected. Craig Silver
|
||
later agreed to serve as the association's counsel and,
|
||
therefore, had to resign from the board because he could not
|
||
represent an organization of which he was a director. Kenneth R.
|
||
Taylor, President of Target International Corporation in Miami,
|
||
was elected to fill the vacancy. Later, the board size was
|
||
increased to 5, and Paul Bowling of National Investigative
|
||
Services, Inc. and Eugene T. Smith of Teltron, both in the DC
|
||
area, were elected to fill the vacancies. Smith later resigned.
|
||
|
||
|
||
Second Annual Meeting. The second annual meeting of the ComSec
|
||
Association will take place on October 23, 1987 at the Sheraton
|
||
Hotel, New Carrollton, MD following Surveillance Expo '87.
|
||
|
||
All members of the association are urged to attend. The
|
||
organization is involved in fields of technology which are
|
||
changing dramatically and rapidly. As professionals, we must
|
||
continue to study and learn, and the conference and exhibits will
|
||
provide a great learning opportunity. Several of our '85
|
||
exhibitors have reserved space, and we're hoping to have about
|
||
100 exhibitors as compared to 43 last time.
|
||
|
||
|
||
New Director. Recently the Board of Directors met to elect a new
|
||
director to fill the vacant slot, and voted to bring Chuck Doan
|
||
on board. He has agreed to handle the job entitled VP, Finance.
|
||
|
||
Finally, after years of confusion, the money matters of the
|
||
association are going to be organized.
|
||
|
||
If you want to contact him, his address is:
|
||
Charles W. Doan
|
||
Clancy, Doan Intl. Assoc. Inc.
|
||
117 Rowell Ct.
|
||
Falls Church, VA 22046
|
||
703-237-0611
|
||
|
||
Welcome, Chuck!
|
||
|
||
|
||
ECPA, WHAT DOES THE LAW SAY?
|
||
|
||
While visiting a colleague in another state recently, I
|
||
heard him tell a journalist that it was OK to record telephone
|
||
conversations of people talking on your own company's phone
|
||
without their knowledge or consent. Your big smart expert editor
|
||
advised him that it might be all right according to his state
|
||
laws, but that such eavesdropping was a federal felony. He
|
||
countered with, "I checked with the FBI and they told me that
|
||
it's OK."
|
||
|
||
Wow. Maybe I really don't know what the federal law says.
|
||
Better read it again after I get home.
|
||
|
||
You know how it goes. You get back from a trip, and here are
|
||
all these things awaiting your attention, so the law did not get
|
||
read.
|
||
|
||
Then comes an issue of Communications Week with a feature
|
||
article on SMDRs, and in this article there is a flat statement
|
||
that the law's "business extension exemption" lets employers
|
||
eavesdrop on business related calls.
|
||
|
||
Wow again. Grab old law. Must be in 18 USC 2511. Read. Read.
|
||
Read. No mention. Ah Ha! Get smart. Call Barbara Rowan.
|
||
|
||
Dear sweet lady takes time out from writing a memo with an
|
||
impending deadline. "Must be in 2511." she says. "Hmmm." she
|
||
says. "Can't find it. Have to call you back."
|
||
|
||
While Barbara is researching this, let's hear from you. What
|
||
do you think the law says? Or is there some case law in which the
|
||
judge took it upon himself to do the job of the legislative
|
||
branch?
|
||
|
||
Meanwhile, your ol' ed has been trying to unravel the
|
||
puzzle. He talked to the reporter who wrote the story in CW, and
|
||
the reporter referred him to the lawyer who was quoted. After six
|
||
calls to San Jose, Robert D. Baker called me back. Asked if he
|
||
had been correctly quoted in the CW story, he asked, "What's
|
||
Communications Week?" So I read him his various statements, and
|
||
his response was that he had never made those comments; in fact,
|
||
he said that, as a civil rights lawyer, he would have responded
|
||
exactly opposite to the statements attributed to him.
|
||
|
||
So, Jon Swartz and the editors of Communications Week, the
|
||
ball is in your court. Where did you get the idea that there is a
|
||
"business extension exclusion"?
|
||
|
||
|
||
BACK ISSUES OF COMSEC LETTER
|
||
|
||
Soon all of the back issues of ComSec Letter will be
|
||
available on our BBS. At present, we are editing those letters on
|
||
our word processor, and will upload them to the board when
|
||
finished. (No, we're not removing the mistakes; we're editing to
|
||
remove topical items such as meeting announcements, etc.)
|
||
|
||
|
||
AN IDEA TO WAKE UP SOME SELF-SATISFIED BUREAUCRATS
|
||
|
||
Recently, I talked to some government people about the mess
|
||
in Moscow. Among others, I called the staff director of the
|
||
committee which was planning hearings about the bugged embassy in
|
||
Moscow. The reason for the call was to advise that there is a
|
||
professional association that has TSCM experts available to
|
||
testify. He said that they planned to call only government
|
||
witnesses, implying that only people with government security
|
||
clearances could possibly understand advanced bugging systems.
|
||
|
||
Ha! It was government experts (with security clearances but
|
||
no knowledge of resonant cavities) who checked the Great Seal
|
||
that the Soviets gave us, and said that it was OK to hang it in
|
||
the Ambassador's office. As a result, of course, the Soviets were
|
||
able to hear everything that was said in that office for years.
|
||
|
||
In fact, they would still be listening except for the detail
|
||
that a defector told British intelligence about it, and the Brits
|
||
contacted our people saying, "I say, old chap, did you know..."
|
||
|
||
So the State Department is attempting to recruit 200 people
|
||
(in Houston because there's a lot of unemployment there) so they
|
||
can beef up security around the world. Wow! They're going to take
|
||
some people off the street, give them 80 hours of training, and
|
||
ship them out to protect our embassies from espionage. They
|
||
actually plan to use these instant experts to counter the efforts
|
||
of the Soviet professionals. Only in America!
|
||
|
||
So here's the idea to shake up some fat cats who think that
|
||
only government experts know anything about bugging. Let's have a
|
||
brainstorming session during Surveillance Expo '87 to discuss new
|
||
ways of bugging. We'll invite members to present ideas, and get a
|
||
consensus from the group as to the practicality of each. Of
|
||
course, no one with a government security clearance will be
|
||
allowed to submit proposals.
|
||
|
||
Its a free country, so the press will be invited. We'll
|
||
discuss sound conduction through pneumatic tubes, remote
|
||
transmitter location, delayed transmission of recorded audio,
|
||
irradiation of non-linear junctions with microwave energy,
|
||
various spread spectrum modulation schemes, modulation of light,
|
||
transmission of modulated ultrasound through pipes, etc.
|
||
|
||
What do you think? Do you think knowledge of electronics is
|
||
reserved unto government people? Let us hear from you.
|
||
|
||
|
||
March, 1987
|
||
|
||
SURVEILLANCE EXPO
|
||
|
||
Well, a few people did a lot of work, but many of the things
|
||
we thought would come true never did, so the board has decided to
|
||
postpone Surveillance Expo '87.
|
||
|
||
At this time, we cannot even provide a tentative date for
|
||
the rescheduled event. However, here's a personal promise from
|
||
Jim Ross: before he announces another date, he'll be absolutely
|
||
certain that all resources needed to ensure success are in hand
|
||
and not just promises.
|
||
|
||
The single overriding reason for our failure was our almost
|
||
total dependence on volunteers due to lack of funds to hire help.
|
||
Therefore, our plan is to use currently available resources to
|
||
enlarge the membership so that we'll have the wherewithal to be
|
||
able to hire professional help.
|
||
|
||
The first step in this process is to collect dues from
|
||
current members by sending dues-due notices with the ComSec
|
||
Letter. (Seems like a sensible thing to do, but it had never
|
||
been done before.) Next, we plan to increase the dues revenue by
|
||
increasing the number of members through mass mailings. Because
|
||
several firms have agreed to participate in a joint mailing for
|
||
the benefit of the association, and to pay all mailing costs,
|
||
we'll be able to do this for only the cost of creating and
|
||
printing the mail piece. The first mailing is scheduled for
|
||
July, and another will follow shortly thereafter.
|
||
|
||
We're charging participating businesses $2,000 to send a
|
||
mail piece to 25,000 prospects (Security Systems subscribers and
|
||
everyone on the Ross Engineering mailing list). If your company
|
||
could benefit by mailing to such a list, call Jim Ross right
|
||
away. We plan to mail to 50,000 people in the next three months.
|
||
|
||
|
||
MOSCOW EMBASSY FLAP
|
||
|
||
One of our correspondents reported that he had had a
|
||
conversation with an AT&T manager who had just returned from
|
||
Moscow. The AT&T fellow said that they had been unable to pull
|
||
wire through the in-place conduits because the conduits were
|
||
already full of Russian wire.
|
||
|
||
That's the way to do it. Don't be subtle. Run your bugging
|
||
wiring through the same conduits that are used for legitimate
|
||
communication. Oh well.
|
||
|
||
|
||
MEMBERSHIP DUES
|
||
|
||
With the previous issue of this newsletter we sent out small
|
||
notices to all members whose dues were paid to any date other
|
||
than September 30, 1987. (The membership year now runs through
|
||
September for everyone, so that all memberships will expire at
|
||
the same time.) A word of explanation is in order.
|
||
|
||
Because of changing responsibilities among the directors of
|
||
the association, a long period went by with no dues notices being
|
||
sent to anyone and we decided that it would not be fair to dun
|
||
people for back dues when they had never received any notices.
|
||
Therefore we devised a small notice and advised on the amount
|
||
necessary to extend membership through September 1987, or
|
||
September 1988.
|
||
|
||
Our thanks to all who have responded. If your payment was
|
||
received before this issue was mailed, your new membership card
|
||
is enclosed. (A new certificate is in the works; please be
|
||
patient.) We're really gratified that renewals are outnumbering
|
||
cancellations by about twenty to one. Also, we really appreciate
|
||
the confidence demonstrated by all, and we're proud to report
|
||
that more than half are renewing through 1988.
|
||
|
||
If we have not yet received your renewal, you'll find
|
||
another little note in the envelope with this letter. As we have
|
||
pointed out, all records are being maintained by volunteers, and
|
||
we know that we're not perfect. If you don't agree with our
|
||
records, don't stew about it; let us know and we'll correct our
|
||
files.
|
||
|
||
|
||
MOSCOW EMBASSY FLAP, II
|
||
|
||
Lessee now. The Senate wanted to get technical advice on
|
||
what to do about the bugged embassy, so they asked the experts
|
||
who let the Soviets bug it in the first place. Based on that
|
||
expert advice, Senator Boren says we'll have to tear it down, and
|
||
build it over again.
|
||
|
||
As we see it, senator, it looks like this. First your
|
||
experts let the Soviets get away with what you report as
|
||
extensive bugging, and then they throw their hands in the air,
|
||
saying, "The Soviets are too smart for us; we'll have to give up
|
||
and tear the building down."
|
||
|
||
A question for the senator: "What makes you think that those
|
||
same experts will be any smarter or more in control the next time
|
||
we try to build this building?"
|
||
|
||
|
||
ECPA
|
||
|
||
These comments on the Electronic Communications Privacy Act
|
||
are triggered by an editorial by Wayne Green in a recent 73
|
||
magazine. Under the heading "CONGRESS GOOFS", Wayne points out
|
||
that the prohibition against listening to what has been broadcast
|
||
on cellular frequencies has proved to be very helpful to
|
||
organized (and disorganized) crime.
|
||
|
||
To understand, you'll first have to appreciate that not
|
||
everyone lives by the rules, and that the cellular system is a
|
||
great technical achievement, but lacks one essential
|
||
administrative ingredient. The people who designed the system
|
||
must have assumed either that all users would be honest, or that
|
||
no one other than their trusted techies could enter the
|
||
electronic serial number (ESN) into a cellular transceiver.
|
||
Operating under such an assumption, they established a
|
||
verification system that looks only for negatives when deciding
|
||
to accept a call. That is, if you have reported your phone
|
||
stolen or have not paid your bill; you will not be able to make a
|
||
call because your ESN will be listed in the file as NG. That's
|
||
fine if everybody is honest, but that's just not the case and the
|
||
crooks soon found that they could have fictitious ESNs entered
|
||
into their machines, and the system will accept calls from them
|
||
because they are not on the bad guy list.
|
||
|
||
What this all means is that the cellular phone companies
|
||
check a NG list before accepting a call, but they don't have any
|
||
way to check that the ESN is a valid one. So the bad guys have
|
||
phoney IDs entered into their machines, make calls all over the
|
||
world, never have to pay for them; and, because of the ECPA,
|
||
never have to worry that what they say on the air will be used
|
||
against them.
|
||
|
||
Wayne ends his editorial with the following paragraph:
|
||
|
||
"If it weren't against the law to listen to cellular channels,
|
||
I'd suggest that we hams help the law by listening for suspicious
|
||
cellular calls and recording them. Say, how'd you like to get
|
||
the goods on some serious crooks and find (a) the evidence is
|
||
inadmissable because it was illegally obtained and (b) yourself
|
||
on trial for making the recordings. So join me in a big laugh,
|
||
okay?"
|
||
|
||
Well, if you've been reading the ComSec Letter, you know
|
||
your editor's opinion of this law, but I can't go along with
|
||
laughing at it. It's a perversion, and should be done away with.
|
||
Period.
|
||
|
||
|
||
NO MORE ASSOCIATION BULLETIN BOARD
|
||
|
||
Well, we did have a bulletin board for a while, but Paul
|
||
Bowling, who did all the work and bore all of the expense,
|
||
decided that he wasn't going to do it any more.
|
||
|
||
We're sorry. We think that this organization should have a
|
||
computer bulletin board, and we're determined to establish a
|
||
permanent board for the use of members. Stay tuned.
|
||
|
||
|
||
GREAT NEW PRODUCT!
|
||
|
||
Radio Shack has done it again! If you ever have need for a
|
||
DNR (dialed number recorder), get right down to your Radio Shack
|
||
store and check out their CPA-1000. It's a neat little package
|
||
with a neat little price. It will print out all of the numbers
|
||
dialed, length and time of day on all calls. In fact it does
|
||
essentially everything that the 10, 15, and 20 thousand dollar
|
||
units do, and it sells for one hundred dollars! Wow!
|
||
|
||
(Ed. note: I just read over that last paragraph, and I used
|
||
more exclamation points in that paragraph than I used all last
|
||
year. Well, the CPA-1000 is worth every one. Double Wow!!)
|
||
|
||
|
||
NEW PUBLICATION
|
||
|
||
Glenn Whidden of Technical Services Agency, Inc. has
|
||
announced a series of technical articles on electronics,
|
||
eavesdropping, and countermeasures. Everyone working in the
|
||
field of countermeasures should try to learn about electronic
|
||
communications, and these papers certainly will be helpful.
|
||
|
||
Good luck, Glenn. I know it's wishful thinking, but I hope
|
||
some of the "professionals" in this field will begin to get an
|
||
education. Unfortunately I'm afraid that their egos are such
|
||
that they know they don't even have to learn the meaning of words
|
||
they use like frequency, impedance, resonance, etc. Their eyes
|
||
glaze over if you mention Maxwell's Equations or Bessell
|
||
Functions, and if you use a common phrase like L di/dt, they
|
||
think you're speaking a foreign language. (To them, of course,
|
||
calculus is a foreign language.)
|
||
|
||
Well, maybe some of the companies that have started in-house
|
||
TSCM programs will subscribe for their technicians. I hope so.
|
||
Education protects us, and every step toward better education is
|
||
a good step. C'mon, all you corporate security managers. Order
|
||
this course for your TSCM people. Contact Glenn Whidden on 301-
|
||
292-6430, at TSA, 10903 Indian Head Hwy #304, Fort Washington, MD
|
||
20744. It's $130 for twelve issues, and well worth it.
|
||
|
||
The August issue of Radio-Electronics magazine lists six
|
||
different national non-profit associations which examine and
|
||
certify electronic technicians. We'll be pleased to list
|
||
everyone in the profession who achieves certification. Send a
|
||
copy of your FCC license or technician certificate to the editor.
|
||
|
||
|
||
|
||
|
||
|
||
April, 1987
|
||
|
||
GREAT IDEA!
|
||
|
||
This idea came from one of the participants in a recent
|
||
seminar, and relates to my comments that infinity bugs are not
|
||
much of a modern threat because they require a cooperating
|
||
telephone if the target is on an ESS exchange (and almost
|
||
everybody in this country is on an ESS exchange).
|
||
|
||
(The reason that they are not much threat is that they
|
||
answer the phone before it rings. So, if you installed one on
|
||
someone else's phone as a bug, it probably would not last long
|
||
because he'd wonder why his phone never rings and have it
|
||
checked.)
|
||
|
||
The great idea that was put forth in the seminar is that an
|
||
infinity bug sure would work fine if installed in a conference
|
||
room telephone.
|
||
|
||
Think about it. If there is direct dial to the conference
|
||
room (no operator on a PBX listening for the ring signal on the
|
||
conference room extension), this could be a major threat. Unless
|
||
there is accidental discovery, there is a good chance that no one
|
||
would be at all suspicious of the lack of a ring on the phone.
|
||
Another good reason to get rid of phones in conference rooms.
|
||
|
||
|
||
MEMBERSHIP DUES
|
||
|
||
With each of the last two letters we have included a note to
|
||
each member who had not sent in dues to renew his membership
|
||
according to our records. The response has been very
|
||
encouraging, but there are still many people receiving this
|
||
letter who have not renewed their memberships.
|
||
|
||
We cannot afford to continue to send the letter if we do not
|
||
have support in the form of dues payment. Therefore, be advised
|
||
that this may be your last letter if we have not received your
|
||
payment before the next issue is mailed. It will be your last
|
||
issue unless you advise us of an error in our record keeping, or
|
||
we find that we have made an error.
|
||
|
||
Speaking of errors, we certainly don't claim to be perfect.
|
||
First we had the list on the Ross computer; then we went to an
|
||
outside vendor which had three owners in rapid succession, then
|
||
we went to a volunteer who didn't have time enough, and now it's
|
||
back on the Ross computer. Yes, there have been some errors, but
|
||
we think we've just about got it all straight finally.
|
||
|
||
|
||
WHO MONITORS OR RECORDS ILLEGALLY?
|
||
|
||
THE PREMISE
|
||
|
||
In a recent COMSEC LETTER we asked our readers to send us
|
||
examples of how the federal law requiring at least one party
|
||
consent to monitor or record conversations is regularly violated
|
||
with no legal action taken against the violators. After all, it
|
||
is a federal felony, and we would logically expect enforcement by
|
||
constituted law enforcement agencies, no?
|
||
|
||
|
||
|
||
POLICE
|
||
|
||
Well, it may just be that law enforcement agencies are the
|
||
biggest violators. Here in Maryland (where state law requires
|
||
all party consent to record phone conversations) some Montgomery
|
||
County police officers have brought suit for $865,000 against
|
||
their department alleging that their calls were recorded without
|
||
their consent. It seems that the Montgomery County Police
|
||
department routinely records all calls to the department, not
|
||
just those calls to the 911 emergency number.
|
||
|
||
Come to think of it, is there an exception in the law which
|
||
allows recording of calls to emergency police numbers? I just
|
||
read through 18 USC 2511 again, and I can't find any exemption
|
||
allowing such recording. Are police departments regularly
|
||
committing felonies while they're trying to do their jobs right?
|
||
|
||
What do your state's laws say?
|
||
|
||
SCHOOLS
|
||
|
||
Most schools have intercom systems which allow selective
|
||
messaging to all rooms, to some selected groups of rooms, or to
|
||
single rooms. In addition to allowing messages to be sent to the
|
||
rooms, the systems also allow listening to activities within the
|
||
rooms. My consultants advise that the system used in the schools
|
||
where they worked had no light or other signal in the room to
|
||
alert occupants that they were being monitored.
|
||
|
||
It looks like this is another case where people who are
|
||
trying to do their jobs right are violating the law without even
|
||
being aware that such a law exists.
|
||
|
||
The California Supreme Court has ruled that such monitoring
|
||
is a violation of the students' right to privacy.
|
||
|
||
COMMERCE
|
||
|
||
In the July issue of Security magazine an item described the
|
||
use of monitors in McCormick Place, a Chicago convention and
|
||
exhibition center with "tubed walkways" and large parking areas
|
||
where providing personal protection is difficult. According to
|
||
the article the security department uses Aiphone intercoms to
|
||
listen for trouble.
|
||
|
||
Again, we have people trying to do their jobs right, and
|
||
apparently violating the law in the process.
|
||
|
||
|
||
THREAT ASSESSMENT, TELEPHONE TAPS
|
||
|
||
GENERAL
|
||
|
||
In estimating the threat to privacy posed by telephone taps,
|
||
several factors must be considered. First and foremost, we must
|
||
evaluate what it is that any tapper hopes to accomplish. What is
|
||
it that we have that is of value to someone else? Second we must
|
||
determine his strength. What resources can he commit to
|
||
accomplishing his aims? Those resources can be summed up as
|
||
technical competence, time, access, and money.
|
||
|
||
MAJOR THREATS
|
||
|
||
Strange as it may seem, one of the most dangerous threats
|
||
might be from a small competing business, run by an electronic
|
||
hobbyist, which occupies space in the same building.
|
||
|
||
The rationale for that statement goes as follows. A
|
||
technically competent small business owner can do the work
|
||
himself without involving any one else. He has no time pressure
|
||
and he has access. He doesn't need much money because he doesn't
|
||
need to hire anyone and the equipment involved in tapping is
|
||
ridiculously inexpensive (less than $100). He could easily
|
||
install automatic recording equipment and scan the recordings for
|
||
the information that he wants.
|
||
|
||
On the other hand, supposing the threat is from law
|
||
enforcement. Contrary to the impression created by TV shows, law
|
||
enforcement agencies are not all-wise and all-knowing. Some
|
||
departments have no one capable of tapping phone lines, and
|
||
getting the necessary court order can be difficult. However,
|
||
let's consider a qualified law enforcement organization.
|
||
|
||
If the activity is to collect evidence to be used in a
|
||
trial, they must be very careful to be certain that the evidence
|
||
will be admissable. We believe that a good defense attorney will
|
||
attack any incomplete tap-generated evidence, and that means that
|
||
all lines must be monitored. Further, officers must be assigned
|
||
to the listening post and other officers must be assigned to keep
|
||
the suspect under surveillance so that they can provide
|
||
corroborating testimony. In addition to monitoring all lines and
|
||
transcribing all tapes, a continuous chain of custody must be
|
||
maintained over the tapes and sometimes experts must be used to
|
||
verify that the tapes have not been altered, etc.
|
||
|
||
(Recently one of our seminar participants advised that his
|
||
state requires that there must be continuous human monitoring of
|
||
all lines so that only the conversations of the suspect are
|
||
recorded, creating even more manpower requirements.)
|
||
|
||
SUMMARY
|
||
|
||
Law enforcement has a major job on its hands when it sets
|
||
out to gather evidence via wiretaps. On the other hand, the
|
||
competitor operating without rules can do the job very simply.
|
||
He is not looking for evidence, only information.
|
||
|
||
|
||
SOME GLOSSARY TERMS
|
||
|
||
ACM. Audio countermeasures. Another name for TSCM.
|
||
|
||
BRIDGE. In telephone parlance this can be a noun or verb
|
||
and refers to making a parallel connection to a pair of telephone
|
||
wires. In contrast, in electronics a bridge is a four-terminal
|
||
device with several applications depending upon configuration.
|
||
|
||
DIALED NUMBER RECORDER (DNR). Device which records all
|
||
activity on the telephone line to which connected. Time off-
|
||
hook, time on-hook for all calls; numbers dialed for all outgoing
|
||
calls. In the days of pulse dialing a device called a pen
|
||
register did the job of recording numbers dialed.
|
||
|
||
ESS. Electronic Switching System. The newest of the
|
||
switching systems in use by the telephone companies in the USA.
|
||
You are served by an ESS exchange if you have access to the
|
||
special features of call waiting, call forwarding, and three-way
|
||
calling.
|
||
|
||
HARMONICS. Frequencies that are integral multiples of the
|
||
fundamental frequency.
|
||
|
||
HERTZ (Hz). Unit for measuring frequency equal to one
|
||
cycle per second. KiloHertz (KHz) = 1,000 Hz; MegaHertz (MHz) =
|
||
1,000,000 Hz; GigaHertz (GHz) = 1,000,000,000 Hz.
|
||
|
||
TEMPEST. Refers to classified government effort to protect
|
||
against compromising emanations from electronic equipment. (It
|
||
may be a coined word, and it may be a semi-acronym from transient
|
||
electro-magnetic pulse emanation standard.)
|
||
|
||
TITLE III. Refers to equipment for surreptitious
|
||
interception of communications. For most people, possession,
|
||
advertising, sale, and use of Title III equipment is a felony.
|
||
|
||
TSCM. Technical Surveillance Countermeasures. Commonly
|
||
called debugging, sweeps, or electronic sweeping. However, these
|
||
terms do not adequately describe the full range of TSCM
|
||
activities, and seem to be more descriptive of "magic wand"
|
||
operations and not of professional work. Let's stick with TSCM.
|
||
|
||
|
||
May, 1987
|
||
|
||
SOME COMMENTS FROM YOUR EDITOR
|
||
|
||
We're now in our fourth year of composing this letter, and
|
||
it seems to be a good time to plan some changes based on that
|
||
experience. So here we go.
|
||
|
||
1. Many of the people who have written to us have received
|
||
no thanks either directly or in print; so we're resolving to
|
||
rectify that by starting the process of acknowledging all of the
|
||
folks who have sent clippings, comments, suggestions and
|
||
questions. Therefore, beginning with this issue, we're going to
|
||
include either Feedback or Questions and Answers or both as
|
||
regular features in this letter.
|
||
|
||
2. We've been neglectful of late in steering you toward (or
|
||
away from) publications that we have read so we're resolving to
|
||
pass along opinions on such things on a regular basis; and in
|
||
this issue you'll find a review of two items recently read.
|
||
|
||
3. It has long been our desire to include a short technical
|
||
essay with each issue of the letter. At this time we're not
|
||
ready to commit to a new essay with each issue, but at least
|
||
we're ready to start. Beginning with the next issue you will
|
||
receive two pages each month from the glossary which has been
|
||
created by your editor for his seminar, Defense against
|
||
Electronic Eavesdropping.
|
||
|
||
4. Each summer has been a catastrophe as far as schedules
|
||
go, so we're going to face facts: getting the letter out each
|
||
month in the summer is not possible so we're going to go with ten
|
||
issues per year. (To answer Ben Harroll and others who have
|
||
asked: No, we did not publish in July and August last year [YOGO
|
||
2.07 and 2.08].)
|
||
|
||
5. Teleconnect and The Councillor (the organ of the Council
|
||
of International Investigators) have several times republished
|
||
some of the thoughts in this letter, and we're pleased. We
|
||
invite all editors to republish anything with appropriate credit.
|
||
|
||
6. Last, but not least, we're looking for practical ways to
|
||
improve this letter and get more information out each month. New
|
||
hardware and software will help us to dress it up, but we'll need
|
||
additional income to expand to 8, 12, or 16 pages. We've given
|
||
serious thought to selling advertising in the letter or mailing
|
||
advertisers messages in the same envelope. What do you think
|
||
about receiving advertising messages in/with the ComSec Letter?
|
||
|
||
|
||
FEEDBACK
|
||
|
||
(The following comments are based on the material that
|
||
happens to be on the top of the stack. There were no criteria
|
||
for determining what to include at this time; we merely grabbed
|
||
the items closest at hand. Next month we'll add some more.)
|
||
|
||
We get clippings and calls on a regular basis from the folks
|
||
at Sherwood Communications Associates. They have a lot of
|
||
contacts with a lot of people in this field, and really do a
|
||
great job of keeping us informed.
|
||
|
||
From California, Norman Perle sends us copies of his press
|
||
clippings, and Roger Tolces sends an occasional note to advise
|
||
that your editor doesn't know what he's talking about. (By the
|
||
way, Roger has submitted a report on a bugging system that he
|
||
found and we'll get around to running it as soon as we can find
|
||
time to edit it.)
|
||
|
||
Don Schimmel gets the credit for calling our attention to
|
||
the two-faced operation of our Congress with regard to the
|
||
airwaves. (See the segment entitled "Who does own the airwaves?")
|
||
|
||
Nice note from Jerold Hutchinson with his membership
|
||
renewal. He says he enjoys reading the newsletter and "keep up
|
||
the good work." Thanks Jerold. Encouraging words help.
|
||
|
||
|
||
QUESTION AND ANSWER
|
||
|
||
Q. Our old friend, Ted Genese, sent along a flier from
|
||
Winkleman in England, and asked what they meant by "line
|
||
interceptor [which] enables an adversary to monitor more than one
|
||
communications line from a single listening post."
|
||
|
||
A. Well, Ted, we featured some of the US Winkleman claims
|
||
in a letter about two years ago. As I recall they claimed
|
||
"Complete Protection against Wiretaps", but never demonstrated
|
||
that they could provide such protection. (The reason that they
|
||
couldn't, of course, is simply because nobody yet has any
|
||
equipment which will detect a simple tap properly installed.)
|
||
|
||
Our mail to their last US address comes back "Moved. No
|
||
forwarding order", so we presume that they have closed their
|
||
offices on this side of the pond.
|
||
|
||
To answer your specific question, Ted, I don't know what
|
||
they mean by a line interceptor. Sounds mighty mysterious, but
|
||
it doesn't sound like anything I have ever studied about in
|
||
communications electronics. However, the idea of monitoring
|
||
several lines from one location is nothing spectacular; answering
|
||
services do it all of the time. Nothing spooky about it at all.
|
||
|
||
I hope our public servants who tap lines save a few tax
|
||
dollars by consolidating a lot of taps in one listening post.
|
||
Paying a few extra dollars out to the phone company for lines to
|
||
one LP is a lot cheaper than setting up and manning many
|
||
different LPs.
|
||
|
||
|
||
WHO DOES OWN THE AIRWAVES?
|
||
|
||
If you've been reading this letter, you might have received
|
||
the impression that your editor is not a fan of the ECPA of 1986
|
||
(Electronic Communications Privacy Act). You'll recall that he
|
||
thinks it is stupid to pass an unenforceable law, especially one
|
||
that makes it a crime to listen to what has been broadcast.
|
||
|
||
Yes, that's right. Our legislators passed a law that makes
|
||
listening to the content of broadcasts on some frequencies OK; on
|
||
some others, a misdemeanor on others, a felony. (Soon we will
|
||
have to have a frequency meter, with calibration traceable to
|
||
NBS, with us at all times while we tune our radios.)
|
||
|
||
In any event, Congress passed this silly law in November of
|
||
1986, and it became effective in January, 1987.
|
||
|
||
In the summer of '87 the FCC abolished the "fairness
|
||
doctrine" which had forced commercial broadcasters to provide
|
||
equal time, and thereby really angered the Congress. In the
|
||
words of Ernest F. Hollings, Chairman of the Senate Committee on
|
||
Commerce, Science and Transportation, "The American people, not
|
||
the broadcasters, own the airwaves!"
|
||
|
||
Well, yeah, OK, Senator. If we own the airwaves, why did
|
||
you vote to make it a crime to listen to what has been
|
||
transmitted over those airwaves into our homes?
|
||
|
||
|
||
SMART, SMART, SMART
|
||
|
||
We've been noticing a trend in big businesses lately which
|
||
strikes us as really smart. More and more of our subscribers who
|
||
work for big companies are having our publication mailed to their
|
||
home adresses.
|
||
|
||
Why is that smart? Think about it. Big company. Big mail
|
||
room. Big payroll to pay the people who try to sort and deliver
|
||
the mail each day. Why not let Uncle Sam do the sorting and
|
||
delivery for you. Doesn't cost the company a thing. Smart.
|
||
|
||
|
||
PUBLICATIONS REVIEWS
|
||
|
||
Recently I ordered a booklet entitled "Study Notes on Secure
|
||
Communications" and one called "Crossroad" from Spear and Shield
|
||
Publications.
|
||
|
||
Wow. What a surprise. The introduction to the secure
|
||
communications booklet was written by Atiba Shanna -- New
|
||
Afrikan Communist of the New Afrikan People's Organization, and
|
||
it contains a lot of stuff but nothing about comsec. The other
|
||
booklet contains several essays, but the title of one should give
|
||
you an idea as to its thrust, "ON GORBACHEV, MICKEY LELAND AND
|
||
SELF-DETERMINATION FOR AFRIKANS IN AMERIKKKA."
|
||
|
||
Available for $2.00 from S&SP,1340 W. Irving Park #108,
|
||
Chicago, IL 60613.
|
||
|
||
Our recommendation: Don't bother.
|
||
|
||
The other publication, however, we really appreciated, and
|
||
we thank Howard Karten for calling and recommending "The Second
|
||
Oldest Profession" by Phillip Knightley.
|
||
|
||
From your editor's point of view this book had two strikes
|
||
against it at the outset: it was written by an Englishman using
|
||
English English, and the many, many references are distracting.
|
||
Despite those drawbacks, though, I found it to be a very
|
||
enlightening book, well worth the price.
|
||
|
||
Before proceeding with the good stuff, however, a caution to
|
||
those who think Ollie is a hero and the CIA should be in the drug
|
||
trade: you won't like this book.
|
||
|
||
That said, let us quote from the book to explain the essence
|
||
of the reason for immortality of secret organizations: "Once
|
||
invented, the intelligence agency turned out to be a bureaucrat's
|
||
dream." "...rebut critics with the simple and unanswerable
|
||
expedient of saying, 'You are wrong because you really don't know
|
||
what happened and we can never tell you because it's secret.'"
|
||
|
||
Throughout the book the author provides details of erroneous
|
||
intelligence that was acted upon, and good intelligence that was
|
||
ignored. For instance: "Ultra showed that Allied strategic
|
||
bombing of Germany had failed to crack German morale, and had not
|
||
made a dent in German aircraft production. ..... All this was
|
||
passed on to proper authorities, yet the raids went on: the truth
|
||
of Ultra did not suit the champions of heavy bombing."
|
||
|
||
Very detailed. References galore. Old spooks will hate it.
|
||
Hardcover. 436 pages. $19.95 from W.W. Norton & Company.
|
||
|
||
|
||
CALL FOR VOLUNTEERS
|
||
|
||
This association is just beginning to take shape and some
|
||
volunteers are badly needed. Some people who are capable of
|
||
working with almost no supervision can have a big impact on our
|
||
growth and success. No, there will be no immediate reward other
|
||
than recognition in our meetings and publications; but the long-
|
||
term rewards could be substantial.
|
||
What say? Want to take one of the committee chairmanships?
|
||
We need help with our next expo, our next membership meeting,
|
||
membership programs and benefits, local chapter genesis, budget
|
||
and audit, and more. Call me. Let's talk about it.
|
||
|
||
|
||
June/July, 1987
|
||
|
||
SURVEILLANCE EXPO '87
|
||
|
||
In case you missed the announcement in an earlier letter,
|
||
we'll repeat: Surveillance Expo '87 has been postponed. It was
|
||
well into the planning stages when it became apparent that we did
|
||
not have the manpower or financial strength to do it right.
|
||
|
||
However, there has been a lot of interest, and we'll be
|
||
announcing new dates soon. Stand by.
|
||
|
||
By the way, this is a program that needs volunteers to work.
|
||
Interested?
|
||
|
||
|
||
MORE ON ILLEGAL(?) EAVESDROPPING
|
||
|
||
It's not that we're opposed to any of these activities that
|
||
we have been reporting on. Certainly the apparently illegal
|
||
eavesdropping activities reported last month are all undertaken
|
||
by people who are trying to do their jobs right. The point of
|
||
presenting this information is to emphasize that the law is not
|
||
enforced and, in many cases, enforcement would be a travesty.
|
||
|
||
Consider the case of the need to properly control prisoners.
|
||
Audio surveillance is routinely used in jails and prisons as a
|
||
means to get more coverage out of the staff. We'll not get into
|
||
the argument as to whether prisoners have any right to privacy;
|
||
that's another issue. The point is that the law does not mention
|
||
an exception for lock ups, and it probably should.
|
||
|
||
The law does make advertising or using equipment "primarily
|
||
useful for surreptitious interception of oral or wire
|
||
communication" a federal felony. So along comes a company called
|
||
Louroe of Van Nuys, California with their "bare bones" Kit #ASK-4
|
||
which consists of a microphone, power supply and amplifier. The
|
||
heading on their sale flier says "When you have a lot to protect
|
||
Louroe Electronics protects a lot." At $270 retail their
|
||
surveillance kit is recommended for convenience stores, delivery
|
||
entrances, hospital therapy rooms, jail interrogation rooms,
|
||
cashier and counting rooms, and all other secured zones.
|
||
|
||
Is this company in violation of the law? Are they
|
||
advertising something which is primarily useful ... etc.? If you
|
||
use their equipment to eavesdrop on other persons without their
|
||
knowledge or consent, are you breaking the law?
|
||
|
||
What do you think?
|
||
|
||
|
||
|
||
|
||
QUESTIONS AND ANSWERS
|
||
|
||
Q. Ben Harroll asks if I have heard of an "FBI phone and
|
||
room unit that saves up a day of conversations ... on a chip in
|
||
digital form. Then dumps the whole memory in something like 30
|
||
seconds when they drive by and trigger a burst transmission which
|
||
they then record and take back for further analysis (perhaps key
|
||
words, phrases, etc.)".
|
||
|
||
Ben also asks about a "wall unit that served to link the
|
||
agents remotely with all the phones (perhaps room audio as well)
|
||
in an entire building. The agent could access any phone from his
|
||
base by contacting the unit built into the wall".
|
||
|
||
A. Let's consider his multi-faceted queries.
|
||
|
||
First let's consider the equipment available for digital
|
||
storage of speech. Digital storage offers many advantages, but
|
||
the equipment which is currently available is severely limited in
|
||
capacity. For instance, I'm looking at the specs for a unit
|
||
which is about 4 by 10 by 17 inches in size and consumes 20 watts
|
||
of power from the mains. This unit would not be easy to conceal,
|
||
and has the capacity of storing only 30 seconds of speech.
|
||
|
||
Now I'm not going to say that a day's worth of conversations
|
||
cannot be stored digitally; but, unless the FBI has come up with
|
||
capabilities far beyond what is available commercially, it does
|
||
not look practical.
|
||
|
||
"Phone and room unit" implies that you would be storing
|
||
tapped phone conversations as well as room audio, and I cannot
|
||
understand why you would want to do that. The phone
|
||
conversations can easily be stored at a remote listening post
|
||
without any concern for concealing the equipment. It just doesn't
|
||
make sense to try to do it in the target area.
|
||
|
||
The other consideration is "driving by" and "triggering a
|
||
burst transmission". (Sounds like Hollywood!) I know that it
|
||
can be done, but I ask why build a radio receiver and transmitter
|
||
into the recording mechanism? Such things are easy to detect,
|
||
and are frequently detected by accident. The power level of the
|
||
transmitter would be high enough to light up even a pen-set
|
||
transmitter detector and the receiver LO would be detected by a
|
||
good TSCM operation.
|
||
|
||
And burst transmission? I know how and why and where burst
|
||
transmission is used in at least one application, but I sure
|
||
don't know why you'd try to use it in this situation. Maybe
|
||
there is a reader to this letter who can shed some light on the
|
||
use of burst transmission in such a circumstance.
|
||
|
||
As for Ben's second question, the answer is exactly opposite
|
||
to the answer to the first. The equipment needed to switch from
|
||
monitoring one line or room to monitoring another is commonly
|
||
available and not the least complicated. Building it into a wall
|
||
is the most complicated part of the whole process, in my opinion.
|
||
(However, it might just be that your informant was referring to
|
||
remotely accessed DNRs and this technique is also very simple.)
|
||
|
||
|
||
|
||
|
||
DUMB, DUMB, DUMB
|
||
|
||
Recently, in the course of providing TSCM service to a
|
||
client here in the DC area, we discovered that the carbon
|
||
microphone in the conference room was wired to spare conductors
|
||
and we spent the better part of a day tracking the wiring back to
|
||
the listening post. Immediately after completing this job we
|
||
left for a job in Ohio and another in Chicago, so we were out of
|
||
touch pretty much while driving.
|
||
|
||
One message picked up when calling the office from Illinois
|
||
was from a private investigator in New York instructing me to
|
||
call a lawyer in Washington, DC. (Neither the PI nor the lawyer
|
||
were known to me.) When I got through to the lawyer, he began to
|
||
ask me questions about my activities for my client the previous
|
||
weekend, and the conversation went like this:
|
||
|
||
"I need information on your activities for the XYZ
|
||
Corporation last weekend."
|
||
|
||
"Sir. Please don't take offense, but you are just a voice on
|
||
the telephone to me. I will not even confirm or deny that I even
|
||
know XYZ Corporation to you."
|
||
|
||
His response was to advise me of his college, his degrees,
|
||
his status with his firm, and the statement that he represents my
|
||
client. Again, I advised him that he was still just a voice on
|
||
the phone; and, before I would talk to him I needed approval from
|
||
someone I know in the client company.
|
||
|
||
"Well. Supposing I have John Jones or Pete Smith call you.
|
||
Would that be all right?"
|
||
|
||
"Sir. I just finished telling you that I will not confirm
|
||
or deny that I even know that company. I'm certainly not going
|
||
to confirm that I know some people by name in that company. If
|
||
you want to discuss any client with me, first have someone that I
|
||
know in that company call me, and tell me it's OK."
|
||
|
||
The upshot of the whole affair is that the GM of my client
|
||
company did call, and I did discuss the facts with the lawyer.
|
||
|
||
However, I'm left with a very bad taste in my mouth for two
|
||
reasons. First, my client is represented in a case involving
|
||
industrial espionage by a lawyer who doesn't have the foggiest
|
||
idea about industrial espionage -- is not even aware that one of
|
||
the easiest ways to collect information is to pretend to be
|
||
someone else and call and ask for it. The client has been the
|
||
victim of a very well executed bugging system, but he has placed
|
||
his trust in a man who can't understand why I don't provide
|
||
chapter and verse to an unknown voice on the phone. Secondly,
|
||
the lawyer, who doesn't know anything about electronics, refused
|
||
to allow me to give him the information that I knew he needed.
|
||
Instead, he insisted in reading me a list of questions which
|
||
apparently had been prepared for him by someone else who doesn't
|
||
understand electronics either. Consequently, whatever report
|
||
that lawyer generated won't make sense and will be of negative
|
||
value.
|
||
|
||
|
||
|
||
DO THEY UNDERSTAND TELEPHONES, OR WHAT?
|
||
|
||
Teleconnect calls this AT&T's marketing coup of the month.
|
||
We're inclined to upgrade it to "of the year" or "of the decade".
|
||
|
||
In a catalog received recently from AT&T is an item called
|
||
"Power Failure Rotary Telephone". It seems that AT&T is offering
|
||
a black rotary (pulse) dial telephone for $54 so you'll be able
|
||
to dial out in the event of a power failure!
|
||
|
||
(In case you're not a telephone techie of any degree, be
|
||
advised that the touch tone phones don't need power from the
|
||
mains to operate; they get their power from the exchange. By the
|
||
way, AT&T Marketing Department, if there's no power from the
|
||
exchange, the pulse phone won't work either.)
|
||
|
||
To all of our friends in AT&T who really do know how phones
|
||
work: We're really embarrassed for you.
|
||
|
||
Maybe we should start a case to undivest!
|
||
|
||
|
||
CONTRIBUTIONS
|
||
|
||
The ComSec Association is organized as a non-profit
|
||
educational association, 501 (c)(3). Gifts (not dues) can be
|
||
deducted on your income tax return (read the rules). We are also
|
||
under the impression that donations in kind (material things) can
|
||
be deducted at full value (again, read the rules, or discuss with
|
||
your accountant).
|
||
|
||
Anyway, we need all the help we can get. If you feel like
|
||
sending in a big cash donation, we sure won't refuse it. On the
|
||
other hand, we badly need to upgrade our computer and printing
|
||
capability, so we'd certainly accept anything along that line.
|
||
Do you have anything that could be helpful?
|
||
|
||
|
||
SPECIAL NOTE
|
||
|
||
As promised, we're starting to include an extra page of
|
||
technical information with your copy of the ComSec Letter. We
|
||
can't promise to have it in with every issue, but we're starting
|
||
with our TSCM Glossary, and you'll get one sheet with each
|
||
letter.
|
||
|
||
|
||
|
||
|
||
|
||
Aug/Sept, 1987
|
||
|
||
OUR MOSCOW EMBASSY, AND DID THE SOVIETS BAMBOOZLE US?
|
||
|
||
Well, our elected representatives who visited our new
|
||
embassy under construction in Moscow say that it is so thoroughly
|
||
bugged that we'll never be able to use it. They said a lot of
|
||
things that don't make any sense technically (such as it is just
|
||
one big antenna), but they never did explain what the threat is.
|
||
|
||
So here's a guess from the outside.
|
||
|
||
I'll bet that the Soviets are aware that our government
|
||
countermeasures people use non-linear junction detectors (NLJDs)
|
||
in TSCM so they dumped thousands of old diodes and transistors
|
||
into the concrete to create lots of responses for the NLJDs. We
|
||
probably detected non-linear junctions every few inches on every
|
||
beam and column and any place that there's poured concrete, and
|
||
every one of those "hits" was reported as a bug.
|
||
|
||
In case you're not familiar with electronic communications
|
||
theory, modern equipment, and government TSCM techniques, let us
|
||
review briefly.
|
||
|
||
Modern electronic equipment contains active components that
|
||
are solid state; some are discrete components, such as bipolar
|
||
junction transistors and field effect transistors, and some are
|
||
monolithic integrated circuits. Such solid state devices, by
|
||
nature, contain non-linear junctions and one characteristic of
|
||
non-linear junctions is that they generate harmonics of whatever
|
||
radio frequency energy excites them. Our government experts knew
|
||
this so they contracted for the design of a non-linear junction
|
||
detector for use in TSCM. In use, its operators found that
|
||
naturally occurring non-linear junctions also emit harmonics of
|
||
the exciting frequency. (Naturally occurring NLJs occur any
|
||
place that there is metal-to-metal contact with something like
|
||
oil or rust in between.) Now, theory says that the naturally
|
||
occurring junctions favor the third harmonic and the solid state
|
||
electronic components favor the second (or maybe it's the other
|
||
way around; I don't remember). In any event, the operator is
|
||
supposed to be able to differentiate between an electronic
|
||
component and a naturally occurring NLJ. However, many people
|
||
with a lot of field experience have told me the false alarms
|
||
drive them batty -- and many have told me that they no longer use
|
||
this instrument.
|
||
|
||
Now, I'm sure that Ivan installed many bugs in the embassy;
|
||
but I'm also very confident that he installed a lot of junk to
|
||
create false alarms for our people. What do you think?
|
||
|
||
|
||
ECPA
|
||
|
||
FOREWORD In November, 1986 the Congress of the United States of
|
||
America, with almost no discussion or debate, passed the law
|
||
known as the Electronic Communication Privacy Act (ECPA) of 1986.
|
||
Shortly thereafter it was signed by President Reagan, and it
|
||
became effective in January of 1987.
|
||
|
||
WHO BENEFITS? This law is an example of what can be accomplished
|
||
for the benefit of some narrow special interests through the use
|
||
of lobbyists. Although our legislators made many pronouncements
|
||
for public consumption that they were acting to protect us, what
|
||
they actually did was to create a law that is of primary benefit
|
||
to cellular telephone sellers who wish to deceive the public.
|
||
|
||
Yes, that's right. The net effect of the new law is to
|
||
allow sellers of cellular telephones and service to say, "No one
|
||
can listen to your calls; it's against the law." This, of
|
||
course, ignores the practical fact that the radio transmissions
|
||
from cellular phone transmitters intrude into our homes and
|
||
businesses without being invited.
|
||
|
||
Will these transmissions be listened to? Of course they
|
||
will. They'll be listened to with impunity because the law
|
||
cannot be enforced; and, further, the Justice Department has
|
||
announced that it will make no effort to try to enforce it.
|
||
There are those of us in various businesses and professions whose
|
||
work requires that we listen to everything that's on the air, and
|
||
we're certainly glad that they are not going to try to enforce
|
||
the law.
|
||
|
||
HISTORY The old law, The Omnibus Crime Control and Safe Streets
|
||
Act of 1968, Title III, was commonly misunderstood --- partly
|
||
because it addressed a technical subject, but mostly because it
|
||
used extremely convoluted language to express a simple idea.
|
||
Consequently, almost everything written to explain that law has
|
||
been incorrect. The words used by the politicians describing the
|
||
old law, in order to justify the creation of the new law, were
|
||
incorrect. "Experts" writing about that law haven't bothered to
|
||
read it; they have simply repeated the same errors that they
|
||
heard from others. Several court opinions relating to the old
|
||
law grossly misquoted it, or inverted the meaning of the words
|
||
used in it. The old law, written to control eavesdropping on
|
||
human voice conversations, was a masterpiece of circumlocution.
|
||
Its drafters apparently were writing to impress, rather than to
|
||
communicate. They used as many fancy words as they could muster,
|
||
but never once used any of the key words: "voice", "human",
|
||
"conversations" or "eavesdropping".
|
||
|
||
In short, the old law was an abomination.
|
||
|
||
The new law is worse.
|
||
|
||
THE NEW LAW The new law makes it a crime to listen to what has
|
||
been broadcast on certain radio frequencies. It's OK to tune to
|
||
some frequencies, a misdemeanor to tune to others, and a federal
|
||
felony to tune to others. Wild.
|
||
The new law allows "providers" to listen to communications
|
||
on telephone circuits that they provide. Unfortunately, the
|
||
drafters neglected to provide a definition of "provider".
|
||
Already, within a few months of passage, those words are being
|
||
interpreted to mean that the boss can listen to his employees'
|
||
phone calls without their knowledge or consent. Carried one step
|
||
further, it could be interpreted to mean that the breadwinner in
|
||
a household can legally listen to his/her spouse's phone calls.
|
||
|
||
The new law puts restrictions on law enforcement's use of a
|
||
dialed number recorder (DNR) (which it calls by the 1930s term
|
||
"pen register").
|
||
|
||
As with the law that it replaced, the new law uses the words
|
||
"in whole or in part" (referring to the kind of communications
|
||
addressed by the law) without defining whether these words are
|
||
intended to refer to the medium or the message. It is your
|
||
author's considered opinion that these words refer to the
|
||
message; otherwise they don't make sense. (I must point out,
|
||
however, that some very smart lawyers disagree.)
|
||
|
||
The new law creates a strange concept: "aural transfer".
|
||
Strange because the word "aural" refers to the human (animal?)
|
||
hearing mechanism which converts the mechanical energy of sound
|
||
impinging on the eardrum into electrical impulses which are
|
||
transmitted to the brain. "Transfer" implies a system, which
|
||
would be composed of a transmitter and a receiver; but the aural
|
||
process is only a receiving process. Let's paraphrase "Where's
|
||
the beef?" and say "Where's the transmitter?" in this system.
|
||
|
||
Oh yes, sounds broadcast on subcarriers may not be listened
|
||
to. Imagine! While you're in an office or elevator that plays
|
||
MUSAK, you are committing a felony by intentionally listening!.
|
||
|
||
Last, but not least, criminals have found that they can use
|
||
cellular phones for communication without paying for the service
|
||
by having phoney electronic serial and telephone numbers
|
||
installed in their phones. Also, they talk freely because they
|
||
know that what they say can't be used against them because law
|
||
enforcement must get a court order in order to legally listen to
|
||
what they are broadcasting on the airwaves.
|
||
|
||
|
||
ONE IMPROVEMENT First, you must recognize that our legislators
|
||
chose to redefine "intercept" rather than to use "eavesdrop" when
|
||
they are referring to eavesdropping. (Intercept means to seize
|
||
something, preventing it from arriving at its intended
|
||
destination; so they had to redefine it.) In the old law they
|
||
redefined this word to mean "aural acquisition" of the content of
|
||
a communication. This was dumb and caused untold confusion.
|
||
|
||
The one improvement in the new law, then, is the re-
|
||
redefinition of interception to mean the acquisition of the
|
||
content of the communication.
|
||
|
||
Hallelujah! (But wouldn't it have been better to use the
|
||
right word in the first place?)
|
||
|
||
|
||
HOW TO USE WORDS TO CREATE A FALSE IMPRESSION
|
||
(a lesson from our elected representatives)
|
||
|
||
The following comment was carried in COMSEC
|
||
LETTER, YOGO 2.06, issued while this law was being
|
||
drafted.
|
||
|
||
"Throughout the proposed law and in all references to
|
||
these laws our Congressmen have used the word "protection"
|
||
when they are referring to the legislated prohibitions
|
||
against eavesdropping on conversations. It is as though
|
||
they really believe that they can legislate protection.
|
||
|
||
"If you believe that legislation can "protect" your
|
||
broadcast conversations from being overheard, we have an
|
||
experiment for you -- and any congressman who thinks he has
|
||
such power.
|
||
|
||
"First let Congress pass a law which prohibits piranha
|
||
fish from biting our citizens. Let's make it a felony.
|
||
|
||
"Then you, or your congressman friend, go jump in a
|
||
river full of piranhas.
|
||
|
||
"Let me know how you make out."
|
||
|
||
|
||
IN THE WORKS
|
||
|
||
Because of the many requests that we have had for
|
||
complete sets of the ComSec Letter, we've been working on
|
||
editing out topical information and consolidating each
|
||
year's letters into one publication. These should be ready
|
||
soon; we'll let you know.
|
||
|
||
|
||
GLOSSARY
|
||
|
||
Just a reminder: we're enclosing pages 2 & 3 of the
|
||
TSCM Glossary with this letter.
|
||
|
||
FEEDBACK
|
||
|
||
Our thanks to Jerold Hutchinson who wrote to advise
|
||
that our definition of ACM is incorrect. He's right, and
|
||
we'll correct it in future editions of the glossary.
|
||
|
||
Although many folks use the terms interchangeably, ACM
|
||
is not another term for TSCM. ACM means audio
|
||
countermeasures and does not include countermeasures
|
||
against other methods of technical surveillance.
|
||
|
||
|
||
October, 1987
|
||
|
||
TRAP AND TRACE -- PEN REGISTER
|
||
|
||
Recently it has come to our attention that some folks
|
||
(especially lawyers) are using these terms interchangeably.
|
||
The confusion was probably started by the juxtaposition of
|
||
the two terms in the new federal law relating to
|
||
communications privacy. So let's see if we can shed some
|
||
light on these two different items.
|
||
First: pen register. (Do we have to use that
|
||
antiquated term? Yes, I know that it is the term used by
|
||
our legislators when they wrote the law, but the pen
|
||
register is an item that was modern when I was a kid, and
|
||
all phones were black rotary dial units with pulse output).
|
||
Anyway, the dialed number recorder (DNR) -- term for the
|
||
modern device which prints out the number dialed whether
|
||
the dialing is done with DTMF or pulses or a combination of
|
||
both -- is a device which is placed across the line of the
|
||
calling telephone. It prints out a chronological record of
|
||
all telephone activity: date and time off-hook and on-hook
|
||
on all calls and digits dialed on all outgoing calls. The
|
||
key to differentiating this from the trap and trace
|
||
equipment is that this device is connected to the line of
|
||
the calling telephone.
|
||
Trap and trace, on the other hand describes telephone
|
||
company equipment which is used, starting at the called
|
||
telephone to "Trace that call!", as they say in the movies.
|
||
However, the process is not as simple as the movies would
|
||
make you believe, particularly if the two ends (calling and
|
||
called) are not in the same exchange. The different
|
||
companies use different equipment to accomplish the same
|
||
thing, namely identification of the number from which the
|
||
call was placed.
|
||
To summarize: the DNR (modern pen register) is used at
|
||
a calling number to determine the called number; and trap
|
||
and trace equipment is used, starting at a called number,
|
||
to determine the calling number.
|
||
As we have reported earlier, there are developments
|
||
which will drastically change this scene. Congress made it
|
||
more difficult for law enforcement to get authority to use
|
||
a DNR and Radio Shack came out with its CPA-1000 -- a DNR
|
||
for the masses at $99.95 ("professional" DNRs start at
|
||
about $5,000). Meanwhile, our phone companies are
|
||
introducing CLASS and CCIS piecemeal across the country.
|
||
(See definitions of these terms in the glossary pages
|
||
distributed with last month's ComSec Letter.) CLASS and
|
||
CCIS will make trap and trace equipment superfluous; the
|
||
called party will be able to identify the calling number
|
||
without the aid or intervention of anyone or anything at
|
||
the telephone company.
|
||
|
||
|
||
ANONYMOUS LETTER
|
||
|
||
We recently received a letter from a former member
|
||
which raises a lot of interesting questions, so we'll run
|
||
it almost in its entirety, and do our best to try to answer
|
||
the questions for the benefit of all.
|
||
|
||
THE LETTER
|
||
"I was a student member of the ComSec Association
|
||
until my membership expired and the CSA board decided for
|
||
whatever reason to delete student member status.
|
||
"For the past several months, I'm glad to say that for
|
||
whatever reason, I have continued to receive the ComSec
|
||
Letter.
|
||
"With all of its coverage of the ECPA, and since the
|
||
whole communications privacy issue has been pushed by the
|
||
cellular telephone industry, I've decided to write to you
|
||
from my perspective -- a hobbyist communications monitor
|
||
whose interest includes the cellular telephone. You are
|
||
welcome to publish this as you see fit, under the condition
|
||
that I will remain anonymous.
|
||
"Cellular telephone communications operate at 825-845
|
||
MHz for the mobiles and 870-890 MHz for the cells. There
|
||
are several hobbyist communications receivers capable of
|
||
covering this range, with prices ranging from $400 to $800.
|
||
Interestingly enough, Radio Shack sells one of the best
|
||
receivers covering this range -- the 300 channel PRO-2004.
|
||
For political reasons (including the fact that RS sells
|
||
CMTs), cellular coverage was deleted by adding one easily-
|
||
removable component to a circuit board. It is common
|
||
knowledge that this component can be removed so this
|
||
continues to be a hot seller. Also, the CMT frequency
|
||
range was once allocated to UHF TV channels, so it is
|
||
possible to monitor cellular on an old TV set!
|
||
The majority of the telephone calls are of a
|
||
(legitimate) business nature, seconded by the more
|
||
interesting (to us casual monitors) personal calls. After
|
||
a quick scan of conversations, you realize how many people
|
||
cheat on their spouses! Drug deals are also often
|
||
monitored, and there have been instances where I have
|
||
copied down times, locations and any other helpful data,
|
||
turned it over to law enforcement agencies, and in turn
|
||
monitored their communications as they staked out the area
|
||
to make the arrests.!
|
||
Many law enforcement agencies themselves use cellular
|
||
phones, and by their lack of COMSEC/OPSEC during those
|
||
calls, they must seem to think the calls are relatively
|
||
secure. It seems that the agencies (DEA, FBI, etc.)
|
||
currently have no capability to monitor CMT conversations,
|
||
and "If we can't do it, chances are no one else can
|
||
either!" seems to be their attitude.
|
||
CMT industry officials would have you think that a
|
||
call changes frequencies every few seconds. While this
|
||
occasionally happens, the majority of the calls remain on
|
||
the same frequency for at least a minute. Also, it usually
|
||
takes me about 30 seconds at the most to relocate a
|
||
conversation that has switched to another channel as long
|
||
as the site is within about 15 miles of my area.
|
||
If you're behind or near a person using CMT, it is
|
||
quite simple to immediately locate the frequency and tune
|
||
in the conversation on the receiver without the use of a
|
||
spectrum analyzer or any other sophisticated equipment.
|
||
I'm currently trying to think of a way to pass on the
|
||
method to law enforcement agencies.
|
||
Overall, the cellular telephone system is a
|
||
sophisticated, extremely useful communications medium, but
|
||
the industry is making a mistake by trying to show that it
|
||
is something that in actuality it is far from -- secure.
|
||
Jim, feel free to use any of the above that you wish,
|
||
but please keep identifying information, such as my name,
|
||
etc. confidential.
|
||
I would like very much to contact my area FBI & DEA
|
||
Field Offices, because, after monitoring them, I know that
|
||
they are currently unable to monitor cellular conversations
|
||
(regardless of the law), yet I can't really just call them
|
||
out of the blue and say "Hey, after monitoring you, I know
|
||
you can't listen in on CMTs. I'd be happy to tell you
|
||
how!"
|
||
"I'd appreciate any advice or comments you might
|
||
have."
|
||
|
||
OUR ANSWER
|
||
First, let's consider the administrative questions
|
||
concerning CSA and your lapsed membership.
|
||
The student membership category was suggested by me
|
||
because I think we should do all we can to get young folks
|
||
interested in this field, and we all recognize that
|
||
students normally don't have a lot of money to throw
|
||
around. We knew when we set the dues at $10 per year that
|
||
it was a money-losing proposition, but we wanted to make
|
||
this information available to young folks studying in the
|
||
field.
|
||
Yep, I'm the one who suggested it. However, I'm also
|
||
the one who suggested that it was unworkable in an
|
||
organization this size with nothing but unpaid volunteer
|
||
administrative help -- me, my wife, and our youngest
|
||
daughter. Our experience in handling membership
|
||
applications convinced us that it was not worth the effort.
|
||
Almost every application had to be sent back for some kind
|
||
of documentary evidence that the applicant was truly a
|
||
full-time student. Many applicants were people who
|
||
sometimes took a course in the evenings, and some said
|
||
flatly that they studied on their own without benefit of
|
||
any recognized school. Those people, and the awful mess of
|
||
address changes just ate up too much time.
|
||
As to the reason that you received copies after your
|
||
membership expired; well, that's an interesting story and,
|
||
again, it relates directly to our naivete (or
|
||
inexperience). First, we tried to notify members to renew
|
||
by referring them to the code in the address label on the
|
||
envelope. Whoops. That didn't work partially because the
|
||
envelope was already in the trash before the member read
|
||
the note, and partially because many folks could not
|
||
understand our coding.
|
||
So then we were saved by a volunteer who said he would
|
||
maintain the membership list and send letters to all
|
||
members to remind them to renew. Whoops, again. We
|
||
suffered from many errors in the labels he printed out, and
|
||
delays of several weeks to get labels for mailing a monthly
|
||
newsletter. Oh, and by the way, he never did send even one
|
||
letter to remind people to renew.
|
||
The reason for the extra letters, then, is that your
|
||
editor was feeling guilty. How can you justify cutting off
|
||
membership if the member had never even been notified that
|
||
it was expiring. (Now, when we get as big as ASIS with a
|
||
five or six million dollar annual operating budget, then,
|
||
by golly, those renewal notices will go out like clockwork.
|
||
We hope.)
|
||
Now, let's consider the very serious subjects
|
||
introduced, namely the ability of some of us to monitor,
|
||
and inability of some others.
|
||
I cannot reveal the location of the letter writer so
|
||
we can't get a geographical fix on where DEA and FBI have
|
||
commented on the air about their inability to monitor CMT.
|
||
So, let's just ask the question of all of our readers: Is
|
||
this the situation in your area?
|
||
Speaking for ourselves, we have occasionally heard
|
||
some cellular phone conversations. In fact, while
|
||
demonstrating to some Senate staffers (before ECPA was
|
||
passed), we listened to a conversation during which one
|
||
party advised the other to buy a coach ticket, and he would
|
||
upgrade it to first class at the airport. (If that doesn't
|
||
make sense to you, let us explain. It is a violation of
|
||
federal law for a government employee to accept
|
||
transportation from a lobbyist or a contractor -- so what
|
||
is done is that the government employee gets his coach
|
||
ticket, and the contractor upgrades the ticket for cash,
|
||
and writes off the expenditure under some legal heading on
|
||
his expense report.)
|
||
Also, we've heard dates being made, and excuses being
|
||
given for dates broken; a girl giving all of her vital
|
||
statistics to what sounded like a prospective client, drug
|
||
deliveries being made, collectors (not the kind who send
|
||
invoices) going out to make collections, and a whole lot of
|
||
trivia.
|
||
|
||
|
||
BBS
|
||
|
||
Recently we were advised of a BBS called Mainstreet
|
||
Data (619-438-6624) which has a section called TAP
|
||
Magazine. Per the notice in 2600 magazine, for a
|
||
complimentary account call, enter 12 for your ID, enter
|
||
DAKOTA for your password, and at the first command prompt
|
||
enter PRO.
|
||
Please let us know how you make out.
|
||
|
||
|
||
|
||
|
||
|
||
SEEN AT ASIS, LAS VEGAS
|
||
|
||
Our nomination for the company with the most
|
||
interesting name at the annual seminar and exhibits of ASIS
|
||
in Las Vegas last month: Network Security Associates which
|
||
identifies itself by using the initials NSA.
|
||
|
||
|
||
FEDERAL COURT RULING RE ECPA
|
||
|
||
In the January 13, 1988 edition, USA Today reported
|
||
That "St. Louis US District Court Judge Roy Harper ruled
|
||
federal laws banning wiretaps don't apply to married
|
||
couples. Karl Kempf recorded his wife's telephone talks at
|
||
home because he suspected an extramarital affair, Harper
|
||
said."
|
||
If any reader has more information on this astounding
|
||
ruling, we'd sure like to receive it. Thanks.
|
||
|
||
|
||
November, 1987
|
||
|
||
THE SKY IS FALLING! THE SKY IS FALLING!
|
||
|
||
Many in politics and the media are screaming as
|
||
Chicken Little did. The fairy-tale chicken jumped to an
|
||
alarming conclusion on very slight evidence, and some high-
|
||
profile folks appear to have been doing the same with
|
||
regard to the Moscow embassy mess.
|
||
|
||
First they said that the Marine guards had been
|
||
allowing KGB agents the run of our embassy including the
|
||
crypto room; now they say no such thing ever happened.
|
||
Also, our legislators who visited our new embassy under
|
||
construction in Moscow say that it is so thoroughly bugged
|
||
that we'll never be able to use it.
|
||
|
||
A lot of what has been said bears examination and
|
||
evaluation by reasonable people. Let's look at some of
|
||
what we have been fed by the press.
|
||
|
||
Washington Post, 1-17-88: "... the Moscow Embassy was
|
||
ordered to cease all classified communication with the
|
||
outside world and to shut down processing of all classified
|
||
information on computer terminals, electric typewriters and
|
||
even manual typewriters on the theory that they might have
|
||
been programmed by nocturnal KGB visitors to emit telltale
|
||
electronic pulses."
|
||
|
||
Representative Olympia J. Snowe, 4-4-87: "We now have
|
||
a secretary [of state] who will be going to Moscow the week
|
||
after next and he will be reduced to negotiating foreign
|
||
policy in a Winnebago [because the embassy building is not
|
||
secure]."
|
||
|
||
Representative Daniel Mica is reported to have taken a
|
||
"Magic Slate" with him to Moscow so that he could
|
||
communicate securely while in our embassy.
|
||
|
||
There have been reports in the press that our new
|
||
embassy is one huge antenna.
|
||
|
||
U.S. News and World Report, 6-1-87 in a story about
|
||
the new Soviet embassy in Washington: "... the embassy
|
||
looms high enough over all of official Washington to enable
|
||
the Soviets to spy with sophisticated photographic and
|
||
listening devices on ... White House ... Pentagon ... State
|
||
Department ... Congress ... CIA ... FBI ... DIA ... and the
|
||
Navy Intelligence Complex."
|
||
|
||
|
||
IS THE SKY REALLY FALLING?
|
||
|
||
Comments on all of this are invited from all of our
|
||
readers. For his part, your editor finds most of it silly
|
||
and some of it downright ludicrous.
|
||
|
||
Can you imagine that anyone would be concerned about
|
||
compromising emanations from a manual typewriter?!? Can
|
||
you imagine that our technical people would allow our
|
||
embassy to be rendered unfit for use by people who have not
|
||
even had access to the premises for several years? In what
|
||
way does having the embassy made into a giant antenna
|
||
compromise communications?
|
||
|
||
All right, so our State Department insisted that the
|
||
Soviets build their embassy on the high ground on Tunlaw
|
||
Road instead of in Chevy Chase where the Russians wanted to
|
||
go. So what? Because all of those federal buildings are
|
||
visible in part from Mt. Alto, does that mean that we have
|
||
to stop doing business in the Pentagon, White House, etc.?
|
||
Yes, being on high ground does mean that radio reception is
|
||
better, but it doesn't mean that the Soviets can spy on
|
||
everything done in that long list of buildings, for Pete's
|
||
sake!
|
||
|
||
|
||
CALL FOR PAPERS
|
||
|
||
Although the dates are not yet firm, the decision has
|
||
been made that there will be a membership meeting in the
|
||
Washington, DC area late this year in conjunction with
|
||
Surveillance Expo '88. Your association is sponsoring this
|
||
expo, and expects to profit from it. Your participation is
|
||
urgently needed.
|
||
|
||
There will be four tracks with panels and
|
||
presentations scheduled throughout the three day period.
|
||
The tracks are: Communications Security,
|
||
Computer/Information Security, Surveillance Technology, and
|
||
Investigations Technology. If you are knowledgeable in one
|
||
of these areas, you are invited to suggest a subject for a
|
||
talk.
|
||
|
||
If you do not want to present a paper, but can help
|
||
with the planning, we'd like to hear from you right away.
|
||
The only pay you'll get for help is some public exposure to
|
||
professionals in the field, but that can be very valuable.
|
||
|
||
|
||
DEFENDING SECRETS, SHARING DATA
|
||
|
||
The title of this segment is the title of a report by
|
||
the Office of Technology Assessment of the U.S. Congress.
|
||
It is a modern-day classic on the subject of vulnerability
|
||
of electronic information to theft. If you work in this
|
||
field, or have responsibility for protecting information,
|
||
you should have a copy. Order from the Superintendent of
|
||
Documents, Government Printing Office, Washington, DC
|
||
20402-9325. GPO stock number is 052-003-01083-6. Price:
|
||
$8.50 per copy post paid.
|
||
|
||
Your editor is proud to say that he contributed in a
|
||
small way as a contractor to OTA.
|
||
|
||
|
||
THIS IS A PROFESSIONAL?!?
|
||
|
||
The headline (Washington Post, 1-23-88) reads "Wiretap
|
||
Consultant Gets 120-Day Term". The tawdry business that
|
||
was being reported on had to do with a man named Eddie T.
|
||
Dockery who admitted to forging an invoice, but that's not
|
||
the story that is of interest to us.
|
||
|
||
The real story is that this is the same man who was
|
||
hired by DC Mayor Marion Barry to perform "electronic
|
||
sweeps". That's right. The mayor of the capital city of
|
||
our nation hired this man to perform a professional
|
||
service. And what was the "professional" report that was
|
||
made to the mayor?
|
||
|
||
According to the Post, Dockery reported that "he
|
||
believed that there was a 90 percent chance that the three
|
||
telephone lines into Barry's house were wiretapped and that
|
||
the rooms in the house were bugged".
|
||
|
||
Now we've heard some pretty wild conclusions being
|
||
reached by some operators of TDRs, and we're wondering if
|
||
that is what this man was using. Or was he just looking
|
||
into a crystal ball?
|
||
|
||
|
||
CUTESY COMMENT AWARD
|
||
|
||
This award goes to William Barden, Jr. who wrote a
|
||
book entitled "Shortwave Listening Guide" which is
|
||
published and sold by Radio Shack. The cutesy comment
|
||
worthy of note appeared in a section of the book relating
|
||
to the ECPA of 1986 in which he explains the act and
|
||
counsels on how to not become a criminal while listening to
|
||
your radio. With regard to the fact that the ECPA makes
|
||
intentionally listening to what is broadcast on cellular
|
||
phone frequencies he comments, "Evidently some of the
|
||
lobbying for the ECPA was done by the Mobile Communications
|
||
industry."
|
||
|
||
In case you have not been following the activity re
|
||
ECPA and its aftershocks, let us explain. Radio Shack, the
|
||
publisher of this book was one of the principal lobbyists
|
||
for the obnoxious provisions of the ECPA which specify
|
||
which listening is OK, which is a misdemeanor, and which is
|
||
a felony. Further, Radio Shack made a quick fix to their
|
||
wonderful PRO-2004 scanner so that it could not be used in
|
||
contravention of the law that they helped to write. Yep.
|
||
The 2004 cannot now be tuned to cellular frequencies.
|
||
|
||
Therefore the "Cutesy Comment Award".
|
||
|
||
(By the way, if you have a PRO-2004 and want to
|
||
unmodify it, send us a stamped, self-addressed envelope and
|
||
we'll send you instructions on how to unmodify it so you
|
||
can listen to cellular.)
|
||
QUOTE OF THE MONTH
|
||
|
||
Milton Berle: "Married fifty years, and we still make
|
||
love almost every day. Almost on Monday, almost on
|
||
Tuesday, ..."
|
||
|
||
|
||
TO/FROM; CALLED/CALLING
|
||
|
||
George Threshman contacted us after our last letter
|
||
which tried to clear up the confusion between "trap and
|
||
trace" devices and dialed number recorders (DNRs). He said
|
||
that our explanation led him to believe that a DNR would
|
||
identify the calling number. (By the way, the Brits, in
|
||
their laws differentiate by using the words "TO" and
|
||
"FROM". Smart, no?) This is too important a point for us
|
||
to leave any possibility of confusion, so let's try again.
|
||
|
||
The DNR is a device which is placed across the line of
|
||
the calling telephone. It prints out a chronological
|
||
record of all telephone activity: date and time off-hook
|
||
and on-hook on all calls and digits dialed on all outgoing
|
||
calls.
|
||
|
||
(News note: The DNR from Radio Shack, the CPA-1000,
|
||
which we praised in that same letter has been reduced in
|
||
price; it's now $79.95. Aren't capitalism and the free
|
||
market wonderful?)
|
||
|
||
|
||
YET ANOTHER PRODUCT
|
||
|
||
Recently we received a letter from Robert Brooks of
|
||
Warrensburg, MO in which he made some nice comments about
|
||
the ComSec Letter and passed along some interesting
|
||
information.
|
||
|
||
First, Robert, Thanks for the kind words. Hearing a
|
||
compliment from time to time really makes this effort
|
||
worthwhile. And thanks for your info and questions.
|
||
(There will be more on laser techniques and equipment in a
|
||
future issue -- and I'm not sure about the facsimile
|
||
scrambling product that you recommend.)
|
||
|
||
Now let's pass on his comments about yet another
|
||
product. Robert says, "In recent product literature I
|
||
received from Sutton Designs, they advertised an 8-digit
|
||
(1.2 GHz) frequency counter for $500.00. If you look in
|
||
the inside cover of the November 1987 Modern Electronics
|
||
you'll see the same frequency counter (same exact ad --
|
||
different company) selling for $99.95. Isn't Sutton being
|
||
a little greedy?"
|
||
|
||
Well, Robert, I think it was P.T. Barnum who said,
|
||
"There's another sucker born every minute." It's just sad
|
||
that there are firms trying to "con" us all the time. By
|
||
the way, I've had other calls on this subject and I seem to
|
||
recall that the counter is available for a lower price, and
|
||
that Sutton is asking an even higher price. We'd be glad
|
||
to hear from anyone, even Sutton Designs, on this matter. December, 1987
|
||
|
||
BY-LAWS, BOARD, OFFICERS
|
||
|
||
We've drifted long enough. The current Board of
|
||
Directors will meet soon to approve By-Laws, and to start
|
||
the process of selecting a new board and new officers.
|
||
|
||
Information will be coming in this newsletter.
|
||
|
||
|
||
DANGEROUS FOOLISHNESS
|
||
|
||
According to information in a recent Popular
|
||
Communications magazine, the Cellular Telephone Industry
|
||
Association, CTIA, not only opposes any effort to force
|
||
manufacturers to put warning labels on radio transmitters,
|
||
they want to ban the manufacture of equipment that can
|
||
receive on cellular frequencies!
|
||
|
||
It seems prudent to us that the public should be
|
||
warned that what they transmit can be heard by others. It
|
||
is unthinkable that receiving equipment could be banned in
|
||
a free country.
|
||
|
||
Well, it took from 1968 till 1986 to change the
|
||
federal law relating to eavesdropping. The new law has
|
||
some improvements, but many strange new provisions. How
|
||
long will it take to undo all the harm done by the ECPA?
|
||
|
||
|
||
MAJOR INDEPENDENT TV STATION BUGGED!
|
||
|
||
We won't identify the station because we don't want to
|
||
embarrass them. (However, you'll find their call sign very
|
||
familiar.) It seems that a scanner operator called one of
|
||
their popular investigative reporters and advised that
|
||
there was a radio bug in the station and that a lot of very
|
||
sensitive information was being broadcast.
|
||
|
||
Investigation of the "bug" revealed that floor
|
||
directors were leaving their headsets turned "on" after
|
||
use. Sound activated (VOX) circuits kept the transmitters
|
||
off the air until they picked up conversations with
|
||
clients, discussions of secret promotional campaigns, etc.
|
||
(Hint, hint. This station just ran an excellent series on
|
||
eavesdropping.)
|
||
|
||
|
||
TEMPEST AND COMPUTER SECURITY
|
||
|
||
From Ray Heslop of the Tempest Division of Atlantic
|
||
Research we received a copy of the above captioned article
|
||
that had been published in last September's edition of
|
||
Government Executive. Our thanks to Ray for thinking of
|
||
us. The article intended to wake up corporate America to
|
||
the TEMPEST threat and it may have done something along
|
||
that line, but it turned us off because of incorrect
|
||
technical information.
|
||
|
||
The first comment on this material relates to a
|
||
popular misconception which seems to have been originated
|
||
by some of those liberal arts majors who became
|
||
journalists. Maybe it's not the fault of the journalists,
|
||
but somebody has divided eavesdropping into "active" and
|
||
"passive" categories without providing definitions of these
|
||
terms. If I understand them correctly, when a man climbs a
|
||
pole and bridges from the target telephone line to the
|
||
leased line to the listening post, that's not active.
|
||
Methinks that the guy who climbed the pole will be
|
||
surprised to find out that he was engaged in a passive
|
||
activity!
|
||
|
||
Leaving aside the generic criticism, let's look at
|
||
some specific technical information offered in this
|
||
article. We'll label the Government Executive comments
|
||
"GE", and our responses "CL".
|
||
|
||
GE. "According to experts, fiber-optic cable is the
|
||
best bet because it doesn't emanate as well. However,
|
||
fiber optic cable can be tapped easily, and it is difficult
|
||
to detect the tapping. Existing coaxial cable can be
|
||
protected with metal shielding."
|
||
|
||
CL. So much for getting expert technical advice from
|
||
Government Executive!
|
||
|
||
All of us know, I hope, that there is no magnetic or
|
||
electric field associated with a fiber optic cable carrying
|
||
a signal because that signal is light, not electric current
|
||
or radio frequency energy. So, in a sense, the author is
|
||
correct; it does not emanate as well 'cuz it doesn't
|
||
emanate at all. However, when she says it can be tapped
|
||
more easily, and the tapping is difficult to detect, she
|
||
couldn't be further off the mark. There is no doubt in my
|
||
mind that fiber optic cable can be tapped. I just don't
|
||
think that it can be done in the field. Consider that a
|
||
single strand of cable is 10 microns in diameter and is
|
||
covered with cladding that is one micron in thickness. I
|
||
can see how this can be handled in the lab, but I really
|
||
can't see a man on a pole, handling the cable with gloves
|
||
on, with the wind and rain, and so forth, can be expected
|
||
to remove the requisite length of cladding without damaging
|
||
the glass fiber so that he can fuse another cable to it as
|
||
they do in the lab in a jig under a microscope.
|
||
|
||
And, as for tap detection, it looks like there are
|
||
many ways to automatically detect tampering on the fiber
|
||
cable, but we don't yet have a way to do the same on a
|
||
phone line.
|
||
|
||
Last, but not least. She says that coax can be
|
||
protected with metal shielding. Great idea, but of course,
|
||
coax means coaxial; the conductor in the center and the
|
||
shield around it share the same axis, therefore, the term
|
||
"coaxial". 'Course, if you put another metal shield around
|
||
it, we don't know what you would accomplish, but it
|
||
shouldn't hurt anything except the pocketbook of the person
|
||
paying for it.
|
||
|
||
GE. This article also says that computer data are
|
||
stolen by "highly sensitive bugs, line taps, parabolic
|
||
microphones, electromagnetic emanation collection
|
||
instruments, and other related devices."
|
||
|
||
CL. Our own experience is limited, but the methods
|
||
listed here don't seem to relate to the practical world
|
||
that we live in. However, let's pass this question on to
|
||
our readers. How often have you found computer data being
|
||
compromised by parabolic microphones or highly sensitive
|
||
bugs or anything else specified?
|
||
|
||
|
||
BBS # NG
|
||
|
||
Shortly after we passed along a new BBS number, we had
|
||
a call from Larry Newman who reported that the number from
|
||
2600 was no good. Sorry about that.
|
||
|
||
|
||
ComSec Association BBS
|
||
|
||
Larry has been flirting with the idea of sponsoring a
|
||
BBS for the ComSec Association, but he's not sure that he
|
||
can bring it off alone. Anybody out there want to give him
|
||
a hand? He's in NYC and his phone number is 212-921-2555.
|
||
Give him a call if you think that you could help get this
|
||
project off the ground.
|
||
|
||
|
||
AT&T INFORMATION SOURCES
|
||
|
||
The following information was published in
|
||
Teleconnect, and we pass it on for those who may be
|
||
interested.
|
||
|
||
Technical Reference Catalog (pub 1000) (lists pubs,
|
||
bulletins, etc.) Available from:
|
||
|
||
Publishers Data Center, Inc.
|
||
POB C-738
|
||
Pratt Street Station
|
||
Brooklyn, NY 11205
|
||
|
||
Bell Labs Record (magazine). $20 per year from:
|
||
|
||
Bell Labs Circulation Dept.
|
||
Room 1F-233
|
||
101 JFK Pkwy
|
||
Short Hills, NJ 07078.
|
||
|
||
|
||
|
||
EVALUATOR EVALUATION
|
||
|
||
At the request of one of the dealers and of the
|
||
inventor (?) of the Evaluator, we tested the device.
|
||
|
||
In case you're not familiar with this unit, let us
|
||
quote the headline in the ad currently running in Security
|
||
Management: "NEW! PATENTED TAP DETECTOR OPERATES 24 HOURS A
|
||
DAY".
|
||
|
||
Based on those words we think that a reasonable person
|
||
would conclude that the Evaluator is capable of detecting
|
||
telephone taps, and is sold as a tap detector, no?
|
||
|
||
Well, we tested the evaluator to see if they had
|
||
invented something that Bell Labs had been unable to
|
||
invent.
|
||
|
||
The first one that we tested did not detect the Radio
|
||
Shack audio amplifier, the butt set, the tape recorder
|
||
starter, the sound activated tape recorder, or the tap made
|
||
out of about $2.50 worth of parts. It did detect an
|
||
extension phone going off hook.
|
||
|
||
The inventor/manufacturer (?) advised that we might
|
||
have received a faulty unit, and also that we should leave
|
||
the tap on for three to five minutes because that's how
|
||
long the detection process sometimes took.
|
||
|
||
So we tested the new unit while timing our taps by
|
||
dialing the time message from the phone company. We
|
||
recorded for at least five minutes while tapping
|
||
sequentially with the same pieces of equipment. Again, it
|
||
failed to detect anything but an extension going off hook.
|
||
|
||
Since then, we've been promised that we would receive
|
||
a new unit for testing. That promise goes back several
|
||
months, so don't hold your breath for our updating story.
|
||
|
||
|
||
SURVEILLANCE EXPO
|
||
|
||
We're trying. Spent innumerable hours talking with
|
||
two Sheraton hotels in the DC area, only to have them
|
||
change the terms when it was time to sign the contract.
|
||
Wasted time.
|
||
|
||
Any member with experience in this arena will be
|
||
welcomed with open arms. Help!
|
||
|