12 ms·

CIA’s Latest Layer: An Onion Site

144 points by dosy 7y ago

vowelless 7y ago
I have a question for the HN audience. Many here have gone to top schools and studied crypto, ML, etc with the best. And are probably the best in their field. Do you currently work for any three letter agencies? Did your smartest colleagues go to work at three letter agencies? I am trying to gauge the quality of talent at CIA, NSA, FBI, etc. All of my best colleagues went to the private sector, usually tech or security companies. I know some of these companies contract for the departments / agencies (and many colleagues have clearances). However, they are not actually working at the agencies themselves. So what is the talent pool at the CIA et al. like?
- jwilli 7y ago
  I work for a 4 letter agency that is trying to go back to the "mall" in 5 years. The talent is a bit lackluster, compared to what I expected.
  - CodinM 7y ago
    I see what you did there.
    - dmos62 7y ago
      I don't.
      - sansnomme 7y ago
        Is s/mall/moon
  - black6 7y ago
    Yah me too. I expected more “get shit done” and less “let’s meet to plan when we’re going to talk about putting together the design committee”. It’s an over-staffed bureaucratic nightmare with too many “helpers” and not enough “doers”. To be fair there is some ENORMOUS talent in certain directorates, but a lot of that has gove over to SpaceX, Blue Origin, et alia.
    - w8rbt 7y ago
      Have you read the "Policy on Policies" yet?
  - ubertakter 7y ago
    A friend and I who have been around (not in) the "4 letter agency who shall not be named" have decided one of the problems is after the last "mall" program they started hiring people directly out of college instead of out of industry. This leads to a organization full of people with no real practical experience, in particular experience in making decisions. This leads to a lot of analysis churn trying to make things perfect instead of good enough. The solution would be to partner with universities for the post-grad research stuff and hire people from "industry" as much as possible. Hopefully the people from industry could pick better people to hire from the post-grad research programs. Likely this will never happen, and it might not fix everything (or anything).
- Mizza 7y ago
  If you're well credentialed, tech-smart, greedy, and morally bankrupt, it's probably more lucrative to work for Google than the NSA.
  - chronic37203 7y ago
    > If you're well credentialed, tech-smart, greedy, and morally bankrupt, it's probably more lucrative to work for Google than the NSA. Can confirm. Went to MIT for EECS. Lots of us went to Google or trading companies.
  - rcchyssser 7y ago
    Best thing ever said on HN.
  - gambiting 7y ago
    Yep. GCHQ was recruiting on our CS course and the starting pay they offered was within £30-35k range. Working for literally any IT company in the region would pay more. (obviously there are perks working for the government that the private industry cannot match, so for some people lower pay is acceptable)
    - 13of40 7y ago
      Not only that, but the senior technical role they hire for, Lead Software Engineer, maxes out at £56,984. I know a handful of people who've gone from GCHQ to my company, and they seem satisfied with forgoing the government pension in exchange for tripling their salary.
      - jarbhuntah 7y ago
        where in the uk can i make 170k as a software engineer? or even 110k?
        C1sc0cat 7y ago
        The City as a contractor
- chrisseaton 7y ago
  Do you realise that almost nobody working in this kind of job can disclose that?
  - huffmsa 7y ago
    "can anyone on this board who works at an alphabet soup agency please identify themselves?" Nice try Infernal Affairs.
  - sneak 7y ago
    I don't think that's true. People's job titles generally aren't classified, even when they have them at present, as far as I know.
  - wil421 7y ago
    Unless your an actual spy you could probably say you work at the NSA as an SE, linguist or something more mundane. I doubt you could talk about your actual work. I’ve known people with clearances at Govt contractors. They could say what they do, EE/ME for X project but not many details beside that.
    - bsamuels 7y ago
      When you work at the NSA, you are not allowed to say that you work for the NSA. Full stop. (Contractors are a different story for some complex reasons, but are still at risk) It's like this for many gov agencies working with intelligence because labeling yourself as an intelligence worker makes you a target for foreign intelligence agents. That may sound a little strange if you aren't part of that industry, but it is the truth.
      - wil421 7y ago
        Where do you say you work? I’ve met a few linguist who said they work for the FBI or whoever but they were contractors on an as needed basis. What do the folks in Virginia say to their neighbors? “Oh I work for the DOD. So your a spy right haha?”
- astura 7y ago
  The smartest guy I went to school with works at the NSA.
- mlthoughts2018 7y ago
  I think there’s an aspect of your question that deserves sincere engagement, but I also think there is a very overblown idea of “the best in their field” and a misconception that if you were “good enough” to get hired into top private sector jobs, it somehow means you are better than peers. For one thing, people grow & change. Out of some hypothetical cohort of peers in year X, some few may have been the “best” in science and engineering at the point of time when everyone was graduating college and getting jobs. Doesn’t mean they would still be the best 5 or 10 years later — in fact the best person from the cohort at that time may not even have ever studied computer science until later in life. Even more importantly, top private firms like Google et al hire in a specific way that emphasizes a combination of rote memorization of facts and youthful resistance to burnout. While this may correlate with high skill in some age groups, for some types of work, it’s a very poor substitute for experience-based judgment and creativity, especially the stuff that cannot be mapped easily to rote memorization of computer science facts. In this sense I’d guess the three letter agencies have employee skill about as good as most tech companies, with the exception that very junior employees are “better” on the rote memorization and burnout-avoidance predisposition at tech companies (and that agencies don’t care much about missing out on that overrated talent pool sector). Many agencies also have long-time partnerships with professors and academic institutions that give them a lot of consulting support, often from literally world experts in things. Combined with FFRDCs that also have this type of consulting relationship and can often pay a little better to attract better talent, the agencies probably have no shortage of good talent. The main question I have is why the agencies are able to pay such low salaries, sometimes even in urban areas, no bonuses, etc. I feel they have talented people who are massively underpaid.
  - ethbro 7y ago
    > I feel they have talented people who are massively underpaid. They pay enough to get the talent they need * . Or in other words, if they're sufficiently staffed it's because people are willing to work there for less than market rate. Patriotism, a chance (in some roles) to work on cutting edge tech / scale, and making a difference in the world attract people. You can feel however you want about the agencies morally and ethically, but their work is unique. * Subject to Congressional cooperation and government pay scales
- theonemind 7y ago
  A bit off topic, but I worked with someone who interviewed with the NSA, got a job offer and declined the job. The funny part is that he has a 100% chance of getting “randomly” selected for search every time he takes a plane.
  - stallmanite 7y ago
    Hmm so if you don’t accept you’ll be harassed? Sounds like a disincentive to even applying.
    - yazan94 7y ago
      I think they are referring to that candidate's ethnicity
      - couchand 7y ago
        As horrible as casual racism is, that would be a much more comfortable explanation than the casual authoritarianism implied by the alternative interpretation.
    - JetSpiegel 7y ago
      You are assuming you are given a choice of applying, instead of being flagged as a person of interest.
- mruts 7y ago
  One of my best friends worked at the NSA, then the CIA. Smart guy. Unfortunately he got charged for Vault7 leaks and is going to spend the rest of his life in jail. So, in short, don’t work for them. It might seem cool, but it’s not worth it. If they don’t like you, they’ll fuck you.
  - edoo 7y ago
    How do you get charged for leaks if you weren't the leaker?
    - dragonwriter 7y ago
      How do you get charged with any crime without being guilty? It's not that uncommon an occurrence.
      - edoo 7y ago
        Great point. I am constantly amazed by my conditioned bias towards trust even in the constant face of contradictory evidence regarding these groups.
    - lallysingh 7y ago
      Be on the list of people who have access and be the least lucky on it.
    - scottLobster 7y ago
      Collusion with the leaker probably
    - icxa 7y ago
      The same way you get charged for murder when you weren't the murderer.
  - JackFr 7y ago
    Do they have the wrong guy or is “they don’t like you” == “commit espionage against the United States”?
- maximente 7y ago
  i think a lot of math PhDs that don't go to finance probably head to one of them. it's probably going to provide unlimited amounts of tough problems for that skill set, and not much fear about losing funding or anything like that.
- chippy 7y ago
  Some of my old buddies worked for the NHS. They said they all accept a paycut compared to the private sector because of the value and prestige of the agency itself. In a way I think those in the spy-ish agencies also think along the same lines but they get no recognition from the public about the benefit compared to national health care.
  - aframe 7y ago
    The _prestige_ of working in the NHS? It’s my experience that the NHS is taken for granted in the UK, and I can’t for one second believe that there’s ANY prestige there.
- dmv_resid3nt 7y ago
  This sounds sill, but I have a really serious question -- how accurate are the Bourne type films w/r/t how things are at these three lettered agencies? If you are to believe even half the movies, it seems the workers are burned left and right as regular consequences of seniors' political battles. Is that how it is? I know this sounds silly, but i've been at big companies before (Fortune 10) and have seen some pretty ugly things (once, three reports of a manager alleged a sexual attack on a rival manager; rival manager is fired; manager who's people made the accusation gets promoted.) Now I can imagine these types of political battles at three lettered agencies might involve false accusations that might land someone at jail. Is it like that? I'd honestly love to work at the intelligence agencies and serve the country in a role better suited given my technical skills, but I dont want to end up in some shark tank.
  - bladegash 7y ago
    As with the private sector, it depends on the workplace. The DC area is a pretty political/cutthroat environment to begin with. However, it is uncommon for political battles or false accusations to land you in jail (although definitely a higher possibility than the private sector). It is far more common/likely for political battles/false accusations to lead to you losing your security clearance (and by proxy, your livelihood/future employment prospects).
  - FrightHorse 7y ago
    Not that I ever saw, not really. What's far more likely to happen is that if you screw up too hard (or potentially piss off the wrong person) you can fairly easily get your clearance burnt, and that can easily (and permanently) cut your IC career off at the knees. How devastating that is depends entirely on your level of investment in your career in intelligence.
- mabbo 7y ago
  I interviewed with Canada's CSE, an NSA equivalent but broke off the process once I had an offer with Amazon. The salary ranges at the CSE were so low that it would be over a decade before I made what Amazon was offering on day 1. I suspect my career income will be more than double.
  - edoo 7y ago
    Unless the jig is to go to the NSA for 5-10 years, build up contacts, then get recruited into a firm that pays insanely for your connections. As far as I can tell the near sole purpose of the NSA/CIA is national level corporate espionage.
    - mabbo 7y ago
      It was the CSE. That doesn't really happen in Canada.
- segmondy 7y ago
  The agencies don't care about degrees as much as they care for raw talent. Many years ago I was in vacation and was just talking about video games with some random dude, then pirating, how to reverse engineer and crack em and from there into buffer overflows and exploit. After our conversation, he told me works for the NSA and asked if I'll like to work for them. I asked about pay, and it was more than double what I made then. Told him I would think about it, but passed. Spooks gives me the creeps. Many that I know that have gone to work for them don't have college degree and were recruited solely on raw talent
  - Wheaties466 7y ago
    Have you written any blog posts about REing and cracking games. Just looking for some good RE blog posts.
  - bezoisevil 7y ago
    That happened
- thisismyaccoun7 7y ago
  A lot are grabbed out of college or post military. These agencies and governement research centers want degrees, but they are willing to grow desired skills in-house. The most common new employee is someone hired for their potential, with experience much more highly valued in the private sector. There are ex-Googlers and such as well, but they're not super common. One guy said he got bored at Google because he was rebasing code all the time so switched over. Not everyone will take the more money for a job where your role can feel meaningless. In comparison, these DOD jobs definitely feel meaningful, almost no matter your role. Feelings inside are very similar to what you hear from military servicemembers about feeling like you're making an important difference. If you don't, it's easy to change positions; it is very desirable to have a load of different skills, and learning/training is not only available but pushed hard. Internal and external classes, paying for degrees and having partnerships with local colleges, externships with large private corporations, internships in other departments are all common. If you like to learn, it is appealing. As a result, there are certainly a lot of very smart people. Being government, you still have a chunk of the pool who are basically done but hanging on til retirement. I'd say it's past the 15-20 year mark that people really start to phone it in in technical positions. I won't get into this too much, but someone who is not known as top of their field but is close to or has maxed out the pay scale, they're probably not useful anymore. There are a lot of these (everywhere in government).
  - dllthomas 7y ago
    > The most common new employee is someone hired for their potential, with experience much more highly valued in the private sector. This makes a lot of sense if the state of the art inside the agency is sufficiently ahead of that outside - experience would be in the wrong stuff. It might also make sense if they want to pretend that is the case.
- nostalgk 7y ago
  I met with an NSA recruiter who was scoping out talent at a local hackerspace. It was one of the most awkward and out-of-touch experiences I ever had. He began trash talking Edward Snowden within 60 seconds, and complained that anyone under 25 (pretty much the sole demographic present at the event) were averse to paperwork and would never make it in the "real world". He also uncannily romanticized doing paperwork and laughed aloud at the prospect of any employees doing any sort of creative work, saying that "engineers are just pencil pushers" (paraphrasing). He mocked the media's representation of the NSA in a characteristically dissociative way, alluding to that he genuinely had no clue why the public perception of the NSA is what it is. He finished it off by rambling about "quantum tunneling and metaphysics" (never knew the NSA was so interested in the works of Arthur Schopenhauer) and more or less begging the public at the event to come work for the NSA, saying they were desperately in need of talent. Up until this experience, I had often considered the public perception of the NSA to be probably unrepresentative of reality, and my opinion could be summed up as "a big fan of Splinter Cell". Now, personally, I am entirely turned off to the prospect of employment with them. Previously, I had envisioned that any issues within the agency could be remedied by new talent reforming internal policies, but I believe the problems that exist within it are pathologic, and I was enthusiastically informed that any position I had within the agency would be "pencil pushing", "paperwork", and a complete lack of creative fulfillment. What a way to kill prospective talent.
  - sandworm101 7y ago
    >> I met with an NSA recruiter Ask them for the NSA Sudoku books. They also publish crosswords. These are the only NSA documents Wikileaks wouldn't touch.
    - nostalgk 7y ago
      These would be great mental exercises for me to complete while I fill out paperwork, unlike the other millennials who are too afraid to step up to the plate (printer?).
      - sandworm101 7y ago
- wil421 7y ago
  The scary 3 letters agencies approach top talent, usually not the other way around. I had a high school classmate who was approached at the end of college. Haven’t heard or seen him since he moved to DC. He was the type who could do whatever put his mind to and had the determination to do it, Doctor, Lawyer, engineer whatever. Professions were probably to easy for him to do.
- CalChris 7y ago
  If you qualify for a security clearance then you will qualify for jobs which require a security clearance. This means that you are basically recession proof. You will be competing (if that's an applicable word) against a smaller pool of applicants in a market (if that's an applicable word) which is protected by the full faith and credit of the US government. https://www.clearancejobs.com/ https://www.clearancejobs.com/
  - C1sc0cat 7y ago
    In the future I could see some senior job at FANGS requiring clearance - BT required DV for some team leader roles 20 Years ago
    - CalChris 7y ago
      That's already happening.
    - philwelch 7y ago
      That’s true for Amazon due to this: https://aws.amazon.com/federal/us-intelligence-community/ https://aws.amazon.com/federal/us-intelligence-community/
cheschire 7y ago
Some previous discussions: https://news.ycombinator.com/item?id=19852989 https://news.ycombinator.com/item?id=19852989 https://news.ycombinator.com/item?id=19853931 https://news.ycombinator.com/item?id=19853931
peteretep 7y ago
> ciadotgov4sjwlzihbbgxnqg3xiyrg7so2r2o3lt5wz5ypk4sxyjstad.onion How does one store links like this? You'd need a bookmark file, which would sort of give the game away, I'd have thought. How do you make sure you notice when you visit a URL with the same readable prefix?
- cyphar 7y ago
  This is an unfortunate downside of onion URLs and a restriction imposed by Zooko's triangle (the CAP theorem of naming systems)[1]. One possible solution would be to issue a TLS certificates for both the clear-web and .onion domain (for services which are offering .onion services to provide better anonymity for users not their servers). Unfortunately, the CAB forum has decided to not allow this -- only EV certificates can be issued for .onion services so you can't use LetsEncrypt for this. [1]: https://en.wikipedia.org/wiki/Zooko%27s_triangle https://en.wikipedia.org/wiki/Zooko%27s_triangle
  - tgragnato 7y ago
    I was looking for the name of the CAP theorem, thanks for posting this! HN discussed (https://news.ycombinator.com/item?id=14038013 https://news.ycombinator.com/item?id=14038013) about the issue and the post (https://blog.torproject.org/cooking-onions-names-your-onions https://blog.torproject.org/cooking-onions-names-your-onions) outlines some of the ways in which you can mitigate right now. Cloudflare is using the 'alt-svc' header (https://blog.cloudflare.com/cloudflare-onion-service/ https://blog.cloudflare.com/cloudflare-onion-service/).. The CIA is not, I'd have loved it. curl -I https://www.cia.gov/index.html https://www.cia.gov/index.html HTTP/1.1 200 OK Accept-Ranges: bytes Content-Type: text/html ETag: "<>" Last-Modified: Tue, 28 May 2019 15:05:25 GMT Content-Length: <> ID: <> SESSION: <> Date: Thu, 30 May 2019 12:36<> GMT Connection: keep-alive Set-Cookie: _session_=<>; path=/; domain=cia.gov; secure; HttpOnly ID: <> SESSION: <>
    - kodablah 7y ago
      > Cloudflare is using the 'alt-svc' header [...] The CIA is not, I'd have loved it. It should be noted that alt-svc is an HTTP header returned which means you have first made an HTTP request before the onion request which affects anonymity. It's not a big deal over Tor because that HTTP call is on an exit node, but still should be noted.
onion2k 7y ago
It's a trap.
- taneq 7y ago
  Paging #notacop
xeeeeeeeeeeenu 7y ago
It's interesting that US government is embracing Tor, while Germany is cracking down on it[1]. [1] - https://news.ycombinator.com/item?id=19399576 https://news.ycombinator.com/item?id=19399576
- danesparza 7y ago
  To be fair, "embracing Tor" is an interesting phrase, considering the FBI was actively breaking it 5 years ago: https://www.forbes.com/sites/kashmirhill/2014/11/07/how-did-law-enforcement-break-tor/#74586a9a4bf7 https://www.forbes.com/sites/kashmirhill/2014/11/07/how-did-...
  - microcolonel 7y ago
    Local and state LEOs and the CIA use it though, even if the FBI has done some attacks on it.
  - cyphar 7y ago
    And the fact that the NSA spent a large amount of resources trying to break it. But law enforcement all over the world uses Tor to ensure that potentially-illegal websites can't fingerprint them.
- deleted 7y ago
  [deleted]
- dragonwriter 7y ago
  The US government created Tor for intelligence purposes. So it being embraced by the US intelligence community is unsurprising.
  - cyphar 7y ago
    The US Navy created the concept of onion routing. Tor was not developed by the US government, it was developed in public (by Roger Dingledine and the rest of the Tor community).
DC-3 7y ago
I don't know how onion links work but would they have had to brute force that URL?
- jasonhansel 7y ago
  Yep.
  - pontifier 7y ago
    13 letters too... do you think they also have another site for people who aren't social justice warriors?
    - sdinsn 7y ago
      ?
      - __HYde 7y ago
        > ciadotgov4sjw... cia.gov for Social Justice Warriors. Pretty sure he was just making a joke and only the first 9 characters were actually being tried for.
        dosy 7y ago
        Could it not be 4 "super-judicial wars"? haw haw haw
- tempuser24 7y ago
  There are a few projects for generating onion URLs, probably relatively easy for the CIA. https://security.stackexchange.com/questions/29772/how-do-you-get-a-specific-onion-address-for-your-hidden-service https://security.stackexchange.com/questions/29772/how-do-yo...
flatiron 7y ago
not sure why it's not a single onion site...its not like they want to stay anonymous too.
SuperNinjaCat 7y ago
I do have an interesting story about going through the beginning of the recuitment process for a multi-letter agency within the 5 eye sphere (Australia), but I'm not sure I want to post it. It involved asking me point blank at the beginning of a face to face interview at their HQ saying to me "soo...what have you hacked?" along with other weirdness. The year before I completed an aptitude test which predominantly focused on abstract reasoning. It was a strange experience and part of me wants to discuss it in a responsible/de-identified sort of way, but on the other hand, the take-away I got from the experience itself is kind of holding me back from following through with that desire to discuss it....I'm not sure if what I just wrote makes any sense to me now that I just typed it out. It was still an interesting experience though which did have a positive impact on my life. EDIT: Sorry, edited for a spelling mistake

144 points by dosy 7y ago

I have a question for the HN audience. Many here have gone to top schools and studied crypto, ML, etc with the best. And are probably the best in their field. Do you currently work for any three letter agencies? Did your smartest colleagues go to work at three letter agencies? I am trying to gauge the quality of talent at CIA, NSA, FBI, etc. All of my best colleagues went to the private sector, usually tech or security companies. I know some of these companies contract for the departments / agencies (and many colleagues have clearances). However, they are not actually working at the agencies themselves. So what is the talent pool at the CIA et al. like?

jwilli 7y ago
I work for a 4 letter agency that is trying to go back to the "mall" in 5 years. The talent is a bit lackluster, compared to what I expected.
- CodinM 7y ago
  I see what you did there.
  - dmos62 7y ago
    I don't.
    - sansnomme 7y ago
      Is s/mall/moon
- black6 7y ago
  Yah me too. I expected more “get shit done” and less “let’s meet to plan when we’re going to talk about putting together the design committee”. It’s an over-staffed bureaucratic nightmare with too many “helpers” and not enough “doers”. To be fair there is some ENORMOUS talent in certain directorates, but a lot of that has gove over to SpaceX, Blue Origin, et alia.
  - w8rbt 7y ago
    Have you read the "Policy on Policies" yet?
- ubertakter 7y ago
  A friend and I who have been around (not in) the "4 letter agency who shall not be named" have decided one of the problems is after the last "mall" program they started hiring people directly out of college instead of out of industry. This leads to a organization full of people with no real practical experience, in particular experience in making decisions. This leads to a lot of analysis churn trying to make things perfect instead of good enough. The solution would be to partner with universities for the post-grad research stuff and hire people from "industry" as much as possible. Hopefully the people from industry could pick better people to hire from the post-grad research programs. Likely this will never happen, and it might not fix everything (or anything).
Mizza 7y ago
If you're well credentialed, tech-smart, greedy, and morally bankrupt, it's probably more lucrative to work for Google than the NSA.
- chronic37203 7y ago
  > If you're well credentialed, tech-smart, greedy, and morally bankrupt, it's probably more lucrative to work for Google than the NSA. Can confirm. Went to MIT for EECS. Lots of us went to Google or trading companies.
- rcchyssser 7y ago
  Best thing ever said on HN.
- gambiting 7y ago
  Yep. GCHQ was recruiting on our CS course and the starting pay they offered was within £30-35k range. Working for literally any IT company in the region would pay more. (obviously there are perks working for the government that the private industry cannot match, so for some people lower pay is acceptable)
  - 13of40 7y ago
    Not only that, but the senior technical role they hire for, Lead Software Engineer, maxes out at £56,984. I know a handful of people who've gone from GCHQ to my company, and they seem satisfied with forgoing the government pension in exchange for tripling their salary.
    - jarbhuntah 7y ago
      where in the uk can i make 170k as a software engineer? or even 110k?
      - C1sc0cat 7y ago
        The City as a contractor
chrisseaton 7y ago
Do you realise that almost nobody working in this kind of job can disclose that?
- huffmsa 7y ago
  "can anyone on this board who works at an alphabet soup agency please identify themselves?" Nice try Infernal Affairs.
- sneak 7y ago
  I don't think that's true. People's job titles generally aren't classified, even when they have them at present, as far as I know.
- wil421 7y ago
  Unless your an actual spy you could probably say you work at the NSA as an SE, linguist or something more mundane. I doubt you could talk about your actual work. I’ve known people with clearances at Govt contractors. They could say what they do, EE/ME for X project but not many details beside that.
  - bsamuels 7y ago
    When you work at the NSA, you are not allowed to say that you work for the NSA. Full stop. (Contractors are a different story for some complex reasons, but are still at risk) It's like this for many gov agencies working with intelligence because labeling yourself as an intelligence worker makes you a target for foreign intelligence agents. That may sound a little strange if you aren't part of that industry, but it is the truth.
    - wil421 7y ago
      Where do you say you work? I’ve met a few linguist who said they work for the FBI or whoever but they were contractors on an as needed basis. What do the folks in Virginia say to their neighbors? “Oh I work for the DOD. So your a spy right haha?”
astura 7y ago
The smartest guy I went to school with works at the NSA.
mlthoughts2018 7y ago
I think there’s an aspect of your question that deserves sincere engagement, but I also think there is a very overblown idea of “the best in their field” and a misconception that if you were “good enough” to get hired into top private sector jobs, it somehow means you are better than peers. For one thing, people grow & change. Out of some hypothetical cohort of peers in year X, some few may have been the “best” in science and engineering at the point of time when everyone was graduating college and getting jobs. Doesn’t mean they would still be the best 5 or 10 years later — in fact the best person from the cohort at that time may not even have ever studied computer science until later in life. Even more importantly, top private firms like Google et al hire in a specific way that emphasizes a combination of rote memorization of facts and youthful resistance to burnout. While this may correlate with high skill in some age groups, for some types of work, it’s a very poor substitute for experience-based judgment and creativity, especially the stuff that cannot be mapped easily to rote memorization of computer science facts. In this sense I’d guess the three letter agencies have employee skill about as good as most tech companies, with the exception that very junior employees are “better” on the rote memorization and burnout-avoidance predisposition at tech companies (and that agencies don’t care much about missing out on that overrated talent pool sector). Many agencies also have long-time partnerships with professors and academic institutions that give them a lot of consulting support, often from literally world experts in things. Combined with FFRDCs that also have this type of consulting relationship and can often pay a little better to attract better talent, the agencies probably have no shortage of good talent. The main question I have is why the agencies are able to pay such low salaries, sometimes even in urban areas, no bonuses, etc. I feel they have talented people who are massively underpaid.
- ethbro 7y ago
  > I feel they have talented people who are massively underpaid. They pay enough to get the talent they need * . Or in other words, if they're sufficiently staffed it's because people are willing to work there for less than market rate. Patriotism, a chance (in some roles) to work on cutting edge tech / scale, and making a difference in the world attract people. You can feel however you want about the agencies morally and ethically, but their work is unique. * Subject to Congressional cooperation and government pay scales
theonemind 7y ago
A bit off topic, but I worked with someone who interviewed with the NSA, got a job offer and declined the job. The funny part is that he has a 100% chance of getting “randomly” selected for search every time he takes a plane.
- stallmanite 7y ago
  Hmm so if you don’t accept you’ll be harassed? Sounds like a disincentive to even applying.
  - yazan94 7y ago
    I think they are referring to that candidate's ethnicity
    - couchand 7y ago
      As horrible as casual racism is, that would be a much more comfortable explanation than the casual authoritarianism implied by the alternative interpretation.
  - JetSpiegel 7y ago
    You are assuming you are given a choice of applying, instead of being flagged as a person of interest.
mruts 7y ago
One of my best friends worked at the NSA, then the CIA. Smart guy. Unfortunately he got charged for Vault7 leaks and is going to spend the rest of his life in jail. So, in short, don’t work for them. It might seem cool, but it’s not worth it. If they don’t like you, they’ll fuck you.
- edoo 7y ago
  How do you get charged for leaks if you weren't the leaker?
  - dragonwriter 7y ago
    How do you get charged with any crime without being guilty? It's not that uncommon an occurrence.
    - edoo 7y ago
      Great point. I am constantly amazed by my conditioned bias towards trust even in the constant face of contradictory evidence regarding these groups.
  - lallysingh 7y ago
    Be on the list of people who have access and be the least lucky on it.
  - scottLobster 7y ago
    Collusion with the leaker probably
  - icxa 7y ago
    The same way you get charged for murder when you weren't the murderer.
- JackFr 7y ago
  Do they have the wrong guy or is “they don’t like you” == “commit espionage against the United States”?
maximente 7y ago
i think a lot of math PhDs that don't go to finance probably head to one of them. it's probably going to provide unlimited amounts of tough problems for that skill set, and not much fear about losing funding or anything like that.
chippy 7y ago
Some of my old buddies worked for the NHS. They said they all accept a paycut compared to the private sector because of the value and prestige of the agency itself. In a way I think those in the spy-ish agencies also think along the same lines but they get no recognition from the public about the benefit compared to national health care.
- aframe 7y ago
  The _prestige_ of working in the NHS? It’s my experience that the NHS is taken for granted in the UK, and I can’t for one second believe that there’s ANY prestige there.
dmv_resid3nt 7y ago
This sounds sill, but I have a really serious question -- how accurate are the Bourne type films w/r/t how things are at these three lettered agencies? If you are to believe even half the movies, it seems the workers are burned left and right as regular consequences of seniors' political battles. Is that how it is? I know this sounds silly, but i've been at big companies before (Fortune 10) and have seen some pretty ugly things (once, three reports of a manager alleged a sexual attack on a rival manager; rival manager is fired; manager who's people made the accusation gets promoted.) Now I can imagine these types of political battles at three lettered agencies might involve false accusations that might land someone at jail. Is it like that? I'd honestly love to work at the intelligence agencies and serve the country in a role better suited given my technical skills, but I dont want to end up in some shark tank.
- bladegash 7y ago
  As with the private sector, it depends on the workplace. The DC area is a pretty political/cutthroat environment to begin with. However, it is uncommon for political battles or false accusations to land you in jail (although definitely a higher possibility than the private sector). It is far more common/likely for political battles/false accusations to lead to you losing your security clearance (and by proxy, your livelihood/future employment prospects).
- FrightHorse 7y ago
  Not that I ever saw, not really. What's far more likely to happen is that if you screw up too hard (or potentially piss off the wrong person) you can fairly easily get your clearance burnt, and that can easily (and permanently) cut your IC career off at the knees. How devastating that is depends entirely on your level of investment in your career in intelligence.
mabbo 7y ago
I interviewed with Canada's CSE, an NSA equivalent but broke off the process once I had an offer with Amazon. The salary ranges at the CSE were so low that it would be over a decade before I made what Amazon was offering on day 1. I suspect my career income will be more than double.
- edoo 7y ago
  Unless the jig is to go to the NSA for 5-10 years, build up contacts, then get recruited into a firm that pays insanely for your connections. As far as I can tell the near sole purpose of the NSA/CIA is national level corporate espionage.
  - mabbo 7y ago
    It was the CSE. That doesn't really happen in Canada.
segmondy 7y ago
The agencies don't care about degrees as much as they care for raw talent. Many years ago I was in vacation and was just talking about video games with some random dude, then pirating, how to reverse engineer and crack em and from there into buffer overflows and exploit. After our conversation, he told me works for the NSA and asked if I'll like to work for them. I asked about pay, and it was more than double what I made then. Told him I would think about it, but passed. Spooks gives me the creeps. Many that I know that have gone to work for them don't have college degree and were recruited solely on raw talent
- Wheaties466 7y ago
  Have you written any blog posts about REing and cracking games. Just looking for some good RE blog posts.
- bezoisevil 7y ago
  That happened
thisismyaccoun7 7y ago
A lot are grabbed out of college or post military. These agencies and governement research centers want degrees, but they are willing to grow desired skills in-house. The most common new employee is someone hired for their potential, with experience much more highly valued in the private sector. There are ex-Googlers and such as well, but they're not super common. One guy said he got bored at Google because he was rebasing code all the time so switched over. Not everyone will take the more money for a job where your role can feel meaningless. In comparison, these DOD jobs definitely feel meaningful, almost no matter your role. Feelings inside are very similar to what you hear from military servicemembers about feeling like you're making an important difference. If you don't, it's easy to change positions; it is very desirable to have a load of different skills, and learning/training is not only available but pushed hard. Internal and external classes, paying for degrees and having partnerships with local colleges, externships with large private corporations, internships in other departments are all common. If you like to learn, it is appealing. As a result, there are certainly a lot of very smart people. Being government, you still have a chunk of the pool who are basically done but hanging on til retirement. I'd say it's past the 15-20 year mark that people really start to phone it in in technical positions. I won't get into this too much, but someone who is not known as top of their field but is close to or has maxed out the pay scale, they're probably not useful anymore. There are a lot of these (everywhere in government).
- dllthomas 7y ago
  > The most common new employee is someone hired for their potential, with experience much more highly valued in the private sector. This makes a lot of sense if the state of the art inside the agency is sufficiently ahead of that outside - experience would be in the wrong stuff. It might also make sense if they want to pretend that is the case.
nostalgk 7y ago
I met with an NSA recruiter who was scoping out talent at a local hackerspace. It was one of the most awkward and out-of-touch experiences I ever had. He began trash talking Edward Snowden within 60 seconds, and complained that anyone under 25 (pretty much the sole demographic present at the event) were averse to paperwork and would never make it in the "real world". He also uncannily romanticized doing paperwork and laughed aloud at the prospect of any employees doing any sort of creative work, saying that "engineers are just pencil pushers" (paraphrasing). He mocked the media's representation of the NSA in a characteristically dissociative way, alluding to that he genuinely had no clue why the public perception of the NSA is what it is. He finished it off by rambling about "quantum tunneling and metaphysics" (never knew the NSA was so interested in the works of Arthur Schopenhauer) and more or less begging the public at the event to come work for the NSA, saying they were desperately in need of talent. Up until this experience, I had often considered the public perception of the NSA to be probably unrepresentative of reality, and my opinion could be summed up as "a big fan of Splinter Cell". Now, personally, I am entirely turned off to the prospect of employment with them. Previously, I had envisioned that any issues within the agency could be remedied by new talent reforming internal policies, but I believe the problems that exist within it are pathologic, and I was enthusiastically informed that any position I had within the agency would be "pencil pushing", "paperwork", and a complete lack of creative fulfillment. What a way to kill prospective talent.
- sandworm101 7y ago
  >> I met with an NSA recruiter Ask them for the NSA Sudoku books. They also publish crosswords. These are the only NSA documents Wikileaks wouldn't touch.
  - nostalgk 7y ago
    These would be great mental exercises for me to complete while I fill out paperwork, unlike the other millennials who are too afraid to step up to the plate (printer?).
    - sandworm101 7y ago
wil421 7y ago
The scary 3 letters agencies approach top talent, usually not the other way around. I had a high school classmate who was approached at the end of college. Haven’t heard or seen him since he moved to DC. He was the type who could do whatever put his mind to and had the determination to do it, Doctor, Lawyer, engineer whatever. Professions were probably to easy for him to do.
CalChris 7y ago
If you qualify for a security clearance then you will qualify for jobs which require a security clearance. This means that you are basically recession proof. You will be competing (if that's an applicable word) against a smaller pool of applicants in a market (if that's an applicable word) which is protected by the full faith and credit of the US government. https://www.clearancejobs.com/ https://www.clearancejobs.com/
- C1sc0cat 7y ago
  In the future I could see some senior job at FANGS requiring clearance - BT required DV for some team leader roles 20 Years ago
  - CalChris 7y ago
    That's already happening.
  - philwelch 7y ago
    That’s true for Amazon due to this: https://aws.amazon.com/federal/us-intelligence-community/ https://aws.amazon.com/federal/us-intelligence-community/

cheschire 7y ago

Some previous discussions: https://news.ycombinator.com/item?id=19852989 https://news.ycombinator.com/item?id=19852989 https://news.ycombinator.com/item?id=19853931 https://news.ycombinator.com/item?id=19853931

peteretep 7y ago

> ciadotgov4sjwlzihbbgxnqg3xiyrg7so2r2o3lt5wz5ypk4sxyjstad.onion How does one store links like this? You'd need a bookmark file, which would sort of give the game away, I'd have thought. How do you make sure you notice when you visit a URL with the same readable prefix?

cyphar 7y ago
This is an unfortunate downside of onion URLs and a restriction imposed by Zooko's triangle (the CAP theorem of naming systems)[1]. One possible solution would be to issue a TLS certificates for both the clear-web and .onion domain (for services which are offering .onion services to provide better anonymity for users not their servers). Unfortunately, the CAB forum has decided to not allow this -- only EV certificates can be issued for .onion services so you can't use LetsEncrypt for this. [1]: https://en.wikipedia.org/wiki/Zooko%27s_triangle https://en.wikipedia.org/wiki/Zooko%27s_triangle
- tgragnato 7y ago
  I was looking for the name of the CAP theorem, thanks for posting this! HN discussed (https://news.ycombinator.com/item?id=14038013 https://news.ycombinator.com/item?id=14038013) about the issue and the post (https://blog.torproject.org/cooking-onions-names-your-onions https://blog.torproject.org/cooking-onions-names-your-onions) outlines some of the ways in which you can mitigate right now. Cloudflare is using the 'alt-svc' header (https://blog.cloudflare.com/cloudflare-onion-service/ https://blog.cloudflare.com/cloudflare-onion-service/).. The CIA is not, I'd have loved it. curl -I https://www.cia.gov/index.html https://www.cia.gov/index.html HTTP/1.1 200 OK Accept-Ranges: bytes Content-Type: text/html ETag: "<>" Last-Modified: Tue, 28 May 2019 15:05:25 GMT Content-Length: <> ID: <> SESSION: <> Date: Thu, 30 May 2019 12:36<> GMT Connection: keep-alive Set-Cookie: _session_=<>; path=/; domain=cia.gov; secure; HttpOnly ID: <> SESSION: <>
  - kodablah 7y ago
    > Cloudflare is using the 'alt-svc' header [...] The CIA is not, I'd have loved it. It should be noted that alt-svc is an HTTP header returned which means you have first made an HTTP request before the onion request which affects anonymity. It's not a big deal over Tor because that HTTP call is on an exit node, but still should be noted.

onion2k 7y ago

It's a trap.

taneq 7y ago
Paging #notacop

xeeeeeeeeeeenu 7y ago

It's interesting that US government is embracing Tor, while Germany is cracking down on it[1]. [1] - https://news.ycombinator.com/item?id=19399576 https://news.ycombinator.com/item?id=19399576

danesparza 7y ago
To be fair, "embracing Tor" is an interesting phrase, considering the FBI was actively breaking it 5 years ago: https://www.forbes.com/sites/kashmirhill/2014/11/07/how-did-law-enforcement-break-tor/#74586a9a4bf7 https://www.forbes.com/sites/kashmirhill/2014/11/07/how-did-...
- microcolonel 7y ago
  Local and state LEOs and the CIA use it though, even if the FBI has done some attacks on it.
- cyphar 7y ago
  And the fact that the NSA spent a large amount of resources trying to break it. But law enforcement all over the world uses Tor to ensure that potentially-illegal websites can't fingerprint them.
deleted 7y ago
[deleted]
dragonwriter 7y ago
The US government created Tor for intelligence purposes. So it being embraced by the US intelligence community is unsurprising.
- cyphar 7y ago
  The US Navy created the concept of onion routing. Tor was not developed by the US government, it was developed in public (by Roger Dingledine and the rest of the Tor community).

DC-3 7y ago

I don't know how onion links work but would they have had to brute force that URL?

jasonhansel 7y ago
Yep.
- pontifier 7y ago
  13 letters too... do you think they also have another site for people who aren't social justice warriors?
  - sdinsn 7y ago
    ?
    - __HYde 7y ago
      > ciadotgov4sjw... cia.gov for Social Justice Warriors. Pretty sure he was just making a joke and only the first 9 characters were actually being tried for.
      - dosy 7y ago
        Could it not be 4 "super-judicial wars"? haw haw haw
tempuser24 7y ago
There are a few projects for generating onion URLs, probably relatively easy for the CIA. https://security.stackexchange.com/questions/29772/how-do-you-get-a-specific-onion-address-for-your-hidden-service https://security.stackexchange.com/questions/29772/how-do-yo...

flatiron 7y ago

not sure why it's not a single onion site...its not like they want to stay anonymous too.

SuperNinjaCat 7y ago

I do have an interesting story about going through the beginning of the recuitment process for a multi-letter agency within the 5 eye sphere (Australia), but I'm not sure I want to post it. It involved asking me point blank at the beginning of a face to face interview at their HQ saying to me "soo...what have you hacked?" along with other weirdness. The year before I completed an aptitude test which predominantly focused on abstract reasoning. It was a strange experience and part of me wants to discuss it in a responsible/de-identified sort of way, but on the other hand, the take-away I got from the experience itself is kind of holding me back from following through with that desire to discuss it....I'm not sure if what I just wrote makes any sense to me now that I just typed it out. It was still an interesting experience though which did have a positive impact on my life. EDIT: Sorry, edited for a spelling mistake