Kok, is the second member of the A club. He addresses my joking question "Show me one case where..." with real sources.
Kok is referring to the DEA's "Operation Raw Deal" wherein the DEA, using the Mutual Law Enforcement Assistance Treaty (MLAT) got the Canadian Minister of justice to issue a warrant to Hushmail in Vancouver, B.C., for a list of targeted accounts. The DEA made two such requests, and were provided with 12 CDs worth of
decrypted email. One DEA source boasted to the media that they received in excess of 100,000 emails from Hushmail.
Somehow, the same folks who are rolling out the heath care plan would need to make huge improvements with their snoop database to make it really work. I'm thinking along the lines of Southpark and the "Intellilink" latest episode...funny. To overestimate your opponent may be better than underestimating, I don't know. Will check the Art of War to find out what they say there. We are playing strictly defense here so tactics are different.
It is a serious error to paint all of government with the same brush. Law enforcement, does not as a rule, advertise its failures. That is one of the reasons that hard evidence is difficult to come by. I don't know if you're old enough to have lived through the crypto wars of the 1990s, but at that time, the various heads of the law enforcement agencies in Canada, the U.S. and the UK were all bordering on hysterical over the prospect of unescrowed crypto. At the time, there was a legislative proposal in the U.S. to require that all crypto be back-doored, with the keys held in escrow by the U.S. government. People were told that the keys would only be made available to police pursuant to a court order. Needless to say, the backlash to this was considerable.
It was the prospect of such legislation that led Phil Zimmermann to release PGP 1.0, in order fto make it available before any such legislation had a chance to become law.
The head of the FBI at the time, Louis Freeh, was almost apoplectic at the thought of unescrowed crypto making it way into the hands of criminals. He stated flat-out that the use of such crypto could stop investigations dead in their tracks. If crypto wasn't effective, they would not have reacted this way, would they?
You asked the question, "Show me one case where people were busted because they didn't use PGP?" Let me answer that in a roundabout way, by telling you a story.
Once in a while, one finds out about criminal cases, the details of which tend to hint at law enforcement capabilities and weaknesses. One such case was that of a paedophile ring which was broken up several years ago.
This ring was broken up after an investigation by the FBI and the Australian Federal Police (AFP) lasting the better part of two years. The ring had operated, pretty much with impunity, for about 5 years by the time they were broken-up. According to the court documents, they were reasonably sophisticated, with members using Tor, remailers, VPNs, and (naturally) PGP.
Members of the ring posted PGP-encrypted messages to various newsgroups; all the members of the ring used a common PGP keypair, to facilitate communications amongst themselves.
According to the court documents, the police were aware of this message traffic for some time, but due to the PGP encryption, they could not read the message traffic -- they were stymied.
So, you might ask, "How did they finally get caught?" Well, they used one of the classic methods outlined in Sun Tzu's
Art of War -- the informer or spy. (Spies are so important, that Sun Tzu devotes an entire chapter of the
Art of War to them.)
One of the members of the ring was caught committing a child pornography offence, unrelated to the ring's activities. In exchange for leniency, they turned over knowledge of the existence of the ring, their PGP keys, and the information on the computer to the police. This allowed an undercover officer to assume their identity and begin monitoring the ring's activities.
After about 2 years of investigation, a series of simultaneous raids took place in the U.S., the UK, Australia and elsewhere. In all some 22 suspects were apprehended. The FBI's own figures state that there were 60 members of the ring, so even despite having been penetrated, about two-thirds of the ring's members were never apprehended. (It was later stated that those who used VPNs were arrested, while those who used Tor and remailers were not.)
Frankly, it was the sheerest of luck that led a member to be arrested, and to turn over information leading to the ring's penetration. I daresay that, if this had not happened, the ring still might be operating to this day. Frankly, as unpalatable as the ring's activities were, this case revealed the limitations of even a well-funded, multi-national police investigation. It only underscores the protection provided by such tools as are commonly available.
Nightcrawler
4096R/BBF7433B 2012-09-22 Nightcrawler <Nightcrawler@SR>
PGP Key: http://dkn255hz262ypmii.onion/index.php?topic=174.msg633090#msg633090
PGP Key Fingerprint = D870 C6AC CC6E 46B0 E0C7 3955 B8F1 D88E BBF7 433B
Security is a bit like religion... some things have to be taken on faith.
Where security differs from religion is that security is NOT retroactive.
Unlike Christianity, where you can come to Jesus, be 'saved' and have all
your sins washed away, with security you can adopt Tails or PGP, and be
secure from that point forward, but rest assured that your previous sins
(security failings) WILL come back to haunt you and bite you in the ass.
The original DPR is the poster child for that, right now.
