La dinámica de redes de los alias

LulzOpSec: The Network Dynamics of Aliases

source

Whoa! "Anonymous," a/k/a "the coolest distributed, decentralized, leaderless, amorphous transnational activist network since al Qaeda," recently suffered a major blow when its alleged leader, Hector Xavier Monsegur, sold out the group's elite talent to the FBI in order to save his own hide. This is pretty exciting news and will be a fun, recurring SNA case study.

The big question folks will be asking is "What does this mean for Anonymous?" We should already know the answer to this one, because we have gotten so good at answering the question "What does this mean for al Qaeda?" This is just another decapitation: a "hierarchy" strategy  in a "network" age. Illicit networks with tangible, hierarchical command and control infrastructures are capable of sophisticated, synchronized, and totally sweet attacks (or hacks), but are prone to detection and infiltration. Loosely organized, decentralized, leaderless illicit networks enjoy greater operational security and penetration, but their attacks (or hacks), in comparison, are pretty lame. "Decapitation" basically transforms the former into the latter.

Anonymous just lost its command and control infrastructure, as well as considerable expertise, as a result of the FBI's hard work. Anonymous is now a flatter organization; a decentralized and distributed network of mostly posers, wannabes, and copycats. This group of second stringers is probably nowhere near as skilled or sophisticated as the core group just arrested. But cybersecurity professionals must not get cocky. Months after 9/11, Afghanistan was invaded and al Qaeda was blasted back to the Stone Age. Instead of going extinct, al Qaeda evolved: it began as an organization and transformed into a movement. What will Anonymous look or sound like from this point forward? This post, in the comments section at Gizmodo, eloquently speaks to this network's next evolution:

source

************

Now that I got that out of the way, I am ready to do some serious SNA work. In this post, I hope to accomplish a few things:

1) Illustrate how aliases facilitate an illicit cell's operational security
2) Illustrate how network analytical techniques can be used to defeat this maneuver
3) Suggest  how an illicit cell might evolve to be resilient against these analytical techniques


1. Aliases facilitate operational security

The indictment of the LulzSec/Anonymous crew reads a little something like this [liberties taken]:

"RYAN ACKROYD, a/k/a “kayla,” a/k/a “lol,” a/k/a “lolspoon”; JAKE DAVIS, a/k/a “topiary,” a/k/a “atopiary”; DARREN MARTYN, a/k/a “pwnsauce,” a/k/a “raepsauce,” a/k/a “networkkitten”; and DONNCHA O’CEARRBHAIL, a/k/a “palladium," [were ratted out by] "HECTOR XAVIER MONSEGUR, a/k/a “Sabu,” a/k/a “Xavier DeLeon,” a/k/a “Leon[.]”

What's with all these aliases? Well, let's first take a look at this network without the benefit of aliases:

Not a whole lot to see here, is there? The sociogram and accompanying sociomatrix above indicate a pretty straightforward network. There is no security inherent in the network structure. Instead, Anonymous relied on operational security measures both high tech (e.g. proxy servers) and low tech (e.g. aliases) in order to assure its members' continued... ahem... anonymity.

Wait a minute: Aliases? Seriously? In a world of cryptography, plastic surgery, stealth drones, SIGINT, facial recognition software and Stuxnet, I can live off the grid if I just call myself Toby instead of Chad? Well, yeah, sorta'. If I say, "Hello, this is CHAD" when I am on the phone, and Twitter from @CHAD, and my email is CHAD@email, then virtually all of my communications, regardless of their medium, will be directed ties originating from a single network node called CHAD. I have made it really easy for the federali to creep on me. However, if my phone is registered to Toby, I Twitter from @Jimbo, and my email is Bertha@email, I have created the impression of 3 independent nodes, each with their own network dimensions. Let's take a look at what happens to the tiny LulzSec network when we insert these guys' aliases into the network:

Take a look at that! Insert a handful of aliases and this network has expanded considerably in both size and complexity. We have created a ton of network noise, masked the organization's true structure, and cast serious doubt as to who is who. In short, somebody's case has gone to shit.

2. Aliases and their owners are structurally equivalent

We all know and love OrgCharts. They remind us of how inconsequential and utterly replaceable we all are. In SNA, we like to refer to that replaceability as structural equivalency. Look at the nuanced and sensitive orgchart above. Structurally, what does a Leader look like? Well, he is linked to Lieutenants, but not Losers. He cannot stand the smell of the proletariat. What does a Loser look like? Well, he is linked to Lieutenants and fellow Losers, but not Leaders. He's never met a leader he didn't want to stab with a pitchfork. What does a Lieutenant look like? Well, he is linked to Leaders, fellow Lieutenants, and Losers. He pretty much has the worst job in the world and everyone hates him. Anyways, this should all be pretty elementary.

Now let's say we insert a random person into this OrgChart. His name is Toby. We do not know if he is a Leader, Lieutenant, or Loser. So then we ask, "What do his links look like?" If the answer is "He is linked to Leaders, Lieutenants, and Losers," then we know he is a Lieutenant. If the answer is "He is only linked to Lieutenants," then we know he is a Leader. If the answer is "He is only linked to Lieutenants and Losers," then we know he is a Loser. And that is structural equivalency in its most basic form.

To spot an alias (that is, a fake actor), we have to take structural equivalency one step further.

Let's say we determine that "Toby" is a Lieutenant. We notice that "Toby," like his fellow Liutenant "Chad," is linked to Leader "Bertha" and Losers "Larry," "Curley," and "Moe." But then we notice something weird: "Chad" and "Toby" are all linked to the same exact people, but they are NOT LINKED TO EACH OTHER. This network reality could indicate that "Toby" is an alias for "Chad," or vice versa. Why? Because no one, unless mentally ill, has conversations with their alias. If you are using an alias for cover, you are doing everything in your power to separate your real identity from your fake one. That distinctive gap, or lack of a link, can be very telling.

Let's break this on down, SNA-style:

In the sociomatrix above, we are looking at the LulzSec network, including aliases. The "1.000" indicates a link between actors when the "          " indicates that there is no link between actors. Let's drill down on the actors "HECTOR_MONSEGUR," "leon," "xavier_deleon," and "sabu." They enjoy links with everyone in this network, but seem to want nothing to do with each other. Why? Because they are the same dude. The other actors and their aliases are spotted the same way.

The sociomatrix above presents a crystal clear picture: what began as 17 actors has been condensed down to 5. Actual actors have been grouped together with their structurally equivalent aliases. The jig is up. For this we can thank an SNA technique called "Block-modeling," an algorithm that rearranges network actors and groups them into structurally equivalent "blocks." I will explore block-modeling further another time, but for now, know this:

3. Towards an SNA-resistant alias

There have been security professionals and dedicated public servants who have talked candidly about terrorist capabilities and have spelled out, explicitly, the vulnerabilities said terrorists could exploit. These people are sometimes accused of "providing a blueprint for terrorism." The folks who make these accusations think that the bad guys are knuckle-dragging, cave-dwelling medievalists. They are dead wrong. The real bad guys, the real threats, are the engineers, scientists, chemists, and managers that empower and compel the knuckle-dragging, cave-dwelling medievalists. These bad guys are way smarter than we are. When we talk about specific tactics that bad guys can use, we are merely talking about tactics that they have already spent years using, perfecting, considering, or passing over for an even better tactic.

That's out of the way, so here it is: SNA-resilient alias will talk to one another. My aliases "Toby" and "Steve" will chat with each other in public online spaces (Toby uses my desktop while Steve uses a mobile device). Both Toby and Steve will attend the same security conference: Toby will write an online review of the event while Steve links to it on his Facebook account. In fact, I will meet them both there and get lunch with them. The gaps and the contours of the network expose its structure and its inner workings. The gap will not hide you, it will only make you more distinct, isolated, and conspicuous. But the link can hide you.  Each time aliases come together in manufactured ways, the link between them grows stronger. But enough appearances together, enough conversations amongst each other, enough co-appearances on the same roster... soon enough, they are mutually exclusive and distinct actors.... and somebody's case has gone to shit.

Third Degree Centrality

Facebook status y hábitos a través de muchos datos

Looking at Facebook’s Friend and Relationship Status Through Big Data

By NICK BILTON

WolframAlphaA data visualization shows the clusters of friends on Facebook. Each color represents a different group.

Wolfram Alpha, a computational search engine, released a detailed report Wednesday about people’s friendships and relationship habits on Facebook.

The research is corralled from the details of more than one million people who have signed up for a free feature on the Wolfram Alpha Web site, Personal Analytics for Facebook, that uses complex algorithms to answer questions and generate reports about the social network.

Wolfram AlphaA detailed look at how people meet friends on Facebook.

The research found that, on average, people have 342 friends on Facebook. This has continued to grow rapidly in recent years. But that number does not include everyone on the service, as “there are significantly more people who have almost no Facebook friends.”

The differentiating factor between people who are ultra popular on the site, and those who are Facebook loners, seems to come down to age.

“After a rapid rise, the number of friends peaks for people in their late teenage years, and then declines thereafter,” wrote Stephen Wolfram, a scientist and entrepreneur. “Why is this? I suspect it’s partly a reflection of people’s intrinsic behavior, and partly a reflection of the fact that Facebook hasn’t yet been around very long.”

The report also showed the relationship status of people across Facebook. People begin to change their relationship status to “in a relationship” in their early 20s, and then at around 27 begin to tag themselves as “engaged.” The next step, of course, is letting the world know they are married. The marriage relationships status continues to grow slowly for people in the late 20s all the way to age 60.

Wolfram AlphaA chart shows the relationship status of people across Facebook.

One curious addition to the relationship aspects of the research found that with age, “the fraction of people who report themselves as single continues to increase for women, while decreasing for men.”

A number of teenagers tend to muddy the statistics slightly by tagging themselves as “married” at a very young age. This is often a result of a strange Facebook hack that teenagers use to note that they are best friends with someone.

Mr. Wolfram compared the data from his research to the United States census data, and found that the two were almost identical, with Facebook users and the real world marrying in their mid-20s.

Using the Facebook data, researchers were also able to determine that although Facebook’s users now total 1 billion, the majority of people on the service are young.

The research also highlights other relationship information — including how people tend to meet and tag friends into grouped clusters around school, work or personal settings, and how the geographic location of friends changes for 18-year-olds as they begin to leave their hometown and head off to college.

Bits

Construyendo la foto de los sospechosos de Boston

Building a Picture of the Bomb Suspects through Social Network Analysis

Police can obtain huge quantities of social network data but must sort out the junk to glean useful information.

• By David Talbot 

Data mine: This Twitter account is thought to have been used by Dzhokhar Tsarnaev.

Within hours after the Boston marathon bombing suspects were identified, police probably obtained warrants to search extensive digital records from mobile phone networks and social media and e-mail providers.

The fast-growing rise of such data sets—and rise of network analysis tools to make sense of them—could be a boon in the investigation. It might reveal the existence of other evidence, further plots, or the identity of accomplices. But sorting the real information from the junk will be a challenge.

“The general number of law enforcement requests of e-mail and social network data has gone up by a wide margin,” says Hanni Fakhoury, a staff attorney at the Electronic Frontier Foundation in San Francisco. The result is that police agencies hold huge databases of stored information.

In the case of Google, such requests are rising rapidly. In the last six months of 2012, for example, Google reported receiving about 8,400 requests for user data, up from about 6,300 in the last six months of 2011. The company reports these data here.

Security camera footage and public appeals seem to have quickly led to the identification of the suspects: brothers Tamerlan and Dzhokhar Tsarnaev,immigrants of Chechen heritage. Now “it will be interesting to see how the prevalence of electronic evidence and data all around us on the Web makes it possible for the police to solve all aspects of this crime,” Fakhoury says.

Searches of e-mail are governed by a 1986 law called the Stored Communications Act, which technically allows police access to e-mails older than 180 days without a formal search warrant. Getting a search warrant would require a judicial finding of probable cause that the defendant committed a crime. In order to access messages more than 180 days old, investigators need only a court-issued document similar to a subpoena that says the information is relevant to a criminal investigation.

“Congress assumed if you left things on the server for six months, you’d abandoned it,” Fakhoury says. However, major providers of Web communication services, like Google and Facebook, won’t release data without a search warrant, he says. Some data—such as the user’s IP address and date the e-mail account was created—won’t be released without such a warrant.  But of course, other data—such tweets and some Facebook posts—are publicly available.

As soon as the names surfaced, police would have gone to court to obtain search warrants. The authorities would turn to any number of software tools to sort through huge quantities of data, and visualize links between suspects, locations, and other points of reference.

One such tool is the Sentinel Visualizer from a Virginia company called FMS Advanced Systems Group. “A lot of police departments have thousands, if not tens or hundreds of thousands, of telephone call records,” says Dan Wasser, the director of business development at the company, which he said is not involved in the current investigation. “It’s impossible to look at that data and see who is calling whom.”

“Let’s say the police have been gathering data for weeks, months, years,” Wasser says. “Now they have the name of these Chechen brothers. Those names may pop up in the records from past databases of phone calls, transactions, and other data they may have collected over the years.”

Some traces of social networking activity have already surfaced. A YouTube profile created last year in the name of the elder suspect, Tamerlan Tsarnaev, features videos about terrorism, but verifying that he created the profile might pose a challenge. 

Technology Review

Entendiendo las redes de conflicto de interés

Understanding Conflict of Interest Networks

The Lab Edmond J Safra Center for Ethics - Harvard  University

Sebastián Pérez Saaibi and Juan Pablo Marín Díaz

Social Network Analysis can be used to understand a wide variety of systems such as research, biological or technological networks. In particular, it is a great tool to observe and analyze conflicts of interest and assess the risks that arise in the evolving relationships between individuals or institutions. By using these tools, one could not only analyze patterns but also understand observed behaviors in networks of individuals.

---

In this blog post we will show how Social Network Analysis can be used to understand conflict of interests. For this purpose, we will use a real example of the network formed by the Management Board of the 50 largest non-financial companies in Colombia. We will describe several properties related to the topology of this network, as well as the possible implications of these metrics.

The original idea and diagnosis of the companies network was published in a joint effort of aentrópico and La Silla Vacía. A brief description can be found here and the original piece (in spanish) can be obtained here.

The main idea is the following: The most important connections inside the 50 largest companies in Colombia are revealed and explained. Starting with a demographical stratification of the different companies, we explored some important aspects of their DNA, including education levels of their board members as well as their female representation levels. A network view of the participation of highly connected individual across several boards is presented on the article.

A subset of the complete network is shown below and will serve for demonstration purposes of howSocial Network Analysis can be used to understand conflict of interests. In this network companies are depicted as blue nodes while board members are orange. Centrality of a node is illustrated by increasingly darker tones of orange.

As this is an affiliation network, it can be represented as a bipartite graph. This will be the focus of our analysis.

Management board networks

 

Interpretation of network properties

The network topology can give important insight on different aspects, including, but not limited to the structure of communities or information flows.

Clusters and bridges

A closer look to the top of the network reveals that Grupo Mundial and Grupo Argos have many members that belong to both boards, which reveals high connectivity between these two companies and thus they form a highly connected cluster. In this type of cluster, individuals tend to adopt the behavior of other individuals close to them and are resistant to outside influences.

There are other types of links offer different interpretations. If we look at Isaac Yanovich (darkest node) we see that he behaves as a bridge between two parts of the network. A bridge is a type of social tie that connects two different groups.

These nodes are of particular interest because they are central in the network in the sense that any information flow is expected to pass through them. In other words, any new information received by some node is very likely to come from a friend connected through a local bridge. Local bridges are important because they compose the shortest path between pairs of nodes in different parts of the network.

Nodes in a local bridge have riskier interactions in the network due to potentially contradictory norms and expectations from the different adjacent nodes associates.

Empirical studies of managers in large corporations have shown correlations of individual success within a company to their access to local bridges. Standing at one edge of a local bridge can also empower creativity and promote combination of multiple ideas.

Given their privileged access to a wide array of information sources, bridge nodes act as social gatekeepers and even prevent formation of triangles.

Triangles or triadic closures are important in networks as they are the simplest structure of a community. If two people in a social network have a friend in common it is very likely that they will become friends and start behaving similarly.

Triadic closures

Note that in the network of Colombian companies we can notice two types of clusters:

The first type, as shown in the previous example, is formed because of the similarity between companies (e.g. Grupo Mundial and Grupo Argos).

However, other clusters can be formed due to the presence of highly connected individuals. That is the case of Mónica de Greiff, Henry Navarro, Fernando Gómez and Ricardo Bonilla who are all linked to each other by simultaneously belonging to the management board of four different companies (Promigás, EEB, Emgesa, Codensa).

Clusters or closed communities are resistant to outside influences. Hence behavioral changes like the adoption of a new technology or the modification of an existing social norm can be slowed down and even blocked by the boundaries of a densely-connected community.

However, if there are incentives to adopt behaviors from neighbors, things can change dramatically and cascading effects can emerge. Given the appropriate conditions, certain behaviors can easily propagate through the network. This is the case of corruption incidents, where generally incentives to change the prevailing social norm tend to be much higher when these changes can benefit all the individuals in the network.

By using peer pressure, one could promote adoption of behaviors inside a community, enhancing the diffusion of a certain social norm for all individuals of the network.

Conflict of interest emerge mainly in bridges, where the structural balance of a group or community can be compromised because of emerging behaviors pushed by adjacent communities. Sources of stress are often related to unbalanced triangles, where among 3 individuals, 2 adopt a behavior but the third one is still reluctant. However unbalanced triangles are not the norm since people try no minimize them by either changing their behaviors or breaking up links.

This post aims to be the starting point for a discussion on future research of conflict of interest based on Social Network Analysis.

Network Science Glossary

Affiliation network Two mode networks that allow one to study the dual perspectives of the actors and the events (unlike one mode networks which focus on only one of them at a time).

Bipartite graph: A graph that does not contain any odd-length cycles.

Bridge: An edge whose removal would lead to two distinct components. An edge is a local bridge whenever it is not in a triadic closure.

Cascading effect: An unforeseen chain of events due to an act affecting a system.

Centrality The various types of measures of the centrality of a vertex within a graph determine the relative importance of a vertex within the graph.

Cluster: Individuals that have a lots of connections with each other forming a closed community. This behavior has been observed in several networks: diseases, gossip, technology, etc.

Triadic Closure: The property among three nodes A, B, and C, such that if a strong tie exists between A-B and A-C, there is a weak or strong tie between B-C.

Topology: The arrangement of the various elements (links, nodes, etc.) of a network.

El Twitter el 18A en Argentina

Exclusivo: todo lo que pasó en Twitter durante el 18A

¿Cuántos tuits se realizaron? ¿A qué hora? ¿Cuáles fueron los hashtags más usados?; descubrí el 18A por dentro, en un trabajo encargado por LA NACION

Centralidad de redes: El Cipayo en el 18A

Así vivió El Cipayo la marcha del 18A

LA NACION realizó el recorrido de la manifestación, que partió de Santa Fe y Callao, junto a quien dice ser el gestor de la protesta

Por Mauricio Giambartolomei  | LA NACION

 

El Cipayo, observando la concentración. Foto: LA NACION / Matías Aimar

"¿Quién puso la fecha de la marcha? La puse yo", dice El Cipayo.

En las redes sociales su presencia comenzó a ser fuerte desde el anonimato y aunque hoy se mantiene protegido por un nombre ficticio, ganó popularidad entre sus pares. Puede acceder a la primera fila de una columna de manifestantes, en la que están políticos y sindicalistas, dice ser el gestor del 18A -aunque la fecha fue elegida en votación- y se mueve entre la masa junto a un séquito de compañeros que lo apoyan en la logística virtual.

"Muchos políticos querían bajarse de la protesta, pero los convencimos a último momento. ¿Nombres? No, no te doy ninguno", sostiene el hombre que caminó anoche desde Callao y Santa Fe hasta el Congreso, pasando antes por el Obelisco, junto a miles de personas que sólo lo conocen por las redes sociales.

El Cipayo son varias personas, pero el origen se le atribuye a este hombre robusto, de unos 35 años, abogado, y sin alineación política, según confiesa. Junto con él, tres amigos lanzaron un blog en febrero de 2012 como una plataforma de opinión y se convirtió en uno de los principales motores de convocatoria de las manifestaciones anti-K. Debutaron el 31 de mayo pasado y desde allí, no faltaron a ninguna. La presencia más fuerte fue en las marchas del 13S y 8N.

Ya son un grupo organizado que aporta contactos -por sus vínculos políticos-, organización y comunicación. Por eso ayer el grupo de base se reunió una hora antes de las 19 en el Starbucks de Santa Fe y Callao para definir los últimos detalles. "Acá importan las ideas, no el líder como el concepto fascista de los kirchneristas", opina. "Tratamos de ir con algo más, no solo con la puteada".

Teléfono en mano, que no deja de sonar, El Cipayo observa la llegada de la gente. "¡Mirá los carteles! ¡Claro que sí!", exclama. Charla con dos hombres de boina y se enorgullece cuando le cuentan que viajaron de otras ciudades para estar en el 18A. "Mirá Cipayo, a este te lo trajé de Tapalqué", le grita un hombre de bombacha de campo.

Las 18.45 marcan el comienzo del ruido de las cacerolas en la esquina, uno de los puntos de encuentro. El hombre, de camisa celeste, jeans gastados y zapatos náuticos, se detiene en el medio de la calle para hacerle una observación a LA NACION : "Esto jamás puede ser espontáneo, pero si autoconvocados porque las personas no pertenecen a un sector en particular".

RELACIONES POLÍTICAS

Patricia Bullrich se anticipó a todos los políticos que acompañaron la columna. Al Cipayo le cuesta llegar hasta el lugar; estira el cuello, saca fotos con su tablet, saluda a una mujer que se arrima llevando un carrito y su bebé, y al fin logra estamparle un beso a la diputada. La música ya es molesta, sale como un ruido latoso de una furgoneta Volkswagen que en el techo tiene seis parlantes. A eso se le suman los estampidos de las cacerolas de las señoras. El ruido es insoportable.

Nada detiene al hombre que va detrás de su criatura, sumando popularidad. Por momentos lo rodean varias mujeres, como esa rubia artificial, con pañuelo animal print, camisa blanca y botas de caña de gamuza color marrón. El animal print abunda en esta esquina.

"A las siete nos vamos", se escucha. El locutor, que se suma al sonido latoso, ahora menciona varias veces a Lilita Carrió. La gente enardece. Y entra en éxtasis cuando aparece el "Momo" Venegas, rodeado de micrófonos, cámaras de televisión y, también, patovicas .

"De los que vinieron tenemos trato con todos", se arriesga a decir mientras se arrima a Silvana Giúdici y Federico Pinedo. La relación con ellos tiene varios años, de los anteriores trabajos de El Cipayo. Ahora muestra los dientes ante ellos, con una sonrisa ancha y abundante, surcada por grandes gotas de sudor.

Ya pasaron algunos minutos de las 19; el himno suena en el desvencijado furgón y la columna empuja para salir. Está impaciente. La primera línea sostiene una bandera. Allí está uno de los hombres que dicen haber gestado el 18A, entre el "Momo" y Giúdici, a unos pasos de Bullrich y a varios metros de Ricardo Gil Lavedra.

Al fin comienza el recorrido por la avenida Santa Fe. Con el puño en alto El Cipayo saluda a la gente en un balcón mientras no despega el teléfono de su oreja y sostiene a una mujer que va colgada del hombro.

Ahora la política camina custodiada por un cerco de hombres que parecen peleadores de catch. Los bíceps les explotan en las mangas y los pectorales sobresalen en las chombas. Parece que no tienen cuello.

"¿Qué pasó? No se puede caminar ahí, se pelean y todos quieren sacarse una foto con las caras conocidas", se queja. ¿Qué pasó? Entre la seguridad de uno y de otro hay encontronazos por la disputa territorial. Los cholulos de turno se llevan la foto de recuerdo y también, algunos empujones.

POPULARIDAD VIRTUAL

El perfil de Facebook de El Cipayo tiene cerca de 35.000 seguidores y en Twitter casi 7000. En la calle es muy popular. O al menos eso es lo que cree. La gente lo para, lo saluda, le grita y él gira moviendo los puños en alto. Camina por la 9 de Julio, frente al Teatro Colón, flanqueado por dos rubias paquetas. En una mano sostiene una bandera argentina enrollada y un cencerro de campo que hace sonar con fuerza. "Se va a acabar, se va a acabar, la dictadura de los K".

Las cuadras van quedando atrás y la próxima escala es el Obelisco, donde se encuentra con el resto de los Cipayos que cantan, otra vez, el himno argentino y muestran las dos palmas hacia delante al grito de "¡Libertad!". Todos se abrazan, festejan el éxito de la convocatoria y hacen planes. "Cerca de octubre organizamos otra marcha; en el medio tal vez una más".

A las 20.30 la concentración hace una pausa en la Plaza de la República para luego tomar Diagonal Norte. El objetivo es Plaza de Mayo, pero una barricada policial impide llegar. "Al Congreso, vamos todos al Congreso", vocifera El Cipayo y la gente a su alrededor grita. "Tiene media sanción la limitación a las cautelares, por eso vamos allá", explica.

El humo de los choripanes de la Avenida de Mayo acompaña el paso de los manifestantes. Pasan las banderas argentinas, los carteles anti-K y las cacerolas. Algunos quieren trepar las rejas del Congreso. Otros se comportan como personas. "La bestia está suelta. ¿Viste lo ordenados que somos? No tiramos ningún papel en el suelo", suelta antes de perderse entre el gentío..