3 ms·

Yeah, there is very little chance of CEOs leaking. The obligation they feel most is their obligation to the interests of their company. It definitely wouldn't b

by jfoster 13y ago

Yeah, there is very little chance of CEOs leaking. The obligation they feel most is their obligation to the interests of their company. It definitely wouldn't be in a company's interests to rebel against the government of the country in which the company is headquartered. Implementation side would definitely be very difficult, but you could screen the candidates for those who are sympathetic toward it. Ensure they understand how important it is that the program stays secret. Keep retention high, and perhaps even have some ongoing benefits for any employees who do churn but were part of the program. It definitely wouldn't be easy, but I think it is doable.

nostrademons 13y ago
With a technical field, though, you have the added constraint that you need people who are familiar with the technology involved. At the low-level infrastructure level of a company like Google or Facebook, that might number in the dozens-to-hundreds - not exactly a huge pool to choose from, particularly when implementation will require quite a few people. And you need someone to do the choosing who can both be trusted by the government and knows all the people with the relevant technical skills. There's also the issue of how to hide the source code (to my knowledge, both Google and Facebook use one source repository for the whole company, to which virtually everyone has access). This can be gotten around - I'm sure that there are private repositories off to the side that you could use to build a binary - but this is yet another integration point that could be discovered. (Eg. some SRE notices that network bandwidth is high for a DC, traces it to a machine, notices the machine is consuming a large amount of CPU, gets root and runs 'top', and suddenly notices an unknown process siphoning off all data. At this point, how could they not assume their network is being attacked - because that's really what this is, the U.S. government hacking into the company's DCs - and pull the alarm? So all the SREs, abuse teams, internal security, etc. would have to be briefed, which is small compared to the whole company but still a huge surface area for a top-secret project.)

by jfoster 13y ago

nostrademons 13y ago

With a technical field, though, you have the added constraint that you need people who are familiar with the technology involved. At the low-level infrastructure level of a company like Google or Facebook, that might number in the dozens-to-hundreds - not exactly a huge pool to choose from, particularly when implementation will require quite a few people. And you need someone to do the choosing who can both be trusted by the government and knows all the people with the relevant technical skills. There's also the issue of how to hide the source code (to my knowledge, both Google and Facebook use one source repository for the whole company, to which virtually everyone has access). This can be gotten around - I'm sure that there are private repositories off to the side that you could use to build a binary - but this is yet another integration point that could be discovered. (Eg. some SRE notices that network bandwidth is high for a DC, traces it to a machine, notices the machine is consuming a large amount of CPU, gets root and runs 'top', and suddenly notices an unknown process siphoning off all data. At this point, how could they not assume their network is being attacked - because that's really what this is, the U.S. government hacking into the company's DCs - and pull the alarm? So all the SREs, abuse teams, internal security, etc. would have to be briefed, which is small compared to the whole company but still a huge surface area for a top-secret project.)