labOPSEC. What leaves an investigator's machine
A request to a source tells it the subject of interest. The security of an investigation begins with an account of who learns what with every action.
OPSEC is operations security: an order of work under which an adversary does not learn more from your actions than you are prepared to give away.
In an open-source investigation the adversary is not necessarily the subject of the investigation. It may also be the data provider, the hosting provider, the network, and anyone who reads request logs.
The main rule: a request names the subject of interest. The owner of a public registry sees which company was searched for, when, and from which address. That is enough for an outsider to learn what the investigation is working on, even if nobody has seen its conclusions.
What leaves with every action
- A request to a source. A name, an address, an identifier — everything typed into a search stays with whoever answers. A series of requests reveals the area and the subject of the work.
- A map tile request. The request names a square of the earth and a zoom level. A series of tiles shows the area that was examined.
- A request to a model. The text of the investigation goes in full to the model provider. That is more than a square of a map or a search string.
- A key. An access key to a source ties all requests into one history and binds it to an account.
- A network address. It shows the time, the place and the regularity of the work.
Order of work
- Nothing is enabled by default. Every outside source is enabled separately, per investigation, and at the moment of enabling the consequence is named: what exactly leaves.
- The data stays on the machine. Records, documents and the state of verification are stored locally. Only what was enabled leaves.
- A cache instead of a repeat. The same question is not put to a provider twice. A repeated request is a repeated report of the subject of interest.
- A narrow window. The depth and the period of a request are chosen for the task. A wide request made "just in case" tells the provider more and returns noise.
- Your own node where possible. A data source of your own reports the subject of interest to nobody.
- Keys reach neither the browser nor the log. They live in an environment file, stay out of the repository and are not printed.
- A service without authentication listens only to its own machine. Exposed on a network address, it hands the list of addresses that were looked up to anyone who opens the page.
What the order of work gives
- Less for the providers to learn. A correct order of work reduces what each provider learns about the subject of the investigation.
- A closed file. A file handed to someone else is closed with a passphrase, and only the person who was told it can read the file.
- A decision before the work. Whom we defend against and what we are prepared to pay for it is decided in advance, and the order of work is derived from that decision.
What goes into the report
For every outside source that was used, the report names who it is, what it received and when. The reader of a report has the right to know which part of the investigation is known to third parties.