Social Engineering Blogs

An Aggregator for Blogs About Social Engineering and Related Fields

How Canines use Expressions to Show their Emotions

Springer SpanielHumans aren’t the only ones that convey emotion through nonverbal behavior: animals do too.

New research by animal behavioral experts has found canine emotions are betrayed by specific facial movements, such as raising their eyebrows or cocking their ears.

Using high-speed cameras, researchers in Japan found when dogs were reunited with their owners they tended to move their eyebrows upwards around half a second after seeing them.

The study entitled “Dogs show left facial lateralization upon reunion with their owners” was published in the journal Behavioural Processes.

The Detector’s Playbook – Stereotype Accuracy

Before reading this post, we highly suggest that you read Deceptive Dimensions: Intro to Deception and The Ekman Nursing Student Study.

Lying, in essence, is just a game: the deceiver faces off against a detector, each using offensive and defensive strategies, both trying to succeed at singular opposing goals.  It’s zero-sum, one-on-one competition with an equal, the third type of social situation “where unpredictability can be applied in Robert Greene’s strategic sense.”

So far, we’ve learned that the odds of success for high-stakes lying are random at best. We think you’ll agree that when your job, your marriage, or your criminal record is on the line, you need more control.  To fix this, we need to know what your opponent, the detector, is looking for and what he’s basing his decisions on.

To form an effective unpredictable strategy in this game, you must first know what’s expected of you; only then can you avoid being thwarted by a counter-strategy.  And to know what’s expected, you must steal the detector’s playbook.

The playbook we’re imagining is nothing more than a list of common behavioral cues used by average men and women when they’re forced into the detector role of a deceptive scenario.  Some behavior-based detection strategies are probably air-tight, and aren’t likely to be circumvented without special training.  Some will be specific to the type of social backdrop against which the deception is taking place.  Some fluctuate in frequency of use depending on what’s at stake.  And some are so universal, so predictable, that we can’t, in good conscience, let you be taken down by them.  These are what we’re looking for.  Once we know what behaviors detector’s use to make their judgments, we can identify which you should try to control.  Not all of them can be controlled, of course, but those that can should definitely not be ignored.

Polygraphs

Polygraphs (lie-detector machines) do not detect lies effectively, contrary to popular belief.  This scene from Lie to Me demonstrates why.  Take a second to watch it.  You’ll see that when the polygraph demonstrator answers control questions (questions the answers to which are obviously and undeniably true), the polygraph only interprets them as true when the demonstrator is calm.  When he’s sexually aroused, the device malfunctions.  Polygraph machines only register arousal, not actual lies.  Introducing any stressor stimulus into the environment – for instance, a sexy latina chick in a skin-tight, v-neck dress – will cause the machine to interpret true statements as lies.

Popular methods for “catching” liars are just as rudimentary as those used by polygraphs.  Surveys show that the average untrained detector looks exclusively for obvious signs of nervousness. That’s all.  Now, liars in general could very well be more nervous than truth-tellers, but nervousness about lying is indistinguishable from nervousness about being disbelieved, nervousness about whatever consequences may result from failure, and nervousness related to the imposing presence of the detector.  When persistent anxiety extends over the entire duration of a deceptive interaction, it garbles the signals.  This helps explains why successful deception rates are random; not only are detectors looking for deception leakage in all the wrong places, but they’re looking for the wrong things to start with.

Nonetheless, in symmetrical/high-salience situations where the stakes are high, the detector makes the rules, and you, the deceiver, are playing his game.  All the more reason to steal that playbook.

The Hocking Study

In 1980, John Hocking and Dale Leathers, speech communication professors from the University of Georgia replicated the Ekman nursing student study we examined last time, but using a different theoretical perspective.

Prior to his experiment, Hocking analyzed survey data to outline the popular cultural stereotype of a liar.  In the survey, respondents overwhelmingly described liars as nervous, defensive, and fidgety.  Liars, they said, will display a wide range of anxious behaviors, such as facial manipulators (i.e., touching the face), restless lower body movements, and lipwetting.  About 65 percent of them also expected liars to avoid eye-contact. (That last belief will come up repeatedly after this study; research suggests that eye-contact avoidance is a myth; liars actually make more eye-contact.)

Since the stereotype of a liar is so pervasive, Hocking hypothesizes that avoiding stereotypical typecasting is paramount for successful deception; a liar, he says, must monitor and control the behaviors that are under scrutiny, suppressing stereotypical (read, “nervous”) lying behaviors and maximizing stereotypical (“calm”) honest behaviors.

As a final pre-experiment preparatory step, Hocking categorizes all the behaviors from the survey into three classes: 1. gestures (Class I); 2. facial expressions (Class II); and, 3. vocal changes (Class III).  Class I behaviors are the easiest for a liar to monitor and control.  Class II behaviors are easy to control, but hard to monitor; after all, a liar can only guess what his face looks like.  Class III behaviors are easy to monitor, but practically impossible to control.

So, according to Hocking’s hypothesis, liars, by default, will exercise more control over their bodily and ocular gestures than anything else.  This contradicts Ekman, who argues that liars control Class II behaviors over and above all others.

Deceptive Dimensions

Deceivers: Criminal justice students.  First, they view a neutral video clip.  Then, they view a positive video of a landscape scene, followed by the negative medical training videos used previously by Ekman, with scenes of limbs being cut off and burnt flesh being peeled away and debrided.  In the interviews that follow, the students will selectively lie about facts pertaining to the first video and will lie completely when they see the medical videos.

Detector: An interviewer.  Hocking recruits a local detective to interview the students.  Hocking provides no details about what the detector says or does; all we know is that he asks questions and gets lied to.

Stakes: Job success.  The students are recruited with a letter bearing the signature and seal of the Director of the School of Criminal Justice.  Hocking not only tells the students that their job success is directly related to their performance, but also convinces them that their results will be reported to the faculty.

Salience: High, symmetrical.  As expected, the detective is fully aware that lies are coming.  The students understand, too, that he’s trying to catch them.  The belief that their careers depend on success means they are also closely watching all sources of feedback, external and internal.

Leakage: Class II and Class III behaviors.  After training observers to identify the survey behaviors, Hocking showed them three edited versions of the students’ interviews.  The first version was a silent, face-only recording, which the observers used to identify facial expressions; the second was a silent, full-body recording, used to identify eye and body gestures; and the third was an audio-only recording, used for vocal changes.  The observers counted as many behaviors as they could, and the results were compared against which interviews were truthful and which were deceptive.  No judgments were rendered by the observers.

Results

The results only partially support Hocking’s hypothesis.  In Class I, several nervous behaviors decreased in frequency during deception (foot movements, head movements, and facial manipulators), but the decreases were not dramatic.  Overall, nervous gestures decreased by about 10 percent during deception.  Class II behaviors neither increased nor decreased, disproving part of Hocking’s hypothesis and again raising the question: Are liars exceptionally good at controlling their facial expressions, or are detectors just really bad at reading them?  Class III’s results do suggest Hocking was right about one thing: the liars couldn’t control their vocal changes.  They spoke faster, paused more, and interrupted themselves much more often.  Finally, Hocking’s eye-contact hypothesis was wrong, too: the liars looked away more often and held eye-contact less.  This is the last study where you’ll see that result; in all subsequent studies we’ve seen, eye-contact frequency and duration both increase during deception.

Later on, we’ll see that Hocking’s experimental design was significantly improved upon by subsequent researchers to fix issues like sample size, subjects’ anxiety fluctuations, deceiver motivation levels, and individual subject’s baselines.  But Hocking’s theory makes a major contribution: the accuracy (or lack thereof) of the average detector is stereotype accuracy.  Once you know how detectors (in general) expect you to act, acting in the opposite way will increase your odds of successful deception considerably.

For now, our advice is, Don’t appear nervous. Impractical, yes.  Vague, of course.  But as of right now, we can’t say more.  We’re not done, though.  As we progress, we will identify which behaviors receive the most attention and, of those, which are the most easily controlled.  Once we’ve isolated these, we believe a little easy practice will make you appear much more honest when the appearance of honesty counts the most.

Sources

Hocking, John E. & Leathers, Dale G., (1980). Nonverbal Indicators of Deception: A New Theoretical Perspective. Communication Monographs, 29, 119-131.

Ten OPSEC Lessons Learned From The Good Guys, Bad Guys, and People-in-Between

If you’ve been in the security world long enough, you’ve heard of a term called “OPSEC” or operational security. This is a security discipline in which organizations or individual operators conduct their business in a manner that does not jeopardize their true mission. If you’re a police officer who is staking out a house, it would be bad OPSEC to sit outside the house in a marked police vehicle. I think it’s prudent we discuss this discipline so we can better analyze our own processes by which we protect ourselves and our operations. Reviewing the OPSEC process is a great place to start. The following come from Wikipedia (I know – it’s super-scholarly):
Identification of Critical Information: Identifying information needed by an adversary, which focuses the remainder of the OPSEC process on protecting vital information, rather than attempting to protect all classified or sensitive unclassified information.Analysis of Threats: the research and analysis of intelligence, counterintelligence, and open source information to identify likely adversaries to a planned operation.Analysis of Vulnerabilities: examining each aspect of the planned operation to identify OPSEC indicators that could reveal critical information and then comparing those indicators with the adversary’s intelligence collection capabilities identified in the previous action.Assessment of Risk: First, planners analyze the vulnerabilities identified in the previous action and identify possible OPSEC measures for each vulnerability. Second, specific OPSEC measures are selected for execution based upon a risk assessment done by the commander and staff.Application of Appropriate OPSEC Measures: The command implements the OPSEC measures selected in the assessment of risk action or, in the case of planned future operations and activities, includes the measures in specific OPSEC plans.Assessment of Insider Knowledge: Assessing and ensuring employees, contractors, and key personnel having access to critical or sensitive information practice and maintain proper OPSEC measures by organizational security elements; whether by open assessment or covert assessment in order to evaluate the information being processed and/or handled on all levels of operatability (employees/mid-level/senior management) and prevent unintended/intentional disclosure.We should also recognize good guys aren’t the only ones who practice this discipline. As a matter of fact, the bad guys do as well and many are quite good at it. The lessons we could learn from them, our fellow security professionals, and others are almost immeasurable.
NEVER trust a big butt and a smile. Yup. I started off with that. Bear with me. Many intelligence agencies and law enforcement organizations use sex as a means to get close to a target or person of interest. Most bad guys realize this. However, many do not to their own detriment. When involved with people in a relationship or sexual encounter, they get very close to you and your secrets. I liken these people to “trusted agents” who you allow close enough to you that can get more information than you’re willing or able to share publicly. Poor OPSEC practitioners often forget this. Most of their security failures stem from this fatal flaw. I’m not saying to not be in a relationship or to eschew intimacy. If you’re in a job that requires you adhere to sound OPSEC principles, what I’m advising you to do is to exercise due diligence and conduct a risk analysis before you do. Think Marion Barry, Anthony Weiner, and Elliott Spitzer.Immortal words spoken during an EPIC fail.Always have a thoroughly vetted back-story for your cover. This is commonly referred to as “legend” in the intelligence community. This is an identity in line with your established, synthetic cover. For example, I previously mentioned the hacker known as the The Jester in a previous blog post. Depending on which side you’re on, he’s either a bad guy or a good guy. However, the lessons he teaches us about cover are insightful. Whenever someone “doxes” him, he has a prepared and detailed analysis as to how he created that cover identity. Many times he’ll use a name that does exist with a person who either does not exist or who he has cleverly manufactured using a multitude of identity generators. He’ll use disposable credit cards, email, LinkedIn profiles, VPNs which show logins from his cover location, etc. He even engages in cyber-deception with other actors to establish various cover stories for operations that require them. Whether you like him or not, he’s certainly good at one thing we know for sure – cover discipline.NEVER trust anyone you just met. I see you laughing. Many people mistakenly believe they can and should trust everyone they meet. They will often claim they don’t but their behavior says otherwise. As Ronald Reagan is often quoted is saying, “In God we trust, all others we verify” I firmly believe this to be the most crucial aspect of operational security. Proper trust is needed in any environment for the mission to be accomplished. However, blind trust can and will kill any hopes of a successful mission. Whether you’re checking identification at an entry control point or planning cybersecurity for an online bank, you should always treat every introduction you don’t initiate as suspect. Then triage people and their level of access according to risk acceptance. This is a lesson we learned with Edward Snowden. He’d only been at Booze Hamilton a few months before he began siphoning massive amounts of classified information he had no direct access or need-to-know. Another saying I’m fond of is “Keep your enemies close, but your friends closer.” I’m not saying everyone you meet is going to steal from you or betray your trust. Like my momma always says, “Not everyone that smiles at you is your friend and not every frown comes from an enemy.”Shut the hell up! No. Seriously. Shut up. If you hang around the special operations community, you’ll hear a term used to describe the work they do as “quiet professionals”. Most successful bad guys realize the best way to ensure longevity to shut the hell up. Bragging about or giving “pre-game commentary” before an operation are guaranteed ways to get caught or killed. The truly dangerous people are the one’s who never say a word and just do their work. Sometimes, lethality is best expressed with silence.

Watch what you leak. While we can keep our mouths shut, it is more difficult in the information age to keep everything connected to us quiet. In order to properly protect ourselves, we have to begin this process by conducting proper risk analysis. Is what I’m doing right now giving away something I don’t want the public to know? Is the the device or medium I’m talking on able to give away information I’m not comfortable with sharing? Does my enemy have the ability to intercept or analyze what I’m doing in order to gain sensitive information? What “tells” am I projecting? These are a few of many questions you should be asking in order to ensure you’re limiting “noise litter”.

In the information age, do I need to say more?If you’re doing secret stuff, NEVER EVER EVER EVER EVER, talk on the wire. Look at the Mafia as a perfect example of what not to do. As an OPSEC practitioner, you should never communicate on any medium that can give away your secrets or be intercepted. John Gotti got busted talking on the wire. A person rule of thumb: If it can receive messages, it can transmit messages without you knowing. Treat every computer like an informant – feed it what you’re willing to share with your adversary.NEVER ever touch or be in the same place as the “product”. For the uninitiated, that is one of first rules of the dope game. Every successfully, elusive drug dealer knows to keep away from the “product” (read “drugs). Whatever the “product” in your “game”, ensure you put enough distance between you and it. If you have to be close to it, then have a good reason to be with it.Recognize “the lion in the tall grass”. When practicing OPSEC, if there is one thing you should never forget is why you’re doing it. The reason you’re practicing it is simple – there are people out there that oppose you. Ignore them at your detriment.NEVER say something you can’t backup or prove immediately. Nothing says you’re a person needing to be checked out better than saying things you can backup or prove. People who are trying to vet you will require you backup what you say for a reason. Be ready for this. A great example of this is demonstrated by people who claim to be connected to someone of stature in order to gain access. In this case, they’re found out because the target asked the other party who could not confirm this.Treat your real intentions and identity as that gold ring from Lord of the Rings. I’m not saying put your driver’s license on a necklace so a troll who think it’s his “precious” won’t take it. First of all, that’s too cool to happen in real life. Second, you’ll look like an idiot. Finally, there are more practical ways of protecting your identity. For starters, never have anything that connects your identity to your operation. Next, if you have to use your real identity in connection with an operation, give yourself some ability to deny the connection. Lastly, NEVER trust your identity, intentions, or operations to anyone or anything other than yourself.I’ve decided to include the more practical list from the “Notorious B.I.G.” to drive home some of these principles:
TEN CRACK COMMANDMENTSRule number uno, never let no one know
How much, dough you hold, ’cause you know
The cheddar breed jealousy ‘specially
If that man *** up, get your *** stuck upNumber two, never let ’em know your next move
Don’t you know Bad Boys move in silence or violence
Take it from your highness
I done squeezed mad clips at these cats for they bricks and chipsNumber three, never trust nobody
Your moms’ll set that *** up, properly gassed up
Hoodie to mask up, s***, for that fast buck
She be layin’ in the bushes to light that *** upNumber four, know you heard this before
Never get high on your own supplyNumber five, never sell no *** where you rest at
I don’t care if they want a ounce, tell ’em bounceNumber six, that God*** credit, dig it
You think a *** head payin’ you back, *** forget itSeven, this rule is so underrated
Keep your family and business completely separated
Money and blood don’t mix like two *** and no ***
Find yourself in serious s***Number eight, never keep no weight on you
Them cats that squeeze your *** can hold jobs tooNumber nine, shoulda been number one to me
If you ain’t gettin’ bags stay the f*** from police
If niggaz think you snitchin’ ain’t tryin’ listen
They be sittin’ in your kitchen, waitin’ to start hittin’Number ten, a strong word called consignment
Strictly for live men, not for freshmen
If you ain’t got the clientele say hell no
‘Cause they gon’ want they money rain, sleet, hail, snowDon’t forget the admonition from Notorious B.IG. gives that should never be diminished:
Follow these rules, you’ll have mad bread to break up
If not, twenty-four years, on the wake up
Slug hit your temple, watch your frame shake up
Caretaker did your makeup, when you pass
An information security professional known as “The Grugq” gave a very interesting talk on OPSEC, I think it is worth taking a glance at (try to contain all laughter and bafoonery at the preview image – we’re running a family show here, folks):