4 ms·

> And yet, near completely useless as shown by cases known to wide public. Just because a system isn't foolproof, doesn't mean it's useless. There are certain

> And yet, near completely useless as shown by cases known to wide public. Just because a system isn't foolproof, doesn't mean it's useless. There are certainly many improvements that can be made to how we protect secrets and conduct investigations into individuals but what we have in place now is far from useless.

tgragnato 8y ago
> When he received a LinkedIn message from a Chinese headhunter. At the beginning I wondered how can the Chinese know who to contact.. On LinkedIn! Then a glimpse at the OPM data breach made my realise that the system might not be useless, but certainly dated and suitable to a very different threat model. It's not easy to update your operating procedures to an information asymmetry at your disadvantage, after decades of advantage in info gathering. Realising that, the top comment starts to make a lot more sense, even if at first sight it's potentially unrelated to the topic: they need to be much more careful about all sorts of things.
- caymanjim 8y ago
  Because people who worked for the CIA have resumes too. Do you think they all have cover jobs? Sure, some do, but most people don't. I've worked for a number of defense intelligence agencies. In my case, indirectly via commercial entities, but it's not hard to read between the lines. We dealt with classified information, but the fact that I worked for them isn't classified, and the nature of the projects isn't classified. I put this all on my resume, and so does almost everyone else who works in intelligence. It's just another career.
  - tgragnato 8y ago
    That's the point. The US has a loose approach. China is aggressive and takes advantage of every weakness. This is not an isolated case, as you will be well aware. https://www.justice.gov/opa/pr/state-department-employee-arrested-and-charged-concealing-extensive-contacts-foreign-agents https://www.justice.gov/opa/pr/state-department-employee-arr... https://sinosphere.blogs.nytimes.com/2014/04/15/using-china-as-an-example-f-b-i-video-warns-americans-about-study-abroad/ https://sinosphere.blogs.nytimes.com/2014/04/15/using-china-... https://www.nytimes.com/2017/05/20/world/asia/china-cia-spies-espionage.html https://www.nytimes.com/2017/05/20/world/asia/china-cia-spie... > "the country’s extensive security apparatus makes it exceptionally hard for Western spy services to develop sources there" That's why I wrote it's an asymmetry.
- deleted 8y ago
  [deleted]
lsc 8y ago
>Just because a system isn't foolproof, doesn't mean it's useless. I think this is... a common mistake people make. It's a common mistake I make, really, to look at a system for preventing a bad thing, see a hole, and then argue that system is worthless. All systems have holes, and just 'cause a system has a hole you can see, that doesn't mean the system doesn't have value.A system that prevents 80% of the bad things it was designed to prevent can be really useful.
fencepost 8y ago
Just because a system isn't foolproof, doesn't mean it's useless. It's just like network security - you take every precaution you reasonably can to prevent breaches, but you also plan for when measures fail. Locks on the doors don't mean you can skip drive encryption, managed antivirus doesn't mean you skip monitoring for ransomware activity or exfiltration, RAID doesn't mean you skip backups. You want not just the belt and suspenders but also properly fitted pants and underwear so no single point of failure leaves your secrets visible to the world.

tgragnato 8y ago

> When he received a LinkedIn message from a Chinese headhunter. At the beginning I wondered how can the Chinese know who to contact.. On LinkedIn! Then a glimpse at the OPM data breach made my realise that the system might not be useless, but certainly dated and suitable to a very different threat model. It's not easy to update your operating procedures to an information asymmetry at your disadvantage, after decades of advantage in info gathering. Realising that, the top comment starts to make a lot more sense, even if at first sight it's potentially unrelated to the topic: they need to be much more careful about all sorts of things.

caymanjim 8y ago
Because people who worked for the CIA have resumes too. Do you think they all have cover jobs? Sure, some do, but most people don't. I've worked for a number of defense intelligence agencies. In my case, indirectly via commercial entities, but it's not hard to read between the lines. We dealt with classified information, but the fact that I worked for them isn't classified, and the nature of the projects isn't classified. I put this all on my resume, and so does almost everyone else who works in intelligence. It's just another career.
- tgragnato 8y ago
  That's the point. The US has a loose approach. China is aggressive and takes advantage of every weakness. This is not an isolated case, as you will be well aware. https://www.justice.gov/opa/pr/state-department-employee-arrested-and-charged-concealing-extensive-contacts-foreign-agents https://www.justice.gov/opa/pr/state-department-employee-arr... https://sinosphere.blogs.nytimes.com/2014/04/15/using-china-as-an-example-f-b-i-video-warns-americans-about-study-abroad/ https://sinosphere.blogs.nytimes.com/2014/04/15/using-china-... https://www.nytimes.com/2017/05/20/world/asia/china-cia-spies-espionage.html https://www.nytimes.com/2017/05/20/world/asia/china-cia-spie... > "the country’s extensive security apparatus makes it exceptionally hard for Western spy services to develop sources there" That's why I wrote it's an asymmetry.
deleted 8y ago
[deleted]

lsc 8y ago

>Just because a system isn't foolproof, doesn't mean it's useless. I think this is... a common mistake people make. It's a common mistake I make, really, to look at a system for preventing a bad thing, see a hole, and then argue that system is worthless. All systems have holes, and just 'cause a system has a hole you can see, that doesn't mean the system doesn't have value.A system that prevents 80% of the bad things it was designed to prevent can be really useful.

fencepost 8y ago

Just because a system isn't foolproof, doesn't mean it's useless. It's just like network security - you take every precaution you reasonably can to prevent breaches, but you also plan for when measures fail. Locks on the doors don't mean you can skip drive encryption, managed antivirus doesn't mean you skip monitoring for ransomware activity or exfiltration, RAID doesn't mean you skip backups. You want not just the belt and suspenders but also properly fitted pants and underwear so no single point of failure leaves your secrets visible to the world.