7 ms·

That states like China and Russia can recruit the best cybersecurity talent in their respective countries, and force them to work for the government, while the

That states like China and Russia can recruit the best cybersecurity talent in their respective countries, and force them to work for the government, while the United States can't, is a problem. If I were the president, I would focus on talent recruitment and retention. Google is paying its top cyberstaff 700k? Offer them 1M. Also get rid of archaic hiring practices like drug tests, and streamline the process to obtain a clearance.

g00s3_caLL_x2 7y ago
I get what you're saying, but do you want you top minds working while high, or better yet, needing to depend on them while they are high? Some things just require a clarity 24/7. Wouldn't nation security fall under that?
bilbo0s 7y ago
Sounds like an interesting plan.
- birdyrooster 7y ago
  Congress loves giving more money to the military.
spunker540 7y ago
I’m not biased at all, just a patriot, and I think the government should inflate the wages of all software engineers in the entire nation to $1M in the name of national defense.
- lioeters 7y ago
  Software Engineeer: We Need to Prepare for a Complete Rewrite (and Significant Salary Increase)
- logfromblammo 7y ago
  I am also not biased at all, but I feel strongly that we need to support the deliberative efforts of our nation's software-building infrastructure-protecting heroes by giving them all individual offices with doors that can close and lock, also ensuring that the occupant of the office has a key for it. And nice, high-backed office chairs. And dual monitors for each workstation, with the computation hardware refreshed at least every three years--to include a real graphics card, that actually works with virtualization, because of 3D mapping. And the kitchenettes should also be enclosed in their own rooms, so microwaved fish or broccoli smells don't permeate all the offices at lunch time. Not that I definitely know that's a thing that actually happens, but I imagine that if it did, if might break a software developer's concentration. Every. Danged. Time. For national security! Should probably recommend these "critical security precautions" to all of our allies, too. And potential allies. And probably the adversaries will copy them, but not much we can do about that. ~
umvi 7y ago
Well, NSA used to have the best and brightest until Snowden. Now NSA can't get the best and brightest because they are conscientious objectors.
- ses1984 7y ago
  There were plenty of objectors before Snowden and also a huge group of folks who would choose to work for the nsa anyway. The impact isn't that great.
- gtfratteus 7y ago
  Any source for that claim? I'd expect salary and drug testing to be the two biggest factors dissuading top engineers from applying to the NSA. Personally, I'd find working for the NSA to be much more interesting than what I'm doing currently, but I just can't justify taking a 50% salary hit to work there. If I were the president, I'd think about opening a sixth military academy specifically focused on Cyber warfare. You could then require graduates to work for the military/NSA for five years after graduation, and you'd only need to throw insane money at fifty or so professors.
- cmiles74 7y ago
  This isn't a technical issue, but I think that it's important: working for the government comes with less pay, but there was always the idea that you were putting in effort for the benefit of the country. In my opinion the NSA has squandered that and they have somehow ended up in the same category as Palantir and Facebook. I'm not sure how they can fix this, but I do think it will need to be addressed if they want to hire and retain top talent. They have interesting problems but no one will work on them if they feel they are, in the end, hurting their fellow country-people.
  - jkestner 7y ago
    They could start fixing it by not turning their spying tools inward, and enacting strong whistleblower protection laws. The other half is admitting that the government did something wrong in the first place, which they can do by prosecuting officials who broke the law, retire those that quasi-legally facilitated domestic dragnets, and pardoning Snowden, Winner, etc. That’s going to take politicians who aren’t jingoistic.
ajay-d 7y ago
Russia also recruits cyber criminals, offering reduced sentences if they work for the government[1] "The cellmate said that people incarcerated for cybercrimes could get out before trial, in exchange for working for the government. Another inmate had already taken a deal, he said. “It was an offer to cooperate,” Mr. Artimovich said. “Why else would you work for the government?” he added. “The salaries are tiny. But if you do something illegal, and go to prison for eight or nine years, the F.S.B. can help you,” he said, using a Russian abbreviation for the Federal Security Service." [1] https://www.nytimes.com/2016/12/29/world/europe/how-russia-recruited-elite-hackers-for-its-cyberwar.html https://www.nytimes.com/2016/12/29/world/europe/how-russia-r...
- bilbo0s 7y ago
  Yeah, but we are almost certainly doing this already as well. So there's no advantage to be gained there. If a cyber criminal is valuable enough, ie-not a script kiddie, we're already making the offers. We need ideas that are somewhat out of the box. Something that isn't already being done that we can start doing to bolster our capabilities.
  - dx87 7y ago
    AFAIK we aren't doing that. Once you've been caught doing criminal activity, you pretty much have no chance of getting the security clearance required to do cyber work for the government. They're willing to overlook criminal activity if you are up front about it and have never been caught, but any sort of criminal record is a showstopper for cleared government work.
    - deleted 7y ago
      [deleted]
- coldtea 7y ago
  You think that's some kind of exception? All kinds of cyber criminals also work for western governments/agencies as consultants. E.g.: "Since 2000, Mitnick has been a paid security consultant, public speaker and author. He does security consulting for Fortune 500 companies and the FBI, performs penetration testing services for the world's largest companies and teaches Social Engineering classes to dozens of companies and government agencies."
bilbo0s 7y ago
Sounds like an interesting plan. Where is the money going to come from? We cutting something else? Like outdated military infrastructure since we should be ramping up for the cyber future? Or are we instead going to ramp up the deficit spending more to cover the extra expenses? Have you actually thought your proposed solution through? Have you considered the larger picture? We're already deficit spending at a level approaching USD1.5T. How do we handle the financial implications of such a shift? Most of the "best and brightest" in America, are not, in fact, American. How do we get them the necessary security clearances? Should we be giving them that level of clearance? I won't even go into the fact that the private sector would still be making all of the best tech as they gobbled up intellectual capital from around the globe, and we only have the US to snap people up from. Sure France, Germany, Russia, China etc can only snap people up from their nations too, but they have much better educational systems. This problem requires more considered thought, and very likely a little bit of creativity, to work through.
- wycy 7y ago
  >Have you actually thought your proposed solution through? Have you considered the larger picture? The OP's plan seems like a good one to bolster national security. OP doesn't need to lay out every single step of the solution, all the way down to the US education system, in order to make it a good point.
- boomboomsubban 7y ago
  >Where is the money going to come from? From the money we currently pay third party contractors to do the job. >We're already deficit spending at a level approaching USD1.5T. How do we handle the financial implications of such a shift By realizing that a gigantic increase in their salary would not be remotely large enough to constitute "a shift." >How do we get them the necessary security clearances? Should we be giving them that level of clearance? With the same bogus system we use for everybody else.
nradov 7y ago
The security clearance investigation process can already be expedited for urgent cases. However we absolutely should never lower clearance standards. Penetration by foreign agents could be far more damaging than a lack of top cyber security personnel.
- ssully 7y ago
  Yeah it would be a real shame if we lowered the clearance standards. Imagine if our president lowered the standards for say, his son in law, who failed to pass the process for years due to foreign contact conflicts. Luckily we have rules and standards that no one is above.
- stallmanite 7y ago
  Hassling people with drug tests doesn't keep out foreign agents.
coldtea 7y ago
>That states like China and Russia can recruit the best cybersecurity talent in their respective countries, and force them to work for the government, while the United States can't, is a problem. Huh? Why the united states couldn't? It's government/military budget is much higher... As for the "force them", China and Russia don't need to force anyone to work for their cybersecurity teams either (nor it would be wise to have someone do such crucial tasks against their will). Paying goes a long way...
- deleted 7y ago
  [deleted]
- logfromblammo 7y ago
  I could be "forced" to do a whole lot of stuff for $200k/year, plus a zero-deductible health plan and fully-matched 401(k), that also doesn't require living in California, NYC, or DC. I won't compromise my personal ethics, though. Not at that price. I'd need another $300k/year, a real defined-benefit pension, family gym membership, company-leased car, tuition benefits, and a bullshit story that I can tell myself in order to sleep at night. And in order to set aside my personal vendettas, such as by actually propping up AT&T or Bank of America in some way, I'll need 8 figures and a 30-hour work week. And unrestricted common stock--not so much that the CEOs have to kiss my ass, but enough that I don't get automatically ignored.
- TheBeardKing 7y ago
  Congress sets salaries and benefits for government positions, but most of those jobs are under the executive branch. So the president can't just increase the head of cybersecurity's salary to $1M, that has to be approved by Congress. The DoD and intelligence agencies get around these restrictions by contracting out the technical work, but the problem is the top decision makers still don't make nearly enough to attract real experts in the field. In the government agency I'm employed with, the cyber security manager for our products has only a logistics management background. The information assurance personnel are contractors, but they don't have much impact on the real decision making.

g00s3_caLL_x2 7y ago

I get what you're saying, but do you want you top minds working while high, or better yet, needing to depend on them while they are high? Some things just require a clarity 24/7. Wouldn't nation security fall under that?

bilbo0s 7y ago

Sounds like an interesting plan.

birdyrooster 7y ago
Congress loves giving more money to the military.

spunker540 7y ago

I’m not biased at all, just a patriot, and I think the government should inflate the wages of all software engineers in the entire nation to $1M in the name of national defense.

lioeters 7y ago
Software Engineeer: We Need to Prepare for a Complete Rewrite (and Significant Salary Increase)
logfromblammo 7y ago
I am also not biased at all, but I feel strongly that we need to support the deliberative efforts of our nation's software-building infrastructure-protecting heroes by giving them all individual offices with doors that can close and lock, also ensuring that the occupant of the office has a key for it. And nice, high-backed office chairs. And dual monitors for each workstation, with the computation hardware refreshed at least every three years--to include a real graphics card, that actually works with virtualization, because of 3D mapping. And the kitchenettes should also be enclosed in their own rooms, so microwaved fish or broccoli smells don't permeate all the offices at lunch time. Not that I definitely know that's a thing that actually happens, but I imagine that if it did, if might break a software developer's concentration. Every. Danged. Time. For national security! Should probably recommend these "critical security precautions" to all of our allies, too. And potential allies. And probably the adversaries will copy them, but not much we can do about that. ~

umvi 7y ago

Well, NSA used to have the best and brightest until Snowden. Now NSA can't get the best and brightest because they are conscientious objectors.

ses1984 7y ago
There were plenty of objectors before Snowden and also a huge group of folks who would choose to work for the nsa anyway. The impact isn't that great.
gtfratteus 7y ago
Any source for that claim? I'd expect salary and drug testing to be the two biggest factors dissuading top engineers from applying to the NSA. Personally, I'd find working for the NSA to be much more interesting than what I'm doing currently, but I just can't justify taking a 50% salary hit to work there. If I were the president, I'd think about opening a sixth military academy specifically focused on Cyber warfare. You could then require graduates to work for the military/NSA for five years after graduation, and you'd only need to throw insane money at fifty or so professors.
cmiles74 7y ago
This isn't a technical issue, but I think that it's important: working for the government comes with less pay, but there was always the idea that you were putting in effort for the benefit of the country. In my opinion the NSA has squandered that and they have somehow ended up in the same category as Palantir and Facebook. I'm not sure how they can fix this, but I do think it will need to be addressed if they want to hire and retain top talent. They have interesting problems but no one will work on them if they feel they are, in the end, hurting their fellow country-people.
- jkestner 7y ago
  They could start fixing it by not turning their spying tools inward, and enacting strong whistleblower protection laws. The other half is admitting that the government did something wrong in the first place, which they can do by prosecuting officials who broke the law, retire those that quasi-legally facilitated domestic dragnets, and pardoning Snowden, Winner, etc. That’s going to take politicians who aren’t jingoistic.

ajay-d 7y ago

Russia also recruits cyber criminals, offering reduced sentences if they work for the government[1] "The cellmate said that people incarcerated for cybercrimes could get out before trial, in exchange for working for the government. Another inmate had already taken a deal, he said. “It was an offer to cooperate,” Mr. Artimovich said. “Why else would you work for the government?” he added. “The salaries are tiny. But if you do something illegal, and go to prison for eight or nine years, the F.S.B. can help you,” he said, using a Russian abbreviation for the Federal Security Service." [1] https://www.nytimes.com/2016/12/29/world/europe/how-russia-recruited-elite-hackers-for-its-cyberwar.html https://www.nytimes.com/2016/12/29/world/europe/how-russia-r...

bilbo0s 7y ago
Yeah, but we are almost certainly doing this already as well. So there's no advantage to be gained there. If a cyber criminal is valuable enough, ie-not a script kiddie, we're already making the offers. We need ideas that are somewhat out of the box. Something that isn't already being done that we can start doing to bolster our capabilities.
- dx87 7y ago
  AFAIK we aren't doing that. Once you've been caught doing criminal activity, you pretty much have no chance of getting the security clearance required to do cyber work for the government. They're willing to overlook criminal activity if you are up front about it and have never been caught, but any sort of criminal record is a showstopper for cleared government work.
  - deleted 7y ago
    [deleted]
coldtea 7y ago
You think that's some kind of exception? All kinds of cyber criminals also work for western governments/agencies as consultants. E.g.: "Since 2000, Mitnick has been a paid security consultant, public speaker and author. He does security consulting for Fortune 500 companies and the FBI, performs penetration testing services for the world's largest companies and teaches Social Engineering classes to dozens of companies and government agencies."

bilbo0s 7y ago

Sounds like an interesting plan. Where is the money going to come from? We cutting something else? Like outdated military infrastructure since we should be ramping up for the cyber future? Or are we instead going to ramp up the deficit spending more to cover the extra expenses? Have you actually thought your proposed solution through? Have you considered the larger picture? We're already deficit spending at a level approaching USD1.5T. How do we handle the financial implications of such a shift? Most of the "best and brightest" in America, are not, in fact, American. How do we get them the necessary security clearances? Should we be giving them that level of clearance? I won't even go into the fact that the private sector would still be making all of the best tech as they gobbled up intellectual capital from around the globe, and we only have the US to snap people up from. Sure France, Germany, Russia, China etc can only snap people up from their nations too, but they have much better educational systems. This problem requires more considered thought, and very likely a little bit of creativity, to work through.

wycy 7y ago
>Have you actually thought your proposed solution through? Have you considered the larger picture? The OP's plan seems like a good one to bolster national security. OP doesn't need to lay out every single step of the solution, all the way down to the US education system, in order to make it a good point.
boomboomsubban 7y ago
>Where is the money going to come from? From the money we currently pay third party contractors to do the job. >We're already deficit spending at a level approaching USD1.5T. How do we handle the financial implications of such a shift By realizing that a gigantic increase in their salary would not be remotely large enough to constitute "a shift." >How do we get them the necessary security clearances? Should we be giving them that level of clearance? With the same bogus system we use for everybody else.

nradov 7y ago

The security clearance investigation process can already be expedited for urgent cases. However we absolutely should never lower clearance standards. Penetration by foreign agents could be far more damaging than a lack of top cyber security personnel.

ssully 7y ago
Yeah it would be a real shame if we lowered the clearance standards. Imagine if our president lowered the standards for say, his son in law, who failed to pass the process for years due to foreign contact conflicts. Luckily we have rules and standards that no one is above.
stallmanite 7y ago
Hassling people with drug tests doesn't keep out foreign agents.

coldtea 7y ago

>That states like China and Russia can recruit the best cybersecurity talent in their respective countries, and force them to work for the government, while the United States can't, is a problem. Huh? Why the united states couldn't? It's government/military budget is much higher... As for the "force them", China and Russia don't need to force anyone to work for their cybersecurity teams either (nor it would be wise to have someone do such crucial tasks against their will). Paying goes a long way...

deleted 7y ago
[deleted]
logfromblammo 7y ago
I could be "forced" to do a whole lot of stuff for $200k/year, plus a zero-deductible health plan and fully-matched 401(k), that also doesn't require living in California, NYC, or DC. I won't compromise my personal ethics, though. Not at that price. I'd need another $300k/year, a real defined-benefit pension, family gym membership, company-leased car, tuition benefits, and a bullshit story that I can tell myself in order to sleep at night. And in order to set aside my personal vendettas, such as by actually propping up AT&T or Bank of America in some way, I'll need 8 figures and a 30-hour work week. And unrestricted common stock--not so much that the CEOs have to kiss my ass, but enough that I don't get automatically ignored.
TheBeardKing 7y ago
Congress sets salaries and benefits for government positions, but most of those jobs are under the executive branch. So the president can't just increase the head of cybersecurity's salary to $1M, that has to be approved by Congress. The DoD and intelligence agencies get around these restrictions by contracting out the technical work, but the problem is the top decision makers still don't make nearly enough to attract real experts in the field. In the government agency I'm employed with, the cyber security manager for our products has only a logistics management background. The information assurance personnel are contractors, but they don't have much impact on the real decision making.