3 ms·

Well, that's being a little flippant. I think there's plenty that could be done to improve the situation. Mainly, we need to be able to discuss whether 50,000

Well, that's being a little flippant. I think there's plenty that could be done to improve the situation. Mainly, we need to be able to discuss whether 50,000 contractors should have full search access to all these records that are too secret to discuss with congress. 1) Congressional oversight, even if it's a special committee. NSA can't be completely outside of elected governance. There should be NO level of access that is "too classified" for this committee. If "super access" like that needs to exist in some fashion it should NOT be under the jurisdiction of the NSA. As it stands, that excuse is a loophole that undermines the concept of oversight and the NSA is way too big of an organization to have that power. Just moving "super secret" stuff to a smaller, more concentrated organization would improve things immensely. 2) Clear and open communication over access rights. The structure of which roles have what access should not be considered a secret. If this somehow weakens our security, so be it - that's the price of democracy. 3) Better access control. From what has been leaked, it's clear the NSA is putting a lot of value in security through obscurity. As we all know, this isn't a great approach. At the same time, contractors are given access to actually get stuff done. The terms of access, tracking of usage, etc. need to be discussed in a more open way because right now that's the biggest problem of the NSA.

mpyne 13y ago
50,000 contractors may have clearances, but they don't all have access to those records. Remember, the whole point of Snowden going in with sysadmin access, and then stealing credentials and otherwise impersonating 20 other people, is precisely because the stuff Snowden wanted to leak was so compartmentalized. Your 1) has already happened, AFAIK. Perhaps we need to have different (i.e. more active and intrusive) Congressmen on the subcommittee so that they don't act so shocked when details come out, but that's a different issue. Another key note is that unlike almost every other subcommittee, these Congressional overseers don't get the ability for political patronage out of what they do. The Chairman of the House Armed Services Committee, for instance, can be greatly influential in drawing massive DoD dollars to their district, but there's not much the Intelligence committees can do in the same vein, aside from random data centers perhaps. Even then, I know there was a determination by Sen. Feinstein earlier that EO 12333 collection was not in their oversight bailiwick. That wasn't NSA refusing to discuss it, it was the subcommittee deciding it was out of their jurisdiction. There are many Federal agencies and groups that do monitor EO 12333 (though it is certainly unclear what type of oversight they are providing across the totality of programs). Beyond all that, I do agree that nothing going on within NSA should be out-of-scope for oversight (including Congressional oversight, if it comes to it). From the nuclear propulsion perspective, we had routine audits of essentially every major program, institutionalized. I don't know how the Congressional subcommittees do their business but it would be a good idea to institute the same there, and also ensure that NSA/IC staff (contractors too) can always feel comfortable coming to a staffer from that Congressional subcommittee with details of abuses. I'd give the NSA some credit on security through obscurity because you're talking about intelligence programs, not computer code or algorithms. A rule of thumb from crypto research does not necessarily directly apply to anything with the word "communications" in it. ;) In fact the only real problem I see in 3) is that (assuming you're talking about public discussion) the people who most need to care (the American public) are going to have their eyes glaze over immediately, the people who might actually be able to craft countermeasures would be intensely interested, and it wouldn't even prevent government abuse; how easy is it to craft a good system of access controls for public approval but then add workarounds as needed in practice?
- lubujackson 13y ago
  All good points. It's easy to be a backseat driver to all of this, especially with the half-information we get.
gretful 13y ago
how about nothing to access? give these cretins an inch, and next week you'll wake up in a police state. Crazy? No, just tired of seeing this stuff waved away.

mpyne 13y ago

50,000 contractors may have clearances, but they don't all have access to those records. Remember, the whole point of Snowden going in with sysadmin access, and then stealing credentials and otherwise impersonating 20 other people, is precisely because the stuff Snowden wanted to leak was so compartmentalized. Your 1) has already happened, AFAIK. Perhaps we need to have different (i.e. more active and intrusive) Congressmen on the subcommittee so that they don't act so shocked when details come out, but that's a different issue. Another key note is that unlike almost every other subcommittee, these Congressional overseers don't get the ability for political patronage out of what they do. The Chairman of the House Armed Services Committee, for instance, can be greatly influential in drawing massive DoD dollars to their district, but there's not much the Intelligence committees can do in the same vein, aside from random data centers perhaps. Even then, I know there was a determination by Sen. Feinstein earlier that EO 12333 collection was not in their oversight bailiwick. That wasn't NSA refusing to discuss it, it was the subcommittee deciding it was out of their jurisdiction. There are many Federal agencies and groups that do monitor EO 12333 (though it is certainly unclear what type of oversight they are providing across the totality of programs). Beyond all that, I do agree that nothing going on within NSA should be out-of-scope for oversight (including Congressional oversight, if it comes to it). From the nuclear propulsion perspective, we had routine audits of essentially every major program, institutionalized. I don't know how the Congressional subcommittees do their business but it would be a good idea to institute the same there, and also ensure that NSA/IC staff (contractors too) can always feel comfortable coming to a staffer from that Congressional subcommittee with details of abuses. I'd give the NSA some credit on security through obscurity because you're talking about intelligence programs, not computer code or algorithms. A rule of thumb from crypto research does not necessarily directly apply to anything with the word "communications" in it. ;) In fact the only real problem I see in 3) is that (assuming you're talking about public discussion) the people who most need to care (the American public) are going to have their eyes glaze over immediately, the people who might actually be able to craft countermeasures would be intensely interested, and it wouldn't even prevent government abuse; how easy is it to craft a good system of access controls for public approval but then add workarounds as needed in practice?

lubujackson 13y ago
All good points. It's easy to be a backseat driver to all of this, especially with the half-information we get.

gretful 13y ago

how about nothing to access? give these cretins an inch, and next week you'll wake up in a police state. Crazy? No, just tired of seeing this stuff waved away.