Traffic Analysis

When I was a wee lad, as a freshly-minted engineer at Three Letter Security agency, they took some considerable time to teach us about Traffic Analysis. It's a technique that you can use to get lots of interesting information, by watching patterns of activity or communication.

A famous example of this happened in World War II, in the run up to the D-Day invasion. The Allies wanted to fool the Germans into thinking that the invasion would come at Calais, at the narrowest part of the English Channel. If the Germans believed that this was the invasion target, they would hold off deploying troops to Normandy, thinking the invasion was a feint.

So, how do you convince the Germans? They were pretty smart, after all. Well, you use that smartness to snooker them. George Patton, America's best general, had been cashiered for slapping a soldier. He got to play the role of CIC, First US Army Group (FUSAG). A commander needs a command, and this was provided by radios.

Armies used radio extensively to coordinate movements. Orders were sent via radio (encrypted, or coded) from FUSAG HQ to several make believe "Corps HQ" in Southeast England, whence more messages would be sent from each Corps HQ to several phantom "Division HQ", and on down the chain. A small army of radio technicians spent their days sending completely made up messages back and forth to each other.

The Germans, of course, were listening, and using the patterns of signal, reply, etc to build an org chart of Patton's Army Group. To verify that all this activity was legit, the Luftwaffe made repeated recon sorties over Kent, photographing inflated tanks and empty tent encampments which made the whole thing look real.

The attack, of course, came in Normandy, where they had been keeping things as quiet as possible. The German's sophisticated traffic analysis had led them into a blind alley.

This doesn't mean that Traffic Analysis doesn't work; on the contrary, it works very well indeed. It took an elaborate deception - including double agents - to fool the German General Staff. There's a very interesting resergence of interest in Traffic Analysis in the internet security industry, as companies like Damballa look for networks of trojan horse programs running on subverted computers. You may not know what's being said, but you see that A is talking to B.

This is all well and good, you may be asking yourself, but what does that have to do with me? As it turns out, plenty:

Anonymized data collected from GPS-enabled devices may not be as anonymous as you think, according to researchers who show that knowing someone's general home and work locations can be enough to identify an individual uniquely.

Your cell phone is ratting you out, leaving an elsectronic trail of bread crumbs that someone could use to identify not just some random Joe, but Joe Bloggs of 791 Elm Street. You don't have to be smart as a General Staff Oberstleutenant to start to fit the puzzle pieces together:

Of course, one of the two most common locations any person frequents are those of his home and work. What Golle and Partridge found is that attempts to anonymize, or obfuscate, personally identifying information may fall woefully short if a user's residence and office can be deduced.
"Obfuscation techniques which prevent re-identification based on (approximate) home location alone may not be adequate if the subject's (approximate) work location is also known," they write. "In fact, we show that home and work locations, even at a coarse resolution, are often sufficient to uniquely identify a person."
Once a subject's home and work are known, snoops can use data compiled by the US Census Bureau's LEHD, or Longitudinal Employer-Household Dynamics, program, which tracks where people live and work. Although only "privacy-preserving synthetic data" is publicly available for download, Bayesian techniques can be used to work around this limitation.

OK, bayesian math means that you do have to be as smart as an Oberstleutenant, but work with me. Data people thought was randomized was only mostly randomized, and can be reconstructed - via a heapin' plate of careful traffic analysis with a side of math - to find you.

Larry Ellison was right when he said You have no privacy; get over it.

UPDATE 15 November 2014 16:57: More on FUSAG and the effort ot fool the German Abwehr here.