4 ms·
The edit window just expired as I attempted to amend my original comment, so I'll amend it here: Those links were the result of a few cursory Google searches.
by rl3 10y ago
The edit window just expired as I attempted to amend my original comment, so I'll amend it here:
Those links were the result of a few cursory Google searches. It wasn't intended as a comprehensive representation of Cisco's CIA ties, nor to imply that anyone mentioned was directly involved in backdoors. Rather, the point was that when a security-oriented organization employs ex-spooks, it increases the likelihood of spooky things happening. At the very minimum it fosters distrust.
>2. Why would the ex-CIA guy hurt his current employer to help his former? Don't people do it the other way around?
While I didn't mean to imply any specific individual, I'll address the underlying rationale: When someone's former employer is a powerful government spy agency built on secrets, the loyalty dynamic is a bit different than that of normal private sector job hopping.
Moreover, I'm sure the CIA isn't stupid and tends to maintain relationships—intentionally or not—with former employees that cross over to private sector work, especially high-level people since they're already trusted, reliable, and may be taking positions that later prove to be beneficial to CIA interests in the future.
>3. Good luck finding a single Fortune 500 company that doesn't employ someone that used to be in the Intelligence Community.
This is a fair point. Given the nature of Cisco's products, and combined with recent leaks detailing the pervasive nature of US offensive cyber efforts, it should raise more suspicion than normal when former IC people go to work for a company dealing with network hardware.
That said, I'm not sure how you'd quantify the number of former IC people Cisco hires versus a normal Fortune 500 company. For all I know it could even be lower than average.
>... and backdoor dependent on physical sabotage (interdiction) ...
This approach is far superior to baking vulnerabilities into entire product ranges (or even standards). It doesn't compromise the private sector in the process, beyond perhaps supply chain integrity. The flipside of course is that physical implants don't really scale well, but at least the blowback is relatively minimal when things go wrong. Not to mention it's just badass in a James Bond kind of way.
>It's a common HN meme that Cisco and Microsoft help the U.S. government spy, but there isn't credible evidence supporting it. They actively resist government espionage attempts.
While that's true, it's also possible a company can publicly say or do one thing—genuine or not—and actively do another because of either connections, or that they're being compelled against their will by NSLs. It's also possible to have factions or even individual employees within a company that are actively subverting security with the addition of backdoors, unbeknownst to management.
- linkregister 10y agoThanks for a reasoned response. I admit I get emotional when people and organizations get unfairly accused. > it should raise more suspicion than normal when former IC people go to work for a company dealing with network hardware. Fair enough about the perception of former IC employees entering the private sector. For the most part, "former IC employee" only impacts an organization once something else newsworthy occurs. Cisco considered the risk to be low that the CIA would pay a former official to order Cisco employees to insert a backdoor without a single one reporting this outside their chain. Personally, I think it benefits companies to hire employees with a diversity of backgrounds. > [backdoor] approach is far superior ... [they] just don't scale well ... it's just badass. The lack of scalability is a feature if you ask me. It should be expensive and difficult enough to limit espionage to those target that matter. And it's more palatable to the people who these agencies ultimately report to.
- andreyf 10y ago> At the very minimum it fosters distrust. why? how is someone who has been vetted by the IC as a trustworthy keeper of their secrets become less trustworthy? > CIA isn't stupid and tends to maintain relationships with former employees that cross over to private sector work what kind of "relationships" are you talking about here?
- samstave 10y ago>why? how is someone who has been vetted by the IC as a trustworthy keeper of their secrets become less trustworthy? once any single person enters the IC, they have lost trust of anyone outside of the IC... simple - and answers your other question as well...
- rl3 10y ago>why? how is someone who has been vetted by the IC as a trustworthy keeper of their secrets become less trustworthy? Because their loyalties may lie with their former employer. National security matters tend to take priority over private sector loyalty for many people, and I'd imagine especially so for former IC types since they tend to be extremely patriotic. I mean that as a compliment, not an insult. >what kind of "relationships" are you talking about here? Personal relationships. Say Joe retires for private sector work. He's good friends with Bill, who's a case officer. Later when some national security matter comes down the pipe requiring access at Company Y, Bill knows Joe who works there. Seeing that Bill and Joe have been through some shit together, that relationship is probably going to supersede loyalty to any private sector employer when there are underlying national security motivations involved. It's not tinfoil hat conspiracy allegations, just basic human dynamics.