1

The Dutch government recently passed a new law: Sleepnet (EN: Dragnet) and got it through both parliament and senate mostly unchanged.

The Sleepnet-law allows government-entities like intelligence-agencies and law-enforcement to legally mass-intercept/-collect and -store ALL communications of entire populations (neighbourhoods/cities/country?), without the need for a specific target/suspect.

So to our government, we're now all, by default, regarded as suspects…

This inspired me to come up with an 'encryption scheme' that, in addition to hiding the contained message from unauthorized eyes, also attempts to exhaust all resources of any system that is required to make something like the Sleepnet law possible.

I'm thinking of hiding the encrypted message (e.g an email) inside a large (>100MB?) blob of random data, which is possibly itself encrypted again. So sending a 40KB encrypted email, becomes sending >100MB of bogus data, which possibly carries some encrypted message inside.

If such a scheme would be adopted by large numbers of people, any Sleepnet-like setup will quickly fall to its knees due to too much data and too few resources (storage/cpu). At least, that's what I'm hoping.

Would a scheme like this be feasible? Could it work at all? What would be required to make it work?

I'm aware of the impact such scheme would have on infrastructure, networks, ISP's and server-hosting companies, but please let's forget about that for now… Right now, I'm only interested in if it is possible at all and what is required technically to create something like this.

And of course, I'd also like to know of any already existing system that uses a similar approach.

EDIT

This idea is specifically not concerned with the gathering and correlating of metadata, which will not be affected by a strategy as described above. Also, in the Netherlands, ISP's and Telecom providers are already obliged to retain this metadata for (I believe) 3 years.

Improve this question
3
  • no, it won't help. they don't routinely brute-force anyway, so you're only self-flagging compared to "mainstream encryption"
    – dandavis
    Commented Nov 10, 2017 at 8:04
  • 2
    Or just use end-to-end encryption. This is exactly the kind of thing it provides protection from (though it has limitations, of course).
    – forest
    Commented Dec 10, 2017 at 7:43
  • I don't think end-to-end encryption solves what he's talking about; encryption would prevent contents from being seen, but it's still easy to that two nodes are communicating. I think he wants a scheme that generates so much data that keeping tabs on who is communicating with who becomes infeasible.
    – K.B.
    Commented Jan 9, 2018 at 20:28

2 Answers 2

Reset to default
3

Sniffing all data as you envision they will do in a dragnet does not mean that there is a way to decrypt all data or that decrypting data is even needed to get useful information.

First, meta data already provide valuable information without the need to do decryption. Such meta data are for example who is the sender, who is the recipient, how many data get exchanged, how long do these party communicate, at which time, from which location, is the data encrypted etc. Connecting such meta data can for example be used to provide social graphs which are then used to find the most valuable targets who can then be attacked in a more targeted way.

Second, today's encryption algorithms can be considered fairly solid. It is currently expected that even secret services do not have the resources to decrypt properly encrypted data. This does not mean that this would be fully impossible in all cases but it just gets to expensive and even governments have limited time and money. It is far cheaper to compromise sender or recipient and thus gets direct access to the plain data. This might be done by exploiting some software bugs or even by silently breaking into the home and directly manipulating the hardware of the target or adding tiny cameras and microphones to listen and watch any communication.

Your proposal will not offer better protection against the attacks I've just described. It might in theory offer a better protection against some attacks which are kind of impossible already if existing encryption is properly used.

Improve this answer
10
  • Thanks for your thouughts! However, you've not really responded to the, at least to me, more relevant aspect of the idea; Massively inflating the volume of even the most stupid short email or whatsapp message, to the point where Dragnet-like 'attacks' simply become impractical or even impossible to do. This is ofcourse more likely to actually work the more people are using it.
    – arri
    Commented Nov 9, 2017 at 22:31
  • @arri: Massive data transfers will not really harm the recording of meta data since these are only small. And like I said - if they want to get to the plain data its way more feasible to get to the source of the data instead of cracking the encryption. Thus, your idea makes only the part harder which will not be used to access the plain data anyway.
    – Steffen Ullrich
    Commented Nov 9, 2017 at 22:51
  • 1
    Sending many messages to many people can complicate metadata and the main criticism I've read is about bandwidth, but it doesn't have to burn as much as the question suggested.
    – user123931
    Commented Nov 9, 2017 at 23:03
  • 1
    @notstoreboughtdirt: if the recipients are random it is probably easy to filter out this noise, i.e. keep only connections in the social graph which are used significantly more often then the rest. Apart from that, this proposal is outside the original question which only cares about embedding a small message in large amounts of junk data. If you want to discuss this different idea further please ask a new question.
    – Steffen Ullrich
    Commented Nov 10, 2017 at 5:51
  • 2
    I think you are also ignoring the fact that all the data collected is already enormous. This means that the government agencies will most likely apply sophisticated machine learning algorithms that would soon identify your actual interconnections. In that case, more data would most likely improve the algorithms faster.
    – Julian Knight
    Commented Nov 12, 2017 at 15:19
1

The first thing it would to is grind to a halt every residential internet connection in the country. ISPs connect groups of ordinary users over a single high-speed connection to the internet. The ratio of users to high-speed lines is known as the "contention ratio", and may be around 20:1 or 50:1. This only works because most people aren't sending or receiving much for most of the time. Your proposal would increase the size of every message a thousandfold.

Shortly afterwards, the ISPs would introduce new/updated "fair usage policies". Anyone sending or receiving excessive amounts of data would either:

  • Have their speed capped at a much lower rate.
  • Be charged extra.
  • Be given the choice of updating their service to a dedicated business line (at great expense) or have their service terminated.
Improve this answer
1
  • Also, imagine having to upload 100/1000 fold data for each web request you make (you'd want to do it for everything, otherwise your large data blobs would just be a giant "HERE'S MY IMPORTANT COMMUNICATIONS" sign) would slow down your functional bandwidth to dialup levels. Reminds me of the Tor fork that wanted to beat timing attacks by having each node send out data regardless of a request or not. Technically it might work but the extra load would be prohibitively expensive.
    – K.B.
    Commented Jan 9, 2018 at 20:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .