5 ms·

This is stupid. You severe ties with the NSA but what about the FBI, CIA, DEA, DISA, DIA, the list goes on. What about contractors who do business for the NSA?

by theboss 13y ago

This is stupid. You severe ties with the NSA but what about the FBI, CIA, DEA, DISA, DIA, the list goes on. What about contractors who do business for the NSA? The big primes. Lockheed, Grumman, SAIC, CGIFederal, BAE, Booz, etc.etc. It's pointless to say you won't do business with one when they are all interconnected. Coming from someone raised in Beltway culture. edit: It is also funny when people say things to the effect of "Beyond what conspiracy theorist could have ever imagined". I'm honestly surprised when people say they didn't know or expect this was happening.

deleted 13y ago
[deleted]
- dragonwriter 13y ago
  > You solve one problem in the world, but what about all the others? Its actually not "others", its the same issue; if you haven't severed ties from the rest of the US intelligence community (and, given the way NSA is wedged into the military as well, that too), you haven't meaningfully severed ties with the NSA, you've just made an empty PR gesture and made those ties very slightly less direct.
undoware 13y ago
> This is stupid... [there are too many, they are all interconnected]. Really? Ever tried to get in shape? There's always that first step. Also -- quoting someone here who, whatever his faults, did get rid of a lot of american colonial bullshit -- it does not matter how slowly you go, so long as you do not stop. It is very clear that you are a beltway product, and I eagerly anticipate never doing business with you, never inviting you to a convention, and never taking your money. Because the guy behind you is getting impatient. NEXT!
- theboss 13y ago
  I didn't try to get in shape actually, I succeeded. On topic though I don't even know what you're talking about. There are plenty of other mathematicians lined up to work for the government from thousands of schools around the country. There are plenty of PhDs in DC/MD/Va who have no problem taking the money at a R&D Firm or at the University they teach at. As long as the NSA shells out money then smart people will take it.
  - snth 13y ago
    This isn't a dichotomy: "no one will work with the NSA" or "this is totally pointless". This approach can at least decrease the quality of people the NSA has working with them, specifically to people who can't get funding another way.
- cschmidt 13y ago
  I came across that quote earlier today (on http://slowtravels.tumblr.com/ http://slowtravels.tumblr.com/), attributed to Confucius. Who do you think it is by? “It does not matter how slow you go so long as you do not stop.” — Wisdom of Confucius
  - jlgreco 13y ago
    A shame Confucius and Zeno never got a chance to sit down and hash things out. That would make for an interesting dialog.
- pmorici 13y ago
  Like it or not Silicon Valley is a beltway product too. It's genesis was in the huge amounts of money that the government showered on universities and companies in the area during the 60's and 70's. They've diversified some since but there are still plenty of companies that are supported by it Palantir for example http://www.palantir.com/solutions/ http://www.palantir.com/solutions/
  - jlgreco 13y ago
    So? I honestly don't know what your point is here. This isn't some sort of "'free market' vs 'government', and who gets credit for various achievements" discussion.
    - pmorici 13y ago
      The point is that the valley isn't an innocent victim here they have in the past and still do facilitate the surveillance state. To act as if refusing to deal with anyone involved would only mean uninviting some government employees from a few conferences and black balling a collection of beltway bandits is naive. The uncomfortable truth is that you would probably have to stop dealing with a lot more people and companies than you would be comfortable with.
      - jlgreco 13y ago
        Consider the possibility of blackballing anybody who continues to be involved. Would that mean blackballing people who continue to work for government contractors as well? Possibly. I'd say that is left up to the individual implementor. We don't need to all literally agree on a list of individuals to blackball. A general trend across some subset of the community would do just fine. Some people may take it to the extreme, some may only dissociate from a narrowly defined group of people. This sort of social tension, or pressure, doesn't need to be engineered with exacting precision. A respected professor here, an influential ex-boss there, one of your college buddies that you might consider asking for a recommendation one day... all can contribute to this ostracism in their own way.
dmix 13y ago
If the NSA and other national SIGINT organizations are the biggest employers of mathematicians I'd say their social and industry reputation matters quite a bit. But most of the kids are recruited and indoctrinated to these agencies straight out of school. So I'm sure they'll still find plenty of people to hire.
- theboss 13y ago
  Let's say every mathematician agreed to no longer talk to NSA at all. NSA would just hire Computer Scientists and dump loads of money into security research. Or they would hire computer scientists to work as insiders at M$, Apple, Cisco, etc.etc. and push well hidden vulnerable code There's no shortage of things you can do when you have a lot of money.
  - genwin 13y ago
    During South Africa's Apartheid its leadership did lots of things to combat the sanctions other countries placed against the country. Eventually it wasn't worth the effort.
  - betterunix 13y ago
    So you are suggesting that if the NSA is working against us, we should just throw our hands in the air and say, "Oh well!" I think perhaps you are a bit too cynical. Why shouldn't the relevant academic communities -- CS, math, EE, etc. -- raise the social cost of working for the NSA? If a biologist learned that one of his colleagues was working on biological weapons, should he just shrug it off or should he reconsider his friendship?
    - theboss 13y ago
      No. I'm only saying that if your goal is to prevent the NSA from working against you then this isn't the way to prevent that. People seem to be a bit upset that I think so also. If there are whole countries that are angry and the US Govt doesn't care then why would they care when a subset of a subset of their possible employees are mad.
genwin 13y ago
You sever ties with the ones who are close enough to the problem. You don't assign guilt by mere association. What would you do against legal but obviously wrong behavior?
- theboss 13y ago
  You have to play by DC's rules which means you have to go the legal route. Just saying "Sorry we won't play with you anymore" won't work because there are a lot of other smart kids with PhDs on the playground.
  - genwin 13y ago
    Yes it could be difficult to keep your job or maybe even your career. Snowden faced that same decision point.
  - Daishiman 13y ago
    what kind of BS is this? DC's rules are their rules, not yours. This is like asking the mafia if they could kindly reconsider extorting you by sending a petition.
    - theboss 13y ago
      Hahah. If you refuse to go the legal route there is nothing you can do but live with the surveillance and protect yourself. It's the only route that could possibly work. I laugh because the legal route is the route people are supposed to trust (you know...checks and balances). It's just funny to see people with no faith in the system.
      - betterunix 13y ago
        "It's just funny to see people with no faith in the system." I think it is more "alarming" than "funny." It is not a new phenomenon, of course, but it is one that should cause us a great deal of concern. We have governments, laws, and legal processes to ensure that various disputes are resolved peacefully and with respect for everyone's rights. When people start losing their faith in the system, they must also start finding "alternative" ways to resolve their conflicts.
nohat 13y ago
I tend to assume people pretend to be surprised because it allows them to be more outraged. This assumption could easily be egocentric bias, but I have difficulty seeing how any moderately informed person would be truly surprised by these 'revelations.' Some interesting specific details, sure -- but nothing particularly strange has surfaced.
- wrongc0ntinent 13y ago
  I'm sure this has been said before, but having proof (such as it is) makes a bit of a difference that just might have political/societal consequences.
- Nogwater 13y ago
  I guess it depends on what you mean by "moderately informed." I've been on HN for a while now. The HN community obviously cares about the NSA's activities, but how many posts were there on HN about the NSA collecting all of this information before Snowden? Or are you just talking about people in the academic crypto community?
  - nohat 13y ago
    I basically mean people with an interest in privacy and implications of information technology on society. If someone doesn't have that interest, I wouldn't expect them to assume the NSA is collecting all the info it can. With a basic background I would expect other people to recognize how powerful vacuuming up everything is. This expectation is strengthened by personal experience (moderate n, but selection bias). Certainly having the leaks makes people actually talk about it -- partially because assumed isn't the same as proved when you are an activist. Furthermore the extent to which the NSA hands this information over to eg the FBI was unknown. IMHO the real danger of spying on everyone is 3 felonies a day style selective enforcement. If the NSA keeps everything well barricaded from political and personal motivations and only pursues genuine threats to national security I frankly think that might be best for everyone. That possibility is seeming less likely because of information the leaks have provided.
betterunix 13y ago
"I'm honestly surprised when people say they didn't know or expect this was happening." Then you must not have much experience with people in the academic crypto community. Most people assumed that the NSA was engaged in wiretapping activity, but BULLRUN was a big shock. People generally assumed that information assurance was at least as important to the NSA as signals intelligence and pointed to things like DES (which the NSA strengthened) as evidence. The idea that the NSA was deliberately subverting crypto and security software, including software that vast swaths of the US government uses, was considered to be an out-there conspiracy theory. So while I think the author is a little extreme in saying that this is beyond what conspiracy theorists imagined, it is not wrong to say that people in the academic community were surprised. You can look at what people said on the cryptography mailing list and in sci.crypt prior to these revelations if you do not believe me.
- 001sky 13y ago
  including software that vast swaths of the US government uses This always ceases to amaze me
  - unimpressive 13y ago
    Are you sure you don't mean never ceases to amaze me?
    - ScottBurson 13y ago
      He means he could care less.
- mpyne 13y ago
  > Most people assumed that the NSA was engaged in wiretapping activity, but BULLRUN was a big shock. People generally assumed that information assurance was at least as important to the NSA as signals intelligence and pointed to things like DES (which the NSA strengthened) as evidence. Why would people have assumed that after the failure to enforce Clipper chip usage, that NSA would have simply given up on getting access to the plaintext of messages? That makes no sense whatsoever; NSA has been breaking codes (not merely wiretapping) since NSA has been around, just like it has long been an open secret (if unacknowledged publically) that NSA hacks into specific systems if they can. It is true that COMSEC is a core function of NSA, but that is not inconsistent with NSA performing targeted SIGINT or general cryptanalysis. If their codebreakers can break into equipment used by the US government or major commercial interests then so can foreign entities, and therefore NSA needs to try anyways, even if we're talking about "pure" information assurance. Likewise the history of NSA has shown them before to be willing to give people cryptosystems that are strong against everyone but the NSA. That's also in keeping with NSA's drive for COMSEC, since (from their POV) they won't be needlessly decrypting 'innocent' information anyways. So I'm not saying you're wrong about what the academic community was assuming, but I am saying I can't imagine why the academic community was so naïve. Indeed, I thought the ever-present distrust of NSA was exactly why they looked for backdoors in things like Dual_EC_DRBG, and used "nothing up my sleeve" constants in algorithms designed in academia.
smsm42 13y ago
It's not pointless. The goal is not to destroy US government and everything to do with it. The goal is to effect change - namely, put NSA surveillance programs back under strict public control and within the borders of reason and limits that must exist in a democratic society valuing liberty and privacy. For this, public pressure exerted on persons helping NSA to do what they do is not a bad measure. You don't need to destroy the NSA, you need to create an environment in which changing their ways would be more attractive that continuing as is. If working for NSA would create a social stigma among mathematicians, that would influence the quality of people they would be able to hire, at least publicly, and thus may contribute to change being considered as more attractive alternative.
lambda 13y ago
This was specifically targeted at mathematicians, and pure mathematicians are a lot more likely to be hired by the NSA than any of those other organizations that you mention. Engineers, programmers, and so on all already have to grapple with this issue with big defense contractors. It's more rare that mathematicians have to deal with it.
nl 13y ago
Don't underestimate the power of symbolism. Imagine if Gandhi had said "Britain will never leave India - look at all the British companies that have ties here"? Instead, he (illegally) picked up a single grain of salt[1]. [1] https://en.wikipedia.org/wiki/Salt_March https://en.wikipedia.org/wiki/Salt_March
hrjet 13y ago
"This is stupid. You severe ties with the NSA but what about the FBI, CIA, DEA, DISA, DIA, the list goes on." Well, I wouldn't call it stupid. Perhaps I would call it "incomplete". Or "hey, that's a start!".

jlgreco 13y ago
> "Why would people have assumed that after the failure to enforce Clipper chip usage, that NSA would have simply given up on getting access to the plaintext of messages?" Consider this exchange on HN nearly three years ago: @moe: I had always considered the Clipper-Chip incident to hint at the tip of an iceberg. Do you really think that was an isolated one-time event? @kgo: The Clipper Chip was introduced in the open. They tried to push it through legislation. It's not like the NSA blackmailed Intel executives to include the capabilities secretly in their Pentium Processors without notifying their customers. Same with the new proposed legislation. But all that demonstrates is that the NSA has an interest in being able to (legally) monitor encrypted communications. Which everyone already knows. If someone had 'busted' the NSA trying to do something sneaky and/or covert and/or illegal, then you could argue that it's the tip of some iceberg of nefarious activity. But like I said this was all done out in the open. You might as well say that because we know the FBI wiretaps phones through legally obtained court orders, that's the tip of the iceberg that points to millions of illegal wiretaps. It's a bad inference. (I would emphasis certain parts of kgo's response that I find particularly... accidentally prescient?... but the result would just be me emphasizing the whole damn thing...) https://news.ycombinator.com/item?id=2018456 https://news.ycombinator.com/item?id=2018456 The gist here is that Clipper, being a public effort to subvert encryption, should not be seen as evidence that the NSA was interested in non-public subversion of security. Was this naive? In retrospect? Obviously. At the time? Arguably. Where people, who reasonably should have been informed, caught off guard by the revelations brought to us by Snowden? You betcha. [edited for formatting]
- mpyne 13y ago
  Thanks for the quote, it's quite illuminating. This is actually essentially what I was arguing, not just moe's point: But all that demonstrates is that the NSA has an interest in being able to (legally) monitor encrypted communications. Which everyone already knows. I don't condone designing backdoors into products. Maybe I can research into BULLRUN more but the impression I had was that the intention was to subvert crypto in a way that only NSA could use (either via escrow or constants-up-their-sleeve), perhaps to take advantage of exploits that happened to get shipped to the commercial sector, but not to design broken gear that anyone could subvert if they know the secret handshake. Obviously even this is sneaky and shady as can be, but that goes with the territory (though @kgo would seem to agree that it's nefarious :-D). But even assuming malice here, I'd have said even at the time, with the ongoing changes to communication patterns across the world, that there's simply no way you can assume NSA isn't trying to hack everything they can. When I was reading Schneier a decade or more ago they were the very definition of Mallory, and nothing has changed on that since. But I suppose you're right, that people at the time weren't seeing NSA the same way I was.
betterunix 13y ago
"NSA has been breaking codes (not merely wiretapping) since NSA has been around, just like it has long been an open secret (if unacknowledged publically) that NSA hacks into specific systems if they can." BULLRUN is not a cryptanalysis program, and it is a stretch to call it a "hacking" program -- and certainly not one that targets specific systems. BULLRUN is the NSA program to deliberately introduce exploitable bugs in cryptographic protocols, software, and so forth. "the history of NSA has shown them before to be willing to give people cryptosystems that are strong against everyone but the NSA." First of all, the NSA does not frequently give cryptosystems to anyone outside of the US government. That being said, there are two prominent counterexamples to your statement: DES and DSA. "I thought the ever-present distrust of NSA was exactly why they looked for backdoors in things like Dual_EC_DRBG, and used "nothing up my sleeve" constants in algorithms designed in academia." It is worth noting that even when the Dual_EC_DRBG backdoor was discovered, there were people who were skeptical about it being deliberate. Even Bruce Schneier expressed some skepticism about it being an NSA backdoor: https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html https://www.schneier.com/blog/archives/2007/11/the_strange_s... I don't understand why the NSA was so insistent about including Dual_EC_DRBG in the standard. It makes no sense as a trap door: It's public, and rather obvious. As for nothing up my sleeve constants, that goes beyond just showing that there is no back door. Suppose you were analyzing a cryptosystem, and it required some particular constant. What about that choice of constant makes the system secure? If a different constant were used, would system still be secure? Even if you never gave any thought to backdoors, nothing-up-my-sleeve numbers would matter -- cryptographers like to know the reasoning behind design decisions, and it is much easier to explain why you picked 1234567890 as a constant than 43895762356157265.
- mpyne 13y ago
  You'll note that Schneier's criticism of NSA as the source of the DRBG backdoor is that it was too obvious (i.e. the work of clowns, not the work of the most-advanced cryptography outfit in the world), not that NSA wouldn't engage in that kind of activity. He also mentioned how it was NSA (and NSA specifically) who were 'so insistent' on including that 'obviously' broken algorithm in the standard. I mean, that question kind of answers itself (even at the time!) as long as you're not presupposing that NSA turned pure white in 1995.