Security And How to Hide From It

Two things happened last year which really made me reflect on security, privacy and the internet.

Before I start on this topic, I think that I should probably tell you about an episode of the US (or possibly Canadian) series ‘Nikita’. The central character is an assassin from a US covert operations group gone rogue, played by the exotic Maggie Q ... who you should never look up on Wikipedia or you will discover that her real name is ‘Margaret Quigley’ and somehow the exotic lure is not the same. At one point in a later series, Nikita flees the US to hide out in Europe, more specifically London (played by a picture of St Paul’s Cathedral added to the background of every shot). The covert agency laugh at this news - ‘they’ve gone to England?’ they cackle, ‘there are more CCTV cameras per person than anywhere on earth in England, she’ll be easy to track down’. At this point, if you are beating your chest with a fist and feeling a surge of patriotic pride at living in the most watched country on earth, then perhaps this post is not for you.

The first of the two things that happened in 2016 was that I Friended a whole load of people on Facebook. I had changed job and because I never Friend people who I work with, I went through a list of people who could be Facebook Friends now that we no longer worked together. One of them was a woman who I had known quite well over the last few years and I was immediately struck by the fact that Facebook had her gender as male.

I am open-minded about such things and I understand that there are transgender people in this world, but this still took me by surprise. I have also come across same sex couples where one of the couple will have their gender listed online as different to their partner’s. Again, I have no problem discovering that a number of people who I worked with were gay. It would be more surprising to find that the world was 100% heterosexual.

It remained a curiosity until someone questioned this Friend about appearing as a man. It was a simple choice she replied, if she logged in as a man then it stopped social media showing her ‘female adverts’. It was only quite recently that I became aware that if your login details are a woman in her early 30s then Facebook, Twitter, YouTube and so on will bombard you with adverts which could be summarised as “Why aren’t you pregnant?” My Friend had discovered the way to change these to be endless adverts for shaving products and Russian brides.

It had never occurred to me before that rather than trying to hide from surveillance, you could achieve just as much by having contradictory and misleading information about yourself out there. Being ‘off grid’ will probably no longer work, so why not be ‘on grid’ but hiding in blurred sight? I also find that women who I tell this to are immediately kicking themselves as to why they never told Facebook that they were male. I am signed up to YouGov surveys and now I find myself tempted to answer quite basic ‘just so we have some details about you’ questions with complete falsehoods that (most importantly) contradict what I replied in the personal details section of the last survey.

The second thing that happened last year was that I watched the Channel 4 series “Hunted”. Years ago, Channel 4 had run a series called “Wanted” where people tried to hide from professional trackers and I had been curious to know whether this format would still work. My presumption was no because the proliferation of CCTV, interception of electronic communications, drones and online spying meant that people could be much more easily tracked nowadays. This turned out not to be completely true.

One of the winners of the show was a man named Nick. Nick was a househusband whose aim was to be ‘grey and unnoticeable’ on the streets of Britain. He camped in people’s gardens and never told one person where he was going next. However, one day he demonstrated something essential about evading being tracked – he understood how his trackers worked.

A man offered him a lift and he took it. He would not say where he was going next, but he asked the man to do him a favour. The stranger was asked to text Nick’s neighbour to ask his wife to go to a local leisure centre with some money as he had run out. He would be wearing a blue boiler suit, dark glasses and a black wig and would approach from the south. Sure enough, the neighbour passed the message on to Nick’s wife and the hunters were waiting at the leisure centre. A man turned up in a dark boiler suit, dark glasses and a wig and when the hunters moved towards him, he ran. They caught him, wrestled him to the ground and celebrated the capture. He took off his glasses – it was the stranger from the car.

What Nick understood was that the hunters would be tapping his neighbour’s phone. Phoning his wife from his own phone would be too obvious, so he used the convoluted method of a strange number and the neighbour’s phone to set up a false trail which the stranger was only too happy to take part in. As with above, one key to not being tracked is not disappearing but leaving a plausible, false trail.

Two other contestants in “Hunted” were two young women from Yorkshire. They survived until late into the series, brought down by the impulse to go home, sadly. Their method was to have no method. They went to motorway service stations and asked random people for a lift to anywhere. They were young, female, pretty and personable so they tended to do well with the tactic and were only once informed on (and luckily the informers were informed on to the girls). The hunters found it impossible to track them because they could go a hundred miles one day and then ten miles the next. They had no particular direction or strategy and so there was no way to predict what they would do next and so where they would be.

Recently I discovered that there are people signed up to an app which orders their shopping for them. They have put in what they buy each week and the app will automatically contact TESCO, arrange the delivery and make the payment. This assumes that everyone buys the same food each week. I have read that that observation is actually true and that the variation in most diets is very small. I find that sad but it also reminds me of the Yorkshire women – what defines us is the patterns in our lives, take away the patterns and your TESCO app would have no idea what to order.

At this point, you are probably thinking that this is all very interesting but generally irrelevant. Changing your online sex may well help with removing annoying ads but most people seem to have settled down to a life of being tracked. One of my mother’s favourite cartoons is of the computer screen which says, “Forgotten your password? Ring GCHQ, they know it.” We seem to have fulfilled the stereotype once described in an episode of ‘Yes Minister’ about the introduction of a European ID card – “Only the British will carry it and also resent it.” We obey the rules and grumble to ourselves about them rather than trying to change them or resisting them.

Both Hillary Clinton and Emmanuel Macron’s Presidential campaigns were subject to hacking attacks. However, they approached the attacks in very different ways and, you might conclude, very different results. Reading about the Macron approach, I think that it is worth remembering the two things that happened to me in 2016 that I have commented on in this blog. I should probably add that this is only what I have read and is not an official account.

The Clinton campaign approached potential hacking by trying to defend the websites and accounts controlled by Clinton and her supporters. As you saw, this was not a completely effective approach. The Macron campaign decided to learn from this. Firstly, they tried to understand how the hackers worked. Phishing was big, it seemed – this is where you are presented with a login screen for Facebook (for example) but the address is actually something like www.facebok.com and your ID and password will be stored by the hacker even if you do then go through to Facebook. The hunters showed how to do this on Channel 4 last year. Rather than fighting it, the Macron team decided to expect it.

I read that where a phishing scam was identified, the Macron team set up programmes to make thousands of logins through the fake addresses, each using fake IDs and passwords. In other words, they bombarded the hackers with far too much information for them to process. Some of them may have been correct, but with so many to process, there was no way that this could be done. They understood the phishing scam and worked against it just as Nick understood that the hunters would be tapping his neighbour’s phone.

However, it did not stop there. Hackers were collecting documents about the Macron campaign and the presumption was that these would be released during the campaign to try to influence the election. Again, Macron’s supporters understood those trying to intervene. Instead of restricting documents accessible to hackers, they created thousands of spurious documents. Crucially, some were true so that they could not all be simply dismissed as fake. This is like Nick knowing not to phone his wife directly – do not be too obvious, give the hacker the impression that they are on to something.

Now look at the final night of the French Presidential campaign when a disgruntled anonymous 4chan user uploaded a vast mass of ‘evidence’ about Macron but saying that he did not have time to go through it all but that there must be something incriminating in it. While people continue to try to work out if that hacker was Russian or not, the tactic appears to have worked. If you are confronted by people looking for information, flood them with a mixture of genuine and fake information which they will never have time to sort through. Remember, the information can be collected by computers but they need a human to work out how any information could be used. Computers look for patterns and the mass of information was rather like the random travel plans of the Yorkshire women.

You may not care that you live in a constant state of surveillance but, if you do, here is how you defeat it. Accumulate a mass of incorrect and misleading information about yourself and be sure to contradict yourself as often as possible. A common name helps – I intend to blame this blog on my namesake who wrote “Accounting for the Severn Bridge” or possibly my other namesake who wrote “Magic Sex 3”. Graham Greene used to confront other people named Graham Greene with the words, “Are you the Graham Greene who writes those dreadful blasphemous books?” to cover his identity. That was kind of a pre-internet strategy for anonymity.

Stop acting in patterns and be unpredictable – it turns out that that might just be the most human thing that we do.

Written on the 14th July 1957 by Abraham Lincoln.