Submarines prowl the ocean floor, while ships above carefully skirt the limits of international waters. On dry land, guards patrol high fences surrounding acres of huge golf ball-shaped radar domes. In the skies, airplanes knife through the stratosphere, while higher up orbiting electronic ears listen to whispers from the planet below.
They’re all trolling a vast sea of electromagnetic signals in hopes of catching a terrorist plot in the making, a shady arms deal, economic intelligence, or a rogue nation building a weapon of mass destruction. This so-called signals intelligence, or Sigint, has been vital to the United States and its allies for decades. But, in the wake of 9/11 and the failure to capture Osama bin Laden, the shortcomings of the world’s biggest interception system are apparent.
The ships, planes, antennas, and satellites are the result of a triumph of Cold War engineering, designed to keep tabs on the Soviet Union and its allies. The question now is: how useful is the system against terrorists who know not to trust their satellite phones? How effective can it be in an age when almost untappable fiber-optic lines carry information at stupefying rates and cheap, off-the-shelf encryption systems can stump the most powerful supercomputers on earth?
Given the veil of secrecy drawn by nations around their intelligence operations, these questions might seem unanswerable, but even top-secret agencies have to operate in the real world, making it possible to draw some conclusions.
Those findings paint an intriguing picture of modern Sigint, in which the best way past a tough problem can be to solve a different one. Rather than the creation of ever more sensitive receivers or code-breaking computers, the hot areas of cloak-and-dagger information gathering include tapping fiber-optic cables (even at the bottom of the sea); using tiny bugging devices and old fashioned bribery, blackmail, and burglary to get at data before it has been encrypted; exploiting software flaws and poorly configured communications systems to bypass data-security measures; and automatically winnowing the vast amounts of intercepted communications.
Big brother or white elephant?
The old workhorse surveillance system described above is run by the United States—with the United Kingdom, Canada, Australia, and New Zealand as junior partners—under the secret 1947 UKUSA agreement. Often referred to as Echelon in the popular press, some fear it as the ultimate Big Brother: listening in on every telephone conversation, reading every e-mail, tracking every Web surfer around the globe.
But these fears are greatly exaggerated, explains Gerhard Schmid, vice president of the European Parliament and rapporteur of a 2001 report to the parliament on the UKUSA system. Schmid notes an obvious fact that many seem to forget: only those communications that the system has access to in some way can be intercepted. “There is no special magic physics for secret services....The rest is movie stories, rumors, and nonsense,” says Schmid.
In effect, whether or not the Sigint system is of value boils down to a technical question: in the face of a telecommunications explosion that has brought e-mail, cellphones, beepers, instant messaging, fiber-optic cables, faxes, videoconferencing, and the World Wide Web to every corner of the globe, can the UKUSA intelligence agencies attain enough access to know what’s going on?
Of course, some communications are easier to access than others. Wireless communications in particular offer two key advantages—you can intercept them without physically tapping into the target’s communications system, and there is no way to detect that they have been intercepted. “Microwave, radio, telephone, walkie-talkie—communications that are in the air are all interceptible by some sort of antenna in the right place,” says Jeffrey T. Richelson, author of The U.S. Intelligence Community (Westview Press, Boulder, Colo., 1999).
Much of the UKUSA system’s physical assets around the world and orbiting above it are devoted to making sure there is an antenna in the right place. Listening posts of varying scale dot the earth—including on top of every U.S. embassy. Many are attached to military installations, while some are operated remotely. Others are mobile, on navy ships and submarines and on specially modified planes such as the EP-3 that crash-landed in China in 2001. For decades these eavesdroppers provided much of the intelligence community’s Sigint.
But, for tactical and technical reasons, the well began to dry up at the start of the 1990s. The biggest tactical problem was that the Soviet Union’s collapse kicked the legs out from under a monitoring network built up over decades. “There were some easy things about the Soviet Union,” says James Bamford, author of Body of Secrets: Anatomy of the Ultra-Secret National Security Agency (Doubleday, New York, 2001). “The first one was you always knew where it was. You could invest a lot of money in a big listening post in Japan near Vladivostok because the Soviet navy was always going to be there.”
Apart from being easily located on a map, the USSR also generated a steady stream of routine radio and microwave transmissions to provide grist for the intelligence wheel. “It’s completely different when you’re going after sporadic miniwars and terrorism,” says Bamford.
The technical issues arose from the Internet-driven telecommunications explosion, the most serious consequence of which is the ever increasing shift toward fiber-optic-based international communications. The shift was due to the commercially attractive fact that one fiber can carry 128 times as much digital traffic as a satellite transponder—over 240 000 channels, each carrying 64 kb/s.
Breaking into Davy Jones’s locker
Before the widespread use of fiber-optic cables, geosynchronous satellite constellations such as Intelsat and the Russian-sponsored Intersputnik carried much of the international communications traffic. Such links can be comprehensively monitored by placing a receiving station in each satellite’s transmission footprint. And thanks to the global range of the territories belonging to the UKUSA countries, exactly such a collection of stations was built, from Pine Gap in central Australia to Morwenstow in England and Sugar Grove in Virginia [see map].
The Big Ear: International communications satellites carpet the world with a patchwork of transmission footprints. So the United States and its English-speaking allies operate a global network of satellite dishes (red dots), dubbed Echelon, that provides comprehensive coverage of these footprints, allowing their intelligence agencies to eavesdrop on virtually all satellite-based communications.Illustration: Bryan Christie
In contrast, cables have to be tapped directly. While this is easy enough to do if the cable makes landfall in a territory controlled by a UKUSA country, someone has to visit the cable clandestinely if it doesn’t, typically in a submarine. Fiber-optic cables are the toughest to crack: fibers don’t radiate helpful electromagnetic fields (as did the old metal cables) that can be detected with an inductively coupled pick-up collar.
Eavesdroppers first solved this problem by targeting the signal-boosting repeater stations strung along the cables. Early repeaters had to convert the signal from light into electricity and back again in order to amplify it, and in its electronic stage, the signal could be tapped externally in much the same way as a metal cable. But the development of erbium-doped fiber amplifiers, in which the signal is boosted without ever being converted into electricity, called for a new approach.
In theory, it’s easy to find out what’s being transmitted along a fiber. “All you have to do is put a little bit of a bend in the fiber and look at the light that comes off it,” says Jim Hayes, president of the Fiber Optic Association, a professional society for the industry. The signal loss in the fiber would be just a few tenths of a decibel, making the tap undetectable. “But practically,” he adds, “it’s not so easy.”
The problem, Hayes explains, is that, in a typical cable, the fiber in question is one of a dozen hair-thin strands of glass, which are embedded inside a laser-welded, hermetically sealed, 3-mm-diameter stainless steel tube. This tube is in turn covered by a few centimeters of reinforcing steel wire and cables carrying 10 kV of dc power, all at a depth of a couple of thousand meters.
“It’s not impossible—but it certainly pushes the definition of practical,” Hayes notes. The easiest interception technique is to open up one of the repeaters to get at the fibers, but, Hayes cautions, “the whole issue of resealing it is quite difficult because you have to do it perfectly.” Parts must either be sourced from the manufacturer or duplicated exactly.
Despite these challenges, “the U.S. has been reconfiguring the submarine USS Jimmy Carter for [fiber-optic tapping],” says Richelson. The Jimmy Carter, one of a new Seawolf class, is being extensively modified for a range of covert missions by the introduction of a new hull section, which will facilitate the use of remotely operated vehicles, surveillance equipment, and the transport of Navy Seals, the U.S. Navy’s special operations warfare specialists. The sub is also being fitted with an advanced communications mast, which will allow it both to eavesdrop on radio signals and transmit information back to base. The Jimmy Carter should be fully operational by mid-2005 [see illustration].
Bond, James Bond
But a big remaining challenge, according to John Pike, a defense expert and founder of GlobalSecurity.org, are fiber-optic cables that stay on land. “I think that one of the things that [Navy Seals] spend a fair amount of time doing is [going] ashore...and walking to the nearest land line,” says Pike. “They were doing that in Iraq a decade ago.” Pike believes that this may also be how fiber-optic communications in North Korea and other countries are monitored: “It’s cat and mouse, we try to see how many taps we can put on [chief of state Kim Jong II's] fiber-optic network, and the Dear Leader runs around and tries to catch them.”
Another, more aggressive approach to the land-line problem is to force an opponent onto the airwaves. “One of the things the United States has been doing since the middle of 2002 is systematically taking apart Iraq’s land-line communications with air strikes, to force them to communicate via channels that are more readily compromised,” says Pike. Indeed, this may be the reason why U.S. Secretary of State Colin Powell was able to present incriminating Iraqi telephone conversations to the United Nations last February.
When a more subtle approach than aerial bombardment is called for, agencies like the U.S. National Security Agency (NSA) and the Central Intelligence Agency (CIA) can call upon organizations such as the Special Collection Service (SCS), a joint NSA-CIA covert group headquartered in Beltsville, Md. “What this group does is the more surreptitious black-bag operations,” explains Wayne Madsen, who previously worked at the NSA and is now a senior fellow at the Electronic Privacy Information Center (Washington, D.C.). Black-bag operations can include breaking into embassies or facilities of communications providers and stealing information or installing bugs.
It’s been extremely difficult to break Russian ciphers
By bugging a computer or communications system, information can be captured before it’s sent through a fiber-optic cable, author Bamford observes. A tiny microphone dropped into a keyboard can pick up the made by the keys as they are struck and transmit the sounds to a nearby receiver. Different keys, according to Bamford, “sound different—each has a specific signature.” Those signatures can be used to reconstruct what was typed.
The SCS also allows the Sigint community “to be proactive, to go after information rather than sit and wait,” explains Bamford. Another important SCS mission is to recruit people who work for targeted governments, like cryptographic clerks or systems administrators, to ensure access to sensitive information, such as cipher keys. When successful, such activities also allow the NSA to avoid another steep hurdle: encryption.
Say what?
The NSA claims to be the world’s largest single employer of mathematicians and has always projected an image of being a code-breaking outfit par excellence, in the mold of the legendary British Bletchley Park, which succeeded in breaking the German Enigma and other ciphers during World War II. But these days, there may be some misdirection in that image.
The NSA has “covered up some quite spectacular successes at breaking into cipher systems...by pretending that they were simply better at mathematics and computer science, whereas what was usually happening was some form of sabotage, blackmail, theft, corruption, or whatever,” says Ross Anderson, a reader in security engineering at the University of Cambridge and cryptographic systems expert. (When contacted by Spectrum for this article, a spokesperson for the NSA said that it does not comment on operational matters.)
NSA’s code-breaking efforts began to run into serious trouble relatively early in the Cold War. According to Bamford, immediately after World War II the NSA captured German code-breaking machines that allowed them to read advanced teleprinter ciphers that the Soviets were using at the time. But because of a suspected spy, the Russians found out and in 1948 changed all their ciphers overnight.
The next day became known as Black Friday, reports Bamford. “From that date on, it’s been extremely difficult to break Russian ciphers. Most of what the NSA got, they got from occasional busts.” A bust is a mistake in the implementation or operation of a cipher system.
“Sometimes they don’t know they’re making a mistake. A clerk is typing away and all of a sudden the crypto system disengages,” explains Bamford. This can give a code-breaker enough of an opening to be able to go back and read the entire message.
The solution was to go around the problem. To divine Soviet diplomatic plans, the UKUSA agencies might track a meeting between a third-world diplomat and the Kremlin. When the diplomat sent a coded report back to the home government, the spooks would go after this target’s weaker encryption.
“Big governments like the United States and Russia use home-brewed [cipher systems]. But they’ve learned through 50 years of experience to do that well,” says Brian Gladman, a former deputy director of the NATO Shape Technical Center who has worked with Government Communications Headquarters (GCHQ), the British equivalent of the NSA. “Smaller countries don’t have that experience, and [when they] build home-brewed ciphers, they don’t do very well.” Countries—including Middle Eastern nations—have also purchased commercial cryptographic machines, but may not have always operated them properly. (There are also rumors that the NSA obtained the default keys to some units prior to delivery.)
In any case, the rise of ubiquitous computer communications has allowed the emergence of widely available strong cipher systems, such as public key cryptography, which rely on mathematical functions that would take the greatest supercomputer on earth millennia to break. Initially, this caused something of a panic in intelligence circles and sparked the so-called crypto wars of the 1990s, when the U.S. government arrested Phil Zimmerman, the creator of one popular public key program, Pretty Good Privacy, and attempted to impose stringent export controls on cryptographic software. But the underlying mathematics was already freely circulating. Non-U.S. companies threatened to take over the expanding market for online security products and the government eventually relented.
But even with theoretically unbreakable encryption available to anyone with Internet access, all is not lost for the code-breakers; once again the solution is to go around the problem. Nowadays, “exploits against cipher systems involve failures in design and implementation rather than in the underlying cryptographic algorithms,” as during World War II, explains Anderson. The same kind of flaws and foul-ups—buggy software, poorly configured systems—that allow computer worms to wreak havoc on the Internet, combined with SCS-style activities, give agencies like the NSA a continuing window of access to the activities of rogue nations and the businesses they deal with.
Indeed, the adoption of new telecommunications technologies has not been all bad for the intelligence agencies. Actually, the widespread deployment of cellphones in countries with historically underdeveloped communications infrastructures has made surveillance easier, especially of nongovernment targets, like terrorists. “There’s more and more cellphone coverage, even in places like Pakistan,” says Madsen.
Pike agrees: “Incomes rose faster than land lines could be put in....Since so much of the economic activity in these emerging economies was focused in a few primary cities, it was relatively easy to overlay a cellphone system.” And it is exactly these cities that are likely to host an eavesdropping U.S. embassy or consulate.
Cell- and satellite phones can also reveal a caller’s location. In cooperative countries, such information may be extracted directly from the cellphone network, while in other regions the location may be determined if multiple listening stations (possibly including satellites) can pick up the phone’s transmissions. It was by pinpointing the origin of a satellite phone call that the United States determined the coordinates for the 1998 cruise missile attack on one of Osama bin Laden’s camps in Afghanistan.
Drowning in data
But these successes in keeping 21st century communications an open book have just compounded the biggest issue of all: volume. “It’s hard to comprehend the enormous increase in communications in the last 15 years....You’re talking two million pieces of communication an hour from one listening post,” says Bamford.
More and more of the NSA’s vast computer resources are devoted to simply storing and cataloging the torrent of raw Sigint that pours into its Fort Meade, Md., headquarters. The agency’s ultimate problem is that there are just too many people on earth to monitor everyone. The only solution is to throw away as much as possible of the information as soon as possible after it’s been collected.
“The electrical engineers and computer scientists at NSA spend a lot of their time developing [automatic] filter systems,” says Bamford. Strategies like focusing on telephone calls from a particular installation, searching for specific words and phrases in e-mails, or using voice recognition techniques [see “Getting the Message”] are all deployed in the hope of picking up a terrorist giving orders rather than someone arguing with their significant other.
While it is unlikely that any government, army, or terrorist group will ever again have its plans as comprehensively exposed as the Nazi war machine’s, Sigint should still be effective against specific targets—but, as 9/11 and the search for Osama bin Laden prove, only as part of an integrated intelligence strategy that prevents it from turning a deaf ear.
To Probe Further
The European Parliament’s report on the Echelon eavesdropping network can be found online at https://www.europarl.eu.int/tempcom/echelon/rrechelon_en.htm.
The National Security Agency’s Web site (https://www.nsa.gov/) has information on its history and outreach programs.
An open-source public key encryption application, Gnu Privacy Guard, can be found at https://www.gnupg.org/.