12 ms·

NSA’s top policy advisor: It’s time to start putting teeth in cyber deterrence

117 points by deanalevitt 8y ago

teumesios 8y ago
As if the NSA wasn't part of the problem to begin with.
czbond 8y ago
And here I was expecting a way to record keystroke noise via a tooth recorder.
- jerkstate 8y ago
  Wake up, Kent.. it's me, Jesus
  - sctb 8y ago
    Could you please not post unsubstantively like this? https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
mtgx 8y ago
> Citing the WannaCry and NotPetya malware attacks Wait, did he just use Wannacry as a reason for more NSA involvement in cyber defense? Wannacry exists because of the NSA. Its exploitation tools leaked (as it always happens, even to the NSA or the Chinese spy agencies) and then others used them to create the highly-effective Wannacry. So...thanks, but no thanks NSA! You're done enough already. Not to mention the fact that the NSA is actively trying to this day to sabotage security efforts both in standards bodies and in private organizations (see recent Simon and Speck controversy, or how they asked Yahoo to put a backdoor in their email servers, Dual_EC scandal, etc).
scarmig 8y ago
From the beginning, the NSA should have held itself to having a primary purpose of cyber defense and deterrence. Even if it has some more aggressive programs running sub rosa, those defensive programs should be its central focus, and it'd be easier to sell as a patriotic career choice if cyber defense was what the NSA was known for. Now we're left playing catch-up, and the NSA is mostly known for cyber espionage against global adversaries and domestic surveillance.
- mr_overalls 8y ago
  Cyber-espionage is a valid role, IMHO, but it should be separated from their defensive one. (Or the defensive role spun off into a different org altogether. I think there's just no other way way to manage the opposing incentives at work here.
  - Valmar 8y ago
    > Cyber-espionage is a valid role Agreed, but the NSA doesn't seem to act like they care about defense, but wielding it only as a weapon. If they care about defense, I'd be interested to see any meaningful examples.
    - scarmig 8y ago
      > If they care about defense, I'd be interested to see any meaningful examples. https://www.nsa.gov/News-Features/News-Stories/Article-View/Article/1775584/ghidra-the-software-reverse-engineering-tool-youve-been-waiting-for-is-here/ https://www.nsa.gov/News-Features/News-Stories/Article-View/... They do do things that meaningfully improve defense. It's just not emphasized or funded nearly enough.
    - lern_too_spel 8y ago
      https://en.m.wikipedia.org/wiki/Security-Enhanced_Linux https://en.m.wikipedia.org/wiki/Security-Enhanced_Linux https://en.m.wikipedia.org/wiki/NSA_Suite_B_Cryptography https://en.m.wikipedia.org/wiki/NSA_Suite_B_Cryptography
  - 8y ago
adrianN 8y ago
How about the NSA and similar institutions in other countries don't hoard zerodays and instead actively work to improve security? Defending against hackers is a lot easier than defending against nuclear missiles. We don't need an active deterrence if the defenses are good.
- zelon88 8y ago
  While I agree and I hate the NSA's practice of hoarding zero days, they do this to keep software vulnerable on purpose. They've invested millions in uncovering zero days SPECIFICALLY so they could then spend millions more to be the only ones exploiting these vulnerabilities. If they share the zero day, the vendor will write a patch and it's game-over for their multi-million dollar exploit. Don't get me wrong, it's entirely inappropriate for an American government agency to be subverting the security of American products made by American companies and used by the American public. We have a unique opportunity that no other country has to coordinate our secret intelligence work with the private sector to completely own the security industry, but we allow our government to take an adversarial approach to defense. It's insane and criminal, but that's how it is. Imagine how effective an intelligence campaign would be against, say, Iran, if the NSA went to Microsoft, disclosed a vuln, and then told them to patch the vuln ONLY in specific markets. Roll out the patch to American companies first, but leave select targets still vulnerable. No other country could get Microsoft to do that except the United States... And we waste that opportunity by trying to lone-wolf everything.
  - AndrewGaspar 8y ago
    I'm sorry, but this seems a little naive. 1) It assumes that the NSA would only want to exploit a vulnerability exactly once, 2) this behavior would be fairly obvious since hackers examine patch payloads, and 3) this behavior on the part of American tech would undermine their credibility globally. Wouldn't you reasonably be very skeptical of Microsoft if you were a foreign government if you knew they were actively working with the American government to pwn you? The status quo of a semi-adversarial relationship between the NSA and tech companies for offensive cyber capabilities seems better to me for both parties. Of course it would be good if they were collaborating on defensive cyber security.
trumped 8y ago
> The midterms were just a warmup, NSA's Joyce warns, as work begins to defend 2020 election. defend against the republicans lol
leroy_masochist 8y ago
The greatest trick the SIGINT Enterprise ever pulled was convincing the world that its capabilities were in danger of being outclassed by the Chinese, Russians, Iranians, Israelis, etc. Nice to see they're still at it.
omouse 8y ago
The best offense is a good defense, so the sooner they start patching software, the better. The sooner they get developers to use safer languages, the better. But that's not gonna happen, it's apparently too costly to develop safe and secure software, but the damage caused by poor cybersecurity is somehow an externalized cost which means it costs nothing in the current equation.
craftinator 8y ago
Glad it's finally fucking time to do something about it, asshole
espeed 8y ago
Foreign actors hacking some servers and systems and placing malware is one thing -- that's been going on for a long time, and it's not unexpected -- but having the insight and expertise to run a campaign that exerts more influence than the entire media and PR industry put together, well that's something else. That would require something above and beyond -- we're not that fragile. Consider this... NB: These are the same questions I posed in a thread a few days ago (https://news.ycombinator.com/item?id=19282809 https://news.ycombinator.com/item?id=19282809). Do you know the size of the Russian economy? https://en.wikipedia.org/wiki/Economy_of_Russia https://en.wikipedia.org/wiki/Economy_of_Russia How many individual US states have an economy larger than Russia? https://en.wikipedia.org/wiki/Comparison_between_U.S._states_and_sovereign_states_by_GDP_(nominal) https://en.wikipedia.org/wiki/Comparison_between_U.S._states... And the size of the PR industry? https://www.statista.com/topics/3521/public-relations/ https://www.statista.com/topics/3521/public-relations/ We invented the modern PR industry, AI, and social media. And the PR industry has been perfecting the design of campaigns for 100 years. That's our bailiwick. You think Russia outclassed us at our own game, at home on our own platforms, on the biggest stage, in the highest stakes game of all? And then to pull that off with no one noticing or countering it in the most measured world of all time? That would be like the Russian basketball team [0] beating the US Dream Team [1] in all of our major sports combined, at the same time. Not gonna happen. And to what extent would a feat like that even be possible for someone from the US? And if some super-genius person or group of US citizens with the combination of intimate understanding, sophistication and skill did exist, then why wouldn't they just work for the campaign? And if one in the US could pull that off, why think Russia could? [0] Russian Basketball https://en.wikipedia.org/wiki/Russia_national_basketball_team https://en.wikipedia.org/wiki/Russia_national_basketball_tea... [1] US Dream Team https://en.wikipedia.org/wiki/1992_United_States_men%27s_Olympic_basketball_team https://en.wikipedia.org/wiki/1992_United_States_men%27s_Oly...
- jopsen 8y ago
  I think you have some very valid points :) But, tech is not like basketball. If you automate an approach for exerting influence you can scale differently. That said, I agree Western democracies are not that fragile :) Honestly, I wonder why Russia dares poke the bear.. they are unlikely to exert significant influence -- but they are likely to be painted as villains and voters will remember that.
abugheratwork 8y ago
> Joyce expressed the pride the NSA's workforce took in "delivering a midterm election that was free of malfeasance and interference" [...] Oh, that's good. I was just imagining all the news out of Georgia, then.
- TACIXAT 8y ago
  I know this is tongue in cheek, but the NSA's mission has to do with foreign interference. They are far less authorized to do anything involving US citizens.
  - jonathanwallace 8y ago
    There's a bunch of relevant information but here's the one showing nation-state interest in Georgia. https://www.ajc.com/news/state--regional-govt--politics/russian-agent-visited-election-websites-georgia-counties-2016/slgj3hy2KIzidtSFrvNG6M/ https://www.ajc.com/news/state--regional-govt--politics/russ...
- jessaustin 8y ago
  North Carolina, too! It's as if the narrative doesn't require any connection at all to reality...
mgleason_3 8y ago
I'm not a security expert, but even a layperson has to wonder if the NSA can actually be successful. Apparently, he thinks the "defend forward to disrupt or halt malicious cyber activity" strategy was effective for mid-terms. Was it actually? Or, did "... the responses come, if ever, after the costs [of those attacks] are already realized." If it was effective, how long will it take for the adversaries to work around it (which apparently he acknowledges in the last paragraph)? Even if they somehow walled all traffic off from Russia and North Korea, wouldn't they just exploiting unwitting computers as 'hop points' to get around the limitations? Maybe I'm missing something? Maybe there's some "teeth" that can provide cyber deterrence I don't know about?
GrryDucape 8y ago
Since WW2 the difference between war and peace have been more and more blurred. Proxy wars, drones and "cyber warfare" have made open conflicts directly between superpowers almost non-existent. Classic warfare, atomic, biological and chemical weapons all have rules and a loads of regulations. The "cyber" sector have a long process ahead to catch up. Unfortunately no one seems interested in being really serious about it it, but I certainly wish they will start work on it. Hopefully we will never experience an all-out "cyber war". Probably a new kind scenario with massive damages to infra structure, lots of civilian casualties and almost no losses among military personal.

117 points by deanalevitt 8y ago

teumesios 8y ago

As if the NSA wasn't part of the problem to begin with.

czbond 8y ago

And here I was expecting a way to record keystroke noise via a tooth recorder.

jerkstate 8y ago
Wake up, Kent.. it's me, Jesus
- sctb 8y ago
  Could you please not post unsubstantively like this? https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

mtgx 8y ago

> Citing the WannaCry and NotPetya malware attacks Wait, did he just use Wannacry as a reason for more NSA involvement in cyber defense? Wannacry exists because of the NSA. Its exploitation tools leaked (as it always happens, even to the NSA or the Chinese spy agencies) and then others used them to create the highly-effective Wannacry. So...thanks, but no thanks NSA! You're done enough already. Not to mention the fact that the NSA is actively trying to this day to sabotage security efforts both in standards bodies and in private organizations (see recent Simon and Speck controversy, or how they asked Yahoo to put a backdoor in their email servers, Dual_EC scandal, etc).

scarmig 8y ago

From the beginning, the NSA should have held itself to having a primary purpose of cyber defense and deterrence. Even if it has some more aggressive programs running sub rosa, those defensive programs should be its central focus, and it'd be easier to sell as a patriotic career choice if cyber defense was what the NSA was known for. Now we're left playing catch-up, and the NSA is mostly known for cyber espionage against global adversaries and domestic surveillance.

mr_overalls 8y ago
Cyber-espionage is a valid role, IMHO, but it should be separated from their defensive one. (Or the defensive role spun off into a different org altogether. I think there's just no other way way to manage the opposing incentives at work here.
- Valmar 8y ago
  > Cyber-espionage is a valid role Agreed, but the NSA doesn't seem to act like they care about defense, but wielding it only as a weapon. If they care about defense, I'd be interested to see any meaningful examples.
  - scarmig 8y ago
    > If they care about defense, I'd be interested to see any meaningful examples. https://www.nsa.gov/News-Features/News-Stories/Article-View/Article/1775584/ghidra-the-software-reverse-engineering-tool-youve-been-waiting-for-is-here/ https://www.nsa.gov/News-Features/News-Stories/Article-View/... They do do things that meaningfully improve defense. It's just not emphasized or funded nearly enough.
  - lern_too_spel 8y ago
    https://en.m.wikipedia.org/wiki/Security-Enhanced_Linux https://en.m.wikipedia.org/wiki/Security-Enhanced_Linux https://en.m.wikipedia.org/wiki/NSA_Suite_B_Cryptography https://en.m.wikipedia.org/wiki/NSA_Suite_B_Cryptography
- 8y ago

adrianN 8y ago

How about the NSA and similar institutions in other countries don't hoard zerodays and instead actively work to improve security? Defending against hackers is a lot easier than defending against nuclear missiles. We don't need an active deterrence if the defenses are good.

zelon88 8y ago
While I agree and I hate the NSA's practice of hoarding zero days, they do this to keep software vulnerable on purpose. They've invested millions in uncovering zero days SPECIFICALLY so they could then spend millions more to be the only ones exploiting these vulnerabilities. If they share the zero day, the vendor will write a patch and it's game-over for their multi-million dollar exploit. Don't get me wrong, it's entirely inappropriate for an American government agency to be subverting the security of American products made by American companies and used by the American public. We have a unique opportunity that no other country has to coordinate our secret intelligence work with the private sector to completely own the security industry, but we allow our government to take an adversarial approach to defense. It's insane and criminal, but that's how it is. Imagine how effective an intelligence campaign would be against, say, Iran, if the NSA went to Microsoft, disclosed a vuln, and then told them to patch the vuln ONLY in specific markets. Roll out the patch to American companies first, but leave select targets still vulnerable. No other country could get Microsoft to do that except the United States... And we waste that opportunity by trying to lone-wolf everything.
- AndrewGaspar 8y ago
  I'm sorry, but this seems a little naive. 1) It assumes that the NSA would only want to exploit a vulnerability exactly once, 2) this behavior would be fairly obvious since hackers examine patch payloads, and 3) this behavior on the part of American tech would undermine their credibility globally. Wouldn't you reasonably be very skeptical of Microsoft if you were a foreign government if you knew they were actively working with the American government to pwn you? The status quo of a semi-adversarial relationship between the NSA and tech companies for offensive cyber capabilities seems better to me for both parties. Of course it would be good if they were collaborating on defensive cyber security.

trumped 8y ago

> The midterms were just a warmup, NSA's Joyce warns, as work begins to defend 2020 election. defend against the republicans lol

leroy_masochist 8y ago

The greatest trick the SIGINT Enterprise ever pulled was convincing the world that its capabilities were in danger of being outclassed by the Chinese, Russians, Iranians, Israelis, etc. Nice to see they're still at it.

omouse 8y ago

The best offense is a good defense, so the sooner they start patching software, the better. The sooner they get developers to use safer languages, the better. But that's not gonna happen, it's apparently too costly to develop safe and secure software, but the damage caused by poor cybersecurity is somehow an externalized cost which means it costs nothing in the current equation.

craftinator 8y ago

Glad it's finally fucking time to do something about it, asshole

espeed 8y ago

Foreign actors hacking some servers and systems and placing malware is one thing -- that's been going on for a long time, and it's not unexpected -- but having the insight and expertise to run a campaign that exerts more influence than the entire media and PR industry put together, well that's something else. That would require something above and beyond -- we're not that fragile. Consider this... NB: These are the same questions I posed in a thread a few days ago (https://news.ycombinator.com/item?id=19282809 https://news.ycombinator.com/item?id=19282809). Do you know the size of the Russian economy? https://en.wikipedia.org/wiki/Economy_of_Russia https://en.wikipedia.org/wiki/Economy_of_Russia How many individual US states have an economy larger than Russia? https://en.wikipedia.org/wiki/Comparison_between_U.S._states_and_sovereign_states_by_GDP_(nominal) https://en.wikipedia.org/wiki/Comparison_between_U.S._states... And the size of the PR industry? https://www.statista.com/topics/3521/public-relations/ https://www.statista.com/topics/3521/public-relations/ We invented the modern PR industry, AI, and social media. And the PR industry has been perfecting the design of campaigns for 100 years. That's our bailiwick. You think Russia outclassed us at our own game, at home on our own platforms, on the biggest stage, in the highest stakes game of all? And then to pull that off with no one noticing or countering it in the most measured world of all time? That would be like the Russian basketball team [0] beating the US Dream Team [1] in all of our major sports combined, at the same time. Not gonna happen. And to what extent would a feat like that even be possible for someone from the US? And if some super-genius person or group of US citizens with the combination of intimate understanding, sophistication and skill did exist, then why wouldn't they just work for the campaign? And if one in the US could pull that off, why think Russia could? [0] Russian Basketball https://en.wikipedia.org/wiki/Russia_national_basketball_team https://en.wikipedia.org/wiki/Russia_national_basketball_tea... [1] US Dream Team https://en.wikipedia.org/wiki/1992_United_States_men%27s_Olympic_basketball_team https://en.wikipedia.org/wiki/1992_United_States_men%27s_Oly...

jopsen 8y ago
I think you have some very valid points :) But, tech is not like basketball. If you automate an approach for exerting influence you can scale differently. That said, I agree Western democracies are not that fragile :) Honestly, I wonder why Russia dares poke the bear.. they are unlikely to exert significant influence -- but they are likely to be painted as villains and voters will remember that.

abugheratwork 8y ago

> Joyce expressed the pride the NSA's workforce took in "delivering a midterm election that was free of malfeasance and interference" [...] Oh, that's good. I was just imagining all the news out of Georgia, then.

TACIXAT 8y ago
I know this is tongue in cheek, but the NSA's mission has to do with foreign interference. They are far less authorized to do anything involving US citizens.
- jonathanwallace 8y ago
  There's a bunch of relevant information but here's the one showing nation-state interest in Georgia. https://www.ajc.com/news/state--regional-govt--politics/russian-agent-visited-election-websites-georgia-counties-2016/slgj3hy2KIzidtSFrvNG6M/ https://www.ajc.com/news/state--regional-govt--politics/russ...
jessaustin 8y ago
North Carolina, too! It's as if the narrative doesn't require any connection at all to reality...

mgleason_3 8y ago

I'm not a security expert, but even a layperson has to wonder if the NSA can actually be successful. Apparently, he thinks the "defend forward to disrupt or halt malicious cyber activity" strategy was effective for mid-terms. Was it actually? Or, did "... the responses come, if ever, after the costs [of those attacks] are already realized." If it was effective, how long will it take for the adversaries to work around it (which apparently he acknowledges in the last paragraph)? Even if they somehow walled all traffic off from Russia and North Korea, wouldn't they just exploiting unwitting computers as 'hop points' to get around the limitations? Maybe I'm missing something? Maybe there's some "teeth" that can provide cyber deterrence I don't know about?

GrryDucape 8y ago

Since WW2 the difference between war and peace have been more and more blurred. Proxy wars, drones and "cyber warfare" have made open conflicts directly between superpowers almost non-existent. Classic warfare, atomic, biological and chemical weapons all have rules and a loads of regulations. The "cyber" sector have a long process ahead to catch up. Unfortunately no one seems interested in being really serious about it it, but I certainly wish they will start work on it. Hopefully we will never experience an all-out "cyber war". Probably a new kind scenario with massive damages to infra structure, lots of civilian casualties and almost no losses among military personal.