12
$\begingroup$

The context: Imagine some (near future) soldiers who have - as part of their standard kit - cameras built into either their helmets or body armour. They'll be recording, and possibly transmitting, while the soldiers are in the field. So very like:

  • The bodycams used by some modern UK police officers.
  • The helmet cams of the Colonial Marines in the Aliens movie.
  • The kind of footage captured by military personnel and made into the BBC documentary Our War, except it is 'official' footage not personal mobile phone recordings.

Now, if the Colonial Marines are transmitting their footage, I get that it will be encrypted to military standards and cycling through frequencies to avoid detection. I'm happy with that.

But what about the physical kit? What happens if Hicks and Hudson get killed, and the enemy picks up their helmets and runs off with the camera card with a view to offloading their footage? There might be all sorts of sensitive information in there. What the inside of their ship looks like, or call signs, for instance.

The question: What sort of encryption or protection needs to be on that footage?

| improve this question | |
$\endgroup$
  • $\begingroup$ The technical considerations of encryption and the policy considerations of what to record are very different questions. Please limit yourself to one question per post. $\endgroup$ – sphennings Sep 25 '17 at 15:32
  • 6
    $\begingroup$ "What sort of encryption needs to be on that footage"? Eh... the kind that does not let an unauthorized person view it? I am sorry for sounding snarky here but that is the main purpose of encryption. There are myriads of way to do this but in short the entire hard-drive / memory card would be encrypted in such a way that if you do not have the secret key, then all you will get from the drive when you try to read it is garbage. This is common technology even today, where you can apply this to any mountable volume, be it hardware or software. BitLocker and TrueCrypt are examples of this. $\endgroup$ – MichaelK Sep 25 '17 at 15:47
  • 6
    $\begingroup$ It is absolutely possible. For example, you can record video on iPhone without unlocking it. When recording session finished, you no longer have access to this video (without unlocking). Soldiers may not even need to have unlocking authority, they will only record and store, and transmit when needed, no playback. $\endgroup$ – Alexander Sep 25 '17 at 18:17
  • 1
    $\begingroup$ I think this question is opinion based. All you need to say is that the transmission/recording files are encrypted and leave it at that. $\endgroup$ – AndreiROM Sep 26 '17 at 14:04
  • 1
    $\begingroup$ This could easily be a "too broad" question to answer really thoroughly. It's a common idea in computer security that "if the box is physically compromised, then everything is compromised." Enemy soldiers picking up recording devices constitutes physical compromise. $\endgroup$ – Green Sep 26 '17 at 15:20
18
$\begingroup$

Basically, you have three options:

Livestream

The camera doesn't record a thing. It instead immediately uploads it (through a secure channel) to your military base, and the recording is mad serverside.

Advantages:
If anyone manages to steal the camera, he will just steal a nice satellite/3g connected camera with a send-only apparatus. While this might be useful to reverse-engineer the technology used, your enemy will have no footage of your operations whatsoever.
The live feed can also be used by commanders to make last-minute decisions and have a tactical advantage.

Disadvantages:
If the enemy produces a jamming signal strong enough, you will have no records of the camera. This can be also used as a decisive hit to your intel capabilities, if your generals are using the live feed to take decisions in real time.
The signal could also be used by a technology advanced enemy to triangulate your soldiers' position. (thanks Agent_L)

Recording

The camera records everything, and all is encrypted on disk, using a system like Bitlocker or similar. The recording can then be reviewed safely at the base.

Advantages:
All footage can be recorded in high quality, regardless of available bandwidth or connection loss.

Disadvantages:
The enemy may be able to capture your soldiers and force them not to disable the camera, so they would (theoretically) be able to retrieve the non-encrypted datas still stored in memory. With modern cryptography techniques, this could amount to a few minutes, seconds, or even a few frames of recording, so the advantage of this for the enemy may vary (thanks MichaelK, André Paramés). Internal storage size will also limit the quality/recording time of the camera. This becomes important for older (less space) camera models or very high resolution cameras (thanks Taegost).

Mixed

This is the system I would use. It involves a bit of both, and consists into recording everything, uploading all the recorded data to the base, then deleting all data already sent.

Advantages:
No quality loss, recording will take place regardless of signal, basically the advantages of both approaches combined

Disadvantages:
If the enemy jams the signal for long enough, you will fall back to the "Recording" case, as data never gets uploaded to the server.

| improve this answer | |
$\endgroup$
  • 21
    $\begingroup$ It's worth pointing out that asymmetric cryptography (requiring a different key to decrypt than the one used to encrypt) will obviate the need to destroy or turn off the device on capture. $\endgroup$ – Unsigned Sep 25 '17 at 18:19
  • 5
    $\begingroup$ @BgrWorker the usual process nowadays (called Forward Secrecy) is to generate a new random symmetric key every few minutes, deleting the previous from memory (leaving just the asymmetrically-encrypted copy on disk). That means very little can be recovered even if they capture a device without triggering its self-protection mechanisms. $\endgroup$ – André Paramés Sep 26 '17 at 7:16
  • 2
    $\begingroup$ @BgrWorker Every time a block of streaming cipher key is extracted, the seed in the random number generator changes. And unless someone really messed things up, this is not reversible. The best an an enemy could hope for — if they captured the equipment intact and read the memory of it — would be to find out what the next streaming cipher keys would have been, not the previous ones. This is useless information. For the record: I have used this exact method to implement encryption in a mobile phone application to protect sensitive data... on a 2005 feature phone, not a smartphone. $\endgroup$ – MichaelK Sep 26 '17 at 7:32
  • 2
    $\begingroup$ @MichaelK I think I misunderstood your comment then, I thought you meant to directly encrypt the stream with the public key. Since you and André Paramés make really good points in favor of the recording option, I will edit my answer accordingly. $\endgroup$ – BgrWorker Sep 26 '17 at 7:44
  • 2
    $\begingroup$ Broadcasting the video signal has two additional problems besides jamming. First, it uses a lot of power if you want the signal to travel more than a few meters away, draining the batteries. Second, the signal can be triangulated, giving away your location to the enemy. $\endgroup$ – Rekesoft Sep 26 '17 at 8:32
12
$\begingroup$

Since you took the path until figuring out that transmission will be encrypted, it's not far fetched to imagine that also stored data will be encrypted with same standards.

Or, even better since the most valuable info is not the footage, there should be some device which monitors the bearer vital signals and destroy the systems if signals cease without proper procedure. With this it should also come a "self destruct" option in case the soldier is captured alive.

This to prevent that your enemy get a nice overview of your capabilities and can get proper countermeasures.

| improve this answer | |
$\endgroup$
  • $\begingroup$ I was just thinking about vital sign monitoring for destruction. If you have this much information, connection to an operator while in the field to monitor each move and analyse best actions would be a real benefit, and especially for special operations teams, the need for covert technology including anti-capture measures would be necessary. +1 $\endgroup$ – Anoplexian - Reinstate Monica Sep 25 '17 at 16:52
  • $\begingroup$ Any hint about the downvote would be welcome. $\endgroup$ – L.Dutch - Reinstate Monica♦ Sep 25 '17 at 19:02
12
$\begingroup$

Encryption can pretty confidently hide data from adversaries, but meta data can be very important and is much harder to hide.

With sophisticated enough listening equipment it should be possible to count and locate every transmitter.

Standard video encodings use more bandwidth when images change more, so you might be able to guess when people are being active.

If you know the specific video compression used you can create images that compress poorly and guess someone is looking at the image if you see spikes in data transmitted.

If you can see the size of stored recordings you can guess how long a soldier has been deployed.

To make use of them the footage must be available somewhere, and might be vulnerable to spies: Viewing large volumes of this footage would give very meaningful insight into tactics and doctrine. This might be usable by adversaries to make sophisticated traps.

| improve this answer | |
$\endgroup$
  • $\begingroup$ Excellent analysis, which makes the whole thing seem like a very silly idea indeed. There's a reason "radio silence" is a thing. To be powerful enough to transmit through buildings etc, they would likely all have to connect through the engineer's pack, making the comms engineer a primary target, with essentially a radio beacon strapped to his back. They could not rely on working cellular or wifi signals in insurgent-controlled areas, so it'd likely need to be satellite or line-of-sight radio comms to base. $\endgroup$ – Dewi Morgan Sep 26 '17 at 5:08
  • $\begingroup$ Its rather simple to hide the size of the stored recordings: Just initialize your storage with random data. If encoded correctly the encrypted data should be indistinguishable from the random data. E.g. VeraCrypt uses that to hide the hidden volumes. Transmission size could either use constant bitrate codecs or buffer data a bit in order to flatten the profile. Good point anyway! $\endgroup$ – Christoph Sep 26 '17 at 7:46
  • $\begingroup$ You don't need to know a lot about the specific video compression in order to create an image that compresses poorly: random images don't compress at all (by definition). There are some lossy codecs that detect random data drop it and fill it with other random data during decoding though. In that case you need to make the images as random as possible without being detected as random. $\endgroup$ – Christoph Sep 26 '17 at 7:51
  • 2
    $\begingroup$ This. A huge part of modern Signals Intelligence (or SIGINT for short) is traffic analysis - essentially, its possible to make educated guesses based not on what your enemy is saying, but rather how much they're saying. If you're livestreaming then you're broadcasting location, numbers, even potentially what type of soldier (dependant on kit etc) - all vital intel. $\endgroup$ – Miller86 Sep 26 '17 at 7:52
10
$\begingroup$

From a crypto standpoint this is very possible. Public-key cryptography allows one machine to encrypt data but not decrypt it. This is because the key is split into two versions, one that can both decrypt and encrypt, and another that can only be used to encrypt.

The camera would record happily, splitting its output into ten second chunks, these would be encrypted against the Homebase public key and stored neatly on the SD drive and maybe uploaded at the same time. The original unencrypted chunk is then deleted.

To do this without the chunking you could research into "public key stream cipher" methods.

The only downside is that the original camera would not be able to view their own feed, if that was somehow needed?

| improve this answer | |
$\endgroup$
  • 3
    $\begingroup$ From a story perspective this also helps given it allows for "We have to steal the key from the enemy base to prove the video feeds of the guards killing civilians!" $\endgroup$ – Tom Sep 25 '17 at 16:53
  • 2
    $\begingroup$ Digital video is generally stored or transmitted as frames, so chunked by default, and I think the general term is "asymmetrical" for separate read and write keys; "public" is probably a dirty word to military information security people. $\endgroup$ – user25818 Sep 25 '17 at 17:27
  • 3
    $\begingroup$ Asymmetric encryption has another major downside: it's slow. Awfully slow. Utterly painfully slow. For this reason, real-world cryptosystems that employ asymmetric encryption or digital signatures typically restrict as much as possible the amount of data that needs to be protected with asymmetric algorithms. For example, in TLS, this is accomplished by having an asymmetric key agreement process, then using that agreed-upon, shared-secret key with a symmetric cipher to protect the bulk of the communications. $\endgroup$ – a CVn Sep 25 '17 at 18:16
  • 4
    $\begingroup$ @MichaelKjörling I think you could take that TLS process and adapt it to support what Tom is talking about. Consider a case where the video is chunked into 1 second pieces. Each second is then encrypted with AES (a symmetric encryption), with a new key each second. Then one uses an asymmetric algorithm like RSA to encrypt the key. Then you forget the AES key. Doing so ensures that the device never has access to more than 1 second of data at any point, and it's always the most recent second. $\endgroup$ – Cort Ammon Sep 26 '17 at 0:02
  • 3
    $\begingroup$ Adding to @CortAmmon's suggestion: You can also include multiple copies of the AES key, encrypted with different public keys (e.g. the forward base, high command, etc's public keys). That way various command levels can all decrypt the data, without having to share keys with each other. $\endgroup$ – Gordon Davisson Sep 26 '17 at 3:40
3
$\begingroup$

The simplest way to prevent leaks of sensitive information if an enemy captures a camera is to make sure that there's no sensitive information on the camera. The cameras would only be turned on when the officers are on a mission, and the memory cards would be copied to a computer somewhere and wiped after every mission. That way, enemies would only be able to capture footage recorded of things they could've seen with their own eyes that very same day.

Of course there would be rules as to when the cameras would be running and when they must be turned off. There's no sense in getting anything the least bit sensitive on tape, even if you don't anticipate that footage getting stolen.

As for whether to record or transmit: Depends on whether or not camera capture is more likely than transmission interception, and on how reliable the radio link is. If you can't get any signal, no sense in trying to transmit; but if you're worried about cameras with valuable footage being stolen, you don't strictly need to store anything on them at all.

| improve this answer | |
$\endgroup$
2
$\begingroup$

You do want backup memory on the camera, so that it keeps recording even if the signal is blocked, so that when the camera gets back to base later the footage can be analyzed.

The trick then is to make sure that the camera memory is write only when recording, with no overwrite or delete, and nothing can be played back on the camera itself, and when it writes to memory it uses the same heavy encryption. So if a soldier is killed and the enemy captures the camera, they can't possibly play it back.

This is also useful if things go before a judge, so that any footage of wrongdoing can't be removed, overwritten, or lost.

| improve this answer | |
$\endgroup$
1
$\begingroup$

For transmission, public-key crypto (see @Tom's answer) is the way to go. On the camera/recorders themselves, I'd suggest a combination of that and tamper-resistant hardware. (Or, more accurately, hardware that can't be tampered without destroying it.) Take a look at what iPhones have: all stored data is encrypted, and the encryption keys are kept in a tamper-resistant "secure enclave" (basically a tiny hardware security module that enforces whatever data access rules it's been programmed with.

| improve this answer | |
$\endgroup$
1
$\begingroup$

Don't forget you have to store the video after it's collected! This is actually one of the hardest parts. Video files are quite large, and with many cameras they're going to pile up fast. You're going to need a secure place to store these video files that can be quickly scaled to fit the needs of your police/military force. This is much more difficult than you might imagine.

If you need to store the footage securely, then the most secure option that still allows quick retrieval is in a server on a local intranet. Depending on how many cameras you're talking about you'll need to shovel lots of data, fast. So you're likely looking at a cluster. Clusters are expensive, and take expensive people to maintain. Also you'll have to encrypt all of these drives or the people who maintain it are going to be able to pull a drive and walk home with it.

This isn't feasible for most (the US military could certainly do so, but local police forces could not), so you might want to look at something like Amazon Web Services. They will do all the maintenance for you, but then you have to worry about it not being stored in-house, and that it has a direct internet connection.

If you're not using the files often, it might be worth it to store it all on magnetic tapes and lock it up in a warehouse. There won't be immediate access, but it's secure and cheaper than a cluster.

| improve this answer | |
$\endgroup$

Not the answer you're looking for? Browse other questions tagged or ask your own question.