3 ms·

Many people fail to realize how hard it is for the military, government and law enforcement to recruit top security talent. There are several reasons that come

Many people fail to realize how hard it is for the military, government and law enforcement to recruit top security talent. There are several reasons that come to mind, a few of which are hard problems to solve. 1. Market competition. The information security industry is currently undergoing major growth. As a whole, it is a thriving and exciting place to work. This allows companies to recruit top talent and, sometimes more importantly, pay top dollar. Sure, there's the occasional genius that comes out of the NSA (like Charlie Miller, for example), but even he is now at Accuvant. If you're a scraggly kid who spent all his high school years behind a terminal, and you're offered low wages to work for the FBI or DoD, or extremely high pay to work for a large consulting firm, which would you pick? Patriotism doesn't help all that much. 2. While less security guys have criminal backgrounds than many would think, the strict clearance required to perform intelligence-related work conflicts with a lot of personalities. Infosec people generally fall into one of two categories: very clean cut, professional, etc., or the typical "dirty hacker" that hangs out in a basement or studio apartment, breaking into networks and slugging beers. Three letter agencies say they want these guys, but there's no way they'd conform to government standards or pass a strict background check. No drugs for ten years? That's a problem for a lot of people. 3. Lastly, and this is probably the weakest point, but a lot of people disagree with things the U.S. government is doing. NSA wiretapping? Security professionals generally don't want to be a part of that. I'm hesitant to make sweeping generalizations, but if you go to a security or hacker conference (DEFCON comes to mind), you'll notice that a lot of the talks and sentiment are of a "rebellious" nature. At the very least, security people are strong advocates of privacy. Working for the NSA or the Air Force Cyber Command doesn't generally sit well with a lot of these people. China has their best hackers in their military, working for the state. The United States has their best hackers in the private sector. I'm not saying that there aren't a few seeds of genius laying around Fort Meade, but it's not the same as what you see in the private sector. If the government wants to recruit more hackers, they need to sweeten the offer; but how can they do so with (a) government-controlled funding and salaries, (b) strict background checks that are required for sensitive work, such as national security and (c) a mandate that many people they're trying to recruit simply don't support?

fghh45sdfhr3 14y ago
you'll notice that a lot of the talks and sentiment are of a "rebellious" nature. At the very least, security people are strong advocates of privacy. It sound to me like the sentiment is not so much rebellious, as it is very ethical.
- david_shaw 14y ago
  > It sound to me like the sentiment is not so much rebellious, as it is very ethical. Sure, I just meant rebellious in the sense that the participants tend to rebel against what is seen as government fascism or privacy violations - not that they're evil anarchists.
doug11235 14y ago
> If the government wants to recruit more hackers, they need to sweeten the offer; but how can they do so with (a) government-controlled funding and salaries, (b) strict background checks that are required for sensitive work, such as national security and (c) a mandate that many people they're trying to recruit simply don't support? They can do it with how they are going about it. Lets look at what is going on here. The US government is funding education that is tailored to focus on their topics of interest. These students then spend 2 years working for the government getting more education and experience. At this point, (a) is remedied by leaving government positions for better paid contractor ones (I think the US government / contractor relationship is greatly misunderstood in general) or feeding off into private industry. If you read through several bios of people in the industry you find ties to DoD and intel agencies all over the place (some are as contractors). But the idea here is (in my opinion), the government isn't concerned about who is on their payroll, but rather they have more capable professionals trained for this type of work in the country. People whose skills they can pay for one way or another. I think a lot of people misunderstand the requirements of (b). And those that can't qualify for top clearances can be fed as "infosec engineers" into other agencies where a secret clearance is all that is required (FAA for example). Again, just having more trained people spread about is the goal here. Additionally, contractors can conduct work in non-classified environments with non-cleared personnel in some situations and/or you have more distant relationships. Think vulnerability selling / purchasing. As for (c), it is often hard to tie someone's direct work to some mandate. Where do you draw the line? Not working in a specific group? Specific agency? Contractor? Supplier? At some level, Microsoft is supporting the work NSA does. Different people draw different lines at different places.

fghh45sdfhr3 14y ago

you'll notice that a lot of the talks and sentiment are of a "rebellious" nature. At the very least, security people are strong advocates of privacy. It sound to me like the sentiment is not so much rebellious, as it is very ethical.

david_shaw 14y ago
> It sound to me like the sentiment is not so much rebellious, as it is very ethical. Sure, I just meant rebellious in the sense that the participants tend to rebel against what is seen as government fascism or privacy violations - not that they're evil anarchists.

doug11235 14y ago

> If the government wants to recruit more hackers, they need to sweeten the offer; but how can they do so with (a) government-controlled funding and salaries, (b) strict background checks that are required for sensitive work, such as national security and (c) a mandate that many people they're trying to recruit simply don't support? They can do it with how they are going about it. Lets look at what is going on here. The US government is funding education that is tailored to focus on their topics of interest. These students then spend 2 years working for the government getting more education and experience. At this point, (a) is remedied by leaving government positions for better paid contractor ones (I think the US government / contractor relationship is greatly misunderstood in general) or feeding off into private industry. If you read through several bios of people in the industry you find ties to DoD and intel agencies all over the place (some are as contractors). But the idea here is (in my opinion), the government isn't concerned about who is on their payroll, but rather they have more capable professionals trained for this type of work in the country. People whose skills they can pay for one way or another. I think a lot of people misunderstand the requirements of (b). And those that can't qualify for top clearances can be fed as "infosec engineers" into other agencies where a secret clearance is all that is required (FAA for example). Again, just having more trained people spread about is the goal here. Additionally, contractors can conduct work in non-classified environments with non-cleared personnel in some situations and/or you have more distant relationships. Think vulnerability selling / purchasing. As for (c), it is often hard to tie someone's direct work to some mandate. Where do you draw the line? Not working in a specific group? Specific agency? Contractor? Supplier? At some level, Microsoft is supporting the work NSA does. Different people draw different lines at different places.