4 ms·

Here’s a novel idea: how about the NSA used its powers to defend Americans instead of hoarding zero days and spying on them? Things like working with companies

Here’s a novel idea: how about the NSA used its powers to defend Americans instead of hoarding zero days and spying on them? Things like working with companies and institutions to ensure they have proper security and encryption.

azinman2 6y ago
That alone wouldn’t be enough; why does this have to be XOR?
- thaumasiotes 6y ago
  It has to be exclusive because the two goals directly conflict with one another. Thus, one of the most common good-government proposals that gets floated in this area is to divide the NSA in two, one group devoted solely to offense, and one devoted solely to defense. At that point, at least you can know whether one group did something wrong. The job of the offense group is to find vulnerabilities, hoard them, and use them to attack people. But the job of the defense group is to find vulnerabilities, publicize them, and make sure they get fixed. Currently we have the offense group, but they like to pretend to be the defense group for PR reasons. This is not a great situation.
  - colordrops 6y ago
    Why is cyber warfare any different from other military efforts? I've never heard of this split of defense and offense in other military realms.
    - thaumasiotes 6y ago
      Everyone uses the same communications technology. Your email and Turkish email are the same, an attack on one is an attack on the other, and a defense of one is a defense of the other. This isn't World War II where German communications are encrypted on Engima machines while American communications are encrypted by translation into Navajo. Your tanks are quite different from Turkish tanks: Turkish tanks are located in Turkey. You can bomb Turkey as much as you want without compromising a single American tank.
      - colordrops 6y ago
        The NSA can attack foreign assets without compromising a single american asset. Mind you, I'm playing devil's advocate here to understand the reasoning. The NSA is abhorrent to me.
        thaumasiotes 6y ago
        No, that's not how software works. An attack that works against foreign assets works just as well against American assets, because they run the same software. So once you have the attack, you know that (1) The evil Turks have a hole in their defenses, and you can use it to spy on them; (2) The righteous Americans have a hole -- exactly the same hole -- in their defenses, and you can use it to spy on them; (3) Everyone else in the world can also spy on the righteous Americans, just like you can. Now you have to choose whether your job is protecting the Americans or undermining the Turks. You can do exactly one of those things. If you protect the Americans, the Turks will receive the same protection. If you keep silent to let the Turks embarrass themselves, you're also letting the Americans embarrass themselves.
        unishark 6y ago
        Are you talking about the introduction of backdoors or just exploiting vulnerabilities that are there? Because the latter sounds analogous to the creation of a tank bomb which might theoretically used against your tanks also. The parent poster said the NSA "can" do attacks that don't reduce the security US assets. They didn't claim that all possible attacks fit this description. For example they can try to guess at bad passwords used on that foreign computer system.
        thaumasiotes 6y ago
        Root comment: >>> how about the NSA used its powers to defend Americans instead of hoarding zero days and spying on them? >> why does this have to be XOR? Because these are opposed goals. Defending Americans means invalidating zero-days. You could restrict yourself solely to attacks that don't rely on flaws in the software. In that case, you would have no reason to hoard zero-days, because you are ideologically committed to never use them. That would be weird in a few different ways. But most relevant here, it answers "Why can't we do both?" with "We can, as long as we never do the second one!" This is not really a compelling response.
    - matkoniecz 6y ago
      It is typical to have separate group that is supposed to build bridges (Ministry of Interior/Ministry of Development etc) and one that is supposed to destroy bridges belonging to someone else (Ministry of War/Ministry of Defence/etc). Having group doing both would be ridiculous. And this is happening with say NSA. And situation is much worse than with bridges! Typically you can bomb bridge far away without affecting your own, it is often not possible with 0days and similar - we have one internet.
    - pizzazzaro 6y ago
      Yes, because a mounted cavalry is incredibly useful as a defensive force in seige warfare.

azinman2 6y ago

That alone wouldn’t be enough; why does this have to be XOR?

thaumasiotes 6y ago
It has to be exclusive because the two goals directly conflict with one another. Thus, one of the most common good-government proposals that gets floated in this area is to divide the NSA in two, one group devoted solely to offense, and one devoted solely to defense. At that point, at least you can know whether one group did something wrong. The job of the offense group is to find vulnerabilities, hoard them, and use them to attack people. But the job of the defense group is to find vulnerabilities, publicize them, and make sure they get fixed. Currently we have the offense group, but they like to pretend to be the defense group for PR reasons. This is not a great situation.
- colordrops 6y ago
  Why is cyber warfare any different from other military efforts? I've never heard of this split of defense and offense in other military realms.
  - thaumasiotes 6y ago
    Everyone uses the same communications technology. Your email and Turkish email are the same, an attack on one is an attack on the other, and a defense of one is a defense of the other. This isn't World War II where German communications are encrypted on Engima machines while American communications are encrypted by translation into Navajo. Your tanks are quite different from Turkish tanks: Turkish tanks are located in Turkey. You can bomb Turkey as much as you want without compromising a single American tank.
    - colordrops 6y ago
      The NSA can attack foreign assets without compromising a single american asset. Mind you, I'm playing devil's advocate here to understand the reasoning. The NSA is abhorrent to me.
      - thaumasiotes 6y ago
        No, that's not how software works. An attack that works against foreign assets works just as well against American assets, because they run the same software. So once you have the attack, you know that (1) The evil Turks have a hole in their defenses, and you can use it to spy on them; (2) The righteous Americans have a hole -- exactly the same hole -- in their defenses, and you can use it to spy on them; (3) Everyone else in the world can also spy on the righteous Americans, just like you can. Now you have to choose whether your job is protecting the Americans or undermining the Turks. You can do exactly one of those things. If you protect the Americans, the Turks will receive the same protection. If you keep silent to let the Turks embarrass themselves, you're also letting the Americans embarrass themselves.
        unishark 6y ago
        Are you talking about the introduction of backdoors or just exploiting vulnerabilities that are there? Because the latter sounds analogous to the creation of a tank bomb which might theoretically used against your tanks also. The parent poster said the NSA "can" do attacks that don't reduce the security US assets. They didn't claim that all possible attacks fit this description. For example they can try to guess at bad passwords used on that foreign computer system.
        thaumasiotes 6y ago
        Root comment: >>> how about the NSA used its powers to defend Americans instead of hoarding zero days and spying on them? >> why does this have to be XOR? Because these are opposed goals. Defending Americans means invalidating zero-days. You could restrict yourself solely to attacks that don't rely on flaws in the software. In that case, you would have no reason to hoard zero-days, because you are ideologically committed to never use them. That would be weird in a few different ways. But most relevant here, it answers "Why can't we do both?" with "We can, as long as we never do the second one!" This is not really a compelling response.
  - matkoniecz 6y ago
    It is typical to have separate group that is supposed to build bridges (Ministry of Interior/Ministry of Development etc) and one that is supposed to destroy bridges belonging to someone else (Ministry of War/Ministry of Defence/etc). Having group doing both would be ridiculous. And this is happening with say NSA. And situation is much worse than with bridges! Typically you can bomb bridge far away without affecting your own, it is often not possible with 0days and similar - we have one internet.
  - pizzazzaro 6y ago
    Yes, because a mounted cavalry is incredibly useful as a defensive force in seige warfare.