4 ms·

The challenge the NSA has is it possesses 2 separate missions that are often in direct conflict: secure the communications of the United States, and to collect,

The challenge the NSA has is it possesses 2 separate missions that are often in direct conflict: secure the communications of the United States, and to collect, eavesdrop, and compromise the communications of other countries. The United States Atomic Energy Commission of the 1950s and 60s had the same problem. Their mission was to both regulate nuclear power as well as research and promote the widespread adoption of nuclear power. Making things safe and keeping them safe while also making things easy and cheap are often in conflict. Ultimately it was split into two different agencies: One tasked with regulation and one Tasked with research and promotion. I believe both missions of the NSA are important. However I believe it should be split into two agencies each Enthusiastically pursuing a single mission to the best of their abilities. Imagine a cyber defense agency that does nothing but find and fix holes in computing infrastructure and major software projects. It pays for exploits and then works to patch them, promotes bug bounties, develops secure coding standards, audits open source projects, etc. Imagine something like The National Endowment for the Arts (NEA) that instead funds critical pieces of software like openSSL, etc. Is that necessarily the best form? Probably not but it’s way better than what we have now: every time the NSA suggests changes to “make something more secure “ there is a looming specter that they are lying and are actually trying to compromise things.

pjmorris 5y ago
> Imagine a cyber defense agency that does nothing but find and fix holes in computing infrastructure and major software projects. It pays for exploits and then works to patch them, promotes bug bounties, develops secure coding standards, audits open source projects, etc. Imagine something like The National Endowment for the Arts (NEA) that instead funds critical pieces of software like openSSL, etc. I like this idea. At the same time, I think the agency - or organization, if you prefer - should look something like the National Transportation Safety Board, where incidents are investigated, reported on, and recommendations are made in a way that improves user safety. Maybe the 'National Digital Safety Board'?
- hirako2000 5y ago
  Or they should stop stealing tax payers money and dissolve these agencies. The one thing they are good at is digging deeper and deeper the debt account, for virtually no benefit, and surely nuisance and worries.
  - pjmorris 5y ago
    Are you saying that the market, such as it is, is doing a good enough job of managing software vulnerabilities and their consequent breaches?
    - hirako2000 5y ago
      No. I'M by no means saying nor implying that. I'm saying tax should not be taken away from people to fund agencies. Businesses are free to do a good or bad job at managing their security posture. And if it is a bad job they are very likely to pay the consequences. The market is fine regulating itself in the long term. Agencies and regulation rather create obstacles and biases.
- tablespoon 5y ago
  > I like this idea. At the same time, I think the agency - or organization, if you prefer - should look something like the National Transportation Safety Board, where incidents are investigated, reported on, and recommendations are made in a way that improves user safety. Maybe the 'National Digital Safety Board'? I like it too, but I also think it would be needed to be backed by some kind of regulatory agency that could issue the cybersecurity equivalent of an "Airworthiness Directive". Otherwise we'd be in a similar situation we have know: lots of information about vulnerabilities that are often not acted upon.
CivBase 5y ago
> The challenge the NSA has is it possesses 2 separate missions that are often in direct conflict: secure the communications of the United States, and to collect, eavesdrop, and compromise the communications of other countries. I don't know... isn't that like saying a military general has 2 conflicting missions: offense and defense? We trust military leaders with both duties, even though they could theoretically sacrifice everything to achieve victory. > I believe both missions of the NSA are important. However I believe it should be split into two agencies each Enthusiastically pursuing a single mission to the best of their abilities. If you split the NSA in two, wouldn't you just have two agencies working against each other? And it would essentially give the offensive agency full permission to hoard security flaws to the detriment of the nation it serves. I think a better solution is to clearly establish the relative priorities of each mission. IMO, the NSA should always prioritize the security of the USA's (and it's allies') technological infrastructure over attacking its enemies'.
- cloverich 5y ago
  Genuinely curious about the downvotes on this. I know political stances often trump generally reasoned arguments on HN -- is it that this thread isn't _outright_ anti NSA?
  - SpicyLemonZest 5y ago
    Probably. I know people in my circles who believe without caveats or qualifications that the NSA is evil, that we just shouldn't have spy agencies at all, and wouldn't entertain any sort of abstract discussion of how the work should be organized.
tablespoon 5y ago
> I believe both missions of the NSA are important. However I believe it should be split into two agencies each Enthusiastically pursuing a single mission to the best of their abilities. At least with cryptography, I'm not sure how practical that is. I'm not cryptographer, but my impression is that offense and defense both deeply inform each other in that space.
AlexSW 5y ago
For what it's worth, I think this is the NCSC in the UK.
cameronh90 5y ago
In the UK we have the GCHQ and NCSC, which are in a sense what you're getting at.
Abishek_Muthian 5y ago
I concur, One who is responsible for punching holes shouldn't be the one to patch it. Right now adversaries are just playing treasure hunt because of this.

pjmorris 5y ago

> Imagine a cyber defense agency that does nothing but find and fix holes in computing infrastructure and major software projects. It pays for exploits and then works to patch them, promotes bug bounties, develops secure coding standards, audits open source projects, etc. Imagine something like The National Endowment for the Arts (NEA) that instead funds critical pieces of software like openSSL, etc. I like this idea. At the same time, I think the agency - or organization, if you prefer - should look something like the National Transportation Safety Board, where incidents are investigated, reported on, and recommendations are made in a way that improves user safety. Maybe the 'National Digital Safety Board'?

hirako2000 5y ago
Or they should stop stealing tax payers money and dissolve these agencies. The one thing they are good at is digging deeper and deeper the debt account, for virtually no benefit, and surely nuisance and worries.
- pjmorris 5y ago
  Are you saying that the market, such as it is, is doing a good enough job of managing software vulnerabilities and their consequent breaches?
  - hirako2000 5y ago
    No. I'M by no means saying nor implying that. I'm saying tax should not be taken away from people to fund agencies. Businesses are free to do a good or bad job at managing their security posture. And if it is a bad job they are very likely to pay the consequences. The market is fine regulating itself in the long term. Agencies and regulation rather create obstacles and biases.
tablespoon 5y ago
> I like this idea. At the same time, I think the agency - or organization, if you prefer - should look something like the National Transportation Safety Board, where incidents are investigated, reported on, and recommendations are made in a way that improves user safety. Maybe the 'National Digital Safety Board'? I like it too, but I also think it would be needed to be backed by some kind of regulatory agency that could issue the cybersecurity equivalent of an "Airworthiness Directive". Otherwise we'd be in a similar situation we have know: lots of information about vulnerabilities that are often not acted upon.

CivBase 5y ago

> The challenge the NSA has is it possesses 2 separate missions that are often in direct conflict: secure the communications of the United States, and to collect, eavesdrop, and compromise the communications of other countries. I don't know... isn't that like saying a military general has 2 conflicting missions: offense and defense? We trust military leaders with both duties, even though they could theoretically sacrifice everything to achieve victory. > I believe both missions of the NSA are important. However I believe it should be split into two agencies each Enthusiastically pursuing a single mission to the best of their abilities. If you split the NSA in two, wouldn't you just have two agencies working against each other? And it would essentially give the offensive agency full permission to hoard security flaws to the detriment of the nation it serves. I think a better solution is to clearly establish the relative priorities of each mission. IMO, the NSA should always prioritize the security of the USA's (and it's allies') technological infrastructure over attacking its enemies'.

cloverich 5y ago
Genuinely curious about the downvotes on this. I know political stances often trump generally reasoned arguments on HN -- is it that this thread isn't _outright_ anti NSA?
- SpicyLemonZest 5y ago
  Probably. I know people in my circles who believe without caveats or qualifications that the NSA is evil, that we just shouldn't have spy agencies at all, and wouldn't entertain any sort of abstract discussion of how the work should be organized.

tablespoon 5y ago

> I believe both missions of the NSA are important. However I believe it should be split into two agencies each Enthusiastically pursuing a single mission to the best of their abilities. At least with cryptography, I'm not sure how practical that is. I'm not cryptographer, but my impression is that offense and defense both deeply inform each other in that space.

AlexSW 5y ago

For what it's worth, I think this is the NCSC in the UK.

cameronh90 5y ago

In the UK we have the GCHQ and NCSC, which are in a sense what you're getting at.

Abishek_Muthian 5y ago

I concur, One who is responsible for punching holes shouldn't be the one to patch it. Right now adversaries are just playing treasure hunt because of this.