US Military and Security fooled by Internet ‘Friends’ hoax

Robin Sage, an attractive MIT graduate with solid career experience in computer security, made lots of useful professional contacts using social networking sites. But things were not quite as they seemed.

Robin was very popular for a while on the Internet with graded Defense Department, NSA, and arms manufacturers such as Lockheed Martin and Northrop Grumman personnel. She also got pally with Google security people. They all added her to their contact lists and relations developed. All of this social networking and more happened on Facebook, Twitter and Linked-In, where she ended up with over 300 friends in just 28 days, according to Le Figaro. Then she was given, or was able to gain access to, the private personal details of her friends, who sometimes gave her sensitive professional information and, seemingly because of her charming personality, she even got job offers. Then Thomas Ryan stepped into the picture, and it was all over. Ryan had decided to kill off Robin and did so in the blink of an eye. But no harm was done because Robin Sage didn't exist. She was his virtual creation and had finished her mission. “Robin” was in fact a fictitious character, created, played and piloted by Ryan, and her mission was to get as much information out of her “friends” in as short a time as possible. A (real) Internet security specialist, he will be at the Black Hat conference next week, at which he will reveal more about his experience and its results. But he has already given some information to specialist sites about the Robin Sage saga. Ryan says he managed to obtain access to emails and one person’s bank account details by guessing the answers to secret questions contained in the databases of the organizations concerned from profile information published on the social networking sites. He also found details of take-off times for military helicopter flights in Afghanistan from a military source serving there. Other contacts and site members contacted him for professional advice, and others still invited him to give lectures in conferences, offer him gifts, and invite him to dinner. Thomas Ryan thinks that the profile photo he chose (visible in the Figaro article) had a lot to do with his success, particularly with men. He also points out however that the underlying objective of his research was not to decredibilize social networking sites, but to alert people to the inherent risk of compromising sensitive information via the misuse of personal information published by them if they are not careful about who they befriend. One thing is certain though, and that’s that Robin Sage, even if “she” had left her accounts open (they have all been closed) would not be making any more Internet friends in certain American government organizations such as the CIA and FBI.