3 ms·
> As a US citizen, you can't report attacks carried out by US intelligence agencies. Sure you can. Short of a gag order (and maybe not even then) you can repor
by kabdib 8y ago
> As a US citizen, you can't report attacks carried out by US intelligence agencies.
Sure you can. Short of a gag order (and maybe not even then) you can report intrusions all you like.
In any event, how does one determine the nationality of hardware that shouldn't be there? It's not like there's going to be a snarky "Designed by the NSA in Fort Meade" logo on the chips in question.
- crankylinuxuser 8y agoIf (IF!) you hold a civilian or military clearance, then you have a legal Duty to Report (DTR). That holds true whether its data in your clearance level or not. You also abide by a whole slew of laws regarding sensitive, secret, top secret, or SCIF information. If I knowingly, or even suspect, some information if classified, and I transmit it to anyone else than my federal assigned contact, I'm breaking major federal laws. A lot of security professionals in the US have such clearances. So finding a NSA implant or such proof makes it dangerous to talk about by default. So yeah, a gag order by profession.
- flukus 8y agoAre you really a white-hat if you have to disclose vulnerabilities to an organisation known to exploit (or at least hoard) them?
- crankylinuxuser 8y agoPlease quote me where I claimed to be a white hat.
- flukus 8y agoYou didn't, but the context was: > This claim seems like a big dilemma for US white-hat security researchers It seems like the two are mutually exclusive.
- igravious 8y ago“Are you really” => “Is one really” https://dictionary.cambridge.org/grammar/british-grammar/pronouns/pronouns-one-you-we-they https://dictionary.cambridge.org/grammar/british-grammar/pro... https://www.quickanddirtytips.com/education/grammar/one-versus-you https://www.quickanddirtytips.com/education/grammar/one-vers...
- Godel_unicode 8y agoVulnerabilities and weaponized implants are very different things.