4 ms·

vital interest of the NSA, and one of its core missions, to be able to penetrate endpoint security It's also a core mission of the NSA to protect US networks f

vital interest of the NSA, and one of its core missions, to be able to penetrate endpoint security It's also a core mission of the NSA to protect US networks from attack. If they're inserting backdoors in products used by US businesses, they're directly undermining their core mission.

oefrha 7y ago
> If they're inserting backdoors in products used by US businesses, they're directly undermining their core mission. Which is not unheard of.
petre 7y ago
You mean like the NIST ECC curves backdoored by the NSA? https://www.miracl.com/press/backdoors-in-nist-elliptic-curves https://www.miracl.com/press/backdoors-in-nist-elliptic-curv...
whatshisface 7y ago
What about PRISM? Protecting US networks is clearly not a part of their mission.
- GcVmvNhBsU 7y ago
  Do you even understand what PRISM was?
  - deleted 7y ago
    [deleted]
  - stjohnswarts 7y ago
    I'm sure they have a much better system in place by now.
  - dang 7y ago
    Please don't post like this—it breaks the site guidelines. If you know more, the best thing is to share some of what you know, so the rest of us can learn. A lot of people read these threads who are curious and open to good information. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
  - GcVmvNhBsU 7y ago
    More info to better conform to the guidelines. OP, your insinuation is that PRISM weakened US networks, but that is a misunderstanding of what the program actually did. Wikipedia: >The actual collection process is done by the Data Intercept Technology Unit (DITU) of the FBI, which on behalf of the NSA sends the selectors to the US Internet service providers, which were previously served with a Section 702 Directive. Under this directive, the provider is legally obliged to hand over (to DITU) all communications to or from the selectors provided by the government.[38] DITU then sends these communications to NSA, where they are stored in various databases, depending on their type. I personally think it's important to understand what types of surveillance our government is doing and not listen to FUD on what people think they are doing. In this case, there's no weakening of a network. The FBI provides a selector (email) to the service provider, and the provider uses their own systems to retrieve the data and send it back. The "direct line" that many people reference is to the database of selectors, so that FBI can push it directly to the provider.
- wool_gather 7y ago
  The NSA absolutely does have two, somewhat contradictory, missions; they're tasked with both offense and defense. One is "spying", or more formally "signals intelligence" a.k.a. SIGINT; the other is indeed "network defense". Until fairly recently it was in essence two organizations loosely joined administratively. You can read some more here: https://www.schneier.com/blog/archives/2016/02/nsa_reorganizin.html https://www.schneier.com/blog/archives/2016/02/nsa_reorganiz...
nickpsecurity 7y ago
That's a myth or some weaker form of legislation. Their mandate is to secure, esp for COMSEC, defense organizations. They usually have contractors build the tech for that, esp Type 1. Non-defense cant buy it. They also publish hardening guides for all sorts of tech. Anyone can use those since almost all of those techs are insecure. So, NSA has a massive mandate for stopping another 9/11 with surveillance but restricted one on defensive side mainly about securing defense organizations. That group recently downgraded its standards with Commercial Solutions for Classified or whatever it is.

oefrha 7y ago

> If they're inserting backdoors in products used by US businesses, they're directly undermining their core mission. Which is not unheard of.

petre 7y ago

You mean like the NIST ECC curves backdoored by the NSA? https://www.miracl.com/press/backdoors-in-nist-elliptic-curves https://www.miracl.com/press/backdoors-in-nist-elliptic-curv...

whatshisface 7y ago

What about PRISM? Protecting US networks is clearly not a part of their mission.

GcVmvNhBsU 7y ago
Do you even understand what PRISM was?
- deleted 7y ago
  [deleted]
- stjohnswarts 7y ago
  I'm sure they have a much better system in place by now.
- dang 7y ago
  Please don't post like this—it breaks the site guidelines. If you know more, the best thing is to share some of what you know, so the rest of us can learn. A lot of people read these threads who are curious and open to good information. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- GcVmvNhBsU 7y ago
  More info to better conform to the guidelines. OP, your insinuation is that PRISM weakened US networks, but that is a misunderstanding of what the program actually did. Wikipedia: >The actual collection process is done by the Data Intercept Technology Unit (DITU) of the FBI, which on behalf of the NSA sends the selectors to the US Internet service providers, which were previously served with a Section 702 Directive. Under this directive, the provider is legally obliged to hand over (to DITU) all communications to or from the selectors provided by the government.[38] DITU then sends these communications to NSA, where they are stored in various databases, depending on their type. I personally think it's important to understand what types of surveillance our government is doing and not listen to FUD on what people think they are doing. In this case, there's no weakening of a network. The FBI provides a selector (email) to the service provider, and the provider uses their own systems to retrieve the data and send it back. The "direct line" that many people reference is to the database of selectors, so that FBI can push it directly to the provider.
wool_gather 7y ago
The NSA absolutely does have two, somewhat contradictory, missions; they're tasked with both offense and defense. One is "spying", or more formally "signals intelligence" a.k.a. SIGINT; the other is indeed "network defense". Until fairly recently it was in essence two organizations loosely joined administratively. You can read some more here: https://www.schneier.com/blog/archives/2016/02/nsa_reorganizin.html https://www.schneier.com/blog/archives/2016/02/nsa_reorganiz...

nickpsecurity 7y ago

That's a myth or some weaker form of legislation. Their mandate is to secure, esp for COMSEC, defense organizations. They usually have contractors build the tech for that, esp Type 1. Non-defense cant buy it. They also publish hardening guides for all sorts of tech. Anyone can use those since almost all of those techs are insecure. So, NSA has a massive mandate for stopping another 9/11 with surveillance but restricted one on defensive side mainly about securing defense organizations. That group recently downgraded its standards with Commercial Solutions for Classified or whatever it is.