7 ms·

From the beginning, the NSA should have held itself to having a primary purpose of cyber defense and deterrence. Even if it has some more aggressive programs ru

From the beginning, the NSA should have held itself to having a primary purpose of cyber defense and deterrence. Even if it has some more aggressive programs running sub rosa, those defensive programs should be its central focus, and it'd be easier to sell as a patriotic career choice if cyber defense was what the NSA was known for. Now we're left playing catch-up, and the NSA is mostly known for cyber espionage against global adversaries and domestic surveillance.

mr_overalls 8y ago
Cyber-espionage is a valid role, IMHO, but it should be separated from their defensive one. (Or the defensive role spun off into a different org altogether. I think there's just no other way way to manage the opposing incentives at work here.
- Valmar 8y ago
  > Cyber-espionage is a valid role Agreed, but the NSA doesn't seem to act like they care about defense, but wielding it only as a weapon. If they care about defense, I'd be interested to see any meaningful examples.
  - scarmig 8y ago
    > If they care about defense, I'd be interested to see any meaningful examples. https://www.nsa.gov/News-Features/News-Stories/Article-View/Article/1775584/ghidra-the-software-reverse-engineering-tool-youve-been-waiting-for-is-here/ https://www.nsa.gov/News-Features/News-Stories/Article-View/... They do do things that meaningfully improve defense. It's just not emphasized or funded nearly enough.
  - lern_too_spel 8y ago
    https://en.m.wikipedia.org/wiki/Security-Enhanced_Linux https://en.m.wikipedia.org/wiki/Security-Enhanced_Linux https://en.m.wikipedia.org/wiki/NSA_Suite_B_Cryptography https://en.m.wikipedia.org/wiki/NSA_Suite_B_Cryptography
- scarmig 8y ago
  I agree, provisionally. The NSA should play a variety of different roles (as it does!), and different parts of the organization should specialize in those roles. And some level of cyber-espionage is valid, though I think it's overemphasized. But improving IT security is less sexy than destroying adversaries' nuclear capabilities, and its easier to sell the (decidedly mixed) value of the latter stories than e.g. improving capabilities to identify and monitor foreign attackers.
- x220 8y ago
  "Valid role" is a meaningless term in the context of the NSA, which has broken the law for at least a decade with no consequences. The head of the NSA has lied to congress (which would put an ordinary man in prison). The NSA has spied and continues to spy on Americans in violation of several laws and court rulings. If the founding fathers were still alive, they'd be stacking bodies by now.
  - mr_overalls 8y ago
    I mean that the conducting of signals intelligence against national adversaries is a useful/common mission for any country's intelligence agencies. There seems to be little doubt - as you point out - that the NSA has also abused their mandate a bit by spying on Americans.
    - x220 8y ago
      >the NSA has also abused their mandate a bit by spying on Americans The largest share of the data they collect is about Americans. This is done without legitimate, meaningful oversight or probable cause. Most of their measurable activity is illegal and violates the rights of Americans. The difference between data collection in the PRC and in the USA is that the USA hasn't extensively acted on this information against its own citizens so far. This overall tone and emphasis is similar to hand-waving away mass police brutality and oppression by saying "buuuuut they keep us safe".
      - NotAnEconomist 8y ago
        > The largest share of the data they collect is about Americans. Could you provide a citation on this? > Most of their measurable activity is illegal and violates the rights of Americans. This is a useless metric: it's true of both healthy and unhealthy spy agencies; the former because we wouldn't hear about the useful and legal things they do, only the occasional whistleblowing, while the latter because of the point you're trying to make. (I also disagree it's true.) However, without a solid metric on their total classified activity, there's no way to determine if it's unhealthy or healthy.
navbaker 8y ago
NSA is a signals intelligence agency, so it makes sense that they would be known for cyber espionage.
- ldiracdelta 8y ago
  Against their own people in violation of the Constitution?
  - evolvedcleaning 8y ago
    Putting away meth dealers supercedes strict adherence to the constitution, by far, IMO, even if the police have to break the law to put the bad guys away. (Parallel reconstruction etc) The founding fathers didn’t have any conception for our information society. Extra judicial activity, With the corresponding regulatory body, is necessary to maintain parity with a morphing technological society
    - k988dfgj_s 8y ago
      Does it? Why do we have this venerated piece of paper then constantly paraded in front of us like it means anything then? Either it is a foundation and a supreme law, or it is not. I am not convinced that catching meth dealers is greater than a supreme law of the land.. or worth the cost of basically tossing entire framework of the country outside the window. edit: added more pompous language
    - komali2 8y ago
      >Putting away meth dealers supercedes strict adherence to the constitution, by far, IMO, even if the police have to break the law to put the bad guys away. (Parallel reconstruction etc) Ethically, I disagree with your argument. See: unlawful asset theft by police departments, which the supreme Court recently confirmed is illegal. But from a legal standpoint your argument doesn't hold water. The Constitution is THE binding legal document of the USA, from which literally every aspect of the US government, and thus justice system, derives authority. There is nothing but strict adherence to the Constitution, trying to work outside it might work for a bit but will end up with someone standing before the supreme Court to answer for it.
Nasrudith 8y ago
And really an emphasis on offense is downright /stupid/. There are several world leading sectors that the US depends on cybersecurity for (design, IT companies, and banking/finance for one). The priorities are exactly backwards - especially when GDP is national power.
- killjoywashere 8y ago
  > emphasis on offense That was General Hayden's call. He dedicates a fair amount of space to that decision in his memoir. His basic calculus was that defense is 1000x harder than offense, so skip defense and punish your adversary through effective offense. I think the Air Force "Air Power" doctrine may have interfered with his thinking, but who am I?
  - Nasrudith 8y ago
    I think that is excessive physicality based thinking paradigms. Rational but stupid ironically - based on past experience but not recognizing that it isn't applicable. With kinetics defense really is harder and you know who is attacking you more or less - the guys with the guns. Also it assumes a fundamental symmetry that doesn't even hold in conventional warfare. But it really isn't that way with information on several levels. Bulletproof security is hard but scales better. One patch and everything is immune. Needless to say that hasn't happened with bullets.
strictnein 8y ago
Cyber wasn't a thing when the NSA started. When its predecessors came about, the state of the art was intercepting telegrams (more or less).

mr_overalls 8y ago

Cyber-espionage is a valid role, IMHO, but it should be separated from their defensive one. (Or the defensive role spun off into a different org altogether. I think there's just no other way way to manage the opposing incentives at work here.

Valmar 8y ago
> Cyber-espionage is a valid role Agreed, but the NSA doesn't seem to act like they care about defense, but wielding it only as a weapon. If they care about defense, I'd be interested to see any meaningful examples.
- scarmig 8y ago
  > If they care about defense, I'd be interested to see any meaningful examples. https://www.nsa.gov/News-Features/News-Stories/Article-View/Article/1775584/ghidra-the-software-reverse-engineering-tool-youve-been-waiting-for-is-here/ https://www.nsa.gov/News-Features/News-Stories/Article-View/... They do do things that meaningfully improve defense. It's just not emphasized or funded nearly enough.
- lern_too_spel 8y ago
  https://en.m.wikipedia.org/wiki/Security-Enhanced_Linux https://en.m.wikipedia.org/wiki/Security-Enhanced_Linux https://en.m.wikipedia.org/wiki/NSA_Suite_B_Cryptography https://en.m.wikipedia.org/wiki/NSA_Suite_B_Cryptography
scarmig 8y ago
I agree, provisionally. The NSA should play a variety of different roles (as it does!), and different parts of the organization should specialize in those roles. And some level of cyber-espionage is valid, though I think it's overemphasized. But improving IT security is less sexy than destroying adversaries' nuclear capabilities, and its easier to sell the (decidedly mixed) value of the latter stories than e.g. improving capabilities to identify and monitor foreign attackers.
x220 8y ago
"Valid role" is a meaningless term in the context of the NSA, which has broken the law for at least a decade with no consequences. The head of the NSA has lied to congress (which would put an ordinary man in prison). The NSA has spied and continues to spy on Americans in violation of several laws and court rulings. If the founding fathers were still alive, they'd be stacking bodies by now.
- mr_overalls 8y ago
  I mean that the conducting of signals intelligence against national adversaries is a useful/common mission for any country's intelligence agencies. There seems to be little doubt - as you point out - that the NSA has also abused their mandate a bit by spying on Americans.
  - x220 8y ago
    >the NSA has also abused their mandate a bit by spying on Americans The largest share of the data they collect is about Americans. This is done without legitimate, meaningful oversight or probable cause. Most of their measurable activity is illegal and violates the rights of Americans. The difference between data collection in the PRC and in the USA is that the USA hasn't extensively acted on this information against its own citizens so far. This overall tone and emphasis is similar to hand-waving away mass police brutality and oppression by saying "buuuuut they keep us safe".
    - NotAnEconomist 8y ago
      > The largest share of the data they collect is about Americans. Could you provide a citation on this? > Most of their measurable activity is illegal and violates the rights of Americans. This is a useless metric: it's true of both healthy and unhealthy spy agencies; the former because we wouldn't hear about the useful and legal things they do, only the occasional whistleblowing, while the latter because of the point you're trying to make. (I also disagree it's true.) However, without a solid metric on their total classified activity, there's no way to determine if it's unhealthy or healthy.

navbaker 8y ago

NSA is a signals intelligence agency, so it makes sense that they would be known for cyber espionage.

ldiracdelta 8y ago
Against their own people in violation of the Constitution?
- evolvedcleaning 8y ago
  Putting away meth dealers supercedes strict adherence to the constitution, by far, IMO, even if the police have to break the law to put the bad guys away. (Parallel reconstruction etc) The founding fathers didn’t have any conception for our information society. Extra judicial activity, With the corresponding regulatory body, is necessary to maintain parity with a morphing technological society
  - k988dfgj_s 8y ago
    Does it? Why do we have this venerated piece of paper then constantly paraded in front of us like it means anything then? Either it is a foundation and a supreme law, or it is not. I am not convinced that catching meth dealers is greater than a supreme law of the land.. or worth the cost of basically tossing entire framework of the country outside the window. edit: added more pompous language
  - komali2 8y ago
    >Putting away meth dealers supercedes strict adherence to the constitution, by far, IMO, even if the police have to break the law to put the bad guys away. (Parallel reconstruction etc) Ethically, I disagree with your argument. See: unlawful asset theft by police departments, which the supreme Court recently confirmed is illegal. But from a legal standpoint your argument doesn't hold water. The Constitution is THE binding legal document of the USA, from which literally every aspect of the US government, and thus justice system, derives authority. There is nothing but strict adherence to the Constitution, trying to work outside it might work for a bit but will end up with someone standing before the supreme Court to answer for it.

Nasrudith 8y ago

And really an emphasis on offense is downright /stupid/. There are several world leading sectors that the US depends on cybersecurity for (design, IT companies, and banking/finance for one). The priorities are exactly backwards - especially when GDP is national power.

killjoywashere 8y ago
> emphasis on offense That was General Hayden's call. He dedicates a fair amount of space to that decision in his memoir. His basic calculus was that defense is 1000x harder than offense, so skip defense and punish your adversary through effective offense. I think the Air Force "Air Power" doctrine may have interfered with his thinking, but who am I?
- Nasrudith 8y ago
  I think that is excessive physicality based thinking paradigms. Rational but stupid ironically - based on past experience but not recognizing that it isn't applicable. With kinetics defense really is harder and you know who is attacking you more or less - the guys with the guns. Also it assumes a fundamental symmetry that doesn't even hold in conventional warfare. But it really isn't that way with information on several levels. Bulletproof security is hard but scales better. One patch and everything is immune. Needless to say that hasn't happened with bullets.

strictnein 8y ago

Cyber wasn't a thing when the NSA started. When its predecessors came about, the state of the art was intercepting telegrams (more or less).