NSA Finds Lost “Rare Italian Cipher Machine” in its Collection

The NSA in October 2021 posted a headline with the interesting title “Long lost and rare Italian cipher machine found“. That sounds innocent enough, yet check out the wobbly history they published along with it:

At the outbreak of WWII in 1939, Nazi Germany’s Enigma encryption machine stood as the state-of-the art method for sending and receiving secret messages. It wasn’t until 1940 that English mathematician Alan Turing, and the team at Bletchley Park, cracked the daily changes Berlin made to its cipher system, and helped the Allied powers win the war.

Technically those words are not wrong, yet the paragraph really obscures some important back-story. For years (last decade, really) the British have tried to raise flags and increase awareness about Polish cryptographers who deserve full credit for breaking Nazi Germany’s Enigma in the 1930s. Almost immediately after WWI ended the Enigma started circulating and the British had been trying to break it, but they owe a lot of credit to others (the Polish).

I’ve written here before in detail about this.

…in 1927 the British government gave Enigma plans to Foss and Knox, code breakers, for review. A book about Knox’s role in breaking Enigma explains how Foss reported in theory it “could be broken given certain conditions” knowing as little as fifteen letters to figure out the machine settings. This effort led to the British and French working together on deciphering Spanish (Civil War) and Italian (invasion of Ethiopia) military communications in 1936. […] Here’s the key issue (pun not intended). Britain was not as keen to monitor German Enigma traffic until long after the French and Polish had warned of its importance. France was able to extract German documentation and gave it to Poland, who then cracked even the most advanced Enigma by 1933. That should put in perspective Britain listening to “several countries” signals in 1936. That was the year Germany was pushing into Rhineland and getting no push-back from Britain.

See how different that telling reads to the NSA tone?

It’s unfair of the NSA to even hint that in 1940 the British suddenly and initially cracked a Nazi German Enigma machine. When anyone adds a caveat to text like “the daily changes Berlin made to its cipher system”, that doesn’t really give a fair depiction of who cracked what, why and when.

I bring up an earlier history of the Enigma also because the NSA post gives us the following paragraph, which seems to gloss over the fact that the Italians had used their own Enigma-like system before Germany and it was as much state-of-art before WWII started:

While the Enigma stands out as the most famous of encryption machines, Italy, set out to develop a high-end machine to rival its war partner, Germany. In 1939 Italy’s government secretly tasked a little-known photogrammetric equipment company, Ottico Meccanica Italiana (OMI), to build a device capable of rivaling its more famous cousin.

I’m nowhere near government archives right now or I might be heading into them. Is there evidence from British military intelligence files that Italy figured out its encryption was cracked in the 1930s? In other words, what if Italy set out to develop a replacement because they realized their systems were vulnerable.

Just a guess, but maybe OMI wasn’t trying to rival a German Enigma as much as stop leaks suspected in the earlier devices, ones giving them trouble with the British and French.

The cryptomuseum supports this guess and even calls Italian machines more advanced than German ones at the start of WWII.

Cryptograph-Alpha, or Alpha, is a wheel-based electromechanical cipher machine, developed and produced in secrecy by OMI in Rome (Italy) around 1939, at the start of WWII. It was intended for use by the Italian Army (Regio Ersetico), the Air Force (Regia Aeronautica) and the Navy (Regia Marina). […] The OMI Alpha is very similar to the Zählwerk Enigma, but is more advanced.

Italian Opto-Mechanics (OMI) machines were more advanced in 1939 than the Nazi Enigma? I’m reminded of the myth of Nazis being technologically advanced, given plain facts such as “75% of the Nazi German Army relied on horses“. It’s fairly clear how ahead the Italians were when you compare features:

The 1939 OMI Alpha had a couple distinct advantages over the Nazi Engima: motorized with five cypher wheels (one more than Engima, except Hungarian G-111) and integrated paper printer for single person to operate easily (much faster than watching lamps to write the letters). Source: Crypto Museum

Keep in mind that German Engima was cracked as early as 1931 by the Polish, and an ability to continue such secretive successful efforts were basically destroyed (abruptly gifted to the British) after German invasion. Again the Crypto Museum explains:

From 1933 onwards, the Poles intercept and decrypt a significant portion of the German radio traffic. In 1938 they see an increase in the number of messages sent by the Germans and it seems clear that Germany is preparing for war. All this time, the Germans have been using a common Grundstellung (basic setting) for all Enigma traffic. On 15 September 1938 however, this procedure is abandoned.

A year later on September 1st, 1939 Germany invades Poland and the codebreakers are forced into exile under extremely difficult conditions (unable to discuss their work to get protection, yet needing it to immediately continue under protection). Or as the NYT reported on Poland’s famously proficient self-defense up to September 7th:

Westerplatte Defenders Repulse Attacks From Sea, Air and Land; 70 to 200 Polish ‘Suicide Troops’ Shatter Two German Attempts to Storm Fortress After Plane and Ship Bombardments

So while the British focused heavily on cracking mainly Spanish and Italian crypto in the mid to late 1930s, and struggled with Germany, Poland had been able to “shatter” the Nazi Enigma during that same time.

In that sense the OMI history of abruptly releasing a state-of-art machine in 1939 (combining features of Enigma, similar yet improving it) should be filed as a tangible result of 1) Poles cracking the German codes 1930s 2) British cracking the Italian codes 1930s, which led into… 3) Italians moving to protect their codes against Allied forces combining 1 & 2.

The Cryto Museum, as well as the NSA, mention how very little is known about these early Italian crypto systems but I would go even further. British cracking Italian codes may have had a decisive effect (in contrast to their failure to crack German ones), helping bring quick Allied victories in northern Africa, such as Mission 101 (a tiny force sent into Ethiopia 1940 and quickly routing Axis forces at least 10 times larger), which far too few people know anything about.

Is Facebook Exempt From New US Arms Embargo Imposed on Cambodia?

Earlier this month, the US announced a new embargo:

The United States government yesterday imposed an arms embargo on Cambodia, citing long-standing concerns about human rights, corruption, and China’s growing influence in the country. According to a statement from the Commerce Department, the move will “restrict” access to “dual-use items,” “less-sensitive military items,” and “defense articles and defense services” by Cambodia’s military and intelligence agencies.

Analysis of the embargo by The Diplomat adds this spice to the soup:

This doesn’t mean a lot – the U.S. is not currently a supplier of arms to Cambodia… one of the reasons that Hun Sen and his government have moved so close to China is precisely because of Western pressure over democracy and human rights issues, which they have long perceived as an attempt to undermine the power of the ruling Cambodian People’s Party.

Is it true the US is not currently a supplier of arms? Not even dual-use technology (as I have written about before here in context of Ronald Reagan and genocide)?

Does Facebook count, given its use by the military there to prop up the ruling party?

The United States and human rights groups on Monday condemned the conviction of a Cambodian teenager who was sentenced to eight months in prison over messages he shared on Facebook and Telegram insulting ruling party officials. The sentencing comes amid a broad crackdown in Cambodia on the opposition, civil society and the media that began in the run-up to a 2018 election.

You may remember the argument that Alex Stamos, founder of the new U.S. government lobby group Krebs-Stamos, probably should be serving time in jail:

[Facebook’s role in genocide] begs a question how quickly can the platform be shut down and the ex-officers held accountable…

Deeper investigation of “items” in Cambodia is surely needed, not least of all because of the unique role Facebook plays in that country.

In 2018, the team at Facebook had a puzzle on their hands. Cambodian users accounted for nearly 50% of all global traffic for Messenger’s voice function, but no one at the company knew why…. While the Facebook employee imagined the behavior to be related to low literacy, Cambodia’s literacy rate is around 80%, according to the most recent World Bank data. […] The mainstreaming of voice messaging in Cambodia raises questions over content moderation and the spread of misinformation. Audio is notoriously hard to scan, lacks contextual clues, and it’s difficult to tell when it’s been manipulated compared to video. […] Audio message evidence has featured in some high-profile cases, such as the reputation smearing of Luon Sovath, an activist Buddhist monk who fled Cambodia. He alleged that incriminating Messenger recordings had been fabricated by Cambodian authorities. When asked about resources for this kind of moderation in Cambodia, a representative of Facebook, now known as Meta, only described general measures.

Is it possible that such Facebook staff communication failure is related to their low literacy? Perhaps the World Bank will let us know.

In the meantime, it’s worth considering whether an embargo that included Facebook would send the Cambodian government a more meaningful message. Of course it would have to be in text and thus on a platform other than Facebook’s.

Resources on Log4J vulnerability

Everyone and their dog or cat (squirrel?) are working on the Log4J news, according to my critical vuln crawler, so here’s a shortlist of resources that may help:

Spread the word.

“Healthy Choice” Restaurant Closed by Health Inspectors

The Orange County Register regularly reports restaurants forced to closed by health inspectors.

In December “Healthy Choice” in La Habra was cited for insufficient hot water and closed for a day.

Source: The OCR

Water measured at the time of an inspection has to be at 120F degrees or more for cleaning. The icon for “Rodent infestation” is for a different restaurant.