5 ms·

U.S. cybersecurity agency warns of 'grave' threat from hack

57 points by lisper 6y ago

Anon4Now 6y ago
Direct link to joint statement: https://www.cisa.gov/news/2020/12/16/joint-statement-federal-bureau-investigation-fbi-cybersecurity-and-infrastructure https://www.cisa.gov/news/2020/12/16/joint-statement-federal...
irateswami 6y ago
I'm not optimistic about the US Gov's ability to defend and maintain these networks. Yeah they have a lot of money to throw at the problem but eventually you have to put the best, most knowledgeable people in front of those computers and do work. They can't hire the best and brightest though, and are otherwise unwilling to make the policy changes necessary to be able to. When security professionals can make 2-3x in the private sector and smoke as much weed as they want (in this case the stereotype has some truth to it; a lot of devs/engineers use marijuana) what incentive is there to work for one of these alphabet-soup government agencies? Even if the positions paid more and had more modern drug testing policies, I have never, NOT ONCE, met someone who works in software at a government agency or at a company doing government contract work who wasn't a massive fuddy-duddy-boomer. These breaches will continue to happen until the Gov takes a more pragmatic approach to it's technology and brings it's culture more in line with the private sector.
- ericmcer 6y ago
  I don't even think many devs are 'stoners' in the sense of using marijuana daily. I don't think you could code at a high level if you were actually smoking weed every day, but it just feels invasive for a job to tell me I can NEVER touch it and they will monitor me to check. I am not a huge fan of alcohol, but if a job told me I could never drink again and they will test me to see if I have been drinking it would feel super invasive and be a huge turn off.
  - i_haz_rabies 6y ago
    I think you'd be surprised. I smoke pretty much every day, at least. That said, only in the evening when I'm done work and I'm not exactly programming control systems for SpaceX or whatever.
  - wbronitsky 6y ago
    > I don’t think you could code at a high level if you were actually smoking weed every day Ah, but on the contrary, I can confirm, based on what I consider a “high level” of coding, that some people cannot code without smoking weed every day. I can also assure you that many, many devs are daily users, quality of code output not withstanding.
    - ericmcer 6y ago
      It probably affects everyone a little differently, I know if I start smoking every day my brain is noticeably slower. I can still get by but I cannot visualize and store as much code in my mind at one time. Adversely tons of sleep, creatine and coffee seem to expand my context and I can hold a lot more simultaneously. Life is also not about being the best programmer though, so I would definitely trade ability for comfort if weed was offering that.
- March_f6 6y ago
  A start would be moving the NSA head office out of some rather depressing forest in Maryland and perhaps to say Venice Beach? :)
  - 127001brewer 6y ago
    There are a lot of things to do outdoors around Maryland: there are a lot really good MTB (or just hiking) places, like Rockburn and Patapsco State Park; beaches are within two hours away; ski / snowboarding places within two hours away; and then there's the Chesapeake Bay. It's not California, but it's nothing either.
  - Animats 6y ago
    CSIA isn't part of NSA. It's part of Homeland Security. That's probably worse for doing anything technical. NSA has a track record of solving hard problems. Homeland Security is a collection of police departments gathered together for political reasons.
- the_only_law 6y ago
  Reminds me of an article that got posted here several months back about the UK government having issues hiring a high level IT worker (I think it was some sort of director). While everyone else was talking about pay, one user pointed out that in such a position they’d be effectively neutered by the bureaucracy and politicians (and others) chasing other interests that would effectively be against the positions missions.
- Veserv 6y ago
  There is lots of evidence that the "best and brightest" are also totally incapable of defending and maintaining networks against skilled individuals, let alone skilled organizations, let alone state actors. I can not think of a single commercial organization which would even dare to claim they could protect against state actors or even provide any legally binding, quantitative assessment of their security that should inspire any confidence in their ability to defend against a single competent individual. You can just look to Google Project Zero to see a continuous stream of evidence of singular skilled professionals breaching these systems within mere weeks to months. Hardly comparable to the resources of state actors who can deploy hundreds or thousands of skilled professionals for years. To go from being unable to defend against skilled individuals to being able to defend against state actors would require on the order of a 100,000% improvement in capability by the "best and brightest".
  - tmotwu 6y ago
    You're oversimplifying the issue to unnecessarily devalue the "best and brightest", whoever you appear to be referring to, and are giving too much credit to state actors. When organizations rely on hundreds to thousands of platforms to operate, and those platforms are under the weight of hundreds and thousands of dependencies, it's not unlikely one could discover and quickly take advantage of randomly sprinkled secrets in some github repository. Humans, weak passwords, and improperly configured ACL are often the common denominator in the majority of recent breaches, not the systems themselves. People get lazy and start overlooking well established protocols that could have prevented these attacks. It's hard to do this right unless you hire red teams to perform monthly audits of every possible leakage or attack vector.
    - Veserv 6y ago
      I do not see how that is disagreeing with my statement. If the security architecture of your IT system can be compromised by stupid mistakes in some selection of hundreds to thousands of dependencies and that selection was not audited then the security architecture can not protect from simple attacks which, almost definitionally, means the security process is largely useless as attackers do not care to attack only where the systems are strong. If auditing dependencies is viewed as "too hard" or "too expensive" I do not see how that has any bearing on the security of the system. It merely demonstrates that improving the security is not worth the cost tradeoff, it does not somehow magically improve the objective security of the system. The objective evaluation of a comprehensive security architecture depends on its holistic effectiveness, not merely the effectiveness of the parts the designers thought about. By that metric, I am not aware of any commercial IT system that even meets the low bar of protecting against an attack with a mere $10M in funding, let alone the billions a state actor has access to. So, a question for you, are you aware of any commercial IT system in the entire world that you think would survive a $10M open bounty let alone $1B? If so, what objective, empirical evidence do you have to justify that claim? Hopefully one day I might get a convincing response to this question.
- TurkishPoptart 6y ago
  It seems that Russia's cyber prime directive is to ceaselessly attempt to penetrate USG contractor's systems, which, to a layperson seems like an obvious cybersecurity flaw. How are these systems secured in other Western countries? How do France and the UK, for example, secure their critical infrastructure networks? The U.S. strategy of just contracting out all these essential service is revealing its pressure points. Seems that the USG insists on just cutting checks to these companies like SolarWinds, which are more interested in gaining clients, generating revenue, and marketing than effectively engineering durable solutions. Another factor is probably NIST's questionable practices about password hygiene (requiring them to be changed every 30-60 days).
Animats 6y ago
"One platform to rule your IT stack." - SolarWinds site. Uh oh.
- ganoushoreilly 6y ago
  I guess this is one of those.. well you're not wrong.. situations lol!
justinzollars 6y ago
Russia is getting one heck of bang for its buck. Its a declining regional power with a GDP the size of Texas [1,2] who our media blames all of our problems on. Imagine if a comparable adversary decided to mess with the United States. [1] https://www.nationmaster.com/country-info/compare/Russia/United-States/Economy/table https://www.nationmaster.com/country-info/compare/Russia/Uni... [2] https://en.wikipedia.org/wiki/List_of_states_and_territories_of_the_United_States_by_GDP https://en.wikipedia.org/wiki/List_of_states_and_territories...
- kalimoxto 6y ago
  Giving you the benefit of the doubt: you've conflated the Russian yearly budget with Maryland's GDP. Russian GDP of 2 Trillion would be the second in the US, between California and Texas
  - justinzollars 6y ago
    corrected. thx
- sebmellen 6y ago
  A better (and more accurate) comparison is that Russia has a lower GDP than Italy: https://countryeconomy.com/countries/compare/russia/italy https://countryeconomy.com/countries/compare/russia/italy.
- disown 6y ago
  > Its a declining regional power It's a declining global power, but a rising regional power. It's nowhere what it was in the soviet days, but it certainly has been growing since the post 90s collapse. > with a GDP the size of Texas [1,2] That's only on a nominal basis, but on a PPP basis, they are the 6th largest economy in the world. https://en.wikipedia.org/wiki/List_of_countries_by_GDP_(PPP) https://en.wikipedia.org/wiki/List_of_countries_by_GDP_(PPP)
  - justinzollars 6y ago
    > but a rising regional power. It's not rising in any sense.
quercusa 6y ago
Has there been any evidence presented to support the attribution to Russia?
- wyldfire 6y ago
  Not public AFAIK. But multiple news agencies cite US officials who make the claim it was Cozy Bear / APT29 [1]. Microsoft claims [2], "We believe this is nation-state activity at significant scale ... Because of the sophistication of the techniques and operational security capabilities of the actor, we want to encourage greater scrutiny by the broader community..." [1] https://en.wikipedia.org/wiki/Cozy_Bear https://en.wikipedia.org/wiki/Cozy_Bear [2] https://blogs.microsoft.com/on-the-issues/2020/12/13/customers-protect-nation-state-cyberattacks/ https://blogs.microsoft.com/on-the-issues/2020/12/13/custome...
- devin 6y ago
  I don't think intelligence agencies are generally keen on revealing their methods, but I understand why you're asking.
- jjk166 6y ago
  Reuters was the first to claim the attack was attributed to russia based on "3 sources close to the investigation" but presented no evidence. The Washington Post claimed it was specifically APT29/CozyBear, also based on "3 anonymous sources familiar with the hack" with no supporting information. Neither FireEye nor the US government have officially attributed the attack to any state actor, nonetheless russia, though it would be unusual to make an attribution this quickly anyways. FireEye makes no note of any tools used in the hack that have been previously associated with either APT29 or Russia in general. Their countermeasures [0] seem to suggest all injected code was either in english or encrypted, but it would be pretty dumb to leave unencrypted russian (or any other language) text in your hack of a US program. The security group Intel 471 apparently [1] found a russian-language actor trying to sell access to the solarwind network in April 2020, but it is unclear if they actually had that access, if that access was connected with this hack, or if this individual was anything more than a middleman. I just googled the name, and there is a facebook page for someone with no friends or activity who is signed up for a couple of ukrainian groups (a support group for the mayor of a town, a public transit department, etc) so the facebook page is clearly a bot but there may be no association. That's the closest thing I could find to evidence. [0] https://github.com/fireeye/sunburst_countermeasures https://github.com/fireeye/sunburst_countermeasures [1] https://twitter.com/Intel471Inc/status/1339233255741120513 https://twitter.com/Intel471Inc/status/1339233255741120513
boomboomsubban 6y ago
Is anyone else expecting an eventual leak that one of the US cyber security agencies is behind this backdoor, never expecting someone else to abuse it? Too much of what the company has said in the past just echoes intel agencies opinions, and the response seems hyper focused on the "enemy" rather than those responsible for the breach. Their "solution" is just to turn off machines with SolarWinds, something they know will be a huge problem for anyone impacted.
- ganoushoreilly 6y ago
  I don't. It's sloppy work on solarwinds part. US agencies aren't know for using sloppy risks, they want clean, precise, and small footprint attack tools.
  - boomboomsubban 6y ago
    You have a far better impression of US agencies than I do.
- alasdair_ 6y ago
  The solar winds update server had a password of “solarwinds123”. I don’t think intelligence agencies need to be blamed.
  - luckman212 6y ago
    Initially I couldn't believe this was true. But, sadly... https://www.techdirt.com/articles/20201215/13203045893/security-researcher-reveals-solarwinds-update-server-was-secured-with-password-solarwinds123.shtml https://www.techdirt.com/articles/20201215/13203045893/secur...
    - alasdair_ 6y ago
      In other news, Trump’s twitter password until a few days ago was “maga2020”. I’m not joking.
Cheyana 6y ago
They talk about what a challenge it will be to remove the malware from the systems. In our municipal IT department, whenever we've had a major infection the users will just have to feel the pain for a day while we pull the systems for reimaging, which takes about an hour to do, with up to another hour to redeploy and install and configure software. In some cases, we had systems standing by ready to swap out. Trying to find and remove the malware can be a needle in a haystack and next to impossible to find, and take longer that just swapping them.
- ganoushoreilly 6y ago
  In many cases, the D.o.D will just remove all tech in the stack and replace with new hardware. They simply can't trust it given the advanced persistence tools in use. I imagine we're going to see a lot of equipment sold off next year to try and recoup after being decomissioned.
user5410 6y ago
Will government still have the nerve to propose backdoor encryption after this? I mean, of course they will but will it still have the same effect over regulators?
rawatji330171 6y ago
https://newsrepoter.com/hbo-max-will-also-be-seen-on-the-roku-player-17dec/ https://newsrepoter.com/hbo-max-will-also-be-seen-on-the-rok...
TurkishPoptart 6y ago
We need to go back to paper, typewriters, and pneumatic tube systems. Or at least not rely on private, profit-seeking companies to protect our most critical infrastructure. How are they protecting critical infra in the U.K., France, and Germany? I would imagine that those governments use more centralized systems and are less reliant on private contractors.

57 points by lisper 6y ago

Direct link to joint statement: https://www.cisa.gov/news/2020/12/16/joint-statement-federal-bureau-investigation-fbi-cybersecurity-and-infrastructure https://www.cisa.gov/news/2020/12/16/joint-statement-federal...

irateswami 6y ago

I'm not optimistic about the US Gov's ability to defend and maintain these networks. Yeah they have a lot of money to throw at the problem but eventually you have to put the best, most knowledgeable people in front of those computers and do work. They can't hire the best and brightest though, and are otherwise unwilling to make the policy changes necessary to be able to. When security professionals can make 2-3x in the private sector and smoke as much weed as they want (in this case the stereotype has some truth to it; a lot of devs/engineers use marijuana) what incentive is there to work for one of these alphabet-soup government agencies? Even if the positions paid more and had more modern drug testing policies, I have never, NOT ONCE, met someone who works in software at a government agency or at a company doing government contract work who wasn't a massive fuddy-duddy-boomer. These breaches will continue to happen until the Gov takes a more pragmatic approach to it's technology and brings it's culture more in line with the private sector.

ericmcer 6y ago
I don't even think many devs are 'stoners' in the sense of using marijuana daily. I don't think you could code at a high level if you were actually smoking weed every day, but it just feels invasive for a job to tell me I can NEVER touch it and they will monitor me to check. I am not a huge fan of alcohol, but if a job told me I could never drink again and they will test me to see if I have been drinking it would feel super invasive and be a huge turn off.
- i_haz_rabies 6y ago
  I think you'd be surprised. I smoke pretty much every day, at least. That said, only in the evening when I'm done work and I'm not exactly programming control systems for SpaceX or whatever.
- wbronitsky 6y ago
  > I don’t think you could code at a high level if you were actually smoking weed every day Ah, but on the contrary, I can confirm, based on what I consider a “high level” of coding, that some people cannot code without smoking weed every day. I can also assure you that many, many devs are daily users, quality of code output not withstanding.
  - ericmcer 6y ago
    It probably affects everyone a little differently, I know if I start smoking every day my brain is noticeably slower. I can still get by but I cannot visualize and store as much code in my mind at one time. Adversely tons of sleep, creatine and coffee seem to expand my context and I can hold a lot more simultaneously. Life is also not about being the best programmer though, so I would definitely trade ability for comfort if weed was offering that.
March_f6 6y ago
A start would be moving the NSA head office out of some rather depressing forest in Maryland and perhaps to say Venice Beach? :)
- 127001brewer 6y ago
  There are a lot of things to do outdoors around Maryland: there are a lot really good MTB (or just hiking) places, like Rockburn and Patapsco State Park; beaches are within two hours away; ski / snowboarding places within two hours away; and then there's the Chesapeake Bay. It's not California, but it's nothing either.
- Animats 6y ago
  CSIA isn't part of NSA. It's part of Homeland Security. That's probably worse for doing anything technical. NSA has a track record of solving hard problems. Homeland Security is a collection of police departments gathered together for political reasons.
the_only_law 6y ago
Reminds me of an article that got posted here several months back about the UK government having issues hiring a high level IT worker (I think it was some sort of director). While everyone else was talking about pay, one user pointed out that in such a position they’d be effectively neutered by the bureaucracy and politicians (and others) chasing other interests that would effectively be against the positions missions.
Veserv 6y ago
There is lots of evidence that the "best and brightest" are also totally incapable of defending and maintaining networks against skilled individuals, let alone skilled organizations, let alone state actors. I can not think of a single commercial organization which would even dare to claim they could protect against state actors or even provide any legally binding, quantitative assessment of their security that should inspire any confidence in their ability to defend against a single competent individual. You can just look to Google Project Zero to see a continuous stream of evidence of singular skilled professionals breaching these systems within mere weeks to months. Hardly comparable to the resources of state actors who can deploy hundreds or thousands of skilled professionals for years. To go from being unable to defend against skilled individuals to being able to defend against state actors would require on the order of a 100,000% improvement in capability by the "best and brightest".
- tmotwu 6y ago
  You're oversimplifying the issue to unnecessarily devalue the "best and brightest", whoever you appear to be referring to, and are giving too much credit to state actors. When organizations rely on hundreds to thousands of platforms to operate, and those platforms are under the weight of hundreds and thousands of dependencies, it's not unlikely one could discover and quickly take advantage of randomly sprinkled secrets in some github repository. Humans, weak passwords, and improperly configured ACL are often the common denominator in the majority of recent breaches, not the systems themselves. People get lazy and start overlooking well established protocols that could have prevented these attacks. It's hard to do this right unless you hire red teams to perform monthly audits of every possible leakage or attack vector.
  - Veserv 6y ago
    I do not see how that is disagreeing with my statement. If the security architecture of your IT system can be compromised by stupid mistakes in some selection of hundreds to thousands of dependencies and that selection was not audited then the security architecture can not protect from simple attacks which, almost definitionally, means the security process is largely useless as attackers do not care to attack only where the systems are strong. If auditing dependencies is viewed as "too hard" or "too expensive" I do not see how that has any bearing on the security of the system. It merely demonstrates that improving the security is not worth the cost tradeoff, it does not somehow magically improve the objective security of the system. The objective evaluation of a comprehensive security architecture depends on its holistic effectiveness, not merely the effectiveness of the parts the designers thought about. By that metric, I am not aware of any commercial IT system that even meets the low bar of protecting against an attack with a mere $10M in funding, let alone the billions a state actor has access to. So, a question for you, are you aware of any commercial IT system in the entire world that you think would survive a $10M open bounty let alone $1B? If so, what objective, empirical evidence do you have to justify that claim? Hopefully one day I might get a convincing response to this question.
TurkishPoptart 6y ago
It seems that Russia's cyber prime directive is to ceaselessly attempt to penetrate USG contractor's systems, which, to a layperson seems like an obvious cybersecurity flaw. How are these systems secured in other Western countries? How do France and the UK, for example, secure their critical infrastructure networks? The U.S. strategy of just contracting out all these essential service is revealing its pressure points. Seems that the USG insists on just cutting checks to these companies like SolarWinds, which are more interested in gaining clients, generating revenue, and marketing than effectively engineering durable solutions. Another factor is probably NIST's questionable practices about password hygiene (requiring them to be changed every 30-60 days).

Animats 6y ago

"One platform to rule your IT stack." - SolarWinds site. Uh oh.

ganoushoreilly 6y ago
I guess this is one of those.. well you're not wrong.. situations lol!

justinzollars 6y ago

Russia is getting one heck of bang for its buck. Its a declining regional power with a GDP the size of Texas [1,2] who our media blames all of our problems on. Imagine if a comparable adversary decided to mess with the United States. [1] https://www.nationmaster.com/country-info/compare/Russia/United-States/Economy/table https://www.nationmaster.com/country-info/compare/Russia/Uni... [2] https://en.wikipedia.org/wiki/List_of_states_and_territories_of_the_United_States_by_GDP https://en.wikipedia.org/wiki/List_of_states_and_territories...

kalimoxto 6y ago
Giving you the benefit of the doubt: you've conflated the Russian yearly budget with Maryland's GDP. Russian GDP of 2 Trillion would be the second in the US, between California and Texas
- justinzollars 6y ago
  corrected. thx
sebmellen 6y ago
A better (and more accurate) comparison is that Russia has a lower GDP than Italy: https://countryeconomy.com/countries/compare/russia/italy https://countryeconomy.com/countries/compare/russia/italy.
disown 6y ago
> Its a declining regional power It's a declining global power, but a rising regional power. It's nowhere what it was in the soviet days, but it certainly has been growing since the post 90s collapse. > with a GDP the size of Texas [1,2] That's only on a nominal basis, but on a PPP basis, they are the 6th largest economy in the world. https://en.wikipedia.org/wiki/List_of_countries_by_GDP_(PPP) https://en.wikipedia.org/wiki/List_of_countries_by_GDP_(PPP)
- justinzollars 6y ago
  > but a rising regional power. It's not rising in any sense.

quercusa 6y ago

Has there been any evidence presented to support the attribution to Russia?

wyldfire 6y ago
Not public AFAIK. But multiple news agencies cite US officials who make the claim it was Cozy Bear / APT29 [1]. Microsoft claims [2], "We believe this is nation-state activity at significant scale ... Because of the sophistication of the techniques and operational security capabilities of the actor, we want to encourage greater scrutiny by the broader community..." [1] https://en.wikipedia.org/wiki/Cozy_Bear https://en.wikipedia.org/wiki/Cozy_Bear [2] https://blogs.microsoft.com/on-the-issues/2020/12/13/customers-protect-nation-state-cyberattacks/ https://blogs.microsoft.com/on-the-issues/2020/12/13/custome...
devin 6y ago
I don't think intelligence agencies are generally keen on revealing their methods, but I understand why you're asking.
jjk166 6y ago
Reuters was the first to claim the attack was attributed to russia based on "3 sources close to the investigation" but presented no evidence. The Washington Post claimed it was specifically APT29/CozyBear, also based on "3 anonymous sources familiar with the hack" with no supporting information. Neither FireEye nor the US government have officially attributed the attack to any state actor, nonetheless russia, though it would be unusual to make an attribution this quickly anyways. FireEye makes no note of any tools used in the hack that have been previously associated with either APT29 or Russia in general. Their countermeasures [0] seem to suggest all injected code was either in english or encrypted, but it would be pretty dumb to leave unencrypted russian (or any other language) text in your hack of a US program. The security group Intel 471 apparently [1] found a russian-language actor trying to sell access to the solarwind network in April 2020, but it is unclear if they actually had that access, if that access was connected with this hack, or if this individual was anything more than a middleman. I just googled the name, and there is a facebook page for someone with no friends or activity who is signed up for a couple of ukrainian groups (a support group for the mayor of a town, a public transit department, etc) so the facebook page is clearly a bot but there may be no association. That's the closest thing I could find to evidence. [0] https://github.com/fireeye/sunburst_countermeasures https://github.com/fireeye/sunburst_countermeasures [1] https://twitter.com/Intel471Inc/status/1339233255741120513 https://twitter.com/Intel471Inc/status/1339233255741120513

boomboomsubban 6y ago

Is anyone else expecting an eventual leak that one of the US cyber security agencies is behind this backdoor, never expecting someone else to abuse it? Too much of what the company has said in the past just echoes intel agencies opinions, and the response seems hyper focused on the "enemy" rather than those responsible for the breach. Their "solution" is just to turn off machines with SolarWinds, something they know will be a huge problem for anyone impacted.

ganoushoreilly 6y ago
I don't. It's sloppy work on solarwinds part. US agencies aren't know for using sloppy risks, they want clean, precise, and small footprint attack tools.
- boomboomsubban 6y ago
  You have a far better impression of US agencies than I do.
alasdair_ 6y ago
The solar winds update server had a password of “solarwinds123”. I don’t think intelligence agencies need to be blamed.
- luckman212 6y ago
  Initially I couldn't believe this was true. But, sadly... https://www.techdirt.com/articles/20201215/13203045893/security-researcher-reveals-solarwinds-update-server-was-secured-with-password-solarwinds123.shtml https://www.techdirt.com/articles/20201215/13203045893/secur...
  - alasdair_ 6y ago
    In other news, Trump’s twitter password until a few days ago was “maga2020”. I’m not joking.

Cheyana 6y ago

They talk about what a challenge it will be to remove the malware from the systems. In our municipal IT department, whenever we've had a major infection the users will just have to feel the pain for a day while we pull the systems for reimaging, which takes about an hour to do, with up to another hour to redeploy and install and configure software. In some cases, we had systems standing by ready to swap out. Trying to find and remove the malware can be a needle in a haystack and next to impossible to find, and take longer that just swapping them.

ganoushoreilly 6y ago
In many cases, the D.o.D will just remove all tech in the stack and replace with new hardware. They simply can't trust it given the advanced persistence tools in use. I imagine we're going to see a lot of equipment sold off next year to try and recoup after being decomissioned.

user5410 6y ago

Will government still have the nerve to propose backdoor encryption after this? I mean, of course they will but will it still have the same effect over regulators?

rawatji330171 6y ago

https://newsrepoter.com/hbo-max-will-also-be-seen-on-the-roku-player-17dec/ https://newsrepoter.com/hbo-max-will-also-be-seen-on-the-rok...

TurkishPoptart 6y ago

We need to go back to paper, typewriters, and pneumatic tube systems. Or at least not rely on private, profit-seeking companies to protect our most critical infrastructure. How are they protecting critical infra in the U.K., France, and Germany? I would imagine that those governments use more centralized systems and are less reliant on private contractors.