3 ms·

This is Keith Alexander[0], the current director of the NSA. It's ironic that the person wearing a shirt from a group that strives for digital rights, including

by kmm 13y ago

This is Keith Alexander[0], the current director of the NSA. It's ironic that the person wearing a shirt from a group that strives for digital rights, including privacy, is worn by the Director of an agency that is trying to snoop on all communication. 0: http://en.wikipedia.org/wiki/Keith_B._Alexander http://en.wikipedia.org/wiki/Keith_B._Alexander

rdl 13y ago
In addition to the SIGINT/spying mission, they also want to secure US (government and private) infrastructure, and need a technically competent workforce to do both missions. So not that hard to understand.
- jacquesm 13y ago
  I sense a slight conflict of interest.
  - rdl 13y ago
    Internal to NSA that's called the "equities debate". Pretty much fought through the 1990s -- the defense guys won once credit cards needed to be processed online, and 1998-2001 was kind of the golden age, then the Saudis crashed their planes and pretty much from 9/11 on it's been all the offense/SIGINT. Within the government, there were a lot of big pushes through the 2000s (and to today) to do things like disconnecting government from the commercial internet except via specific gateways, get host based intrusion detection on all DoD computers ("HBSS"), ban USB keys (after the Russians started putting nice factory shinkwrapped ones full of malware in the on-base markets in Afghanistan...), etc. I.e. bringing government up to the level of a well-secured private organization.
- subsystem 13y ago
  Of course you could argue that those aren't necessarily separate missions. http://articles.latimes.com/2009/jul/14/opinion/oe-radack14 http://articles.latimes.com/2009/jul/14/opinion/oe-radack14
  - rdl 13y ago
    Most of the COMSEC mission is getting secure software/algorithms/protocols/standards speced, written, and deployed, not secure IDSes and stuff operational (that's generally been done at the service level or below). And generally the NSA's contribution to commercial security has been via their advisory role to NIST in the process to develop or select things like AES, SHA, etc. (and various FIPS, like 140-2, required to sell to government, but also used by private industry). The "NSA run CERT/IDS/etc." is obviously problematic, but I'm pretty happy to have NSA/NIST advising on algorithm selection, as long as the algorithms also are liked by the open community (giving NSA a veto, even a secret veto, seems fine as long as there are enough options.)

by kmm 13y ago

rdl 13y ago

In addition to the SIGINT/spying mission, they also want to secure US (government and private) infrastructure, and need a technically competent workforce to do both missions. So not that hard to understand.

jacquesm 13y ago
I sense a slight conflict of interest.
- rdl 13y ago
  Internal to NSA that's called the "equities debate". Pretty much fought through the 1990s -- the defense guys won once credit cards needed to be processed online, and 1998-2001 was kind of the golden age, then the Saudis crashed their planes and pretty much from 9/11 on it's been all the offense/SIGINT. Within the government, there were a lot of big pushes through the 2000s (and to today) to do things like disconnecting government from the commercial internet except via specific gateways, get host based intrusion detection on all DoD computers ("HBSS"), ban USB keys (after the Russians started putting nice factory shinkwrapped ones full of malware in the on-base markets in Afghanistan...), etc. I.e. bringing government up to the level of a well-secured private organization.
subsystem 13y ago
Of course you could argue that those aren't necessarily separate missions. http://articles.latimes.com/2009/jul/14/opinion/oe-radack14 http://articles.latimes.com/2009/jul/14/opinion/oe-radack14
- rdl 13y ago
  Most of the COMSEC mission is getting secure software/algorithms/protocols/standards speced, written, and deployed, not secure IDSes and stuff operational (that's generally been done at the service level or below). And generally the NSA's contribution to commercial security has been via their advisory role to NIST in the process to develop or select things like AES, SHA, etc. (and various FIPS, like 140-2, required to sell to government, but also used by private industry). The "NSA run CERT/IDS/etc." is obviously problematic, but I'm pretty happy to have NSA/NIST advising on algorithm selection, as long as the algorithms also are liked by the open community (giving NSA a veto, even a secret veto, seems fine as long as there are enough options.)