🚀 go-pugleaf

In <hmiller.724028396@lucpul.it.luc.edu> hmiller@lucpul.it.luc.edu (Hugh Miller) writes:

>>>    Other interesting note.  He spoke with the FBI  about the matter and
>>>    they indicated that they have also run into PGP. Once case involving
>>>    espionage.

>>In hindsight, I guess this is quite obvious.

>>If he sticks to PGP, which is in relatively widespread use, what's on his
>>laptop is much less incriminating than if he had a custom encrypt/decrypt
>>application.

>    I do not find this story obvious at all.  Unless we are talking about
>Burkina Fasso or Sudan, I doubt that any country would trust its diplomatic or
>intelligence traffic to a product like PGP.  Real intelligence and diplomatic
>services have had practically secure computer crypto for quite a while now.
>If most American corporations won't let their employees use software that
>hasn't been vetted by the folks in their MIS department, I can't imagine that
>an intelligence agent of a decent government would be permitted to wing it
>with PGP.

>    It would not be above some folks at State or the FBI to circulate such a
>rumor.  Absent any specifics, which you are not going to get, consider this
>story nothing but the usual _desinformatsiya_.

>    _Industrial_ espionage, now -- that's a real possibility.

It's important for a spy to not be obvious. A custom crypto program is more
obvious than one in "widespread" use. Mailing to boris@kremvax.Xussr is more
obvious than posting GIFs (as someone else suggested). You didn't comment on
this aspect. For a fictitious example, The Cardinal of the Kremlin disguised
his messages as diary entries. That way he could plausibly deny that they
were anything more than diary entries.

We (readers of sci.crypt) have a belief that PGP is secure because we believe
that very large numbers are "impossible" to factor, and that IDEA is difficult
to break given frequent key changes. Perhaps the NSA and its counterparts have
reached the same conclusions. In that case, it would be quite reasonable to
have lower level spies (perhaps only industrial ones as you suggest) use PGP.

I'm not really a student of bureaucracy but I'll suggest that Not Invented
Here would be a bigger obstacle keeping an agency from adopting PGP than any
weaknesses in it. There is a general consensus that real spooks disparage the
use of factoring based cryptosystems, but perhaps *that* is disinformation.