6 ms·

Have to appreciete the direct honest approach: "It's true that you must be a U.S. citizen, and you'll need a security clearance that requires a background inve

by Zenst 14y ago

Have to appreciete the direct honest approach: "It's true that you must be a U.S. citizen, and you'll need a security clearance that requires a background investigation and polygraph. But ... If you have a few, shall we say, indiscretions in your past, don't be alarmed. You shouldn't automatically assume you won't be hired. If you're really interested, you owe it to yourself to give it a shot."

spiffistan 14y ago
Indeed. That has to be a first from a US government agency.
- zitterbewegung 14y ago
  I think its great though that the NSA is acknowledging the resource that DEFCON is though.
  - mcantelon 14y ago
    Kind of a no-brainer, when you're trying to circumvent your population's security and break its encryption, to attempt to buy off people with related skills.
- maayank 14y ago
  From what I learned and searched for (sorry, no references), in general the important thing for a security background check for government agencies is not that you have shady business in your past - but that you're willing to be totally transparent to your (governmental) employer. Was in the past a heavy consumer of weed/was part of a cult/always attending protests against federal government policies? No problem, just tell us that on the forms/interview BEFORE we find it out for ourselves (and they will find it, because you'll give them permission to). Transparency and trust is the most important thing here, not your history (in the non-extreme cases). So willing applicants, don't let your history prevent you from trying. EDIT: to clarify, the main reason it's being done is because one of the main actual real-life-no-movies-plot threat for such agencies is that someone will find something in your past they don't know about and will blackmail you for confidential information. It's ALL in their interest not to disclose your past shady activities as that will deter recruits from being frank with them, supplying blackmail potential to adversaries. Judge on your own, but if you were my friend I would advice you not to be afraid to fully comply with the screenings as you'll just do harm to you and your country.
  - utnick 14y ago
    Doesn't this approach seem kind of backwards though? For example, weed. If they want to prevent enemies from blackmailing their employees for past weed use. They should come out and say we don't care how much weed you smoke, we're not going to drug test you now or ever, we just don't care what you do in your free time. The fact that they polygraph & question you to find the exact # of times you have done drugs in the past opens the door to blackmail situations. Polygraphs are not perfect, I'm sure some people that work for the NSA claimed no drug use on the application when that was not the case or claimed to have done it a handful of times when they really did it a lot more. Now an enemy could blackmail those people because they would be afraid of losing their jobs if the truth came out.
    - maayank 14y ago
      I don't know the specifics about the NSA (or about any other agency), but the whole "don't care much about past, caring about trust and transparency" is pretty standard security model in western governmental agencies. Notice that CURRENT illegal activities can be a source of blackmail - if I'd work for the NSA and run over someone with my car I wouldn't expect a three letter agency to come and make the charges disappear (and that's a good thing of course, we don't want an above-the-law military class). As I said, I don't know the specifics of the NSA (maybe they do or do not care about future light drug use) but I would expect them not wanting you to continue any illegal activities, to a reasonable degree (continue stealing the office toilet paper if it gives you kicks). Unless you're some sort of a world-level genius they would probably also shy away from evident extreme sociopathic behavior. From a reasonable human resources angle, not just security. Most of us wouldn't want to work with someone who released a worm that specifically targets thesis drafts for example. ANOTHER EDIT: I really think the #1 concern for applicable defcon recruits is "computer crimes", not drug use. Found/tested exploits? Use bittorrent? Cracked WinRAR (and hopefully something else that is more than simply changing a je to jne)? don't be afraid to send a CV and be honest. That is all.
    - Daniel_Newby 14y ago
      > They should come out and say we don't care how much weed you smoke, we're not going to drug test you now or ever, we just don't care what you do in your free time. The threat is that a foreign nation will take over a DEA field office and blackmail you. "We can overlook the pot this time if you cooperate and wear this wire. Don't cooperate and we'll do an asset forfeiture on your house and report your kids to CPS for being homeless." In a few months you'll be doing dead drops for a Chinese handler and thinking you are doing the right thing for family and country. It is not about drugs but the abject corruption of the War on Drugs. Polygraph interviews are not anout ferreting out all secrets, they are about finding how hard it is to get secrets out of you.
stfu 14y ago
and polygraph Are they still serious about doing the polygraph dance? Even after all these years with questionable results and even the Supreme Court rejecting it as neutral evidence. I guess they are starting pretty early in making employees believe into made-up Security Theater mechanisms.
- briandear 14y ago
  The polygraph isn't about lie detection. If you can't beat an NSA poly, they wouldn't want you. The poly isn't about finding 'truth' inasmuch as it's about your abilities to pass it. I can't speak to the NSA specifically, but in other agencies, the poly is a screening tool. Even if you're lying but can beat the poly, then you have proven that you can maintain while under extreme pressure. Intel agency polys are seriously stressful. Often 3 days long, sometimes administered in a generic northern Virginia chain hotel room with constant badgering. The goal is to maintain physiological control under mental duress. Polys are worthless as lie detectors, but they are a good test of mental toughness (or sociopathic skills.) the easy part is just to tell the truth. Unless there's something in your immediate past that's a disqualifier, usually within the previous 12 months, then there's nothing to fear. If you're easily rattled, even if telling the truth, the poly weeds that out.
  - rdtsc 14y ago
    The polygraph to me is about the ability to lie without being detected. Psychopaths pass them with flying colors. You tout that as a "good thing" -- you've proven you can tell lies, come join our team. What kind of people do you end up with in the end then? -- yes people who are tough, but also psychopaths, people who can lie well and can then easily turn on you and sell that $150M spying project to someone else for $50k.
    - TruthElixirX 14y ago
      Polygraphs are passable by non-psychopaths. Its a broken test that is useless and not scientifically verified.
  - 14y ago
Spearchucker 14y ago
Having some experience of this I know that background is crucial, as is current circumstance. Both need to show beyond doubt that you're trustworthy. What that means is that if you've been convicted of something you should point that out. If it's serious, like assault, you're out. If it's not serious, like exceeding the speed limit, and you didn't mention it, you're out. Current circumstances are about trying to uncover anything that might be used as leverage against you. So having excessive debt means you're out. Being gay is absolutely ok, but keeping it a secret from your parents is not. All techniques, from completing the application form to polygraph and interviews are about finding the chinks.
- rdtsc 14y ago
  It seems financial problems is the top reason for clearance denials. The other major one as you pointed out is falsifying information (lying or hiding stuff).
- adavies42 14y ago
  > If it's serious, like assault, you're out. i've seen some examples that suggest it might not be as cut-and-dry as that. i don't have the url handy, but some time ago someone in one of this discussions linked to a publicly-accessible record of clearance decisions. the one that jumped out at me had a guy who'd been a drug addict and involved in dealing in the past--he was clean now and fully informed them about it during the screening, and was approved.
luriel 14y ago
> polygraph WTF? What security expert would want to work at a place that takes seriously crackpot bullshit like polygraphs?
hammock 14y ago
Some people are saying the polygraph is to prove you are trustworthy, others are saying it's to test your ability to lie. These two notions appear to contradict each other, though.
epoxyhockey 14y ago
Have to appreciete the direct honest approach You know, they are only referring to smoking pot once or twice, right? Admit to running a small botnet or monitoring GSM calls and I'm sure your 2nd interview will be with the FBI .. not for a job. This whole NSA/DEFCON relationship smells funny. I've lost a lot of respect for DEFCON.
- mcantelon 14y ago
  Yeah, the fact that DEFCON brought in an NSA director to keynote is pretty vile. By helping legitimize the NSA and allowing it to openly recruit hackers DEFCON is doing their part to help compromise the privacy and infosec of American citizens.
- unimpressive 14y ago
  > Admit to running a small botnet or monitoring GSM calls and I'm sure your 2nd interview will be with the FBI .. not for a job. I just assumed that they're trying to lure blackhats into submitting incriminating resumes. I bet it'll work too.
- mentat 14y ago
  Many of the leaders of DEFCON work for the government. I've come to suspect that it's 'pwned' and is now revealing its form as a recruiting tool.
  - epoxyhockey 14y ago
    Many of the leaders of DEFCON work for the government I can confirm this. Though, to be realistic, I haven't encountered any conference or local 2600-type meeting that hadn't been pwned by government representatives. What I haven't seen is the active promotion of the very agencies that are working hard to put meeting attendees in jail.

by Zenst 14y ago

spiffistan 14y ago

Indeed. That has to be a first from a US government agency.

zitterbewegung 14y ago
I think its great though that the NSA is acknowledging the resource that DEFCON is though.
- mcantelon 14y ago
  Kind of a no-brainer, when you're trying to circumvent your population's security and break its encryption, to attempt to buy off people with related skills.
maayank 14y ago
From what I learned and searched for (sorry, no references), in general the important thing for a security background check for government agencies is not that you have shady business in your past - but that you're willing to be totally transparent to your (governmental) employer. Was in the past a heavy consumer of weed/was part of a cult/always attending protests against federal government policies? No problem, just tell us that on the forms/interview BEFORE we find it out for ourselves (and they will find it, because you'll give them permission to). Transparency and trust is the most important thing here, not your history (in the non-extreme cases). So willing applicants, don't let your history prevent you from trying. EDIT: to clarify, the main reason it's being done is because one of the main actual real-life-no-movies-plot threat for such agencies is that someone will find something in your past they don't know about and will blackmail you for confidential information. It's ALL in their interest not to disclose your past shady activities as that will deter recruits from being frank with them, supplying blackmail potential to adversaries. Judge on your own, but if you were my friend I would advice you not to be afraid to fully comply with the screenings as you'll just do harm to you and your country.
- utnick 14y ago
  Doesn't this approach seem kind of backwards though? For example, weed. If they want to prevent enemies from blackmailing their employees for past weed use. They should come out and say we don't care how much weed you smoke, we're not going to drug test you now or ever, we just don't care what you do in your free time. The fact that they polygraph & question you to find the exact # of times you have done drugs in the past opens the door to blackmail situations. Polygraphs are not perfect, I'm sure some people that work for the NSA claimed no drug use on the application when that was not the case or claimed to have done it a handful of times when they really did it a lot more. Now an enemy could blackmail those people because they would be afraid of losing their jobs if the truth came out.
  - maayank 14y ago
    I don't know the specifics about the NSA (or about any other agency), but the whole "don't care much about past, caring about trust and transparency" is pretty standard security model in western governmental agencies. Notice that CURRENT illegal activities can be a source of blackmail - if I'd work for the NSA and run over someone with my car I wouldn't expect a three letter agency to come and make the charges disappear (and that's a good thing of course, we don't want an above-the-law military class). As I said, I don't know the specifics of the NSA (maybe they do or do not care about future light drug use) but I would expect them not wanting you to continue any illegal activities, to a reasonable degree (continue stealing the office toilet paper if it gives you kicks). Unless you're some sort of a world-level genius they would probably also shy away from evident extreme sociopathic behavior. From a reasonable human resources angle, not just security. Most of us wouldn't want to work with someone who released a worm that specifically targets thesis drafts for example. ANOTHER EDIT: I really think the #1 concern for applicable defcon recruits is "computer crimes", not drug use. Found/tested exploits? Use bittorrent? Cracked WinRAR (and hopefully something else that is more than simply changing a je to jne)? don't be afraid to send a CV and be honest. That is all.
  - Daniel_Newby 14y ago
    > They should come out and say we don't care how much weed you smoke, we're not going to drug test you now or ever, we just don't care what you do in your free time. The threat is that a foreign nation will take over a DEA field office and blackmail you. "We can overlook the pot this time if you cooperate and wear this wire. Don't cooperate and we'll do an asset forfeiture on your house and report your kids to CPS for being homeless." In a few months you'll be doing dead drops for a Chinese handler and thinking you are doing the right thing for family and country. It is not about drugs but the abject corruption of the War on Drugs. Polygraph interviews are not anout ferreting out all secrets, they are about finding how hard it is to get secrets out of you.

stfu 14y ago

and polygraph Are they still serious about doing the polygraph dance? Even after all these years with questionable results and even the Supreme Court rejecting it as neutral evidence. I guess they are starting pretty early in making employees believe into made-up Security Theater mechanisms.

briandear 14y ago
The polygraph isn't about lie detection. If you can't beat an NSA poly, they wouldn't want you. The poly isn't about finding 'truth' inasmuch as it's about your abilities to pass it. I can't speak to the NSA specifically, but in other agencies, the poly is a screening tool. Even if you're lying but can beat the poly, then you have proven that you can maintain while under extreme pressure. Intel agency polys are seriously stressful. Often 3 days long, sometimes administered in a generic northern Virginia chain hotel room with constant badgering. The goal is to maintain physiological control under mental duress. Polys are worthless as lie detectors, but they are a good test of mental toughness (or sociopathic skills.) the easy part is just to tell the truth. Unless there's something in your immediate past that's a disqualifier, usually within the previous 12 months, then there's nothing to fear. If you're easily rattled, even if telling the truth, the poly weeds that out.
- rdtsc 14y ago
  The polygraph to me is about the ability to lie without being detected. Psychopaths pass them with flying colors. You tout that as a "good thing" -- you've proven you can tell lies, come join our team. What kind of people do you end up with in the end then? -- yes people who are tough, but also psychopaths, people who can lie well and can then easily turn on you and sell that $150M spying project to someone else for $50k.
  - TruthElixirX 14y ago
    Polygraphs are passable by non-psychopaths. Its a broken test that is useless and not scientifically verified.
- 14y ago

Spearchucker 14y ago

Having some experience of this I know that background is crucial, as is current circumstance. Both need to show beyond doubt that you're trustworthy. What that means is that if you've been convicted of something you should point that out. If it's serious, like assault, you're out. If it's not serious, like exceeding the speed limit, and you didn't mention it, you're out. Current circumstances are about trying to uncover anything that might be used as leverage against you. So having excessive debt means you're out. Being gay is absolutely ok, but keeping it a secret from your parents is not. All techniques, from completing the application form to polygraph and interviews are about finding the chinks.

rdtsc 14y ago
It seems financial problems is the top reason for clearance denials. The other major one as you pointed out is falsifying information (lying or hiding stuff).
adavies42 14y ago
> If it's serious, like assault, you're out. i've seen some examples that suggest it might not be as cut-and-dry as that. i don't have the url handy, but some time ago someone in one of this discussions linked to a publicly-accessible record of clearance decisions. the one that jumped out at me had a guy who'd been a drug addict and involved in dealing in the past--he was clean now and fully informed them about it during the screening, and was approved.

luriel 14y ago

> polygraph WTF? What security expert would want to work at a place that takes seriously crackpot bullshit like polygraphs?

hammock 14y ago

Some people are saying the polygraph is to prove you are trustworthy, others are saying it's to test your ability to lie. These two notions appear to contradict each other, though.

epoxyhockey 14y ago

Have to appreciete the direct honest approach You know, they are only referring to smoking pot once or twice, right? Admit to running a small botnet or monitoring GSM calls and I'm sure your 2nd interview will be with the FBI .. not for a job. This whole NSA/DEFCON relationship smells funny. I've lost a lot of respect for DEFCON.

mcantelon 14y ago
Yeah, the fact that DEFCON brought in an NSA director to keynote is pretty vile. By helping legitimize the NSA and allowing it to openly recruit hackers DEFCON is doing their part to help compromise the privacy and infosec of American citizens.
unimpressive 14y ago
> Admit to running a small botnet or monitoring GSM calls and I'm sure your 2nd interview will be with the FBI .. not for a job. I just assumed that they're trying to lure blackhats into submitting incriminating resumes. I bet it'll work too.
mentat 14y ago
Many of the leaders of DEFCON work for the government. I've come to suspect that it's 'pwned' and is now revealing its form as a recruiting tool.
- epoxyhockey 14y ago
  Many of the leaders of DEFCON work for the government I can confirm this. Though, to be realistic, I haven't encountered any conference or local 2600-type meeting that hadn't been pwned by government representatives. What I haven't seen is the active promotion of the very agencies that are working hard to put meeting attendees in jail.