3 ms·

What doesn't pass the smell test is how a single individual like Snowden was able to hack so many passwords, load so much stuff, contact Greenwald, transfer the

by mudil 12y ago

What doesn't pass the smell test is how a single individual like Snowden was able to hack so many passwords, load so much stuff, contact Greenwald, transfer the stuff out, successfully evade and eventually escape. To me it smells like a sophisticated op, organized by an intelligence agency.

harshreality 12y ago
It's been publicly stated that Snowden got fellow sysadmins to give him their passwords. Is your theory that they're all Chinese or Russian agents, too? Or that this is a face-saving false claim by the NSA? He was in Hong Kong by the time the NSA knew something was wrong. There was no evasion necessary. Contacting Greenwald would have ordinarily been detected? Wouldn't that imply that NSA contractors' personal communications are monitored? Source? It's not like he contacted journalists directly. He was using lavabit or something like it, so positively identifying a metadata link between Snowden and Greenwald would have required the NSA to hack or NSL whatever email service he was using. If there's automated metadata linkage from traffic analysis, they might have had a weak correlation between Snowden's web traffic to e.g. lavabit and an outgoing email from lavabit to Greenwald. I'm sure that's something the NSA will be looking at in the future, because it's right up their alley and something they probably could have done better. You're presuming the NSA has far better internal computer security measures than anyone else does (insider espionage is a pervasive problem in every industry). I don't see any reason to think that it did. There's a trade-off: the better the security, the harder it is to get anything done and the higher that drives computer and network admin costs. Much of the security in classified operations is gained through issuing clearances and relying on social cohesion ("I'm cool; I've got a clearance and work for the NSA, and my friends are here; violating classification rules would get me kicked out.") and punishment ("Violating classification rules could mean prison."). Then there's physical security: keeping those without proper clearance away from data they are not allowed to access. The rest is fuzzy. A classified system/network has some monitoring and auditing, but it's not a magic bullet particularly against savvy sysadmins. Audit records are an information glut. You have to have some idea of you're looking for in order to find it.

by mudil 12y ago

harshreality 12y ago

It's been publicly stated that Snowden got fellow sysadmins to give him their passwords. Is your theory that they're all Chinese or Russian agents, too? Or that this is a face-saving false claim by the NSA? He was in Hong Kong by the time the NSA knew something was wrong. There was no evasion necessary. Contacting Greenwald would have ordinarily been detected? Wouldn't that imply that NSA contractors' personal communications are monitored? Source? It's not like he contacted journalists directly. He was using lavabit or something like it, so positively identifying a metadata link between Snowden and Greenwald would have required the NSA to hack or NSL whatever email service he was using. If there's automated metadata linkage from traffic analysis, they might have had a weak correlation between Snowden's web traffic to e.g. lavabit and an outgoing email from lavabit to Greenwald. I'm sure that's something the NSA will be looking at in the future, because it's right up their alley and something they probably could have done better. You're presuming the NSA has far better internal computer security measures than anyone else does (insider espionage is a pervasive problem in every industry). I don't see any reason to think that it did. There's a trade-off: the better the security, the harder it is to get anything done and the higher that drives computer and network admin costs. Much of the security in classified operations is gained through issuing clearances and relying on social cohesion ("I'm cool; I've got a clearance and work for the NSA, and my friends are here; violating classification rules would get me kicked out.") and punishment ("Violating classification rules could mean prison."). Then there's physical security: keeping those without proper clearance away from data they are not allowed to access. The rest is fuzzy. A classified system/network has some monitoring and auditing, but it's not a magic bullet particularly against savvy sysadmins. Audit records are an information glut. You have to have some idea of you're looking for in order to find it.