A few weeks ago, and prompted by an HN post, I considered writing about the possibilities if ML as applied to large aggregate datum and with criminal investigation as the motivation.

With all the public posts, writing style analytics, and use of a common moniker across services, it seems that it may be possible to do just that on a large scale. It seems that it could be made trivial to narrow down lists of suspects by crunching large data sets that contain stuff like SO questions, AC posts on Slashdot, or responses on HN.

After all, how many people are actively seeking to secure a message board as a hidden service and doing so at that time? I sort of envision it as having some commonality with the timing attacks already in use to deanonymize Tor users.

Subject A asked about securing IP addresses for uploads and Sevice A got this feature two weeks later. Subject C asked about this security aspect and Service A has that concern. Subject Q asked about using this forum software and requested this modification. Service A uses that software, etc...

So, maybe Subjects A, C, and Q are all the same people.

While it doesn't prove much, it does potentially aid in narrowing down the list of suspects. Coupled with other bits of information, it may narrow the list down significantly.

That and there are huge sets of data out there. Processing that intelligently, and rapidly, could really change the way investigations are done.

That's what XKEYSCORE does, pretty much. The NSA has spent a lot of time working on these sorts of techniques.

No it doesn't - or at least there is no claim I've seen that this is part of XKEYSCORE. It's not mentioned on the Wikipedia page either[1].

However this is an active areas of research in both classified and (presumably) non-classified areas. See for example this search: https://scholar.google.com.au/scholar?q=related:KbJLbpaKfCkJ...

[1] https://en.wikipedia.org/wiki/XKeyscore

Right, the NSA has a bunch of anti-Tor tools that usually are called QUANTUM-whatever. However, correlation of people across different networks is something that XKEYSCORE does. There's also the writing deanonymisation tools that you mention (but there's Anonymouth[1] which could help).

My original point was that OPSEC is hard if you're trying to be a topic expert in a short period of time. You don't need NSA tools to attack someone in that situation.

[1]: https://github.com/psal/anonymouth

In particular, this part:

> It seems that it could be made trivial to narrow down lists of suspects by crunching large data sets that contain stuff like SO questions, AC posts on Slashdot, or responses on HN.

Is what XKEYSCORE does (or at least, it's the interface you use to query the above data sets which are collected as part of PRISM and the other programs).

I've said it before, I'll say it again. Comments like that are why I like HN. I see there is some long reads associated with this subject.

Once again, HN has sent me off into a subject I'd not have found on my own. That's why I like HN as much as I do.