4 ms·
Call it paucity of imagination on my part, but I was wondering if somebody could make explicit some legitimate examples of situations involving a "clear nationa
by maldeh 13y ago
Call it paucity of imagination on my part, but I was wondering if somebody could make explicit some legitimate examples of situations involving a "clear national security need"? It's not like they're just making a legal exception for a "Blockbuster" scenario, where terrorists are about to nuke a city and a lone hacker saves the day by breaking SSH, right?
Is this supposed to apply to instances where the flaw affects the competition more than civilians -- say, a security flaw that somehow disproportionately affects Iran, China and Russia over the US? (there are obvious reasons why the government cannot explicitly acknowledge this, but I'm wondering if this is a direct implication)
- XorNot 13y agoThe NSA would monitor hacker message boards and the various black market websites for exploits like this. If they find something which they don't see any chatter about on any of these sources, then it's reasonable to presume no one has found it. Moreover, actually exploiting heartbleed would leave a signature. You can fake SSL certificates, but eventually someone has to lose their money, or some innovation has to come out of the blue. MitM's involve traffic diversions unless they're conducted at a government level. Espionage always leaves a trail - even if you don't know where someone gets their intel, you can always tell they must be getting it somehow.