Re: What about Traffic Analysis?

[Adam Shostack <adam () homeport org>]

Ted Doty wrote:
| At 03:28 PM 8/6/98 -0400, Adam Shostack wrote:
| 
| >     What about performing traffic analysis on the mail flow?
| >Catching information by spikes in the places people send mail?
| >Sending files to the competition?  Is this worthwhile?  (Assume
| >trapping messages that hit some threshold.)
| 
| Traffic Analysis is still more art than science.  This doesn't mean that
| much of it couldn't be captured in automated tools, but the cost of using
| the tools will be high - lots of analysis and lots of false positives.
| This is why it's mainly governments that use TA (they can stand the cost).

        Actually, there is a definite science to TA. The NSA has had
courses in it for long enough that Agean Park has old books available.
There has been some very interesting work done and not published by
various cypherpunks on TA in a remailer network.

        However, you're correct; it does lead to lots of manual
analysis and lots of false positives.  However, if you're going to
fail at the problem of understanding content, you may be more
interested in the problem of following message flows.

        Seeing lots of mail from a GM executive to Volkswagen shortly
before he leaves the company may be interesting even without the
content.  It also may be useful as a means of deciding what to do
content analysis on.

| >     In a talk at Defcon this weekend, someone made the comment
| >that sending pictures of giraffes to your freinds is calling attention
| >to yourself, regardless of the ability of the screener to find the
| >stego'd encrypted message in the picture.
| 
| Presumably you'd have more of a clue than to send random pix of Barney the
| Dinosaur.  Even the random "You'll never believe THIS (I heard it on the
| Internet)" that I get from all my Internet-newbie friends has lots of
| bandwidth for hidden messages.

        Presumption of clue on the part of the enemy makes the problem
harder than it often is. :)

| This is a classic covert channel analysis problem.  Trying to block covert
| channels in an Internet world will make your hair fall out.

        My question is not, can we catch everyone, its can we catch
some people, and is that a useful thing to do?

Adam


-- 
"It is seldom that liberty of any kind is lost all at once."
                                                       -Hume