<nettime> Wikileaks release: "Scribbles"--the CIA's secret system to track leakers

[Geert Lovink <geert@xs4all.nl>]

   From: "WikiLeaks / Sunshine Press" <sunshinepress@this.is>

   On 28 April 2017 WikiLeaks published the documentation and full source
   code for CIA's classified "Scribbles" system--a document watermarking
   and tracking project designed to embed invisible "beacons" into CIA
   documents that may be copied by leakers. The beacons are designed to
   covertly report back to the CIA when the documents are opened, for
   example, after transmission to a journalist. The released version (v1.0
   RC1) is dated March, 1st 2016 and classified "SECRET//ORCON/NOFORN"
   until 2066.

   Scribbles is intended for off-line preprocessing of Microsoft Office
   documents. For reasons of operational security the user guide demands
   that "[t]he Scribbles executable, parameter files, receipts and log
   files should not be installed on a target machine, nor left in a
   location where it might be collected by an adversary."

   WikiLeaks editor Julian Assange stated "The CIA's 'Snowden Stopper'--a
   serious threat to source protection--is no more. That's good, because
   the CIA is one of the world's most dangerously incompetent agencies and
   it needs close monitoring by investigative journalists. The CIA has not
   only lost control of its entire cyber arsenal of viruses, it is
   directly implicated in the human rights catastrophe's of Iraq, Libya
   and Syria, the rise of ISIS and the European refugee crisis (which has
   led to the destabilisation of Europe and increased terrorism) as well
   as the installation numerous dictatorships leading to
   counter-productive outcomes such as the conflict with Iran."

   According to the documentation, "the Scribbles document watermarking
   tool has been successfully tested on [...] Microsoft Office 2013 (on
   Windows 8.1 x64), documents from Office versions 97-2016 (Office 95
   documents will not work!) [and d]ocuments that are not be locked forms,
   encrypted, or password-protected". But this limitation to Microsoft
   Office documents seems to create problems: "If the targeted end-user
   opens them up in a different application, such as OpenOffice or
   LibreOffice, the watermark images and URLs may be visible to the
   end-user. For this reason, always make sure that the host names and URL
   components are logically consistent with the original content. If you
   are concerned that the targeted end-user may open these documents in a
   non-Microsoft Office application, please take some test documents and
   evaluate them in the likely application before deploying them."

   Security researches and forensic experts will find more detailed
   information on how watermarks are applied to documents in the source
   code, which is included in this publication as a zipped archive.

   https://wikileaks.org/vault7/?scribbles#scribbles


#  distributed via <nettime>: no commercial use without permission
#  <nettime>  is a moderated mailing list for net criticism,
#  collaborative text filtering and cultural politics of the nets
#  more info: http://mx.kein.org/mailman/listinfo/nettime-l
#  archive: http://www.nettime.org contact: nettime@kein.org
#  @nettime_bot tweets mail w/ sender unless #ANON is in Subject: