3 ms·

So let's say it was the NSA who did it. You think they haven't already sent Juniper an NSL telling them to cease discussing this incident? Personally, I'll be

So let's say it was the NSA who did it. You think they haven't already sent Juniper an NSL telling them to cease discussing this incident? Personally, I'll be rather surprised if we hear any more about this from Juniper than we already have.

rdtsc 11y ago
They have a lot to lose if they keep quiet -- customers, credibility, future business, etc. What are the powers of NSL, can they be given to any entity / person / company for any reason at all and also gag them from discussion getting the NSL? What are the penalties for a company breaking the NSL silence? Jailing the CEO? NSA sending it would also reveal quite a lot and jeopardise their future operations, it seems they'd want to have plausable deniability of some sort.
- tazjin 11y ago
  Not sure what the penalties for disclosing an NSL are, but companies sometimes use warrant canaries[1] for this purpose. Notably the one used by Apple disappeared some time last year. [1]: https://en.wikipedia.org/wiki/Warrant_canary https://en.wikipedia.org/wiki/Warrant_canary
cmurf 11y ago
Considering FBI is investigating, other one hand doesn't know what the other is doing, or at least if not more likely the other handticles of the U.S. (and other governments) have been depending on some versions of affected hardware for some time.
- sandworm101 11y ago
  Don't assume that the FBI and NSA get along. There is constant infighting wherever intel/LE agencies overlap. The FBI is a couple steps down the pyramid from the NSA, and so would want to score a few points. These are also vast organizations. Even if the NSA was behind this, there is a reasonable chance the official hierarchy doesn't know whether or not they were involved. This exploit could even be the result of a mistake, code never meant to be deployed.
  - techdragon 11y ago
    There is inherent levels of deniability in the operations of such a code word clearance heavy organisation. It's entirely possible >75% have no idea the full capabilities and less than 5% know the impact any individual program has on the overall capability of the organisation.
    - rdtsc 11y ago
      That's how it should be if it runs like it is supposed to. Compartmentalization is one of the basics of running a 3-letter agency.
mtgx 11y ago
I think new NSLs have been limited to 3 years now, but I doubt Juniper will ever say it was the NSA, or even that the backdoor that others used was because of an NSA algorithm (which would make both them and the NSA look bad). So in the end it will be more about Juniper's reluctance to say than it being gagged. Companies that sell a lot to the US government have a tendency to make more "compromises" to protect the government, too, or do what the government says. See BlackBerry and its new found (or maybe older than we think) "anti-privacy"/pro-lawful intercept stance.
michaelt 11y ago
Doing that would be implicitly admitting they'd made America less safe, which might lead to them having less power. If I was the NSA I'd blame those sneaky commies, because that might lead to me getting more power. I'd say "this Chinese attack wouldn't have gone undetected for so long if the NSA had access to Juniper's source code repos, and monitored on all their employees, to check for sleeper agents"

rdtsc 11y ago

They have a lot to lose if they keep quiet -- customers, credibility, future business, etc. What are the powers of NSL, can they be given to any entity / person / company for any reason at all and also gag them from discussion getting the NSL? What are the penalties for a company breaking the NSL silence? Jailing the CEO? NSA sending it would also reveal quite a lot and jeopardise their future operations, it seems they'd want to have plausable deniability of some sort.

tazjin 11y ago
Not sure what the penalties for disclosing an NSL are, but companies sometimes use warrant canaries[1] for this purpose. Notably the one used by Apple disappeared some time last year. [1]: https://en.wikipedia.org/wiki/Warrant_canary https://en.wikipedia.org/wiki/Warrant_canary

cmurf 11y ago

Considering FBI is investigating, other one hand doesn't know what the other is doing, or at least if not more likely the other handticles of the U.S. (and other governments) have been depending on some versions of affected hardware for some time.

sandworm101 11y ago
Don't assume that the FBI and NSA get along. There is constant infighting wherever intel/LE agencies overlap. The FBI is a couple steps down the pyramid from the NSA, and so would want to score a few points. These are also vast organizations. Even if the NSA was behind this, there is a reasonable chance the official hierarchy doesn't know whether or not they were involved. This exploit could even be the result of a mistake, code never meant to be deployed.
- techdragon 11y ago
  There is inherent levels of deniability in the operations of such a code word clearance heavy organisation. It's entirely possible >75% have no idea the full capabilities and less than 5% know the impact any individual program has on the overall capability of the organisation.
  - rdtsc 11y ago
    That's how it should be if it runs like it is supposed to. Compartmentalization is one of the basics of running a 3-letter agency.

mtgx 11y ago

I think new NSLs have been limited to 3 years now, but I doubt Juniper will ever say it was the NSA, or even that the backdoor that others used was because of an NSA algorithm (which would make both them and the NSA look bad). So in the end it will be more about Juniper's reluctance to say than it being gagged. Companies that sell a lot to the US government have a tendency to make more "compromises" to protect the government, too, or do what the government says. See BlackBerry and its new found (or maybe older than we think) "anti-privacy"/pro-lawful intercept stance.

michaelt 11y ago

Doing that would be implicitly admitting they'd made America less safe, which might lead to them having less power. If I was the NSA I'd blame those sneaky commies, because that might lead to me getting more power. I'd say "this Chinese attack wouldn't have gone undetected for so long if the NSA had access to Juniper's source code repos, and monitored on all their employees, to check for sleeper agents"