4 ms·

That looks like a false dichotomy to me. I don't see any reason why the NSA's role couldn't include protecting the nation's citizens. I mean that's the original

That looks like a false dichotomy to me. I don't see any reason why the NSA's role couldn't include protecting the nation's citizens. I mean that's the original purpose of government, no?

sillysaurus3 9y ago
The purpose of the NSA is the same as the purpose of the military: To apply force in the digital arena, the same way the military applies force in the physical arena. In the same vein, the NSA isn't about protection. That's not their role, just like the point of the military isn't protection.
- infogulch 9y ago
  > the point of the military isn't protection I'd argue that it is, if indirectly.
  - sillysaurus3 9y ago
    It's true. We're all safer thanks to the enormous success of our military. That's why it's valuable, just like the NSA. So it leads to the same logical conclusions: If the point of the military is to apply force to an opponent, then the NSA has to have ways of applying force to a digital opponent. Disclosing vulnerabilities would be precisely the opposite of what they should do.
    - ionised 9y ago
      > We're all safer thanks to the enormous success of our military Examples from the last 50 years?
- extra88 9y ago
  NSA has dual roles, not only spying on others but also protecting U.S. resources. This creates this tension between keeping exploits secret or informing vendors and others. For a long time, security researchers like Bruce Schneier have advocated for splitting the NSA up, essentially one for offense and one for defense.
PeterisP 9y ago
NSA's role could include protecting the nation's citizens or whatever other role the US government decides to assign to NSA, but it currently does not. In addition to it's main role of collection of foreign intelligence data (which includes breaking encryption and finding/making vulnerabilities), it does have a secondary mission of protecting US government systems. Hopefully that does mean that they have ensured that US gov't systems have been patched against those vulnerabilities. For example, Microsoft patching the SMB vulnerability (including for WinXP) before it was made public was likely done after a report from NSA, and would be consistent with such a goal. Having "private" custom patches that would get installed in sensitive gov't systems but not made available to general public would also match this goal. However, the relationship of NSA and the main victims of WannaCry are at best neutral. For example, it seems reasonable that NSA should want companies like Spain's Telefonica to stay vulnerable to various exploits - their mission explicitly includes obtaining intelligence from (among other sources) foreign telecommunications operators, so if they had the ability to protect Telefonica, then doing so would go against the mission given to NSA by the congress.

That looks like a false dichotomy to me. I don't see any reason why the NSA's role couldn't include protecting the nation's citizens. I mean that's the original purpose of government, no?

sillysaurus3 9y ago

The purpose of the NSA is the same as the purpose of the military: To apply force in the digital arena, the same way the military applies force in the physical arena. In the same vein, the NSA isn't about protection. That's not their role, just like the point of the military isn't protection.

infogulch 9y ago
> the point of the military isn't protection I'd argue that it is, if indirectly.
- sillysaurus3 9y ago
  It's true. We're all safer thanks to the enormous success of our military. That's why it's valuable, just like the NSA. So it leads to the same logical conclusions: If the point of the military is to apply force to an opponent, then the NSA has to have ways of applying force to a digital opponent. Disclosing vulnerabilities would be precisely the opposite of what they should do.
  - ionised 9y ago
    > We're all safer thanks to the enormous success of our military Examples from the last 50 years?
extra88 9y ago
NSA has dual roles, not only spying on others but also protecting U.S. resources. This creates this tension between keeping exploits secret or informing vendors and others. For a long time, security researchers like Bruce Schneier have advocated for splitting the NSA up, essentially one for offense and one for defense.

PeterisP 9y ago

NSA's role could include protecting the nation's citizens or whatever other role the US government decides to assign to NSA, but it currently does not. In addition to it's main role of collection of foreign intelligence data (which includes breaking encryption and finding/making vulnerabilities), it does have a secondary mission of protecting US government systems. Hopefully that does mean that they have ensured that US gov't systems have been patched against those vulnerabilities. For example, Microsoft patching the SMB vulnerability (including for WinXP) before it was made public was likely done after a report from NSA, and would be consistent with such a goal. Having "private" custom patches that would get installed in sensitive gov't systems but not made available to general public would also match this goal. However, the relationship of NSA and the main victims of WannaCry are at best neutral. For example, it seems reasonable that NSA should want companies like Spain's Telefonica to stay vulnerable to various exploits - their mission explicitly includes obtaining intelligence from (among other sources) foreign telecommunications operators, so if they had the ability to protect Telefonica, then doing so would go against the mission given to NSA by the congress.