Cryptography Reference
In-Depth Information
The evaluation of this type of information is referred to as
traffic analysis
.
The article by Schwartz and Wood, (on our Web site
www.wileyeurope.com/
go/cryptology
) is very illuminating in this respect (see also the end of Section
7.1.3). This article was written in 1992 when the Internet was 'small'. The
authors collected data crossing 15 mail nodes over a period of two months.
At the end, they had about 1.2 million emails of about 50 000 users on 17 000
computers in 31 countries. The significant growth of information happened in
the first few days; the daily information yield then dropped by a factor of 10.
Based on their analysis, the authors could clearly make out single groups of
interest without previously having searched for specific topics. Also, it didn't
matter if one email user belonged to several such groups.
The remarkable thing about this analysis is that Schwartz and Wood weren't
interested in the email contents at all; they only acquired who mailed to whom
how often.
You might think: 'So what, let the NSA know who I converse with!' Unfortu-
nately, things are not that harmless. I will show this in another example.
There were once 'eternal phone cards' that reloaded themselves after use. Early
in 1997, a case reported in Dresden had it that three users of such cards were
busted while still in the phone booth. Of course, nobody would tell us how the
trap the three fell into worked. But this example shows that card phones must
be somehow online-connected to some center. It is also known that each phone
card has a unique serial number, and that this number is reported to a center
(together with all connection data) upon each call.
From the purely technical point of view, we have to assume that the owner of
a phone card, though initially anonymous, can be identified perhaps after 20
or fewer calls made with this card thanks to his calling structure, at least in
theory. This also means that he can be allocated to calls he conducted earlier.
If this type of information harvesting does actually take place (I'm afraid it
does), then it will certainly not become public in the next ten years.
More speculation: owners of cell phones tell their networks pretty good move-
ment patterns, and the data acquired are forwarded to the center at intervals
of about 10 to 15 minutes. Theoretically, cell phones would even allow some-
body to do a highly precise radio position finding, though it appears to be too
expensive yet, at least for the network operators. However, based on the rough
radio cells, it is often possible to clearly determine when you have used which
railway route or highway. Together with other information about you, this can
produce your travel destination or the length of your trip.
