Disinformation 1942: Operation Bertram

North Africa in 1942 gives a useful study of disinformation because the British kept their moves a total secret by duping Germans with fake ones.

The first battle of El Alamein in July 1942 became a clear victory by British forces against over-stretched, exhausted and poorly organized impatient Nazi invaders. Battalions of M3 “Grant” Lend-Lease tanks from America ripped apart Rommel’s best armored divisions as he predictably advanced from the south below Alam Halfa Ridge. The second battle would be an even bigger victory, a huge rout, thanks to almost perfectly executed disinformation strategy.

Conflict typically means incentives are really oppositional positioning. Defenders have to predict where and when an attack will come, allocating resources wisely. Attackers meanwhile have to predict where defenders are pooling resources to go somewhere else. The side that telegraphs a move increases chances of failure because the other side can transform intelligence advantages into hugely asymmetric effects.

Newspapers reported British advances in the south while actual plans for attacks were to come along the north coastline.

The Nazis had been confident as the summer began in 1942 that they soon would be rolling tanks into Egypt. General Rommel infamously became so unrealistic about the situation that Mussolini himself flew into Libya towards the end of June (under Italian rule) expecting he would be sitting atop a victory parade through Cairo.

Instead, General Rommel’s hot-headed and poorly constructed strategy of attacks stalled. His forces were in a disarray and his propaganda became seen as a laugh. Mussolini high-tailed it home in July as Nazi leadership began to waffle and flail.

From this point onward the Axis troops rapidly would be pushed back until entirely out of North Africa by a British General appointed to make haste.

Rommel’s men show utter disgust with his leadership, while the “unbeatable and unbearable” General Montgomery outsmarts them at El Alamein. Source: “Images of War: The Armour of Rommel’s Afrika Korps” by Ian Baxter.

The man Britain appointed was General Montgomery who on August 13 shipped in to command the Eighth Army. His entrance was a classic British shake-up, a move reminiscent of 1917 in WWI when General Lord Edmund Allenby landed as Commander of the Egyptian Expeditionary Force.

Lieutenant General Bernard Montgomery (right), shortly after taking command of the 8th Army, 20th August 1942 and trouncing Rommel. Source: Getty Images.

Deception was a game Allenby had famously adopted in WWI to turn tides and roll through and around the Ottomans (and Germans). He also had written about it after the war, as captured by many books.

Such tactics were back on the table for British planning, as Montgomery decided disinformation would be essential to victory in a second battle of El Alamein. In fact, he would repeat much of the tactical strategy used in WWI — deceive and offset, weaken with artillery, surprise and smash through.

The connection to Allenby’s WWI campaigns was no coincidence for the British in El Alamein. The head of British deception in WWII arguably was Field Marshall Lord Achibald Wavell (British Commander in Chief in the Middle East 1939-1941). He served as a senior officer under Allenby in WWI and thus was well aware of what had worked before and where.

An early WWII test, for example, was the decisive 1940 victory for the British at Sidi Barrani. Successful plans (Operation Compass) were credited to Wavell’s deception expertise. His intelligence operations definitely made a big impression.

Wavell had enabled just 2 divisions (less than 50,000 ready under General O’Connor) to confidently head into battle against over 300,000 Italian soldiers in Egypt. Using an old Allenby WWI tactic, he faked British troop movements and generated bogus radio traffic to suggest they had started relocating out of Egypt and into Greece.

Total surprise was the result. After three months in 1940 just 500 British were killed yet 10 Italian divisions had been destroyed and over 100,000 men taken prisoner.

Fast forward two years, the 6th of October 1942 was the day Montgomery ordered disinformation to be fed to the Germans.

Specific tactical procedures for Operation Bertram were conceived by the brilliant yet controversial Dudley Wrangel Clarke. Deception would be to protect a surprise night offensive near the Mediterranean coast by the British on October 23rd.

Some readers may recall September 25, 1942 was the day an Allied plane had crashed near Spain, which created a certain sense of urgency to deception methods.

There were no survivors; one fatality in particular that worried Allied commanders was a courier who carried sensitive documents about [November 1942] invasion plans for North Africa, called Operation Torch. Allegedly those documents didn’t leak yet it was this incident that inspired Allied intelligence to attempt an intentional leak.

Some readers also may recall that February 1942 was when the British were ignominiously defeated in Singapore due to significant intelligence failures, not least of all reallocation of its own tanks coupled with allegations that the sound of enemy bicycles had been mistaken for approaching tanks.

And on top of all that, “visual deception” had been formalized to confuse and disorient Nazi attacks.

In 1941 the filmmaker Geoffrey Barkas was made Director of Camouflage at General Headquarters (GHQ) Cairo. Among the specially trained Royal Engineers, camouflage officers under his command were artists, zoologists, and theatre and film set designers. Creative improvisation remained key to their success.

Thus in 1942 the British were thinking a lot about shifting from defense to offense and using deception methods to improve chances of success; how to give Rommel the impression of a large slow offensive to come from the south sometime in November, while actually it would come very quickly in the north weeks earlier.

Four elements of disinformation were set in motion for Bertram.

First, the mass of actual British preparations had to be hidden, such as extensive materials in movement around the north.

Second, all the preparations had to appear much slower than reality by a factor of several weeks.

Third, a fiction of British preparations for an attack from the south had to be convincing.

Fourth, during the actual attack along the northern shore there would be sea-borne tactics to distract and disorient the Germans.

The most complicated of these was procedures to conceal actual equipment and men in the north. Mechanized tracks for thousands of tons had to be erased, stacks of supplies had to be minimized. Painted canvas (another Allenby tactic, although dummy horses in WWI) created “dummy trucks”.

Guns and tanks were covered over before sunrise to become invisible by aircraft. Many real trucks also were staged ahead of time so they could be swapped with the canvas ones concealing arrival of more tanks, for example.

Water was of course essential to any bluff in the desert, as Allenby’s WWI disinformation tactics also had demonstrated so well. A fictional assault launch point in the south was set as a target for a fake water pipeline to work towards. It was very openly built using a timeline meant to attract German observation. It was hoped the Nazis would think pipeline status was how they should estimate a attack from the south sometime in November.

The clever efficiency of the fake pipeline was how it reused a small section of props (disused cans) over and over again. A trench was excavated during the day next to materials only to be filled in again at night. This gave the appearance of forward movement to airborne observers. The operation slowly shifted like this indicating progress without any pipe being laid at all.

Another overt procedure by the British was moving tanks during daylight to attract attention. At night these tanks moved forward elsewhere to be concealed, and their last positions filled by dummy tanks coupled with noisy wireless signals to convince Germans of slower progress.

All the emphasis on a southern front and late attack then led to yet another deception tactic when British forces began their actual attack in the north along the coastline. Fast boats fitted with loudspeakers played recordings of battle sounds to give the impression of flanking by an amphibious landing. This also helped serve as disinformation related to November plans in Operation Torch amphibious landings.

Montgomery’s operation worked as intended. The Nazis were unprepared and disorganized, shortly in retreat.

The third phase of the battle, ‘Break-out’, was fought between 1 and 4 November 1942, when Montgomery, judging Rommel’s forces at breaking point, ordered the final blows against them. By 3 November it was obvious that Rommel was preparing to withdraw, and the next morning the 5th Indian Brigade attacked, driving a wedge through Rommel’s front, thus enabling the 1st and 7th Armoured Divisions and the 2nd New Zealand Division to go in pursuit of enemy forces, now in full retreat. In Britain, the church bells were rung for the first time since May 1940 to celebrate the Eighth Army’s success which was, as Winston Churchill described it, ‘a glorious and decisive victory’.

British deception had worked so well it completely convinced Nazi observers they faced no threat at all in the north, right before they were attacked from the north. Montgomery faced difficulty, of course, yet his surprise tactics rolled quickly towards victory with troops in high morale laughing at Rommel.

Despite replaying a (modified) WWI strategy that had been widely discussed by the British themselves over the 20 prior years, Montgomery managed to achieve high shock value. Rommel by comparison was entirely predictable and defeated as such (although more research is needed to determine whether Axis communications, especially Italian, were decrypted at Bletchley Park and their North Africa campaigns had been totally compromised).

Perhaps then, even more to the point of security, the true triumph in deception under Operation Bertram may have been achieving such a level of secrecy that Allied plans were neither compromised nor even guessed.

Map of British victory in second battle of El Alamein under the headline: “8th ARMY IS ADVANCING OVER THE WHOLE FRONT. Rommel’s Tanks Retreat in North.” Source: Evening Standard, 5 Nov 1942

Montgomery on 5 November 1942 poses in front of his personal American-made M3 Grant tank, named by the British after the greatest U.S. general and president in history. Source: IWM photo E18982

Cyberwar and Drugwar: “Metaphors We Live By”, by Lakoff and Johnson

The book “Metaphors We Live By” was published in 1980 and required linguistics reading when I attended college many years ago.

It’s been coming up a lot lately, as people start to realize that disinformation is an area of security thousands of years old.

Here’s a quick explanation of the book’s thesis:

One of the most useful applications of this old book for me has been to explain how a rhetoric of war is overused in information security. It undermines a practice of computer security as a science.

Technology giants and governments pour time and money into loose concepts of “cyber war” yet remain mostly unprepared for even the most banal and predictable integrity issues (e.g. “deep fakes“).

As another example the “war on drugs” has even more documentation of failure. It was a concealed racist metaphor initiated by President Nixon to silence American political speech and incarcerate Blacks on false pretense.

The Nixon campaign in 1968, and the Nixon White House after that, had two enemies: the antiwar left and black people. You understand what I’m saying? We knew we couldn’t make it illegal to be either against the war or black, but by getting the public to associate the hippies with marijuana and blacks with heroin, and then criminalizing both heavily, we could disrupt those communities. We could arrest their leaders, raid their homes, break up their meetings, and vilify them night after night on the evening news. Did we know we were lying about the drugs? Of course we did.

This has been widely discussed by historians so shouldn’t surprise anyone. Technology giants and government in the 1960s used drugs as a metaphor for Blacks, turning the country backwards into President Wilson’s (KKK) race war platform of the 1910s.

If that fact surprises anyone, they’re probably going to be angry they have been taught lies due to some “Young Turks”.

Gerald Ford became President of the United States after he rose to prominence in a right-wing group called “Young Turks” and Nixon chose him as VP. Donald Rumsfeld also was a “Young Turk”.

The “war” on drugs was initiated and waged by a radical Republican faction known as “Young Turks“. Although it now frequently is declared “lost”, as drugs are more widely sold and used in America than ever I don’t know anyone who brings the loss back to those who came up with the metaphor.

In 1960 he was mentioned as a possible Vice Presidential running mate for Richard Nixon. In 1963 a group of younger, more progressive House Republicans—the “Young Turks”—rebelled against their party’s leadership, and Mr. FORD defeated Charles Hoeven of Iowa for chairman of the House Republican Conference, the number three leadership position in the party. In 1963 following the assassination of President John F. Kennedy, President Johnson appointed GERALD FORD to the Warren Commission that investigated the crime. […] In the wake of Goldwater’s lopsided defeat at the hands of Lyndon Johnson, GERALD FORD was chosen by the Young Turks to challenge Charles Halleck for the position of minority leader of the House. With the help of then- Congressmen Donald Rumsfeld and Bob Dole, Mr. FORD narrowly upset Halleck.

Despite all the “Young Turk” leadership driving over-militarized U.S. interventions to incarcerate or assassinate non-whites and silence political opposition, they instead turned military bases into a “symbol of our definitive loss“.

Get-tough measures on part of police and prosecutors have done nothing to reduce the demand for narcotics, and demand will always beget supply. The 50-year history of the failed War on Drugs has taught nothing if not that. Perhaps there is no greater symbol of our definitive loss in that interminable war than Fort Bragg itself. From this flagship base, the beating heart of the U.S. special-operations complex, the military apparatus behind the global War on Drugs deploys to the far corners of the world. Green Berets train security forces in countries like Colombia, El Salvador, and Honduras. Delta Force reportedly took part in the anti-cartel operations that killed Pablo Escobar and captured El Chapo Guzmán. Yet drive down Bragg Boulevard into the Bonnie Doone neighborhood of Fayetteville, and in between the storage facilities, mobile-home dealerships, and tattoo parlors, you will find roach motels full of addicts, indigent veterans camped out beneath bridges, and strung-out junkies hanging around boarded-up trap houses. The dismal tide of synthetic opioids and amphetamines has penetrated Fort Bragg’s high-security gates, permeated through to the lowliest privates’ barracks, and caused at least a dozen overdose deaths in just the last year. These dead soldiers, who far outnumber combat casualties, are clearer proof of the United States’ unequivocal defeat in its longest-running international military campaign than a white flag run up over the main parade field. As the old saying goes: The War on Drugs is over — drugs won.

See the problem with the metaphor?

A “war” to criminalize an “antiwar left” and Black Americans never really intended to stop drugs. Assassinating non-white leaders considered “too left” did basically nothing to end a drug crisis because that’s obviously not how anyone would go about reducing production and use of drugs, especially since white leaders are heavily involved in the drug crisis too yet escape justice.

Unfortunately it still gets talked about in terms of drugs instead of politics and race because the metaphor became so ingrained.

How many white Americans hate non-white immigrants? Far more today than if there had not been a “war” trying to convince them non-whites are drug users.

Thus returning to the early 1900s race war (e.g. Red Summer) by another name is what really came from the metaphor — turning Americans into a mindless militant crusade against other Americans — and so you still see today a rhetoric from the Republican extremists about drug this and that when they really mean non-whites.

In that sense Nixon, Ford, Rumsfeld, Reagan… were all really a sad repeat of Prohibition-era racism, which also worked too well. The KKK had a policy of assassination and incarceration of Blacks hidden inside an anti-alcohol platform.

The KKK’s war on alcohol as much as the “war” on drugs has failed, in other words they succeeded in both cases seriously destroying political power and American prosperity of other Americans (non-whites). America did not completely stop alcohol production or consumption (mostly shutting down non-white distilleries, breweries and taverns while giving exception licenses to whites), and instead used its government for excessive violence against Blacks. Today we know whites and conservatives sell and make heavy use of drugs yet the Nixon (and later Reagan) concept of this “war” never intended to target them.

Cyber and drugs are just two examples of how “war” has become the unfortunate metaphor that Americans still live by. Maybe the book should have been titled Metaphors We Live For?

Or, to put it like a recent book about Pentagon growth, “Everything became war and the military became everything”.

Albania Breaks Ties With Iran After 2022 Microsoft Investigation of CVE-2019-0604

The U.S. is very confidently accusing Iran of attacking Albania, based on yesterday’s report by Microsoft about Microsoft’s usual software vulnerabilities and mis-configurations.

Microsoft assessed with high confidence that on July 15, 2022, actors sponsored by the Iranian government conducted a destructive cyberattack against the Albanian government, disrupting government websites and public services. At the same time, and in addition to the destructive cyberattack, MSTIC assesses that a separate Iranian state-sponsored actor leaked sensitive information that had been exfiltrated months earlier. Various websites and social media outlets were used to leak this information. […] A group that we assess is affiliated with the Iranian government, DEV-0861, likely gained access to the network of an Albanian government victim in May 2021 by exploiting the CVE-2019-0604 vulnerability on an unpatched SharePoint Server, administrata.al (Collab-Web2.*.*), and fortified access by July 2021 using a misconfigured service account that was a member of the local administrative group. Analysis of Exchange logs suggests that DEV-0861 later exfiltrated mail from the victim’s network between October 2021 and January 2022.

The report unfortunately is not titled “What are you even doing running Sharepoint in 2021” and instead uses this far more provocative line:

Microsoft investigates Iranian attacks against the Albanian government

Just a decade ago many experts in the security industry warned against investigations being so overtly bold or confident with their attribution statements. The fear was rooted in dubious logic that someone could make a mistake and therefore shouldn’t even try.

I mean if that was sound logic Sharepoint would have never been released to the public. Ok, maybe there’s some truth to that logic.

But seriously, anyone in any history 101 class knows you can’t let perfect be the enemy of good when writing reports about what happened in the past. Of course you can get attribution wrong, which is in fact why you should try hard and make sure you do it well.

It feels like a very long ago time ago (but really only 2014) that I gave a counter-argument to fears about uncertainty, in a presentation to incident response teams in Vienna, Austria basically saying it’s time for attribution.

Looking back at my slides, honestly I think I tried too hard to make data integrity funny. Attribution is less complicated by some unique thing about computers than it is by things about people like this: Americans are more likely to want to intervene in places they can’t find on a map (click to enlarge and have a sad laugh).

Here’s another one, where I poked fun at FireEye for making very crude and rube attribution mistakes and surviving (they’re still in business, right?).

Now look how far the world has come!

Microsoft shakes heavy doses of political science into its computer forensics reports like it’s powdered sugar on a Turkish delight.

  • The attackers were observed operating out of Iran
  • The attackers responsible for the intrusion and exfiltration of data used tools previously used by other known Iranian attackers
  • The attackers responsible for the intrusion and exfiltration of data targeted other sectors and countries that are consistent with Iranian interests
  • The wiper code was previously used by a known Iranian actor
  • The ransomware was signed by the same digital certificate used to sign other tools used by Iranian actors

[…] A group that we assess is affiliated with the Iranian government, DEV-0861…
[…] The geographic profile of these victims—Israel, Jordan, Kuwait, Saudi Arabia, Turkey, and the UAE—aligns with Iranian interests and have historically been targeted by Iranian state actors, particularly MOIS-linked actors.
[…] The cyberattack on the Albanian government used a common tactic of Iranian state sponsored actors…
[…] The wiper and ransomware both had forensic links to Iranian state and Iran-affiliated groups. The wiper that DEV-0842 deployed in this attack used the same license key and EldoS RawDisk driver as ZeroCleare, a wiper that Iranian state actors used in an attack on a Middle East energy company in mid-2019.
[…] Multiple other binaries with this same digital certificate were previously seen on files with links to Iran, including a known DEV-0861 victim in Saudi Arabia in June 2021
[…] The messaging, timing, and target selection of the cyberattacks bolstered our confidence that the attackers were acting on behalf of the Iranian government. The messaging and target selection indicate Tehran likely used the attacks as retaliation for cyberattacks Iran perceives were carried out by Israel and the Mujahedin-e Khalq (MEK), an Iranian dissident group largely based in Albania that seeks to overthrow the Islamic Republic of Iran.
[…] The messaging linked to the attack closely mirrored the messaging used in cyberattacks against Iran, a common tactic of Iranian foreign policy suggesting an intent to signal the attack as a form of retaliation. The level of detail mirrored in the messaging also reduces the likelihood that the attack was a false flag operation by a country other than Iran.

Done and dusted. Need I continue?

It is nice to see such definitive and detailed work about attribution as if it’s a normal investigation with regular analysis methods… but it’s even nicer to read Albania has announced they’re cutting ties with Iran. And then… to see the U.S. follow-up with announcements about sanctions, it’s like why didn’t Microsoft start doing this way back in 1986 instead of for decades completely ignoring security as a get-rich scheme?

The Moonbeam Song

by Harry Nilsson from the “Nilsson Schmilsson” album (1971)

Have you ever watched a moonbeam
As it slid across your windowpane
Or struggled with a bit of rain
Or danced about the weathervane
Or sat along a moving train
And wondered where the train has been

Or on a fence with bits of crap
Around its bottom
Blown there by a windbeam
Who searches for the moonbeam
Who was last seen
Looking at the tracks
Of the careless windbeam
Or moving to the tracks
Of the tireless freight train
And lighting up the sides
Of the weathervane
And the bits of rain
And the windowpane
And the eyes of those
Who think they saw what happened

Have you ever watched a moonbeam
As it slid across your windowpane
Or struggled with a bit of rain
Or danced about the weather vane
Or sat along a moving train
And wonder where the train has been?

Looking at the tracks
Of the careless windbeam
Or moving to the tracks
Of the tireless freight train
And lighting up the sides
Of the weathervane
And the bits of rain
And the windowpane
And the eyes of those
Who think they saw what happened