Black Hat USA 2013 - OPSEC failures of spies

Matthew Cole discusses how phone and location metadata exposed a CIA team during a 2003 kidnapping operation in Milan.

By: Matthew Cole The CIA is no more technologically sophisticated than your average American, and as a result, has suffered serious and embarrassing operational failures. This is a rare peek inside the CIA's intelligence gathering operations and the stunning lack of expertise they can bring to the job. In 2005, news organizations around the world reported that an Italian court had signed arrest warrants for 26 Americans in connection with an extraordinary rendition of a Muslim cleric. At the heart of the case was the stunning lack of OPSEC the team of spies used while they surveilled and then snatched their target off the streets of Milan. The incident, known as the Italian Job inside the CIA, became an international scandal and caused global outrage. What very few people ever understood was that the CIA's top spies were laughably uneducated about cell phone technology and ignorant of the electronic fingerprints left behind. The story would be startling, though old, if not for the fact that eight years after the debacle in Milan, history repeated itself. In 2011, an entire CIA network of Lebanese informants was busted by Hezbollah. The reason: cell phone OPSEC failures. After receiving a warning from Mossad, who had lost their network a year earlier the same way, the CIA dismissed Hezbollah's ability to run analytic software on raw cell phone traffic. But they did. And with a little effort, the CIA's network of spies, as well as their own officers, were identified one by one. This is the true story of American Intelligence's Keystone Kops.