10 ms·

NSA revelations could hurt collaboration with 'betrayed' hackers

171 points by Chirael 13y ago

ihsw 13y ago
Contrary to the article's inflammatory title, software engineers haven't quit their jobs at the USG en masse. As for the "with the government" vs the "for the government" rebuttals: surveillance and research contractors haven't stopped working with the USG either.
- DevX101 13y ago
  I don't think there will be droves of people leaving because of recent scandals. But it sure will make it harder to answer a smart college grad who asks "Why should I work for the NSA?" when he/she has options at private tech companies.
  - wf 13y ago
    Except... They aren't only recruiting "smart college grads" they're recruiting smart college Freshmen etc. I know several people who did internships with the NSA/DoD starting their freshmen year. And I can tell you at that point there is still the shiny, "I work for the NSA! This is so cool!" feeling.
    - Ygg2 13y ago
      If their friends, condemned their actions i.e. working for a bunch of incompetent, paranoid spooks, their job outlook would change as well.
      - walshemj 13y ago
        How would their friends know you you are working for the NSA? Shurly you sign the official secrets act (the US version of it) at the interview stage and have an agreed cover story for your referees.
        oijaf888 13y ago
        I believe they let you tell people who ask since being evasive would raise more suspicion.
        walshemj 13y ago
        Thats why you have a cover story allegedly :-)
        danielweber 13y ago
        NSA has both overt and covert employees.
  - mrt0mat0 13y ago
    i agree with this statement. i don't think that anyone was saying they would quit the government en masse. i actually got the impression that they were talking about freelancers and such, but i could be wrong.
  - rainsford 13y ago
    I'm sure it will be a consideration, but I wonder how MUCH of a consideration it really will end up being. The loudest voices against the government in the current debate seem unlikely to be people who would work for the government under most circumstances anyway. At the end of the day, the NSA will always be a secret government intelligence gathering organization, 3 descriptors that seem at odds with a big part of the hacker community to begin with.
  - neutronicus 13y ago
    The answer is easy. I like money, I like job security, I like playing for a winner, I like being on the bleeding edge. Were I crypto guy, I would snatch up a vacated-on-principle spot at the NSA in a heartbeat.
    - Helianthus 13y ago
      I guess at least you know your price.
- melling 13y ago
  They just write stories like this so it will make it to HN and drives traffic. Nothing has changed. There are just more people running on that gerbil wheel on HN.
joshuahedlund 13y ago
Doesn't really present much evidence that this is happening so far, but I wouldn't be surprised if the continuing revelations push more and more hackers in this direction, especially at the margins. The possibility of such a "self-correcting" measure to the surveillance state, even without legislative reform, is one reason to be optimistic (though it would be naive to put too much hope in that alone)
- hobs 13y ago
  I dont know about your second point, but I definitely agree the link quotes another article that says something "might" happen. While I hope that the intelligencia of america wake the hell up and stop cooperating, this article is a crock of shit.
danso 13y ago
Even before seeing that the submission was from techdirt, the headline itself contains the type of assertion that is highly questionable on its face. 1. What is a "top" hacker? Someone who has hacked the most systems? Hacked the most secure system? Created the most cleverest exploit? 2. How do you know that it's actually the "top" hackers who are refusing to work with the USG? Because quite conceivably, there are great hackers who are already working at the USG and aren't revealing themselves or quitting in protest. The hackers you have now speaking out may indeed be refusing to work for the USG, but your article is then based on a self-selecting sample. 3. Is being a "top" hacker an immutable thing? If top mercenaries said they'd never join the Navy SEALS, does that mean the SEALs are screwed? Only if you forget that they have no shortage of young men who are pruned and groomed to being elite fighters.
- res0nat0r 13y ago
  I'd love if we could add techdirt to the auto kill submission list. That would help cut down on the inflammatory noise articles being submitted without much substance.
scrabble 13y ago
It seems to me like a great way for the government to really start keeping close tabs on you would be to have any sort of tech job for them and quit -- especially after Snowden.
coldcode 13y ago
We really need to out and shame any engineer or contracting agency working for the NSA. If they can't hire anyone they can't spy on anyone.
- eshvk 13y ago
  Once you have done this outing and shaming, what do you expect to do? Burn the engineer or contracting agency at the center of the town hall? Have a fifties style whisper campaign where you refuse to go to their cocktail party? Apart from the fact that it vaguely sounds discriminatory, I don't see what you could achieve on a practical level.
  - Karunamon 13y ago
    A de-facto blacklist where having the NSA on your resumé is as desirable as having NAMBLA?
- fotbr 13y ago
  What happens when the people you're trying to shame simply do not care about your opinion, or the opinions of anyone else?
  - jlgreco 13y ago
    The same thing as if you had done nothing.
- zeckalpha 13y ago
  Assuming sane people would respond to this criticism by leaving, what would be left with? As with any institution, perhaps it is better to have sane people working there, trying to change it from the inside.
snowwrestler 13y ago
There have always been reasons to object to working in national defense. During the Cold War quite a few physicists and engineers chose not to go into defense work because they did not want to feel like they were hastening nuclear Armageddon. And yet, the U.S. government developed effective new defense and energy technologies during this time. There are reasons to work for the government that are attractive to top tech talent: access to information and tools that no one in private enterprise has; gigantic budgets, with no demand for profitability; a great mission: protecting the American people. And if the issue is privacy, there are objections to made at most top tech companies now as well--most of their product development treads on or over the privacy line of their customers. I'm not advocating for defense work BTW, just expressing skepticism that the Snowden affair will substantially harm the government's ability to attract tech talent. It probably will scare off the most innovative, forward thinking hackers...but they've never been a crowd that works for the government anyway. Too slow and bureaucratic.
- dclowd9901 13y ago
  > most of their product development treads on or over the privacy line of their customers. I think most people now understand and have well-embraced the idea of "if you don't pay for a product you are the product." Given the relative odds of being injured or killed by a terrorist attack, it's debatable if any utility is gained from giving up your privacy to government.
  - usefulcat 13y ago
    If by "most people", you mean "most HN readers", then I agree. But if you actually mean "most people", then I'd say that issue is probably not even on their radar.
- yareally 13y ago
  > "There have always been reasons to object to working in national defense. During the Cold War quite a few physicists and engineers chose not to go into defense work because they did not want to feel like they were hastening nuclear Armageddon." Robert Oppenheimer, the "Father of the Atomic Bomb," lost his security clearance and his position on the Atomic Energy Commission for voicing concerns and refusing to directly help build the hydrogen bomb in the 50s. He argued it was against the United States' best interests to develop it, because the USSR had no cities large enough to use it on, while the United States did. The United States also had plenty of large atomic bombs with pretty high yield already that were much cheaper to build. Thus, when the Soviets eventually created their own, they would be ones with a reason to have it, while we wasted tons of money giving it to them that could have been spent elsewhere. Just for reference: http://en.wikipedia.org/wiki/Robert_Openheimer#Atomic_Energy_Commission http://en.wikipedia.org/wiki/Robert_Openheimer#Atomic_Energy... http://www.imdb.com/title/tt0078037/ http://www.imdb.com/title/tt0078037/ Great miniseries on Oppenheimer done by the BBC, if one can find it.
joetek 13y ago
"it's significant that the NSA's massive XKeyscore program runs on a Linux cluster." Is there an option in Creative Commons or GPL to exclude government use?
- TeMPOraL 13y ago
  If they modified GPL code, maybe they can be sued to release changes.
  - dragonwriter 13y ago
    The only action possible against the federal government for copyright violation is an action in the Court of Federal Claims to recover money damages. [1] [1] http://www.law.cornell.edu/uscode/text/28/1498 http://www.law.cornell.edu/uscode/text/28/1498
- mhurron 13y ago
  Such an exclusion would be incompatible with the GPL. There are other licenses that do have such an exclusion.
- aylons 13y ago
  No, and at least on the GPL, this is by principle. Free software, as proposed by the FSF, is agnostic to these issues by design.
- tomjen3 13y ago
  No, and that is one of the reason GPLs in an immoral license.
bit_genesis 13y ago
It's worth pointing out that you don't need to work "for the NSA" to be contributing to state surveillance. If someone is hired straight out of college to work for any type of cloud services provider with revenues over a billion, it's probably safe to say that they your prospective employer has enough market reach to have attracted the attention of state surveillance programs. Of course, by law, your prospective employer would be required to lie to you about involvement.
- majelix 13y ago
  > It's worth pointing out that you don't need to work "for the NSA" to be contributing to state surveillance. The flip is also true: you're not necessarily contributing to state surveillance just because you work "for the NSA". Two easy examples are SELinux and the various NSA Guides to Securing <OS_of_choice>.
  - tomjen3 13y ago
    I always assumed SELinux was backdoored. I am still waiting on the proof that I am wrong.
theboss 13y ago
Wow, awful. If you got to a InfoSec/Hacker Con the people there either work for Govt Contractors, Used to work for the Govt, or work at small companies (that get paid by the govt). The "Top Hackers" certainly still will work for the government.....Why do you think so many are in DC
andrewcooke 13y ago
one related thing that i have been wondering about: it's been argued that the internet-based voter support was key in getting obama elected. will that same team - or similar people - be willing to work next time round? not work for the government, but for the democrats. will hackers work for democrats in the next presidential election? if it's disappointment with obama, will switching to clinton be enough? and will we see a move to 'blame obama' near the end of his term to help clinton?
tptacek 13y ago
The most dangerous and stupid meme percolating in pop tech culture is that the people engaged with tech culture have a unique claim to computer science, electrical engineering, cryptography, information security, and privacy technology. The Slashdot diaspora genuinely believes that most of the world's computer engineering talent reads their comments. The reality is that not only does money do a fine job of buying talent, but, if it's the USG you're thinking about, they don't even have to try hard; extremely qualified engineering graduates compete to secure positions at NSA, which has been ~10 years ahead of private industry for the last couple decades, before which time they were even further ahead. Part of the reason the USG doesn't actually have a problem recruiting people is that actually believe in training people. I don't know how effective they really are at it, but I do know that our industry is fundamentally unserious about training. The kinds of commercial organizations that take in raw recruits generally turn out extremely mediocre J2EE and .NET developers. The rest, to a first approximation, run their recruiting programs based on measurements of reproductive organs. Giant defense contractors haul in green IT graduates by the truckload and adapt them to jobs that command significant premiums on the private market. Again, I'm not saying defense contractors can turn information management grads into electronic supersoldiers, but: they're not hurting for recruits. The reason I think you care about this is because it informs you of a hidden handicap that private industry and activist groups have when facing down the government. I'm very sorry if I'm the first person to break this to you, but if you're an activist targeting the USG, your adversary isn't stupid. In fact, I think it's likely that they're significantly smarter than any of us. Bear that in mind when you design your NSA-proof email applications. I don't do work for the USG, and haven't before, but I'm realistic about the impact of that decision; it has more to do with my own psychological welfare than it does with anyone else's.
- mjolk 13y ago
  >In fact, I think it's likely that they're significantly smarter than any of us. Bear that in mind when you design your NSA-proof email applications. Math is math and it's relatively easy to implement decent encryption -- it is possible to pass data securely from end to end. The larger issue with these projects is that they're usually proposed by someone that can sling a bit of Ruby and fashions him/herself a cyber revolutionary, not someone that understands that the real power of the US Government in the tech sphere is its ability to apply pressure away from a keyboard - whether it be a subpoena for raw data from a hosting provider, legal fuckery, or sending armed soldiers to your doorstep.
sharrocker 13y ago
tptacek what is your sourcing on this? I have spoken with people at engineering schools-- including those with close ties with the NSA, where NSA goes for hiring-- and they say the NSA is hurting. A recently retired (as in that month) fed at DefCon said straight up we are seriously behind you guys and cant keep up because of bureaucracy.
JabavuAdams 13y ago
I'm not convinced. People are very good at cognitive dissonance. If you're passionate about tech, then there are some very interesting projects to work on in government. Rocket scientists want to build rockets. Roboticists want to build robots. Hackers want to hack. They've gotten good at what they do by subordinating other concerns to their driving interests. So, why would they be put off by something that doesn't seem to directly affect them or their loved-ones? EDIT> Regarding the furor over heavy-handed prosecution of tech-assisted offences: that only matter if you choose the wrong side. I.e. Work on this cool stuff, stay in line, and you'll never have a problem with the law. Not a hard sell.
mcguire 13y ago
Interesting paragraph from the Reuters article: "Some security experts remain supportive of the government. NSA Director Keith Alexander's talk at the Black Hat conference was well received on Wednesday, despite a few hecklers. "...Alexander took a conciliatory tone during his Black Hat speech, defending the NSA but saying he looked forward to a discussion about how it could do things better." The article portrays Black Hat as the more "professional" conference, as opposed to Def Con.
- rdl 13y ago
  Mostly because DC20 happened a year ago, before Snowden. I don't think GEN Alexander's PSD would have allowed him to attend Defcon this year. (not that his life would have been in danger, but enough violent/etc. heckling that people probably would have gotten hurt, which would be horrible press.)
rdl 13y ago
I'm certainly not a TAO offensive security type, but maybe I'm somewhat representative of median people in the security space. I was certainly more than willing to work for USG at one point, but the "crypto wars" of the 1990s (as well as the end of the cold war and lack of a mission) convinced me not to go to NSA then (I was going to do ROTC -> NSA). Post-9/11, I fully supported both the USG infosec mission and the use of sigint/etc. to go after specific foreign terrorist groups, and worked as a defense contractor with what that entails (although doing nothing so glamorous as NSA/TAO/etc., but at least not running a helpdesk for ITT either. I envied INSCOM/ISA so much.). Now, I'd have a really hard time doing anything more contractory than selling totally standardized COTS products to the USG, even something non-threatening like a better teleconferencing system, until/unless there is re-established effective elected oversight (i.e. congress, as a whole, and not just 15 committee members with little interest, expertise, or competence) over these programs. Not really holding my breath on that.
Fuxy 13y ago
This would all sound nice and all but where's the proof? Just hackers saying they will refuse government contracts doesn't mean anything. I honestly hope they would do that but I lost hope in such a thing happening a long time ago. Just dangle some money in front of the and they're just average suckers like the rest of humanity.
quantumpotato_ 13y ago
"An illustration picture shows the logo of the U.S. National Security Agency on the display of an iPhone * in Berlin, June 7, 2013. Credit: Reuters/Pawel Kopczynski" * Surrounded by cables that couldn't connect
rdl 13y ago
We do have a pretty clear historical precedent. In the late Vietnam era and immediately after, the prestige of the military, and thus the quality of recruits and soldiers in the US military was basically at its lowest point ever (at least since we started having a big standing military with WW2). I mean, really bad. I'm not sure how much of this was due to "evil babykillers" meme about Vietnam, or the stink of failure from losing our first (and unpopular) war, or what, but it's conceivable the same kind of thing could affect NSA recruiting. The post-Snowden fiasco is about 5% of the way toward doing that, though -- until we see evidence of actual people that "we" "care about" seriously harmed, it won't get much closer than we are now. (It was bad enough that they had to pass laws to consider Vietnam-era veterans a "protected class" for discrimination. From everything I've read and heard about the post Vietnam military, especially the Army, it was even worse (at least until the 1980s, and really until Gulf War I in a lot of ways.)
dpeck 13y ago
This is sadly far from true. There is plenty of talent to be bought for the right amount of money and plenty of talented people who can divorce morality from their job. Besides that though there have been quite a bit of growth in nationalistic sentiment in the hacker community for some time. It seems that its been present in non-US/EU parts of the culture for quite some time, but I've noticed in recent years it becoming a bigger and more accepted part of US circles. Joking about popping boxes in .cn, seeing the whole country as an enemy, etc. It was a lot quieter on those topics in Vegas this year, but it was certainly a very present part of the dialogue 2010/11, etc.
acd 13y ago
The state are purposely allowed to break laws the citizens are not allowed to break. It is illegal for a citizen to hack other persons and organizations computers and take their data. It is allowed for the government to hack other persons computers and steal their data. The government now has professional teams of hackers doing just that. Thus the same laws does not apply for citizens as the government, thus the government thinks they are above the law. It is almost the same as the government would have teams that steal credit cards and make drugs. We are walking towards a Internet 3.0 which be heavily encrytped anonymized and reinvented by hackers. Imagine encrypted mesh sockets. ifconfig anoninet up Peer2Peer dns and trust authorities. Not to mention the banks the government are protecting and the central banks, which purposely steals peoples money through inflation. The Fed is privately owned by the banks they are as Federal as Federal express not at all. The creature from Jekyll island.
e3pi 13y ago
"Closest to home for many hackers are the government's aggressive prosecutions under the Computer Fraud and Abuse Act, which has been used against Internet activist Aaron Swartz, who committed suicide in January, and U.S. soldier Bradley Manning, who leaked classified files to anti-secrecy website WikiLeaks." With also Binney, Drake, Snowden, with the Justice Dept's Eric Holder and Carmen Ortiz prosecuting with trump upped draconian charges, and that we also know the intel/security agencies spokespeople with an eagle logo are consistent prevaricators, it is clearly recklessly dangerous to become directly involved with these federally sanctioned criminals. At least factor that in, while negotiating your compensation.

171 points by Chirael 13y ago

ihsw 13y ago

Contrary to the article's inflammatory title, software engineers haven't quit their jobs at the USG en masse. As for the "with the government" vs the "for the government" rebuttals: surveillance and research contractors haven't stopped working with the USG either.

DevX101 13y ago
I don't think there will be droves of people leaving because of recent scandals. But it sure will make it harder to answer a smart college grad who asks "Why should I work for the NSA?" when he/she has options at private tech companies.
- wf 13y ago
  Except... They aren't only recruiting "smart college grads" they're recruiting smart college Freshmen etc. I know several people who did internships with the NSA/DoD starting their freshmen year. And I can tell you at that point there is still the shiny, "I work for the NSA! This is so cool!" feeling.
  - Ygg2 13y ago
    If their friends, condemned their actions i.e. working for a bunch of incompetent, paranoid spooks, their job outlook would change as well.
    - walshemj 13y ago
      How would their friends know you you are working for the NSA? Shurly you sign the official secrets act (the US version of it) at the interview stage and have an agreed cover story for your referees.
      - oijaf888 13y ago
        I believe they let you tell people who ask since being evasive would raise more suspicion.
        walshemj 13y ago
        Thats why you have a cover story allegedly :-)
      - danielweber 13y ago
        NSA has both overt and covert employees.
- mrt0mat0 13y ago
  i agree with this statement. i don't think that anyone was saying they would quit the government en masse. i actually got the impression that they were talking about freelancers and such, but i could be wrong.
- rainsford 13y ago
  I'm sure it will be a consideration, but I wonder how MUCH of a consideration it really will end up being. The loudest voices against the government in the current debate seem unlikely to be people who would work for the government under most circumstances anyway. At the end of the day, the NSA will always be a secret government intelligence gathering organization, 3 descriptors that seem at odds with a big part of the hacker community to begin with.
- neutronicus 13y ago
  The answer is easy. I like money, I like job security, I like playing for a winner, I like being on the bleeding edge. Were I crypto guy, I would snatch up a vacated-on-principle spot at the NSA in a heartbeat.
  - Helianthus 13y ago
    I guess at least you know your price.
melling 13y ago
They just write stories like this so it will make it to HN and drives traffic. Nothing has changed. There are just more people running on that gerbil wheel on HN.

joshuahedlund 13y ago

Doesn't really present much evidence that this is happening so far, but I wouldn't be surprised if the continuing revelations push more and more hackers in this direction, especially at the margins. The possibility of such a "self-correcting" measure to the surveillance state, even without legislative reform, is one reason to be optimistic (though it would be naive to put too much hope in that alone)

hobs 13y ago
I dont know about your second point, but I definitely agree the link quotes another article that says something "might" happen. While I hope that the intelligencia of america wake the hell up and stop cooperating, this article is a crock of shit.

danso 13y ago

Even before seeing that the submission was from techdirt, the headline itself contains the type of assertion that is highly questionable on its face. 1. What is a "top" hacker? Someone who has hacked the most systems? Hacked the most secure system? Created the most cleverest exploit? 2. How do you know that it's actually the "top" hackers who are refusing to work with the USG? Because quite conceivably, there are great hackers who are already working at the USG and aren't revealing themselves or quitting in protest. The hackers you have now speaking out may indeed be refusing to work for the USG, but your article is then based on a self-selecting sample. 3. Is being a "top" hacker an immutable thing? If top mercenaries said they'd never join the Navy SEALS, does that mean the SEALs are screwed? Only if you forget that they have no shortage of young men who are pruned and groomed to being elite fighters.

res0nat0r 13y ago
I'd love if we could add techdirt to the auto kill submission list. That would help cut down on the inflammatory noise articles being submitted without much substance.

scrabble 13y ago

It seems to me like a great way for the government to really start keeping close tabs on you would be to have any sort of tech job for them and quit -- especially after Snowden.

coldcode 13y ago

We really need to out and shame any engineer or contracting agency working for the NSA. If they can't hire anyone they can't spy on anyone.

eshvk 13y ago
Once you have done this outing and shaming, what do you expect to do? Burn the engineer or contracting agency at the center of the town hall? Have a fifties style whisper campaign where you refuse to go to their cocktail party? Apart from the fact that it vaguely sounds discriminatory, I don't see what you could achieve on a practical level.
- Karunamon 13y ago
  A de-facto blacklist where having the NSA on your resumé is as desirable as having NAMBLA?
fotbr 13y ago
What happens when the people you're trying to shame simply do not care about your opinion, or the opinions of anyone else?
- jlgreco 13y ago
  The same thing as if you had done nothing.
zeckalpha 13y ago
Assuming sane people would respond to this criticism by leaving, what would be left with? As with any institution, perhaps it is better to have sane people working there, trying to change it from the inside.

snowwrestler 13y ago

There have always been reasons to object to working in national defense. During the Cold War quite a few physicists and engineers chose not to go into defense work because they did not want to feel like they were hastening nuclear Armageddon. And yet, the U.S. government developed effective new defense and energy technologies during this time. There are reasons to work for the government that are attractive to top tech talent: access to information and tools that no one in private enterprise has; gigantic budgets, with no demand for profitability; a great mission: protecting the American people. And if the issue is privacy, there are objections to made at most top tech companies now as well--most of their product development treads on or over the privacy line of their customers. I'm not advocating for defense work BTW, just expressing skepticism that the Snowden affair will substantially harm the government's ability to attract tech talent. It probably will scare off the most innovative, forward thinking hackers...but they've never been a crowd that works for the government anyway. Too slow and bureaucratic.

dclowd9901 13y ago
> most of their product development treads on or over the privacy line of their customers. I think most people now understand and have well-embraced the idea of "if you don't pay for a product you are the product." Given the relative odds of being injured or killed by a terrorist attack, it's debatable if any utility is gained from giving up your privacy to government.
- usefulcat 13y ago
  If by "most people", you mean "most HN readers", then I agree. But if you actually mean "most people", then I'd say that issue is probably not even on their radar.
yareally 13y ago
> "There have always been reasons to object to working in national defense. During the Cold War quite a few physicists and engineers chose not to go into defense work because they did not want to feel like they were hastening nuclear Armageddon." Robert Oppenheimer, the "Father of the Atomic Bomb," lost his security clearance and his position on the Atomic Energy Commission for voicing concerns and refusing to directly help build the hydrogen bomb in the 50s. He argued it was against the United States' best interests to develop it, because the USSR had no cities large enough to use it on, while the United States did. The United States also had plenty of large atomic bombs with pretty high yield already that were much cheaper to build. Thus, when the Soviets eventually created their own, they would be ones with a reason to have it, while we wasted tons of money giving it to them that could have been spent elsewhere. Just for reference: http://en.wikipedia.org/wiki/Robert_Openheimer#Atomic_Energy_Commission http://en.wikipedia.org/wiki/Robert_Openheimer#Atomic_Energy... http://www.imdb.com/title/tt0078037/ http://www.imdb.com/title/tt0078037/ Great miniseries on Oppenheimer done by the BBC, if one can find it.

joetek 13y ago

"it's significant that the NSA's massive XKeyscore program runs on a Linux cluster." Is there an option in Creative Commons or GPL to exclude government use?

TeMPOraL 13y ago
If they modified GPL code, maybe they can be sued to release changes.
- dragonwriter 13y ago
  The only action possible against the federal government for copyright violation is an action in the Court of Federal Claims to recover money damages. [1] [1] http://www.law.cornell.edu/uscode/text/28/1498 http://www.law.cornell.edu/uscode/text/28/1498
mhurron 13y ago
Such an exclusion would be incompatible with the GPL. There are other licenses that do have such an exclusion.
aylons 13y ago
No, and at least on the GPL, this is by principle. Free software, as proposed by the FSF, is agnostic to these issues by design.
tomjen3 13y ago
No, and that is one of the reason GPLs in an immoral license.

bit_genesis 13y ago

It's worth pointing out that you don't need to work "for the NSA" to be contributing to state surveillance. If someone is hired straight out of college to work for any type of cloud services provider with revenues over a billion, it's probably safe to say that they your prospective employer has enough market reach to have attracted the attention of state surveillance programs. Of course, by law, your prospective employer would be required to lie to you about involvement.

majelix 13y ago
> It's worth pointing out that you don't need to work "for the NSA" to be contributing to state surveillance. The flip is also true: you're not necessarily contributing to state surveillance just because you work "for the NSA". Two easy examples are SELinux and the various NSA Guides to Securing <OS_of_choice>.
- tomjen3 13y ago
  I always assumed SELinux was backdoored. I am still waiting on the proof that I am wrong.

theboss 13y ago

Wow, awful. If you got to a InfoSec/Hacker Con the people there either work for Govt Contractors, Used to work for the Govt, or work at small companies (that get paid by the govt). The "Top Hackers" certainly still will work for the government.....Why do you think so many are in DC

andrewcooke 13y ago

one related thing that i have been wondering about: it's been argued that the internet-based voter support was key in getting obama elected. will that same team - or similar people - be willing to work next time round? not work for the government, but for the democrats. will hackers work for democrats in the next presidential election? if it's disappointment with obama, will switching to clinton be enough? and will we see a move to 'blame obama' near the end of his term to help clinton?

tptacek 13y ago

The most dangerous and stupid meme percolating in pop tech culture is that the people engaged with tech culture have a unique claim to computer science, electrical engineering, cryptography, information security, and privacy technology. The Slashdot diaspora genuinely believes that most of the world's computer engineering talent reads their comments. The reality is that not only does money do a fine job of buying talent, but, if it's the USG you're thinking about, they don't even have to try hard; extremely qualified engineering graduates compete to secure positions at NSA, which has been ~10 years ahead of private industry for the last couple decades, before which time they were even further ahead. Part of the reason the USG doesn't actually have a problem recruiting people is that actually believe in training people. I don't know how effective they really are at it, but I do know that our industry is fundamentally unserious about training. The kinds of commercial organizations that take in raw recruits generally turn out extremely mediocre J2EE and .NET developers. The rest, to a first approximation, run their recruiting programs based on measurements of reproductive organs. Giant defense contractors haul in green IT graduates by the truckload and adapt them to jobs that command significant premiums on the private market. Again, I'm not saying defense contractors can turn information management grads into electronic supersoldiers, but: they're not hurting for recruits. The reason I think you care about this is because it informs you of a hidden handicap that private industry and activist groups have when facing down the government. I'm very sorry if I'm the first person to break this to you, but if you're an activist targeting the USG, your adversary isn't stupid. In fact, I think it's likely that they're significantly smarter than any of us. Bear that in mind when you design your NSA-proof email applications. I don't do work for the USG, and haven't before, but I'm realistic about the impact of that decision; it has more to do with my own psychological welfare than it does with anyone else's.

mjolk 13y ago
>In fact, I think it's likely that they're significantly smarter than any of us. Bear that in mind when you design your NSA-proof email applications. Math is math and it's relatively easy to implement decent encryption -- it is possible to pass data securely from end to end. The larger issue with these projects is that they're usually proposed by someone that can sling a bit of Ruby and fashions him/herself a cyber revolutionary, not someone that understands that the real power of the US Government in the tech sphere is its ability to apply pressure away from a keyboard - whether it be a subpoena for raw data from a hosting provider, legal fuckery, or sending armed soldiers to your doorstep.

sharrocker 13y ago

tptacek what is your sourcing on this? I have spoken with people at engineering schools-- including those with close ties with the NSA, where NSA goes for hiring-- and they say the NSA is hurting. A recently retired (as in that month) fed at DefCon said straight up we are seriously behind you guys and cant keep up because of bureaucracy.

JabavuAdams 13y ago

I'm not convinced. People are very good at cognitive dissonance. If you're passionate about tech, then there are some very interesting projects to work on in government. Rocket scientists want to build rockets. Roboticists want to build robots. Hackers want to hack. They've gotten good at what they do by subordinating other concerns to their driving interests. So, why would they be put off by something that doesn't seem to directly affect them or their loved-ones? EDIT> Regarding the furor over heavy-handed prosecution of tech-assisted offences: that only matter if you choose the wrong side. I.e. Work on this cool stuff, stay in line, and you'll never have a problem with the law. Not a hard sell.

mcguire 13y ago

Interesting paragraph from the Reuters article: "Some security experts remain supportive of the government. NSA Director Keith Alexander's talk at the Black Hat conference was well received on Wednesday, despite a few hecklers. "...Alexander took a conciliatory tone during his Black Hat speech, defending the NSA but saying he looked forward to a discussion about how it could do things better." The article portrays Black Hat as the more "professional" conference, as opposed to Def Con.

rdl 13y ago
Mostly because DC20 happened a year ago, before Snowden. I don't think GEN Alexander's PSD would have allowed him to attend Defcon this year. (not that his life would have been in danger, but enough violent/etc. heckling that people probably would have gotten hurt, which would be horrible press.)

rdl 13y ago

I'm certainly not a TAO offensive security type, but maybe I'm somewhat representative of median people in the security space. I was certainly more than willing to work for USG at one point, but the "crypto wars" of the 1990s (as well as the end of the cold war and lack of a mission) convinced me not to go to NSA then (I was going to do ROTC -> NSA). Post-9/11, I fully supported both the USG infosec mission and the use of sigint/etc. to go after specific foreign terrorist groups, and worked as a defense contractor with what that entails (although doing nothing so glamorous as NSA/TAO/etc., but at least not running a helpdesk for ITT either. I envied INSCOM/ISA so much.). Now, I'd have a really hard time doing anything more contractory than selling totally standardized COTS products to the USG, even something non-threatening like a better teleconferencing system, until/unless there is re-established effective elected oversight (i.e. congress, as a whole, and not just 15 committee members with little interest, expertise, or competence) over these programs. Not really holding my breath on that.

Fuxy 13y ago

This would all sound nice and all but where's the proof? Just hackers saying they will refuse government contracts doesn't mean anything. I honestly hope they would do that but I lost hope in such a thing happening a long time ago. Just dangle some money in front of the and they're just average suckers like the rest of humanity.

quantumpotato_ 13y ago

"An illustration picture shows the logo of the U.S. National Security Agency on the display of an iPhone * in Berlin, June 7, 2013. Credit: Reuters/Pawel Kopczynski" * Surrounded by cables that couldn't connect

rdl 13y ago

We do have a pretty clear historical precedent. In the late Vietnam era and immediately after, the prestige of the military, and thus the quality of recruits and soldiers in the US military was basically at its lowest point ever (at least since we started having a big standing military with WW2). I mean, really bad. I'm not sure how much of this was due to "evil babykillers" meme about Vietnam, or the stink of failure from losing our first (and unpopular) war, or what, but it's conceivable the same kind of thing could affect NSA recruiting. The post-Snowden fiasco is about 5% of the way toward doing that, though -- until we see evidence of actual people that "we" "care about" seriously harmed, it won't get much closer than we are now. (It was bad enough that they had to pass laws to consider Vietnam-era veterans a "protected class" for discrimination. From everything I've read and heard about the post Vietnam military, especially the Army, it was even worse (at least until the 1980s, and really until Gulf War I in a lot of ways.)

dpeck 13y ago

This is sadly far from true. There is plenty of talent to be bought for the right amount of money and plenty of talented people who can divorce morality from their job. Besides that though there have been quite a bit of growth in nationalistic sentiment in the hacker community for some time. It seems that its been present in non-US/EU parts of the culture for quite some time, but I've noticed in recent years it becoming a bigger and more accepted part of US circles. Joking about popping boxes in .cn, seeing the whole country as an enemy, etc. It was a lot quieter on those topics in Vegas this year, but it was certainly a very present part of the dialogue 2010/11, etc.

acd 13y ago

The state are purposely allowed to break laws the citizens are not allowed to break. It is illegal for a citizen to hack other persons and organizations computers and take their data. It is allowed for the government to hack other persons computers and steal their data. The government now has professional teams of hackers doing just that. Thus the same laws does not apply for citizens as the government, thus the government thinks they are above the law. It is almost the same as the government would have teams that steal credit cards and make drugs. We are walking towards a Internet 3.0 which be heavily encrytped anonymized and reinvented by hackers. Imagine encrypted mesh sockets. ifconfig anoninet up Peer2Peer dns and trust authorities. Not to mention the banks the government are protecting and the central banks, which purposely steals peoples money through inflation. The Fed is privately owned by the banks they are as Federal as Federal express not at all. The creature from Jekyll island.

e3pi 13y ago

"Closest to home for many hackers are the government's aggressive prosecutions under the Computer Fraud and Abuse Act, which has been used against Internet activist Aaron Swartz, who committed suicide in January, and U.S. soldier Bradley Manning, who leaked classified files to anti-secrecy website WikiLeaks." With also Binney, Drake, Snowden, with the Justice Dept's Eric Holder and Carmen Ortiz prosecuting with trump upped draconian charges, and that we also know the intel/security agencies spokespeople with an eagle logo are consistent prevaricators, it is clearly recklessly dangerous to become directly involved with these federally sanctioned criminals. At least factor that in, while negotiating your compensation.