3 ms·

What upset me most about his speech is him conflating the issues of protection against terrorists and protection against cyber-attacks, implying that they are b

What upset me most about his speech is him conflating the issues of protection against terrorists and protection against cyber-attacks, implying that they are basically the same, and that the NSA is just as useful for both. I won't discuss the fact that 12 years of surveillance have led to no results on stopping any terrorist plots, as the NSA has already admitted, but the NSA has actually made cyberattacks more likely because they are undermining the security of everything, including US infrastructure. As Schneier says, it's not a question of whether we allow the NSA to spy on everyone or not. It's a question of whether we allow every attacker to spy or attack our networks - or we try to make everything more secure by default. So when president Obama implies that NSA should keep hoarding their vulnerabilities into systems, he's choosing the former, rather than the latter. He's making cyberattacks more likely, not less. The way you defend against cyberattacks is by increasing security, not by increasing your offense capabilities. If they really cared about the security of US infrastructure, they'd divulge the vulnerabilities they found or bought from the black market that exploit the security of these systems, so those systems can be fixed, and no one else can exploit them with these exploits. Instead they keep them for themselves so they can exploit them. That's not just wrong. It's incredibly dangerous and reckless, especially from an agency that supposedly wants to "protect us".

pekk 13y ago
He didn't conflate terrorism and cyber-attacks, he only said that we need the capability to stop these. He certainly never implied that "NSA should keep hoarding their vulnerabilities into systems." Are you arguing that the US should be the only large country without intelligence or counter-intelligence programs?
- 97d7de9817f 13y ago
  And you seem to be conflating dragnet surveillance with intelligence/counter-intelligence programs. Obama stated in this speech that the purpose of this type of surveillance isn't to spy on potentially hostile nations, but to spy on individuals or small networks of individuals. Torture is another great way of ousting terrorist plots which other nations incorporate into their intelligence gathering process. We choose not to do this because it is unethical and has too much potential for abuse. I see no reason to think that this same logic shouldn't be applied to the dragnet surveillance of the entire planet.
- higherpurpose 13y ago
  They should certainly separate the US Cyber Command from the NSA. That caused a lot of the current problems. It's also what Obama's own NSA review panel recommended. Putting a big wall between the two should ensure that the powers aren't abused as much, and that the exploits are used only in most important cases, and only outside of US (NSA is still not supposed to attack US citizens, right?!).
  - mpyne 13y ago
    I don't know why Obama didn't take the recommendation, but as someone in the military I can tell you it's probably because the downsides outweigh the gains. From the perspective of civil liberties NSA is the threat because of its extensive capabilities. But it is exactly that suite of capabilities that makes it useful for USCYBERCOM. You wouldn't expect to see USSTRATCOM without its collection of silos, bombers, and SSBNs, would you? Splitting up CYBERCOM and NSA would leave the capabilities substantially still in the hands of NSA, so they'd still need to coordinate often (but now it would be much more difficult, reducing military readiness for CYBERCOM). But it wouldn't eliminate the threat to civil liberties from NSA (since those come substantially from the NSA's capabilities). If you instead give CYBERCOM equivalent capability to NSA (at great expense, mind you), you'd simply have two large octopi that are civil liberties risks, instead of one. And only one of those would be substantially overseen by FISC and Congress, since the President would have direct military control over CYBERCOM's actions. Does this sound better? Leaving CYBERCOM dependent on NSA for its ability to conduct overseas cyberattack actually makes it easier to ensure civil liberties oversight is implemented and performed, and that NSA can't evade those oversight controls by pawning off an illegal search on their friendly neighborhood CYBERCOM with equivalent (or better) cyber capability.
andrethegiant 13y ago
> 12 years of surveillance have led to no results on stopping any terrorist plots, as the NSA has already admitted Source?
- vegashacker 13y ago
  Probably impossible to verify one way or the other. May be more true to say "...have led to little evidence of stopping...". See, e.g., Schneier's article on this (https://www.schneier.com/blog/archives/2014/01/how_the_nsa_thr.html https://www.schneier.com/blog/archives/2014/01/how_the_nsa_t...), which references a summary article on what may be true about the effectiveness of the surveillance in stopping plots/attacks (http://www.huffingtonpost.com/2013/10/23/nsa-attacks-thwarted_n_4148811.html http://www.huffingtonpost.com/2013/10/23/nsa-attacks-thwarte...).
  - mpyne 13y ago
    NSA overall has certainly been successful in stopping attacks. The major question was the effectiveness of 215 phone metadata surveillance in particular, which is the thing that was hotly debated. But even leaving out 215 metadata there were still about least a dozen plots with actual planning/action taken for them and probably 35-ish more that were detected and either stopped before they reached that point, or verified to have trailed off on their own.

pekk 13y ago

He didn't conflate terrorism and cyber-attacks, he only said that we need the capability to stop these. He certainly never implied that "NSA should keep hoarding their vulnerabilities into systems." Are you arguing that the US should be the only large country without intelligence or counter-intelligence programs?

97d7de9817f 13y ago
And you seem to be conflating dragnet surveillance with intelligence/counter-intelligence programs. Obama stated in this speech that the purpose of this type of surveillance isn't to spy on potentially hostile nations, but to spy on individuals or small networks of individuals. Torture is another great way of ousting terrorist plots which other nations incorporate into their intelligence gathering process. We choose not to do this because it is unethical and has too much potential for abuse. I see no reason to think that this same logic shouldn't be applied to the dragnet surveillance of the entire planet.
higherpurpose 13y ago
They should certainly separate the US Cyber Command from the NSA. That caused a lot of the current problems. It's also what Obama's own NSA review panel recommended. Putting a big wall between the two should ensure that the powers aren't abused as much, and that the exploits are used only in most important cases, and only outside of US (NSA is still not supposed to attack US citizens, right?!).
- mpyne 13y ago
  I don't know why Obama didn't take the recommendation, but as someone in the military I can tell you it's probably because the downsides outweigh the gains. From the perspective of civil liberties NSA is the threat because of its extensive capabilities. But it is exactly that suite of capabilities that makes it useful for USCYBERCOM. You wouldn't expect to see USSTRATCOM without its collection of silos, bombers, and SSBNs, would you? Splitting up CYBERCOM and NSA would leave the capabilities substantially still in the hands of NSA, so they'd still need to coordinate often (but now it would be much more difficult, reducing military readiness for CYBERCOM). But it wouldn't eliminate the threat to civil liberties from NSA (since those come substantially from the NSA's capabilities). If you instead give CYBERCOM equivalent capability to NSA (at great expense, mind you), you'd simply have two large octopi that are civil liberties risks, instead of one. And only one of those would be substantially overseen by FISC and Congress, since the President would have direct military control over CYBERCOM's actions. Does this sound better? Leaving CYBERCOM dependent on NSA for its ability to conduct overseas cyberattack actually makes it easier to ensure civil liberties oversight is implemented and performed, and that NSA can't evade those oversight controls by pawning off an illegal search on their friendly neighborhood CYBERCOM with equivalent (or better) cyber capability.

andrethegiant 13y ago

> 12 years of surveillance have led to no results on stopping any terrorist plots, as the NSA has already admitted Source?

vegashacker 13y ago
Probably impossible to verify one way or the other. May be more true to say "...have led to little evidence of stopping...". See, e.g., Schneier's article on this (https://www.schneier.com/blog/archives/2014/01/how_the_nsa_thr.html https://www.schneier.com/blog/archives/2014/01/how_the_nsa_t...), which references a summary article on what may be true about the effectiveness of the surveillance in stopping plots/attacks (http://www.huffingtonpost.com/2013/10/23/nsa-attacks-thwarted_n_4148811.html http://www.huffingtonpost.com/2013/10/23/nsa-attacks-thwarte...).
- mpyne 13y ago
  NSA overall has certainly been successful in stopping attacks. The major question was the effectiveness of 215 phone metadata surveillance in particular, which is the thing that was hotly debated. But even leaving out 215 metadata there were still about least a dozen plots with actual planning/action taken for them and probably 35-ish more that were detected and either stopped before they reached that point, or verified to have trailed off on their own.