Crypto Blamed for US terrorist attack - World Exclusive

[Nick Barnes]

Note that I sent my original message on Thursday; it took a long time
to get to the list because I sent it from the wrong address.  Much
more information came to light in that interval, and continues to come
to light.

At 2001-09-16 22:22:02+0000, Dave Bird writes:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> In article <97673.1000375321@thrush.ravenbrook.com>, Nick Barnes
> <Nick.Barnes@pobox.com> writes
> >At 2001-09-12 16:23:19+0000, "Owen Lewis" writes:
> >
> >> The acts yesterday in NY, Washington and near Pittsburgh were purposefully
> >> designed to kill very large numbers of people. The final death toll may
> >> never be known with certainty but there is already reason to suppose that it
> >> will not be less then 50,000.
> >
> >This is a considerable overestimate; the true figure seems likely to
> >be between 5K and 10K.  Even on Tuesday there weren't any level-headed
> >estimates higher than 20K.  I believe that the official unofficial
> >estimate of the WTC toll is now 5-6K.
> >
> >> Perhaps only those with experience of military operations will fully
> >> appreciate the level of planning, discipline, expertise, coordination and
> >> self-sacrifice required to conduct yesterday's operation so successfully. It
> >> was a carefully organised and well run operation designed as an act of war.
>> It is reasonable to assume that one or more 'terrorist' groups were involved
> >> in the implementation of the plan but it is improbable that such a plan
> >> could be brought to fruition without the knowledge of it and connivance in
> >> it by some state's government.
> >
> >I see no evidence of this whatsoever.  There seem to have been between
> >10 and 20 hijackers actually on the planes (3-5 on each: the reports
> >from the Pennsylvania flight strongly indicate 3).  Given the total
> >lack of prior intelligence, it seems more likely to me that this was a
> >mid-sized terrorist group, with no more than 500 active members.
> 
>  I heard media reports of 18, two teams of four and two of five. I would
>  think not more than 35 or 40 were involved in support roles (apart from
>  anything else how could you keep it secure?) though a lot of money 
>  would be involved.

Maybe 100 people involved in this operation, suggesting a somewhat
larger organisation.  Consider the IRA: any given bombing operation
involved no more than a dozen or so people, but an organisation of a
dozen people could not have carried out IRA operations.

My size estimate is limited above by the question of how large an
organisation could have been involved for the several years of
preparation without prior intelligence being available.

Some interesting articles in the Sunday press about the way in which
al-Qaeda operates: for the most part it's a training organisation;
operations blamed upon it may have been carried out by people who have
been trained there but not under subsequent instruction from bin Laden
or his staff.

> >Undoubtedly using crypto to communicate, FWIW.
> 
>  I'm puzzled: almost certainly to co-ordinate such a thing requires
>  voice contact, and voice crypto is still rare so it would stand out
>  like a sore thumb.

Yes, most of the coordination was likely done face-to-face.  However,
I would be surprised if any covert organisation of such a size and
scope uses _no_ crypto (or at least crypto-related technology:
steganography, chaffing/winnowing, etc).  Plans change, and changes
have to be communicated swiftly, accurately, and securely around the
world.  Crypto is good for that; that's why it was invented.  It is
easily and securely done from internet cafés in Peshawar, El Obeid,
Hamburg, Pyongyang, Stamford Hill, etc etc.  It's a good solution to
the problem, and whoever did this is plainly clever enough to know
that.

> Nothing as obvious as sending PGP email from A to B.

I agree.

[snip]

> >I cannot imagine any government anywhere conniving at this.  Iraq?
> >Libya?  North Korea?  Surely even the Taleban are not so foolish.
> 
>  Iraq, Iran, Libya because they feel they have been directly attacked.
>  Syria over Israel.  The Taliban to make themselves look big, though
>  less likely because they are an inward-looking group.  I fear they
>  may have concealed the transfer of funds rather carefully.

I understand why someone might have done it; I hope that the
governments of all these countries are smart enough to understand why
to avoidf it.  Given that acts like this seem to be possible without
the involvement of a state, why should we suppose that a state was
involved?

Nick Barnes