
CIA wanted a way to copy 3.5“ floppy disks ”in a covert manner“  in 2013 - re_re
https://wikileaks.org/ciav7p1/cms/page_1179686.html
======
atemerev
US nuclear C&C systems still use 8 inch floppies:
[http://time.com/4348494/pentagon-nuclear-floppy-
disks/](http://time.com/4348494/pentagon-nuclear-floppy-disks/)

So, 3.5" floppies are probably used in much more modern weapon designs.
Perhaps orbital lasers or something. /s

------
chc
This doesn't seem terribly surprising to me. There are still companies that
use them, so if you need to spy on one, a device like this would be useful.

The weirdest part is that the CIA uses agile-type user stories when developing
its spy gear.

~~~
sojsurf
In fact, this is an excellent requirements document. Clear user stories with
prioritization and notes. I also appreciate the Questions section at the
bottom.

Good requirements documents are a rare find in my experience.

~~~
dmix
Indeed, as a UX designer I would have loved having these types of requirements
when starting a project. Especially with the "Must Have"/"Nice to Have"
distinction which isn't always made clear when people are asking for an
endless list of features.

------
JoblessWonder
Just to be clear, they actually made this. Not only that, but it appears like
they had 3 different versions.[0]

[0]
[https://wikileaks.org/ciav7p1/cms/page_1179700.html](https://wikileaks.org/ciav7p1/cms/page_1179700.html)

~~~
pvitz
It is also amazing that they were using RPI and Gumstix. Looks like rapid
prototyping instead of custom miniature solutions, but if it works, why not...

------
SEJeff
CIA is doing their job spying on tech that they care about, news at 11!

SCADA systems are often very old and sit unconnected to the internet for
decades at a time. There are likely hundreds of nuclear reactors around the
world running this old, unpatched, and very vulnerable software. They'll
likely not patch it until they refurbish the entire system.

------
mgamache
On the face this seems ridiculous. It's a big stretch, but we do know that
some US adversaries use portable media (usually thumb drives) to currior data.
Maybe they had a target that was using floppies? Maybe Iran's centrifuges or
N. Korea still uses really old tech?

~~~
anc84
"Really old tech" is everywhere. For example Germany's high speed trains'
reservation system runs on floppy disks.

~~~
lb1lf
...and if you're not careful when ordering Siemens Simatic software, the
accompanying licence file arrives on a yellow 3,5" floppy.

Don't ask me how I know. It took AGES to purge our ERP system of any reference
to the Siemens item# which resulted in a floppy showing up.

On the other hand, it resulted in some business for both DHL and whoever still
manufactures floppy drives nowadays - service engineers opening a package
somewhere in the world, finding what kids today would assume was a 3d-printed
'save' icon - and order a drive, double haste...

~~~
prewett
+1 for "3d-printed 'save' icon"!

------
throwaway2016a
To me an interesting piece is the systemd / Linux references. The protocol to
talk to floppy drives is not all that complex. If battery life is a concern,
dedicated embedded code (not using Linux) seems likes a better option and not
all that much more difficult to implement.

Then again, I suppose embedded Linux keeps getting lighter / better.

That requirement strikes me as classic non-/semi-technical product owner
trying to suggest to the engineers how to do their job.

As for people using floppy disks in 2013... actually not surprised at all.
They have a little bit of security through obscurity now and they can be
easily cleared with a magnet and some scissors or open flame. And as another
poster pointed out, it might be for legacy systems like industrial control.

~~~
adrianN
I think most storage mediums are amenable to easy clearing with an open flame.

~~~
throwaway2016a
True. But some people would be surprised at what you can do to a spinning disk
hard drive before it becomes unrecoverable.

------
d--b
That seemed pretty covert to me at the time:
[http://arabuusimiehet.com/break/amiga/img/3000/3782.PNG](http://arabuusimiehet.com/break/amiga/img/3000/3782.PNG)

------
retSava
Can't understand why they even considered using compression at all. A simple
mini sd card can easily have room for 128 GB while a typical 3.5" floppy is
1.44MB. There's gonna be quite a lot of floppies to copy before that is
filled.

------
compsciphd
I don't understand why crypto doesn't help avoid detection?

Imagine I have a usb thumb drive with gigabytes of mp3s on it, and I devise a
way to embed and extract a floppy image into the mp3s (i.e. steganography), or
perhaps family pictures. unless the images are viewed before and after, it can
be difficult to determine what was stored or even if anything was stored.

Of course, not impossible as their attacks that can be done on this, but I'd
argue that if one is already suspected of using steganography and they have
access to the device you are storing the data on, you are most likely screwed
anyways, even if they can't prove it.

~~~
Retric
Steganography actually causes distortions that are noticeable. Unencripted
data often has very odd patterns, encrypted data looks unusually random.

~~~
qwerty_asdf
Probably was supposed to be steganography, since stenography is what courtroom
reporters do.

~~~
Retric
Aye, AutoCorrupt to the rescue.

------
stuaxo
If this is much quicker than ordinary floppy drives and has flash it would be
great for imaging disks from old systems, Amiga version anyone?

~~~
JdeBP
LS-120s were quicker than ordinary floppy disc drives for reading ordinary
floppy discs.

------
johansch
Are there any devices (on the public market) that allow for high-density
whole-disk imaging/scanning with one rotation of the floppy? Feels like it
could be useful for bringing "dead" floppies back to life for e.g. retro
computing enthusiasts.

Scan it once at insanely high resolution and later analyze the data...

~~~
anfractuosity
There are hardware tools like
[http://www.kryoflux.com/](http://www.kryoflux.com/) which might be of
interest, I've never used them, so can't comment on how well they'd work
afraid.

------
dmix
A 3.5" floppy copier concealed as a "day planner" and using systemd? Such
spycraft in 2013 is hilarious to think about.

Especially thinking about some random corporate/government worker who got
recruited as a source by the CIA and has 'unsupervised' access to some
floppies.

~~~
dsfyu404ed
I'm sure there's plenty of mostly non-networked industrial facilities in the
"3rd world" that use 3.5 for enough of their equipment that it's the most
convenient form of storage at the facility level.

~~~
Sgt_Apone
Hell, there's plenty of industrial equipment in the 1st world that still does.
This doesn't surprise me at all.

------
drzaiusapelord
I imagine this is to target old manufacturing or scada equipment. If you want
to sabotage an industrial target then you're going to be seeing a lot of
legacy equipment. /r/sysadmin posts from manufacturing and industrial
sysadmins are fascinating as they are scary.

Also it may reveal that the target is using old methods for security purposes.
Imagine an office where no one has any sort of user accessible networking
(ethernet would be just for updates, security, auditing, etc), just a 1980s
style set of workstations each accessing things from the floppy drive. If you
want to see a file on a certain topic then you'd walk up the librarian who
would check your ID and give you the disk. If you wanted to sneak that data
out, then you'd have to physically copy the disk or steal it. The latter being
much more risky as the librarian knows you had it last. Perhaps there's enough
empty space in the floppy case to put in some kind of tracker as well.

You also don't need to worry about USB vulnerabilities with USB sticks nor the
worry that someone will show up with the right cable, mount the USB drive to
their phone, and copy the data. Nor the write limits and versioning exploits
on writable CD media. You could also set off a EM burst that'll wipe a room
full of floppies in a millisecond if need be.

If you deal with text data files then the 3.5" space limitation is not an
issue, what's the average word file size? 80k? Imagine an intelligence service
that keeps its state secrets like this. You'd be hard pressed to hack them.
This isn't a hypothetical as we have data that suggests some intelligence
services have moved to typewriters to avoid hacking[1]. Seems to me, I'd much
rather just use 3.5" disks on a linux box with no networking attached to a
printer than a typewriter. Even spies can't live without WYSIWG editors.
Perhaps the great typewriter experiment has failed and sneakernet is a better
compromise between security and convenience.

[1]

[https://www.theguardian.com/world/2013/jul/11/russia-
reverts...](https://www.theguardian.com/world/2013/jul/11/russia-reverts-
paper-nsa-leaks)

[https://www.theguardian.com/world/2014/jul/15/germany-
typewr...](https://www.theguardian.com/world/2014/jul/15/germany-typewriters-
espionage-nsa-spying-surveillance)

edit (as it wont let me reply) in regards to exploits here:

Your attack surface has now changed from "Anastasia in accounting clicking on
resume.js" to now dragging TEMPEST equipment into the basement of the Lubyanka
building undetected.

Or a mole now trying to sneak in a bulky 3.5" copy device instead of right-
click > encrypt > email.

~~~
theamk
Typerwriters won't help. Soviets could bug them in 1976:
[https://arstechnica.com/security/2015/10/how-soviets-used-
ib...](https://arstechnica.com/security/2015/10/how-soviets-used-ibm-
selectric-keyloggers-to-spy-on-us-diplomats/) I bet that now, CIA can do it
much more stealthily.

And I also think that it is pretty hard to make these 1980's workstations
secure -- that old DOS software was full of vulnerabilities, and it has no
modern protections at all (usernames, kernel mode). I remember back at high
school we had "1980s style set of workstations each accessing things from the
floppy drive." and they were full of viruses. And once you have your code on
target computers, you can exfiltrate data pretty easily (emit right patterns
with pc speaker, memory access, display, etc..)

~~~
j3097736
All of those vulnerabilities are pretty useless unless you can get the data
out easily, the CIA solution seems better

------
captainmuon
I love that they are writing user stories like UX people do, or like cucumber
tests. _As_ the asset, _in order to_ conserve battery life, ...

------
hexscrews
Don't copy that floppy!

------
cosinetau
Does that mean going down to Fry's for a couple USB floppy drives in
sunglasses and a hat?

Because that shit cute.

