6 ms·

How the NSA Threatens National Security

ds9 13y ago
The most important line: "put security ahead of both domestic and international surveillance". That's what it comes down to, we can have communications security or surveillance, not both.
- Zigurd 13y ago
  > we can have communications security or surveillance, not both With all the smart people in the industry, I don't see Google, much less Cisco, internalizing this fact. They want the toothpaste to slide back into the tube so they can sell to normal users as well as law enforcement as well as spy agencies. Nobody, especially not overseas customers, will believe that is possible. Any product that accommodates surveillance is not secure. Too much of the tech industry, and especially the security industry, is too impressed with helping catch "bad guys." They will have to leave that to real-world person-to-person police work if they want to be credible about secure communications and storage.
- higherpurpose 13y ago
  Yes, so far NSA has been successful as promoting mass surveillance as a matter of "security" not just against terrorists (which we now learn is being very wasteful and ineffective), but against "cyber-attacks", too. Every time they talked about cyber-attacks, they implied Congress need to give them more powers and more money, which they later used for offensive actions, rather than securing the networks. NSA has zero interest in security networks at this point. Maybe they cared about that a little before 9/11, but I don't think they care about it at all anymore. All they want to do now is be able to break into everything or have backdoors into everything, which means they will not only hoard systems' vulnerabilities for themselves, but they also won't even use that knowledge to secure domestic systems, because the truth is they want access to domestic systems, too, and to them that has a higher priority than securing those systems even against China and so on. The NAS has probably always had this corrupted idea about security, but I think it became much more so when they merged the US Cyber Command with the NSA. Bottomline is that we need to educate others that surveillance is pretty much the opposite of "cyber-security", and we need to call NSA out on it everytime they try to use the lie that they're the same.
- jobu 13y ago
  This is my favorite part of the article: "We have been repeatedly told that these surveillance programs would have been able to stop 9/11, yet the NSA didn't detect the Boston bombings -- even though one of the two terrorists was on the watch list and the other had a sloppy social media trail." It's upsetting how freely those in the government are willing to give up liberty for safety, but when we find out it isn't even a fair trade they're still ok with it.
r0h1n 13y ago
While there's a healthy debate in the US (and to a lesser extent in Europe perhaps) about the extent of spying being done by governments, I see hardly any concern in India among both media organizations (with probably the exception of The Hindu newspaper), businesses and citizens. Fed by the constant drip-drip of "free" features, people are almost blind to the true "cost" they're paying. I've tried my best to convince people I know to adopt even simple (not foolproof, which probably nothing is) countermeasures like VPNs or HTTPS-Everywhere...but nobody gives a damn. Reminds me of a Supernatural episode [1] featuring drugged Turducken sandwiches that turn people into passive, media-absorbing, harmless zombies. [1] - http://io9.com/5861160/turducken-and-the-rise-of-dick-make-one-helluva-supernatural-episode http://io9.com/5861160/turducken-and-the-rise-of-dick-make-o...
- pavanred 13y ago
  This is true, just days ago there was a proposal of a Google tie-up with Election Commission of India [1]. The proposal allowed Google to offer services for the General Elections in India to be held in 2014. Google proposed free online voter registration besides making available vital details of voter EPIC card numbers and polling station locations. While this did stir up a concern among the political parties and got some column inches and airtime in mainstream media, I think it should have deserved a lot more attention. I was quite surprised that many people I know don't even have a clue that this happened about a week ago. With all the recent spying revelations, this was seen as a huge security risk. Nevertheless, the Election Commission of India later dropped plans to partner with Google after spying fears [2]. [1] http://articles.timesofindia.indiatimes.com/2014-01-07/india/45954589_1_voter-facilitation-security-concerns-tie-up http://articles.timesofindia.indiatimes.com/2014-01-07/india... [2] http://in.reuters.com/article/2014/01/09/india-elections-google-idINDEEA080CQ20140109 http://in.reuters.com/article/2014/01/09/india-elections-goo...
  - DannyBee 13y ago
    "The proposal allowed Google to offer services for the General Elections in India to be held in 2014. Google proposed free online voter registration besides making available vital details of voter EPIC card numbers and polling station locations." I started and used to run these programs for Google. I'm not sure what you are implying is done with this data, but security and privacy are always the highest priority. Google does this stuff for completely altruistic reasons. It's not even part of .com anymore, it's part of .org. The goal is to help people know where to vote. Nothing more, nothing less. If you'd like to tell me what conspiracy you think this is part of, ...
higherpurpose 13y ago
> We need to build a coalition of free-world nations dedicated to a secure global Internet, and we need to continually push back against bad actors -- both state and non-state -- that work against that goal. Let's do it. Even though I'm starting to believe that a "secure by default Internet" will come from the wilderness of the Internet and not from committees, because too many corporations (Google, Facebook, Microsoft, etc) and governments (US, China, "5 eyes", etc) will push against those committees' standards, I still think it's important to have at least some large countries support those types of projects when they arrive, or at least not be outright hostile against them and try to ban them "because terrorism/child pornography/money laundering". These technologies will need some time to incubate, and leak into the mainstream, so at the very least we'll need some countries to turn a 'blind eye' to them until they reach critical mass, and not try to shut them down from day one or threaten people with new laws and arrests if they use them.

ds9 13y ago

The most important line: "put security ahead of both domestic and international surveillance". That's what it comes down to, we can have communications security or surveillance, not both.

Zigurd 13y ago
> we can have communications security or surveillance, not both With all the smart people in the industry, I don't see Google, much less Cisco, internalizing this fact. They want the toothpaste to slide back into the tube so they can sell to normal users as well as law enforcement as well as spy agencies. Nobody, especially not overseas customers, will believe that is possible. Any product that accommodates surveillance is not secure. Too much of the tech industry, and especially the security industry, is too impressed with helping catch "bad guys." They will have to leave that to real-world person-to-person police work if they want to be credible about secure communications and storage.
higherpurpose 13y ago
Yes, so far NSA has been successful as promoting mass surveillance as a matter of "security" not just against terrorists (which we now learn is being very wasteful and ineffective), but against "cyber-attacks", too. Every time they talked about cyber-attacks, they implied Congress need to give them more powers and more money, which they later used for offensive actions, rather than securing the networks. NSA has zero interest in security networks at this point. Maybe they cared about that a little before 9/11, but I don't think they care about it at all anymore. All they want to do now is be able to break into everything or have backdoors into everything, which means they will not only hoard systems' vulnerabilities for themselves, but they also won't even use that knowledge to secure domestic systems, because the truth is they want access to domestic systems, too, and to them that has a higher priority than securing those systems even against China and so on. The NAS has probably always had this corrupted idea about security, but I think it became much more so when they merged the US Cyber Command with the NSA. Bottomline is that we need to educate others that surveillance is pretty much the opposite of "cyber-security", and we need to call NSA out on it everytime they try to use the lie that they're the same.
jobu 13y ago
This is my favorite part of the article: "We have been repeatedly told that these surveillance programs would have been able to stop 9/11, yet the NSA didn't detect the Boston bombings -- even though one of the two terrorists was on the watch list and the other had a sloppy social media trail." It's upsetting how freely those in the government are willing to give up liberty for safety, but when we find out it isn't even a fair trade they're still ok with it.

r0h1n 13y ago

While there's a healthy debate in the US (and to a lesser extent in Europe perhaps) about the extent of spying being done by governments, I see hardly any concern in India among both media organizations (with probably the exception of The Hindu newspaper), businesses and citizens. Fed by the constant drip-drip of "free" features, people are almost blind to the true "cost" they're paying. I've tried my best to convince people I know to adopt even simple (not foolproof, which probably nothing is) countermeasures like VPNs or HTTPS-Everywhere...but nobody gives a damn. Reminds me of a Supernatural episode [1] featuring drugged Turducken sandwiches that turn people into passive, media-absorbing, harmless zombies. [1] - http://io9.com/5861160/turducken-and-the-rise-of-dick-make-one-helluva-supernatural-episode http://io9.com/5861160/turducken-and-the-rise-of-dick-make-o...

pavanred 13y ago
This is true, just days ago there was a proposal of a Google tie-up with Election Commission of India [1]. The proposal allowed Google to offer services for the General Elections in India to be held in 2014. Google proposed free online voter registration besides making available vital details of voter EPIC card numbers and polling station locations. While this did stir up a concern among the political parties and got some column inches and airtime in mainstream media, I think it should have deserved a lot more attention. I was quite surprised that many people I know don't even have a clue that this happened about a week ago. With all the recent spying revelations, this was seen as a huge security risk. Nevertheless, the Election Commission of India later dropped plans to partner with Google after spying fears [2]. [1] http://articles.timesofindia.indiatimes.com/2014-01-07/india/45954589_1_voter-facilitation-security-concerns-tie-up http://articles.timesofindia.indiatimes.com/2014-01-07/india... [2] http://in.reuters.com/article/2014/01/09/india-elections-google-idINDEEA080CQ20140109 http://in.reuters.com/article/2014/01/09/india-elections-goo...
- DannyBee 13y ago
  "The proposal allowed Google to offer services for the General Elections in India to be held in 2014. Google proposed free online voter registration besides making available vital details of voter EPIC card numbers and polling station locations." I started and used to run these programs for Google. I'm not sure what you are implying is done with this data, but security and privacy are always the highest priority. Google does this stuff for completely altruistic reasons. It's not even part of .com anymore, it's part of .org. The goal is to help people know where to vote. Nothing more, nothing less. If you'd like to tell me what conspiracy you think this is part of, ...

higherpurpose 13y ago

> We need to build a coalition of free-world nations dedicated to a secure global Internet, and we need to continually push back against bad actors -- both state and non-state -- that work against that goal. Let's do it. Even though I'm starting to believe that a "secure by default Internet" will come from the wilderness of the Internet and not from committees, because too many corporations (Google, Facebook, Microsoft, etc) and governments (US, China, "5 eyes", etc) will push against those committees' standards, I still think it's important to have at least some large countries support those types of projects when they arrive, or at least not be outright hostile against them and try to ban them "because terrorism/child pornography/money laundering". These technologies will need some time to incubate, and leak into the mainstream, so at the very least we'll need some countries to turn a 'blind eye' to them until they reach critical mass, and not try to shut them down from day one or threaten people with new laws and arrests if they use them.