Can the NSA Really Track You Through Power Lines? 109
mask.of.sanity writes Forensics and industry experts have cast doubt on an alleged National Security Agency capability to locate whistle blowers appearing in televised interviews based on how the captured background hum of electrical devices affects energy grids. Divining information from electrified wires is a known technique: Network Frequency Analysis (ENF) is used to prove video and audio streams have not been tampered with, but experts weren't sure if the technology could be used to locate individuals.
Interessting in any case (Score:5, Interesting)
While I also doubt that this is possible today, I am sure the NSA is looking at placing the respective sensors. Then we will have to do "analog routing" and mix in mains hum form several places to obscure where and when things have been recorded. Maybe we should start to offer recordings of local grid noise. Would not be that difficult to do.
Well, fighting fascism is difficult. But there really is no alternative for anybody with at least a shred of noncompromised personal ethics. The price of doing nothing is just way to extreme.
Re:Interessting in any case (Score:4, Funny)
Re: (Score:2)
Re:Interessting in any case (Score:5, Insightful)
While the article, you, and i'm sure more to come keep mentioning the need to "place senors" the reality is any Utility company worth it's salt already has this data logged as part of normal operations through SCADA/DCS systems.
This systems monitor (and log) so many different variables that it forces the companies to store everything in databases for reference & analysis. When it comes to power generation nearly all power generation is done by a "utility" company all of which are heavy government regulated. In a lot of areas it is actually the government which determines bill rates and adjustments to generation capacities (or at least responsible for the play book the operators work by).
It would be far easier and less far fetched to believe that the NSA would have access to theses logs/DBs for what ever use they wanted. Especially with most major power generation sites being covered under FERC regulations and several of the regulation requirements for Reliability requires operators to track and monitor this exact data that the NSA would need.
And trust me when i say that these sites log everything and keep it incase of an Audit. The consequences for failing to be able to provide the data in case of an Audit or Incident Investigation is worse (for the company) than just about any incident would be. They log it, they keep it, even if they will will never look at it again, because the government might come asking for it (and they will give it when asked with no questions as they are required to by regulations).
Honestly going this route i'd say compared to the wiretapping network the NSA has put together, this would be trivial for them to do (not cheap or quick, just not all that difficult).
Re: (Score:3)
Consulted for the industry.
They already feed the data (substation instantaneous V and phase for each leg) to the dispatch floor data centers, the plant owners data centers, the transmission area control floor (if different from the dispatch floor), the 'Independent System Operator' data centers. Maybe all the same entities in neighboring regions.
One thing Electric utilities don't generally lack (ETSA not withstanding...EDS supplied their office network.) is bandwidth.
Re: (Score:2)
I would think analog to be better for this than digital that gets run through filters before the data gets saved to disk as a single frame(analog being continuous feed giving them more to work with within a single frame.
telephone codecs etc would also just filter this out.
and hey, this doesn't really help one bit to catch some guy sitting inside a cave running their own generator. or someone who just runs it through some filters to improve quality.
though, that being said, I have no doubt that there's a few
Re: (Score:2)
I don't doubt they have data. I just doubt they have the precision required and the clock-sync required that the NSA needs for precise targeting. Also, the respective literature goes into looking at disturbances as well (large AC starting, that kind of thing) and these may not even be visible at the utility-end, as the net has very low impedance there. I also expect that the NSA wants real-time capability as they will want to vector in drone strikes.
But yes, for very rough after-the-fact localization, the d
Re: (Score:2)
GPS chips are pretty much everywhere and would provide an extremely accurate time reference, this could allow locations to be infered from power line conditions. Knowing this is at least plausable, counter-measures would be vary from trivial to very complicated, one could even record conditions at one location and inject them into a video recorded in a different country.
Re: (Score:2)
That would work if the NSA would be hacking devices anywhere. They do not do that. Not because of any ethical concerns or because they cannot, but in order to protect their tools and methods. Whenever they hack something, they risk losing the vulnerability used. As vulnerabilities are expensive and not in unlimited supply, they cannot use them for minor things such as a sensor point somewhere.
Re: (Score:2)
Wow, your UPS has an upgraded version of Sark's Carrier? It must be fucking huge!
Re:Interessting in any case (Score:5, Insightful)
It's not even that complicated.
Many power lines have optical fiber strung in the middle of them, it's called optical power ground wire (OPGW) [thefoa.org] (scroll down a bit). That fiber is used as Internet backbone, as telecom voice, and as diagnostic for when there are power grid problems. If a line goes down then they can use an OTDR to determine the distance to the break instead of having to hunt for it.
All that they'd have to do would be to put devices at termination points and use dark strands. Sure, the equipment to transceive on single-mode fiber at those distances would be pricey, but it's completely within the technology that we have right now.
Re: (Score:2)
Re:Interessting in any case (Score:4, Informative)
A city gets basic energy saving with a lot of optional extras to contain any freedom of assembly and association.
Voice as in mic, voice stress, gait, wifi and everything a camera offers over every road or public area.
Fun with wifi funds? 'SPD will shut off its new Wi-Fi after privacy backlash" (November 15, 2013)
http://seattletimes.com/html/l... [seattletimes.com]
CIA Chief: We’ll Spy on You Through Your Dishwasher (03.15.12) for the next generation of basic consumer appliances.
http://www.wired.com/2012/03/p... [wired.com]
Add in a smart meter https://en.wikipedia.org/wiki/... [wikipedia.org] with a rapid communications setting.
Then you have your tame game console with "webcam" from bands who love to help all govs over all product lines.
As for Network Frequency Analysis, it sounds like something others have hinted at from the TEMPEST generations. https://en.wikipedia.org/wiki/... [wikipedia.org]
Re: (Score:2)
Big Brother is watching: Fears over 'homeland security' streetlights that can record your conversations and track your movements (28 October 2011)
http://www.dailymail.co.uk/new... [dailymail.co.uk]
Re:Interessting in any case (Score:5, Interesting)
Smart TVs are almost certainly involved and if they aren't already, soon will be.
Gullible people seem quite happy to install TVs with inbuit cameras and microphones in their living rooms and connect them to the Internet. What could possibly go wrong?
Re: (Score:2)
Re: (Score:3)
I read something about this - quite a long time ago. Two years, maybe even three? Can't really recall now.
It wasn't JUST the humming of the power grid that was being used, as I recall.
Anyway - how hard would it be to force a generating plant to INTRODUCE a unique identifier, if one didn't exist already?
Re:Interessting in any case (Score:5, Interesting)
Inserting a localizer signal using ultra-wide band would be very, very simple. These are basically very brief spike signals at "random" times that you cannot measure unless you know the cryptographically generated sequence in advance. They look like low-level noise to most equipment. But as soon as you know the sequence and look for it, they become glaringly obvious.
So maybe "inserting the sensors" is the wrong idea and "inserting the UWB localizer beacons" is more what they will be doing.
Re: (Score:2)
The police have used the technique to prove the authenticity of recordings or the time when they were created before. In one case the defendants claimed that the police had stitched together separate recordings to make them sound incriminating, but they used this technique to show that they were in fact continuous.
Faking it would certainly be possible. Masking it should be possible too, with a single 50Hz signal generator and power amplifier.
One huge flaw in this technique is that it assumed that the record
Re: (Score:2)
GPS chips provide a pretty solid time signal.
Re: (Score:1)
That seems more difficult than just applying a sharp notch filter at 60Hz, then adding in some random noise over that band.
Re: (Score:2)
While I also doubt that this is possible today, I am sure the NSA is looking at placing the respective sensors.
The NSA almost certainly have placed sensors, either just a few to test the principle, or completed their deployment many years ago.
And whether it's effective or not: classified, probably
On the other hand... if it is effective... I am sure the NSA would like the world to think it is ineffective, which is easily accomplished using propaganda and some nudges to the media.
Therefore... I think
Not likely in modern communications (Score:5, Informative)
Due to the amount of signal processing that goes on with modern television, its highly unlikely. MPEG compression probably stops it at the source since its instantly fuddled with and massive amounts of the data they use is lost right then and there.
If you were actually afraid of the NSA finding you, as a whistle blower, getting around this form of tracing is trivial.
Use a UPS for power, unplugged from the power grid. No power line tracking.
Or the more old school way that people have done for a while, record it and leave before broadcasting it. Locating the source of the recording doesn't mean much if the target is already 800 miles away.
Re: (Score:3)
Just don't use your mom's basement or rent a recording studio that keeps logs on who was there and when, or else you will still get popped.
A generator, tarp for a back drop, and a semi- isolated spot in the middle of nowhere (like 800 miles away as you suggest) should be good. Leave your work cell phone and re
Re: (Score:2)
Due to the amount of signal processing that goes on with modern television, its highly unlikely. MPEG compression probably stops it at the source since its instantly fuddled with and massive amounts of the data they use is lost right then and there.
It might, but you can't really be too sure that there isn't enough data surviving; MPEG compression was never designed as a feature for ensuring privacy, and there will still be human-imperceptible recorded noise.... or, maybe intentional "canary" noise signa
Re: (Score:2)
Imperceptible but recorded visual noise from the background lighting in the room and orientation of cosmic background radiation noise alone may be revealing.
Also, simulating the universe from the big-bang will reveal your location.
Re: (Score:2)
And if they record to a VHS tape, I might be concerned. Once it hits the MPEG encoder, not so much. The entire point of MPEG is to throw out as much data as possible if it isn't perceptible by humans and recreate it as something that is much smaller but looks the same to human senses.
MPEG is perceptual encoding. The imperceptible would be lost by design, not because they were trying to ensure privacy but simply as a side effect of the design.
Yes, they could easily design cameras that could use stenograph
Re: (Score:2)
look at the reconstruction of that lander video. from nothing to understandable things. i wouldn't be that sure nothing can be obtained
Sounds Plausible (Score:1)
The skeptics are creating a straw man by framing the issue as whether the NSA could do it reliably, consistently, and at all locations. And then tear it down by saying it's too far fetched. Well, d'uh. But that's the typical response for anybody who doesn't actually study and understand how attacks work in real-life, and how you leverage multiple pieces of evidence to zero in on an answer.
The supposed informer said that they could do it even faster if the informant was taped at a known location (that is, on
Re: Sounds Plausible (Score:2, Interesting)
To the paranoid, this sounds like a cover. When the magician says he can pull a rabbit out of your ear with his right hand, look to his left hand; when the NSA says/leaks that they can locate you by electric hum, they probably found an easier shortcut (something embedded in the camera?) and want you to go looking elsewhere so you don't find it. Remember, the NSA claims magic but practices sidechannel attacks that make it look like they know magic.
Well, sort of. (Score:2, Informative)
Tracking someone through landlines has been a Thing for many years now. Ever hear of a "lock and trace"? You can SORT OF do the same thing for power, by embedding a signal in a given substation. It's nontrivial, and it's horribly complicated, but it IS feasable. As for the "hum" thing, that's just standard TEMPEST, been a Thing now for going on thirty years, where you can fingerprint electronics via EM signatures and you can read those EM signatures via physical phenomena including audio hums and induce
Re: (Score:1)
If someone has not yet called bullshit, allow me.
Re: (Score:3, Insightful)
You can SORT OF do the same thing for power, by embedding a signal in a given substation.
So, I came here to ask, "Why is this on Slashdot? Don't we all realize that isn't possible?"
Then I came here and saw this, and that it was moderated up. Oh well.
Re:Well, sort of. (Score:5, Interesting)
Tracking someone through landlines has been a Thing for many years now. Ever hear of a "lock and trace"? You can SORT OF do the same thing for power, by embedding a signal in a given substation. It's nontrivial, and it's horribly complicated, but it IS feasable. As for the "hum" thing, that's just standard TEMPEST, been a Thing now for going on thirty years, where you can fingerprint electronics via EM signatures and you can read those EM signatures via physical phenomena including audio hums and induced currents in surrounding circuits. This is why the LASER mike was actually developed, not for actual sounds (standard shotgun mikes do wonders there, because the glass reresonates sound just fine), but to get a good frequency signature on TEMPEST EM leakage. So, in sum, they're not specifically taking a van out and following lines to see what location an interviewee is at, but a lot of that is that they don't really need to because they can get all the information they need through older technologies that approximate the capabilities
HUGE problem with this theory.
The power grid operates on incredibly tight tolerances with regard to frequency. Additionally, within that margin (which is the same, everywhere, within a certain grid...and by grid, I mean, like "The United States" or "Great Britain") there is a small degree of variation that is the same for that grid and all that are built using the same equipment...which is a significantly humongous population.
Imagine a metropolitan area like, say, San Antonio. San Antonio has several power stations that service its region. Each generation turbine produces what's known as "three-phase power," which is kind of like TDMA for AC electricity. Those three phases get broken out and separated into three outputs that then go into a substation and transformers, then out on the grid. The three phases equally and perfectly distribute around the 360-degree rotation of the "exciter," which is basically the generator's key component. If that distribution gets out of whack, power spikes in a really nasty way, and copper vaporizes fast enough that it's actually a detonation.
But I digress. The point is this: AC power is a waveform, oscillating at 60 Hz. It cannot vary much at all...because within the same grid, everything is interconnected. Every generator is in sync, or has a syncrophasor to re-sync the power coming from it before it hits the grid. Otherwise, you get some power from A and some from B, with waveforms that are out of sync...and the frequency changes in both rate and amplitude, and shit blows up. (Including generators themselves...the "Aurora Vulnerability" that DoE is so batshit scared of is essentially a manifestation of this at the generator itself.)
So...I've been trying to think of how there could possibly be enough variation to fingerprint someone based on the hum caused by that 60Hz frequency noise. I've been in transmission control centers where they monitor, regulate and occasionally wet themselves over frequency shifts, and I've seen that the amount of variation needed to cause sheer panic is shockingly low..and it rarely ever happens for even a second. And those tolerances have been the same everywhere I've gone.
So no, it's not at all like TEMPEST. Because if it were, it'd be the equivalent of being able to figure which monitor you were looking at by EM emissions...when all the monitors in the country show the exact same thing.
Re: (Score:2)
Sure, the fundamental won't tell you much. There's a lot of other crap on the power lines though, and that might give you a signature of the location.
Re: (Score:2)
The other crap in the lines is noise. It's insane to imagine that you could reliably extract any reliable information from it.
Re: (Score:2)
Noise? Or the encrypted output of a signal generator? Prove it.
Spend some time in a DMS operations center of a power company. They watch for noise too...noise is variation in that waveform, and a sign that something somewhere (a transformer, for example) is in distress. A power company would notice noise on their lines like the phone company would notice Rick Astley playing instead of a dial tone on their landlines.
Re: (Score:3)
It may be just noise, but is it different noise between different power lines (and if so, consistently different)? If so, it's a fingerprint. Noise can be information if you're looking for a specific kind of noise. Not all noise is identical, and if you can fingerprint that noise, you can use it to determined the source.
Granted, that's a pretty big "if". I have no idea if powerline noise is consistent enough to be fingerprinted, different enough for a useful comparison, or strong enough to be picked up by
Re: (Score:2)
HUGE problem with this theory.
The power grid operates on incredibly tight tolerances with regard to frequency...
FTA: "It found fundamental differences in the structure of the harmonics of the 50 Hz which could be detected because Total Harmonic Distortion was strongly affected by local factors and had as a result little geographical consistency."
Not that any of this is likely to matter. Even if they had a unique spectrum capture of a specific location at a specific time for comparison purposes, turning one computer on, (or off), would totally change the harmonic signature appearing on the local wiring, thereby making
Re:Well, sort of. (Score:4, Interesting)
There's also the off-peak hot water signals that are modulated on the line (at around 1kHz) in some places. Those signals are generated at the local substation. Their purpose is to activate various hot-water systems to load balance the area's power use. Where the final goal is to minimise the peak usage during 'peak' periods of use.
It is conceivable that if an 'interview' is made when that type of noise appears on the line, and that an accurate time reference is available, it may be possible to use this to narrow down the search region.
Still not going to pin-point a location, but could definitely narrow it down far better than just using the 60Hz line frequency. Which is far too narrow band to provide any useful information beyond what country you're in.
Re: (Score:3)
But I digress. The point is this: AC power is a waveform, oscillating at 60 Hz. It cannot vary much at all...because within the same grid, everything is interconnected. Every generator is in sync, or has a syncrophasor to re-sync the power coming from it before it hits the grid. Otherwise, you get some power from A and some from B, with waveforms that are out of sync...and the frequency changes in both rate and amplitude, and shit blows up.
You may wish to engage in a quick review of:
And numerous other examples of various subcarriers being successfully overlaid on the 50/60Hz power waveform. When used for data transmission, BPL technologies (while commonly deployed in short-range scenarios due to EMI problems), can deliver hundreds of megabits, up to multiple gigabits of bandwidth over tens of KMs - this was deployed and trialled for wide-coverage broadband deliver
Re: (Score:2)
That Laser story of your parent is nonsense ofc.
You are right that the whole grid is synched at 50Hz/60Hz.
Nevertheless it is fluctuating locally +/- 1Hz as soon as a heavy demand (or simply high inductive) consumer gets switched on or switched off.
Re: (Score:2)
Interesting story: I once took a plug-in alarm clock to Europe. My first day there, I used it with a plug adapter. I overslept the next morning, and soon realized that the clock was running slow by several hours per day! Apparently its entire timing mechanism was based on the 60Hz of the grid, and where I was the frequency was 50Hz, so the clock ran slow by exactly that proportion.
Re: (Score:3)
I've been in transmission control centers where they monitor, regulate and occasionally wet themselves over frequency shifts, and I've seen that the amount of variation needed to cause sheer panic is shockingly low..and it rarely ever happens for even a second.
You answered your own question. There are tiny variations at the local substation level, fractions of 1Hz and fractions of a volt. All that is monitored and recorded, second by second. The pattern of tiny variations over time, small as they might be, can be picked out of the mains hum on the recording and matched up to the data on file. Maybe not in real-time yet, but certainly after the fact.
Re: (Score:2)
I've been trying to think of how there could possibly be enough variation to fingerprint someone based on the hum caused by that 60Hz frequency noise. I've been in transmission control centers where they monitor, regulate and occasionally wet themselves over frequency shifts, and I've seen that the amount of variation needed to cause sheer panic is shockingly low..and it rarely ever happens for even a second. And those tolerances have been the same everywhere I've gone.
The frequency is synchronized across t
Re: (Score:2)
Powerline Electricity has a wavelength of 6000 Km, which means that it's highly likely that even without loads connected to the grid, the constructive and destructive interferences of the different generators which is very likely to be analysable to produce a geographic area within a knowable error radius. Start adding in unique charecteristics like dead-spots in the generator's comutators, odd harmonics caused by the unique differences in how the stators are wound and even the number of stators used, and w
Re: (Score:2)
Wow, lots of flapping e-peens here. Please note I specificaly mentioned at the SUBSTATION for a reason. Anyone that thinks that a substation has anything at all to do with generation, please go away: while there CAN be generators at substations, if one's in use at the substation, the chances of there being enough current to do a TV interview anywhere within the substation's reach are vanishingly small, they typically call times when substation generators are active "brownouts". One of the bits of equipmen
Needn't be done on the power company's premisis. (Score:2)
How hard would it be to send signals from the power plant or substations across different parts of the grid creating a signature that could be detected in recorded hums?
It wouldn't have to come from the substations. It could be injected at any power feed (though the higher-capacity feed the better). B-b
It might also drive the power company nuts - especially if it was close to the line frequency, because that would look like a large and rapidly varying power factor.
Re: (Score:3)
Or I could be talking out of my ass.
As long as there's no hum signature, you should be okay.
I doubt it (Score:2)
Lossy digital compression and processing filter this out. This is especially true on consumer electronics used today. If people were still using all analog AC powered equipment, maybe.
Re: (Score:2)
Lossy digital compression and processing filter this out. This is especially true on consumer electronics used today.
In theory. There's no such thing as a perfect filter, though.
You're not guaranteed that lossy compression render the signals completely unusable for the purpose investigators would be interested in.
Theories one way or the other are pointless, until people start looking with the best analysis tools to see if videos usually contain such signals in some form or another or not.
I mean....
Re: (Score:2)
The electric noise would only be useful for a very rough approximation of where someone is located and largely depend on interference on the grid. At best you may find the county or town where someone is located, but it won't necessarily be conclusive since it's important to also match that to the correct time slot.
The noise brought in as location information in CSI etc. is often depending on more distinct noises that are well-known. A subway station has one set of specific noises, a harbor has a different
Re: (Score:2)
The way I've seen the DEA track down grow-ops, is to use a helicopter outfitted with FLIR and fly over neighborhoods at night. The houses with decent sized grow operations lit up 'like a Christmas tree' compared to other houses around them. The heat from the lights would transfer through the windows, and exhaust vents of the house.
The other method that I've heard is that people with very high power usage or big power fluctuations at set times per day get flagged for further scrutiny. They basically use i
doubtful (Score:2)
They would have to have data recorded 24/7 about load distribution throughout the entire country. And if the person leaves the country to rendezvous with a reporter? Are they recording the electrical loads in Mexico? Brazil? Poland?
Perhaps they are monitoring EMF using receivers around the country, recording them and using triangulation. But how does this help them? If I blow the whistle to a reporter I am not doing it in my home town. Most people would go somewhere else to a neutral location. So then the t
Sounds like fiction (Score:2)
Almost no-tech method (Score:2)
Misread that (Score:2)
used to prove video and audio screams have not been tampered with
I thought this was going to something involving power lines, clamps and testicles. Never mind.
What about if they inject signal? (Score:2)
Re: (Score:1)
Re: (Score:2)
A hum list from firms based in say Brazil, South Africa, Spain, Italy, Germany, Japan, Russia i.e. exports that that find a new role in another part of the world.
Whats working, how many are running, how many shifts, what the power needs are. Look for staff who might want/need cash....
Re: (Score:2)
http://en.wikipedia.org/wiki/L... [wikipedia.org]
http://en.wikipedia.org/wiki/Z... [wikipedia.org]
A few nations use that. If tame staff let you can dial in tiny changes and know what your looking for?
Information collection via power lines from PC's (Score:1)
Re: (Score:2)
Add to it the arcing that occurs from bad insulators on the grid - sometimes they cause a lot of RFI - and they are local. Just go out and listen to a high voltage power line when the weather is humid - there's usually a buzzing on the line caused by surface currents on the insulators.
Being wrong doesn't mean the NSA doesn't believe (Score:1)
Many times in business and ever more often in government circles the belief that something works is more important than the truth. The truth normally being ... seriously, what ever made you think that might work? Did you skip all of physics? The truth is most likely that some NDA droid convinced some useless government drone that this might work. Said drone then told his, laughably called such, superiors and they increased the possible results from slim to 99% certain. Typical up scaling of the results by m
lol (Score:2)
Ok, a few years ago I would have also said it was impossible. But now that I know the lengths they'll go to for information that's not even helpful to them... Give me a unlimited budget and complete legal immunity? Yea, I could do it. It would be pretty unconventional, and break tons of laws, but I bet I could get it to work.
I think my first wild guess would be, start buying up power transformer producers. I bet there's only a few in the world. Figure out how to make that hum unique in a way most people wou
Better idea (Score:1)
Modulate the power frequency in a cycling and distinguishable patters, different 'sections' and the number and size determine resolution, and .. wait until they match.
Isn't this already used? Seems natural. Or some variation of this.
Re:Better idea (50Hz timing detected in cell?) (Score:1)
Oh, would anyone happen to know the cell encoding .. if it somehow communicates the timing of such built in, or a time code when last detected..?
Perhaps such is already implemented and see-able in the deep code.
Re: (Score:2)
Some recording studios have done this to clean up their power.
Why wouldn't they just run DC?
Easily countered in any case (Score:2)
All this weird stuff relies on the subject being unaware of it.
Not location but time (Score:2)
I think I saw this on the Discovery channel a couple of years ago.
An AC grid does not keep perfect time. It will vary by a few hundredths of a HZ when certain things happen, like increased load during commercials, dropped load as people go to work and even when wind speed suddenly increases making the wind turbines contribute more.
All these things make a unique time signature for that mains hum on any given power grid. If you have a nationwide grid, as found in most developed countries, this is the same
Chrono-location via mains hum (Score:2)
There was BBC story [bbc.co.uk] a couple of years ago about the Met police in London recording the frequency of UK mains so that they can analyse the mains hum from recordings and compare the fingerprint against their records to accurately place the recording in time.