It does. The problem is that crooks aren't generally trustworthy, and selling you out is leverage they're very willing to use should the cops ever catch them. The same applies to every part of the illicit communications network you rely on - if any part of the trusted chain breaks down in a way that enables the cops to subvert your encryption you're screwed, right down to installing an OS update on your device.

Good opsec is exceptionally hard. If you aren't building it from scratch it probably isn't secure. And even if you are, if you're a big enough target for nation states to be looking you're still going to have a hard time.

> If you aren't building it from scratch it probably isn't secure.

And if you are building it from scratch, it is definitely not secure.

It's essentially a larger scale, legal version of https://xkcd.com/538/

The missing part is often the "well done" part. Other than that - traditional bugs/listening devices, malware (recording the sound before encryption/after decryption)?

Then there's traffic analysis (a talk to b, b kill c, b talk to a). See also: "well done".

If crooks were proficient at using FOSS to write their own encryption apps that obey best practices... working as an SWE would probably pay better and have less downsides.

Crimie movies make us think criminals are bright subversives, when the vast majority of them are dumb thugs.

There are much more lucrative paths for intelligent psychopaths in the professional world.

But that doesn't stop them from hiring a bunch of capable software engineers from e.g. the Western Balkans to build stuff for them for crazy money (6 figures EUR is crazy money for the Western Balkans). Like the guy who created a phone network for the Colombian cartels in the 1990s.

Movie stereotyping whole region as aside, 6 figures EUR is not crazy money for western Balkans.

6 figures EUR is bordering on crazy money for Eastern Balkans, which are in the EU, let alone Western Balkans.

For reference, in Bosnia and Herzegovina, the median salary for a software engineer is 3650 BAM (1867 EUR at today's rate), per month, making a yearly 43800 BAM / 22404 EUR, and that's gross, before taxes and stuff. 6 figures EUR, even assuming low 6 figures like 300k, is the equivalent of more than 13 yearly salaries, and is of course untaxed, so even more with that. One can comfortably retire with 300k EUR in Bosnia.

Same guy snitched 'em once caught by the FBI tho

They'd need to kill those SWE to be -safe- after

PS: I wouldn't take a job that can get me killed, there's a reason I like working with computers

I think the main reason is that LE basically has root on the entire stack up to the encryption.

It does.

The standard playbook for rolling up criminal conspiracies is to arrest a low level member, offer him a reduced sentence in return for testimony, arrest the next guy higher up based on that testimony, etc. (The only way to prevent that would be a fully trustless "cell" structure where none of conspirators know each other, which has never been done in real life.)

You will notice none of this requires communications intercepts. This is because the feds are simply lying when they say encryption prevents law enforcement operations.

There was a Chinese drug lord operating out of Canada who did successfully pull off the cell structure. Amazon of Drugs or something.

Somehow they managed perfect forward secrecy.

For a while.

Here he is.

https://torontolife.com/city/this-man-is-the-jeff-bezos-of-t...

It has never been discovered to exist. If it’s actually good it’ll defeat attempts to uncover it. An even better cell structure would be one where the cells don’t even know that other cells exist.

> An even better cell structure would be one where the cells don’t even know that other cells exist.

You can’t have a network with more than one cell where no one outside of the cell knows that it exists, and without those people using a communication method to people in the cell that at least one person in the cell knows exists. And when you minimize down to the minimum contact, the network is very much non-resilient: its hard to discover and roll-up, but (especially if the cells are doing high-risk functions, which is probably why you want to do it) its also easy to disintegrate accidentally, even without being discovered and rolled-up.

I think you -could- generate a network of cells where cells are independent and the communicator doesn't know the cells - broadcast your radicalisation on radio and let the cells organise themselves. At least one cell member knows about the communication method but since it's broadcast, I think that's safe (in this context.)

But practically there's a whole bunch of problems as you say - you've no idea how many - if any - cells exist, they can't coordinate on which one picks up a particular target, the communicator is obviously at risk from being tracked down, how do you tell people where the radio broadcast is, authorities can obviously listen in once they've found the broadcast, etc.

> "and the communicator doesn't know the cells - broadcast your radicalisation on radio and let the cells organise themselves. At least one cell member knows about the communication method"

Couldn't be done by sending messages encrypted with private key and the cells decode it with public key?

Then the problem is: How to trust public keys to have been provided by the "right" correspondent, and not someone from another gang or law enforcement?

Not trying to start an argument because I think your statements are mostly correct. I do think you can have autonomous actors inside of cell systems that can compose an entire cell. Especially at the lowest levels.

Cell systems have order, but only where the most risk is imposed. Lesser risk, less order. Infact, too much order imposes far more risk.

Not sure about never been done in real life - some of the Provos and Unionists in Northern Ireland pivoted their cell structures from terrorism to profitable crime when peace broke out.

It's a reasonable common idiom with tongue firmly planted in cheek.

(Btw, you've been shadowbanned a while ago. I'm only mentioning this, because your recent comments seem sane as far as I can tell.)

You should email dang. I didn't bother to review your comment history, but if your new comments are avoiding whatever got you shadow banned, he'll probably give you another chance. Skipping that step, there's a very good chance your new account would get auto-shadowbanned as well.

TIL.

I've only ever heard it on an episode of Monty Python. Wonder if it's just a UK thing.

I've heard it in other context, but those people might have picked it up (indirectly) from Monty Python.

> The only way to prevent that would be a fully trustless "cell" structure where none of conspirators know each other, which has never been done in real life.

When properly done, such organization is almost impossible to find. I'd not be too sure about them not existing. The idea is well known, so someone must have tried it at least.

How would they recruit?

Refer a friend -> referral goes up the chain and back down to a different group?

Now the friend knows two groups.

Only leaf groups, with very tenuous connections.

Ah the infamous crossover: Cartel x MLM.

PGP recruitment drives

Well it's never been done in real life that we're aware of. Mostly because if it has been done, they almost certainly were not caught by traditional policing techniques.

Why would you even want to be in a conspiracy if you don't know anyone? You couldn't trust that it would work or you wouldn't be manipulated.

The Crips and the Bloods are kind of like that cell structure, but cells have internal beef all the time. If you had different cells have no communication, that would happen way more as they try to expand

That's not how cells work though. Cells don't know people in other cells. Well maybe one or two people do. Sure an internal beef can happen but the people in the cell are mostly still responsible for themselves not the others in the cell.

Think of a cell like a class in programming. If a class has a bug you can fix the bug, or make a new class with the same ins and outs. Never have to restructure the entire code base. Properly made classes don't leak to other ones. Worst case internal beefs take down prod for a bit but they don't take down the entire program

> Why would you even want to be in a conspiracy if you don't know anyone?

Perhaps you are in it for the ideology? Or perhaps they pay you?

Apple does this kind of secrecy well.

I suppose you're talking about development teams that have no knowledge about what other development teams are working on.

My sense is that it has become a bit more lax since Apple has grown and, well, let's face it, Steve is no longer with the company.

>The only way to prevent that would be a fully trustless "cell" structure where none of conspirators know each other, which has never been done in real life.

Or you just have your buddies enact violence on the friends/relatives of anyone caught squealing.

> none of conspirators know each other,

"Why am I Mr. Pink?"

https://www.imdb.com/title/tt0105236/characters/nm0000114

None of these busts involved breaking encryption. They all involved trusting a third party which later became known to be untrustworthy.

Also when they arrested people the phones were often unlocked (I watched a documentary and saw the police capture phones and state they were unlocked)

Also they didn’t use disappearing messages or delete them so the full history was available without breaking any encryption

Sounds like they catched a bunch of n00bs to me.

That's what a n00b would think!

The real problem is that most people cannot tell whether they're buying proper encryption or snake oil.

Exactly this. If your core competence is crime and not cryptography, what have you got other than reputation to base your decision on? Just like all of us in whatever sphere we're in.

It does. But how do you prove you have a "well done" cryptosystem?

Very few "crypto" exploits are ever the issue. It's almost always easier to break some other part of the system than the crypto.

To be honest, if someone were trying to sell me a cryptosystem for a criminal enterprise and I were in the market for one, I'd happily start tracing everybody in that company as they are almost certainly part of the Feds.

If you are the target of a nation state actor, you're pretty much fucked. Once a nation decides to put down that much resource to get you, you're getting gotten.

Crypto is only valuable in the sense of "I don't have to outrun the hungry tiger. I just have to outrun you so the tiger stops chasing me to eat." If you, specifically, are a target, crypto won't help you much.

Sounds to me like the best criminals become nations.

Yup, Russia, China, North Korea, all authoritarian states

Winners write the history books.

Real winners write the law books.

Whether that's European colonial settlers, or William of Normandy.

(Not known as "William the Negotiator", or "William the all-around nice guy").

Descendants of the local warlords he installed still own huge (well, by British standards, the entire country isn't much bigger than New York State) tracts of land, a thousand years later.

Are you trying to somehow claim that the well-established fact that the Russian govt is indistinguishable from the Russian Mob, or that North Korea is not counterfeiting currency, running drugs, and hacking networks for currency, all indistinguishable from a criminal gang, and definitely not the purview of legitimate governments?

In linguistics they say that the difference between a dialect and a language is that a language is a dialect with an army.

https://en.wikipedia.org/wiki/A_language_is_a_dialect_with_a...

You know the saying don't roll your own crypto, well that is because almost everyone does it wrong. AES/RSA/ECC can't protect you from using it incorrectly.

You can have perfect crypto on your devices, and great operations, and your messages can still be intercepted several ways. The feds are almost never in a rush. If they want you, they'll get you. If they want you enough, they'll sit in a coffee shop they know you frequent with a high zoom camera ready to read your encrypted texts from across the room. Or they'll bug your car and listen in to your properly encrypted phone calls. Or they'll intercept a package and add some spy gear. They won't do this to bust some street level meth dealer. But, if you're suspected of something like posting state secrets in a Minecraft server? You betcha. They'll follow you everywhere.

> But, if you're suspected of something like posting state secrets in a Minecraft server? You betcha. They'll follow you everywhere.

Or they just call up discord and ask for the name and billing address on the account.

Presumably a criminal mastermind would know to fake that

Seeing as anybody who takes a credit card on the internet has to do some fraud prevention, that's pretty likely to be very difficult. Hell, depending on how paranoid things have been set up, even having uBlock can prevent you from using a credit card somewhere!

That's an almost impossible task.

The Pegasus malware for example was able to infect and spy any phone.

The article addresses this: it’s because it’s almost never well done.

They claim it’s super secure, and then apparently implement whatever with no oversight.

Encryption only works if the endpoints are secure. Zero day one of them and you have all the access you need without cracking anything.

The biggest endpoint vulnerabilities are human in nature.

The NSA quantum computers.

At its simplest - they attack the middleman. Most crooks aren't tech nerds, they're not a lot smarter with technical devices than your average user.

So all the cops need to do is go after the central server and then quietly hijack it. After that the choices are pretty much endless. If they used non-standard encryption, ggez, they're probably not smarter than the police. If they did, chances are that the server has an OTA mechanism to update the message application on the phone, so just push out a malicious update that quietly just resends every message to a police controlled server and uploads all messages still stored on the device. Less useful (not as much access to historical messages) but still very useful for tracking criminal activity if you run the tracking net for long enough.

I would disagree with your assumption on their intelligence wrt knowledge of the tech. No matter how poor your technical education is, you are likely to learn details about the thing that is central to the secrecy of your organization if you have any sense of self-preservation.

The reality is that when you start to endanger society the State comes after you. See Escobar and Noriega.

The companies offering encrypted phones were infiltrated. Servers hacked. Employees intimidated with prosecution. Bank accounts seized.