Secure communications for the modern terrorist

Question

This is my first post in this seemingly awesome forum.

I need some suggestions for mobile communications in my detective novel.

My story features a US police detective who is pitted against a group of billionaire funded mercenaries.

In the first encounter, my protagonist and his detective partner follow a lead to a warehouse on the docks in the middle of the night. They are supported by a colleague with access to the full range of a major city precinct's police surveillance equipment. This surveillance cop becomes aware of some active communications in the area of the wharf but is not able to directly understand them due to them being encrypted.

On entering the building a firebomb is triggered and not only is my hero badly injured but his partner is killed.

I have a second bombing encounter, much later in the story, where my hero needs to be alerted to the presence and location of the mercenaries' communications a few moments before the bomb goes off, giving him time to escape the area. Aside from being able to identify the location of these communications, it's vital that my protagonist can be sure that the perpetrators are one and the same group, to enhance his motivation to avenge the death of his partner.

I imagine, after the first encounter, that the surveillance cop puts in place a 24/7 monitoring system with an alarm set to go off when it encounters the same unique communications identified on the night of the wharf bombing.

I wrote a rough draft revolving around military, channel-hopping radio technology but have been advised that this is a bit dated. The modern terrorist has better encryption opportunities by using mobile Internet data connections but I need someone to outline an approach that seems feasible and yet offers me my required plot devices.

What forms of communication would fit these requirements:

• They might be chosen by a current day, privately funded, quasi military mercenary group enacting terror on US soil.
• They could remotely detonate a bomb.
• They could be detected and their location identified by existing police surveillance equipment, even if they can't be decrypted.
• They should have a unique identifier which could be recognised as belonging to the same group.

To my mind, if the mercenaries are using burner phones, and fake online accounts, communicating over Skype or similar online chat, there would be no possibility of identifying them. This would suck for my story.

I could of course opt for a signature explosive charge to identify the group but, if there's no advance warning of the second attack then my story will end abruptly if my hero dies.

Cheers,
Nigel Byron Bay

Answer 1

Detective workaround.

I like "To my mind, if the mercenaries are using burner phones, and fake online accounts, communicating over Skype or similar online chat, there would be no possibility of identifying them. This would suck for my story.".

Your detective feels this way. There is no way to bust into these communications that he can think of. He feels helpless, and dated. Maybe you do too by your comment about channel hopping. Have your detective propose that and his surveillance buddy smiles sadly. Write that into your story because you feel it and it will be good.

But key: "This surveillance cop becomes aware of some active communications in the area of the wharf ". The bad guys are not in Kazakhstan; not all of them, anyway. At least one is local. Your detective has to be a detective - an old school detective. He might as well, because that is all he has got. Have him figure out where the local they heard was, physically during the explosion. He was nearby. Where did he go next? Figure out the guy and his movements. Plant a listening device, or arrange that the burner phones for sale in the bodega where he buys his smokes are all bugged. Or just tail the bastard and listen in on the conversation with his own hairy cop ear.

I am not writing your story but I love to imagine the detective picking up the bomb right after the guy plants it and walking it over to the guys rental car and leaving it in the rear passenger footwell.

Answer 2

Consider Metadata vs. Encryption vs. Content

What makes communications unique? Once upon a time, with landlines and wiretaps, a cop or a counterintelligence agency would target a telephone extension, possibly by physically attaching a tap on the line, or by asking the phone company for itemized phone bills if there was no tap in place. The modern equivalent is to track a specific SIM card or IP address. And the modern countermeasure is to use "burner phones."

But with enough computing power, it would be possible to look into each message and scan it. That's like listening to every phone call in a city -- clearly impossible when people sit at the switchboard, but computers can scale up better.

Within their message, the bad guys are encrypting their content. That encryption could be a commercial or open-source, off-the-shelf system, but perhaps the bad guys are paranoid about those software packages being subverted by intelligence agencies. So they grabbed a few computer science textbooks, and a compiler, and wrote their own.

That is their undoing.

The self-made encryption program is not just vulnerable because of programming mistakes, it is also recognizable because of the non-standard data format. As a simple example, perhaps it is always two slashes followed by six digits followed by three slashes followed by 1024 lower-case letters followed by two slashes, repeated as many times as necessary for the length of the message. If the surveillance has the power to look into each and every message.

With "power" I means not just computing capacity but also the legal permissions. The police usually doesn't have it. Intelligence agencies might have the right, or subvert safeguards to do it anyway.

---

Follow-Up:

1. The cops get their hands on communication which they cannot read. Perhaps there was a file on a stick in a suspected hideout, or a dead letter drop, or perhaps an IMSI-catcher, or they are tapping one phone number of a possible contact.
2. They analyze the communication and see patterns. Perhaps there are three files attached which are called "something.jpg" but when they try to open the picture they find that there is no picture inside. But what they do notice is that all are exactly the same size, and all start with exactly the same bytes at the beginning, and exactly the same bytes at the end. They still cannot read the middle piece with the content, but the next time they encounter a file like this they know (or at least suspect) that it is the same bad guys.
3. Using some really serious pull at the DHS, they get the DHS to ask the NSA to monitor an entire city if more of these "corrupted jpgs" show up. That is probably illegal and unconstitutional in the US.

So they still cannot read it but they can detect it.

Answer 3

If your protagonists can see who is transmitting to whom, but not the contents of the messages, then they can use traffic analysis to deduce a lot of information about the internals of the terrorists' organistion. This includes their location(s), command-hierachy, and planning of future activity.

Traffic-analysis is part of modern SIGINT (signals intelligence), and is used by most modern spy agencies.

• Generally during the planning stage, traffic rates will step up.
• The Command-hierachy, especially if its strictly command <-> subordinates, (even if several levels), gives very distinct traffic patterns.

Answer 4

1. Military vs Commercial Frequencies. Communication use frequencies issued by government for that purpose, each radio station has permission to use that frequency, each phone company uses that frequency. (https://en.wikipedia.org/wiki/Spectrum_management)

Most military frequencies are isolated for that purpose; and civilian communication tools don't use it. I imagine Russian communication system would be heavily encrypted by the only ones using those frequency (or stolen US military equipment).

Its a pretty sloppy mistake, but its at least "detectable" as being transmitted, even if can't be read.

However as you said, I would rather use data access that looks like nothing until it put through a Skype Chat (which has happened IRL). Its also much more contemporary.

2. My solution: Its not about their communication traffic you detect. Instead you detect them test the trigger for the explosives. They use a military remote trigger, not an insurgent style mobile phone. They are properly constructed so more reliable, and your mercenaries have used them before. As part of setting the explosives they test the remote control trigger (as part of setting the explosives, you would ensure it works, then connect the receiver to the detonator) it is detected as a unique military transmission.

Bonus, the same signal was picked up during the last explosive too.