Heise and Aftenposten  both report on IMSI catchers that have been detected in Norways government quarter. Now, given that anybody with a few thousand Euro in their hands can build such an IMSI catcher (which is capable of catching much more than just an IMSI, the unique mobile identification number of a cellphone, but can actually serve as a listening device to conversations and tape streams of voice-data), it is not neglect that is to be seen. In fact, it is an inability to see attacks while they are happening and take adquate measures.

This inability takes two different shapes:

1. technical and

2. mindset

While the technical one is obvious, the localization of an attacker is particularly difficult, depending on the way the attack is staged (active/passive), just to name a few issues, the most problematic one is the problem of mindsets.

First, it has to be assumed, that all the institutions that care about IT or communications security (e.g. BSI in Germany) are biased. They are not up to speed on the current attacks, and they are technologically way behind the attacking parties. Second, they are receiving orders from their political leaders, who live in fear of the foreign three-letter agencies.

The mixture of fear and preemptive obedience disallows our national leaders to take adequate measures in time they are needed, hesitance and blocking the needful are the most prevalent reactions, at least in nations that don’t carry “United States of” in their names.

The TLA and other criminal organizations are running circles around our national organs of safety, while even the slightest investment in means and methods are blocked.

And even if all of this weren’t the case, the mindset of beaurocracy would step in and destroy all and every innovative creativity in getting something positive for the nation done.

So, as a result, the technical is not an issue that couldn’t be resolved. It is the mindset that is the bottleneck to find solutions to the problem of how to catch the catchers (like search & destroy).