My brother in law is DEA and I often bounce story ideas of him and exploit his knowledge of firearms and policing tactics all the time.

On several occasions he has commented on how he hates shows that blow SOP (Standard Operating Procedures), like The Wire and more recently Burn Notice.

The things he hates about the shows are the things I love, the authenticity makes the shows that much more engaging for me.

I was just wondering where to draw the line. I know on at least three occasions ideas I've had would have revealed surveillance techniques to the masses that he would prefer remain off the grid. These are things that occured to me based on the tech that is out there, and I have no problem changing the specifics to help protect SOP. I was just curious what everyone else opinion on this was?

Anyone else ever come across this?

It's really pretty logical stuff, but just not something most people think of.

Burn Notice

In one episode they have the protag performing an entry through a sheet rock wall, since it is only sheet rock it provides very little resistance. On the whole most people percieve a wall as solid regardless of whether it is or isn't. This afflicts good and bad guys, apparently there are a large number of injuries from people taking cover behind thin interior walls, these walls are not bulletproof and also provide no protection from grenade shrapnel, which is an issue in Iraq right now.

Another episode dealt with how easy it is to create a VERY effective tracking and/or bugging device out of an off the shelf cell phone and some parts from radio shack.

These are the kinds of things I'm talking about.

I say that if the information is available through public research means, you'd be cheating yourself not to use it.

But one should be careful about the specifics. So, for example, it's okay to indicate that thieves can steal information on bank account numbers and details by searching through the trash in the dumpster at the back of a bank, but wrong to reveal that Bob's Bank located at 123 Main Street, New London, throws out bank statements every Thursday night at 8.00 p.m.

One benefit is that the more people are aware of the general attacks, the more likely they are to defend against them.

Another aspect in information security (BTW infosec is about maintaining the confidentiality, integrity and availability of information) is that organized crime plays a big part in information scams. They can afford to pay very clever programmers --or blackmail them. So by the time you or I find out about a scam, they certainly know about it; by publishing it we make little difference to the overall threat and help increase defence against it through increasing awareness.

For example, there's a scam out there at the moment whereby if you want to attack a specific organization, Cathy's Call Center perhaps (because you know they take calls from consumers and ask for credit card details) you load a nice fat memory stick with evil software that will send interesting information to you over the internet, and casually drop it in Cathy's parking lot. It looks lost and forgotten. If you're lucky someone will pick it up and plug it into Cathy's network and voila -- you're in. (Which is why responsible call centers ban their employees from using memory sticks, iPods, cell phones, cameras, etc. But everyone is vulnerable to this attack so the more people know of it, the better.)

One area that's more challenging is when an attack depends on a security hole in a product. Responsible security practitioners will not publicly disclose the flaw and will instead inform the manufacturer so it can be fixed without placing the world at large at risk. But it doesn't always work because manufacturers sometimes won't fix the problem. Then, sometimes, security practitioners go public, despite all the risks that that entails.

Perhaps the most memorable and high visibility example of this was the 'Sony rootkits'. In a misguided effort to protect their copyright, Sony released a bunch of music CDs which stopped you from copying their content from one computer to another by installing and running some clever software on your PC. To stop you from switching it off, it hid itself, using an ingenious program called a 'rootkit.' Unfortunately, a hacker could use the rootkit to hide all kinds of other bad stuff on your computer as well. Unwittingly, Sony had made sophisticated rootkits available to the world for the price of a CD. When told by a security company, they apparently did nothing. Eventually, Mark Russinovich went public with it and after some high comedy (Their CEO initially refused to fix it, saying that "Nobody even knows what a rootkit is." The general response was, "They do now and they don't want it.") Sony fixed it by replacing the CDs with new ones that only carried the music, issuing special software that would clean the rootkit off your PC, and agreeing not to use such copyright protection technology again.

This was an example where public disclosure of a major security flaw was, apparently, the only way to pesuade the company to fix a serious information security flaw.

OF course, the Government tried to do tha with information sent to one of the Arab Despots, but that was do badly done that his people and the Russians who were helping them were able to get around the false information and gain some technology.

Anyway, You might misdirect by having the prociedures right but the results wrong, or visa versa. They might not know until they do it that there was an error.

quote:

---

Keep in mind, the vast majority of criminals are rather dumb. and do some mistakes that you wonder how they are able to velcro their shoes (tying their shoes are beyond them). The television criminal who is untraceable is rare.

---

Actually, from my experience in prison ministry, I'd say that most criminals are very clever, but not very wise. It's truly amazing what they cobble together from the limited goods they can buy at the prison commissary. Now, what they often do with the things they cobble together--that's the stupid/non-wise part. I do agree with your last statement, though.

HuntGod, I'd suggest this: If using that information in a story will endanger your brother-in-law or any policeman, then don't use it. It's never worth endangering a real human for the sake of writing a good story. Besides, if you use the information he tells you that he doesn't want you to use, he'll probably stop telling you stuff.

On the other hand, if these SOP have already been uncovered for the public in a TV show or through an easy search of the internet, it's probably safe to use them in your story.

So their computer guy zooms into the picture until all you can see on the monitor is an eyeball. He then optimizes the image until the eye is crystal clear, and they examine the eye's glassy REFLECTION to see what was happening behind the photographer.

quote:

---

In one episode of CSI they had a digital picture in their evidence. It was a standard 'couple-on-vacation-smiling' photo.

So their computer guy zooms into the picture until all you can see on the monitor is an eyeball. He then optimizes the image until the eye is crystal clear, and they examine the eye's glassy REFLECTION to see what was happening behind the photographer.

I stopped watching CSI after that.

---

1) The DEA, FBI, BATF, and other federal agencies are evolving their surveillance all the time. For example, I was just involved in a case that was targeting two guys. They tapped the cell phone of both guys--and every other phone those guys were known to call. There were something like 27 wiretaps when it was all said and done. They also had three houses under surveillance, and trackers on five different cars. All for two guys. The only way to ditch that surveillance would be to ditch all the cars, leave the houses, and have all their friends, family, and associates get new phones at the same time. And they'd have to know they were under surveillance to even do that. It's not like giving away SOPs makes it easy to avoid surveillance if you're targeted. If they want you, they'll find a way to get you.

2) Running a continuing criminal enterprise is difficult. No one--no one--is going to commit many major crimes relying on ideas they got from TV. If a big time coke dealer messes up, he's looking at a 30 year mandatory minimum. He cares too much about not getting caught to rely on a TV show for ideas. If anyone picks up your book, reads about an SOP, and says, "Hey, that gives me an idea," he will likely end up in prison sooner rather than later.

Like taking cover behind sheetrock.

Or checking someone for a wire and not paying any attention to the ubiquitous "bluetooth" ear microphone they are wearing, which is broadcasting video and audio over the net to a surveillance van.

Sales records of gasoline generators to circumvent detection of grow houses by audits of power consumption, or periodic checks of their power meter. Since they can no longer do FLIR observations from helicopters in most states.

These are the kinds of things I was refering to.

My mother tells me she finds the show "ER" unbelievable because she used to do emergency room work and it wasn't like that at all.