32 ms·

New Snowden Docs Indicate Scope of NSA Preparations for Cyber Battle

463 points by zmanian 12y ago

amirmc 12y ago
At best this seems like an arms race but at worst, there are actually battles being fought (of a kind). I wonder what the digital equivalent of a nuke would be such that govts decide that diplomacy is better. Some kind of Digitally Affected Mutual Destruction (DAMD).
ancarda 12y ago
> the only law that applies is the survival of the fittest. Is this such a problem? In a world where exploits are used to break infrastructure, isn't the best solution simply to build increasingly more secure code? If that won't solve the problem I don't know if legislation will. Right now a determined hacker can harm a company via the internet (e.g. Sony). Are laws really going to stop that from happening? If not, please correct me. I know little about cyber warfare and would love to know more.
- dthal 12y ago
  I think you are exactly right. Any solutions to this have to be technical and largely defensive. Legal or diplomatic solutions will only bind parties that intend to follow the law. Counter-attacking and deterrence will fail if the attacker is not defending much of anything, so that approach might work against states and state-backed actors, but not against non-state actors.
  - allendoerfer 12y ago
    > Legal or diplomatic solutions will only bind parties that intend to follow the law. Simple rule of thumb: This argument is always false. Our society is too complex. It is never about good guys vs. bad guys. It is mostly about money, who has the most and how laws can change incentives and prices. It is the same with drugs, guns, atomic bombs and nearly every other topic were this argument is brought up. We need to get over this because it is just slowing us down.
- CaveTech 12y ago
  Legislature can't prevent bad people from doing bad things. But it can prevent good people from doing bad or ignorant things, and it provides a framework to punish those who cause harm. Every law can and does get broken, but that doesn't mean laws are useless.
  - throwaway349823 12y ago
    There are other ways to have an impact with laws than punish the aggressor. Airplanes aren't safe because the pilot or mechanic gets punished when something happens, it's because (very simplified) the airlines and manufacturers do.
jacquesm 12y ago
Judging by the scope of the attack on Belgacom in 2011 that battle is already underway, the surprise I guess should be that it is the allies attacking each other. If China or North Korea would have made an attack like this it would be trumpeted as an act of war, but because it is the UK with NSA assistance it's downplayed as much as possible.
stickhandle 12y ago
The last 2 articles I read were this one and the earlier piece on Google and neural nets [1]. It's easy to connect the two, add the pervasive integration of technology in our lives, mix in a healthy dose of paranoia --> see a SkyNet future. [1]https://medium.com/backchannel/google-search-will-be-your-next-brain-5207c26e4523 https://medium.com/backchannel/google-search-will-be-your-ne...
philip1209 12y ago
Domestic surveillance was controversial and surprising. Is a spy agency preparing ways to attack and cripple foreign infrastructure that unexpected or contentious?
- Cakez0r 12y ago
  > Is a spy agency preparing ways to attack and cripple foreign infrastructure that unexpected or contentious? In light of current revelations, it may or may not be all that surprising. Surprising or not though, it is most definitely contentious!
pdknsk 12y ago
There was a long interview with Snowden posted recently, which didn't make it to the frontpage. I guess because of Snowden penalty on HN and Snowden fatigue. Anyway, he kept repeating a point which is quite easy to understand for the public I think. https://news.ycombinator.com/item?id=8859606 https://news.ycombinator.com/item?id=8859606 And the reality is when it comes to cyber conflicts [...], we have more to lose. We spend more on research and development than these other countries, so we shouldn’t be making the internet a more hostile, a more aggressive territory. We should be cooling down the tensions, making it a more trusted environment, making it a more secure environment, making it a more reliable environment, because that’s the foundation of our economy and our future. [...] The concept there is that there’s not much value to us attacking Chinese systems. We might take a few computers offline. We might take a factory offline. We might steal secrets from a university research programs, and even something high-tech. But how much more does the United States spend on research and development than China does? Defending ourselves from internet-based attacks, internet-originated attacks, is much, much more important than our ability to launch attacks against similar targets in foreign countries [...]. [...] When you look at the problem of the U.S. prioritizing offense over defense, imagine you have two bank vaults, the United States bank vault and the Bank of China. But the U.S. bank vault is completely full. It goes all the way up to the sky. And the Chinese bank vault or the Russian bank vault of the African bank vault or whoever the adversary of the day is, theirs is only half full or a quarter full or a tenth full. But the U.S. wants to get into their bank vault. So what they do is they build backdoors into every bank vault in the world. But the problem is their vault, the U.S. bank vault, has the same backdoor. So while we’re sneaking over to China and taking things out of their vault, they’re also sneaking over to the United States and taking things out of our vault. And the problem is, because our vault is full, we have so much more to lose. So in relative terms, we gain much less from breaking into the vaults of others than we do from having others break into our vaults.
- ed 12y ago
  There's no reason to pick Offense vs. Defense any more than there is Social Security vs. Education. It's just a question of budgeting. Why wouldn't we invest in both?
benstein 12y ago
How is this whistleblowing? What benefit do we as the public gain from this knowledge?
- deleted 12y ago
  [deleted]
- thomasahle 12y ago
  This hurts everybody in the world. Americans too.
- teamhappy 12y ago
  > What benefit do we as the public gain from this knowledge? I'm from the EU, but I can imagine that, given that some of the NSA's operations today are only semi-constitutional, where these operations are supposed to be going is relevant to the debate.
- moe 12y ago
  I would ask the other way round. Why should this knowledge be hidden from the public?
  - EpicEng 12y ago
    The obvious answer is that it becomes much harder for the NSA (and related entities) to do their job when their tactics and capabilities are known to the world. And yes, this is their job, and there's nothing wrong with it. Domestic spying is something that needs to be reigned in and tightly controlled, but to think that everyone should know everything is just naive and shows little understanding of how the real world actually operates.
    - moe 12y ago
      The obvious answer is that it becomes much harder for the NSA (and related entities) to do their job when their tactics and capabilities are known to the world. Harder as in how? That handwavy excuse gets thrown around a lot, I have yet to hear someone back it up with anything tangible. Domestic spying is something that needs to be reigned in and tightly controlled Well, we tried with blind faith for a while. Turns out that didn't work all too well. So, how do you propose we control something that we are not allowed to know anything about?
ajcarpy2005 12y ago
How should NSA spying figure into the public's view of Obama's efforts to help municipalities build out competitively priced broadband networks?
- stefantalpalaru 12y ago
  Add some legal pot and it will all be forgiven and forgotten.
fidotron 12y ago
To be fair here, the NSA should very well be doing these things, for the purpose of attacking other states. The reason is very clear as the Russian attacks on Estonia ( https://en.wikipedia.org/wiki/2007_cyberattacks_on_Estonia https://en.wikipedia.org/wiki/2007_cyberattacks_on_Estonia ) demonstrate a clear need for defensive capability in this area, and where you have defence you end up needing offence. This persistent confusion between legitimate NSA operations such as preparing to intercept communications of foreign governments and illegitimate such as mass slurping of everyone's email merely serves to discredit the entire privacy defending position, and in the long run will just play into the hands of those that want to read everyone's email for nefarious purposes.
- Afforess 12y ago
  Agreed. I think the Snowden revelations have harmed the NSA's reputation to the point where most people on HN just assume NSA is a bond-level villain. The NSA serves a purpose, they are meant to be prepared offensively and defensively for the USA's security, which includes the internet. I have no problems with the NSA's purpose and would prefer they continue to exist and prepare against threats to the country. I do believe the NSA overstepped their mandate in domestic surveillance, and should be held accountable, but let's not forget that this world does have bad guy's - plenty of nations would lose no sleep at night if they hurt America.
  - sroerick 12y ago
    The article addresses this very point. It specifically explores the conflict of interest that the NSA must work both offensively and defensively. It makes the argument that the balance has shifted so drastically to the offensive that our defensive is being weakened.
    - iwwr 12y ago
      What the article fails to mention is the NSA's instrumental efforts in weakening crypto standards and computer security in general. We don't know the extent of that undermining yet, but it's likely significant. They are also hoarding security vulnerabilities and not releasing them, as responsible researchers should. They're weakening security for everyone. Now, the US government as a whole is in a very strong position to actually push for genuine security compliance and to ultimately defend against even the most determined state cyber warfare initiative. They haven't done that because they want a way to get into systems even if it makes people less safe on the whole.
tosser002 12y ago
I can understand the support of Snowden for blowing the whistle on domestic spying, but how is this defensible?
- tlear 12y ago
  It does not. This stuff gives argument that Snowden went over to FSB long time ago and that the whole thing is a Russian op a lot more weight.
  - username 12y ago
    No, it doesn't. Snowden isn't the one who's been releasing these documents; the journalists are. For your claim to make any sense, you'd have to believe Der Spiegel is secretly working for the Russians.
    - tlear 12y ago
      They can disclose it because they were given it. Do you think he did not know this will get published sooner or later? Also depth of Russian penetration of security services and media in Europe.. in many places it is quite complete. It would not actually be surprising at all if Spiegel had someone working for FSB/GRU. Having said that it is not 100% certainty. If he was not turned before the disclosures then US whistleblower witchhunt that drove him into arms of FSB is even worse because he really had no choice once US started hunting him.
  - hobs 12y ago
    Did Snowden go to his superiors about the program? Did anyone care? If the Russians wanted to steal our information why not just steal the information? They have many of the secrets Snowden talked about already (via their own intelligence agencies, Russia is no slouch) and could publicize them if they wanted to, or release them anonymously and pretend it was some hackers on steroids. It just doesnt hang together that Snowden is a spy for me, whether or not you approve of what he did.
    - 12y ago
Animats 12y ago
Everything at the lowest levels needs to be tightened up now. Buffer overflows in trusted code have to go. This means getting rid of the languages with buffer overflow problems. Mostly C and C++. Fortunately we have Go and Rust, plus all the semi-interpreted languages, now, and can do it. We need something that runs Docker-like containers and, all the way down the bare metal, has no unsafe code. We need dumber server boards, with BIOS and NIC code that's simpler and well-understood. The big cloud companies, Amazon, Facebook, and Google are already doing their own server boards. Companies which put in "backdoors" should face felony criminal prosecution. That doesn't happen by accident. Latest CERT advisory: "Vulnerability Note VU#936356 Ceragon FiberAir IP-10 Microwave Bridge contains a hard-coded root password ... Ceragon FiberAir IP-10 Microwave Bridges contain an undocumented default root password. The root account can be accessed through ssh, telnet, command line interface, or via HTTP. ... CERT/CC has attempted to contact the vendor prior to publication without success." All Ceragon customers should demand their money back, and their products should be seized at US customs as supporting terrorism.
- saryant 12y ago
  The chair of the computer science department at my university liked to say that CS could just as easily be considered the Computer Security department. This guy wasn't a pragmatic programmer whatsoever, he always claimed he didn't even know how to code (he was a theory guy), but he was right.
- dmix 12y ago
  > Buffer overflows in trusted code have to go. This means getting rid of the languages with buffer overflow problems. In the meantime, since moving away from C will take years, we need to invest in better exploit-mitigation technology instead of relying on bug-hunting-driven-security. That means OS/kernel developers need to start taking security seriously and keeping up with attackers. This means adding proactive measures instead of slowly reacting only when a new CVE comes out. Which sadly far from the reality at the moment. For example, OpenBSD made headlines for adding W^X to the whole kernel but hackers have already been bypassing W^X on iOS for years: http://bsd.slashdot.org/comments.pl?sid=6723643&cid=48812833 http://bsd.slashdot.org/comments.pl?sid=6723643&cid=48812833 >> These protections may guard against a (very small subset of) casual attackers, but they're just another minor hurdle for determined attackers. In addition we need to move away from signature-based AV towards host-based intrusion detection systems (HIDS). It is not accident that all the feds who left government cybersecurity jobs in recent years moved to build private companies creating HIDS products and making millions selling them to big corps (FireEye, Crowdstrike, etc). The only options available for consumers and the average sys admin are security tools easily bypassed by any semi-sophisticated adversary (for ex: Anti-virus/RKhunter/SELinux/most trusted computing code-integrity systems/etc).
pa7ch 12y ago
Looking at the comments in support of the NSA here makes me suspect an astroturfing campaign is happening. Edit: I should add that my suspicion came from noticing that the vast majority of the comments when this was first posted seemed aligned in favor of the NSA's mission. It wasn't the presence of pro-NSA comments that was interesting but rather that these opinions were the overwhelming majority. This is, of course, how astroturfing becomes effective, it is not the rhetoric that is important but the cognitive bias imparted by the facade of so many people falling to one side of an issue. This is of course, only a suspicion, but it seemed worth noting.
- sroerick 12y ago
  Hacker News is quite astroturfed. Every web forum is.
  - omphalos 12y ago
    One approach to countering sock-puppetry as a general problem is with increased transparency. Personally, I think lobste.rs' notion of a user tree is a step in the right direction: https://lobste.rs/u https://lobste.rs/u
    - sroerick 12y ago
      Very interesting. I like that a lot. However I'm not sure it would ever work with an open forum. Invite only is awesome, but open forums are important too.
    - mikegioia 12y ago
      Do you have an account there? I would love to get an invite if so, that site looks really cool.
      - alecco 12y ago
        The introduction tree is a great idea. But lobsters community is junk. If you dare have an opinion against their hivemind you get donwvoted to oblivion. It's like a clique took over. Reddit had a similar problem with truthers taking over discourse at the beginning, luckily it went away. Perhaps because there was a popular parody account mocking them all the time (something like 9_11_was_an_inside_job), and that account retired in time when it's job was done.
zmanian 12y ago
There are a number of objectionable elements to the NSA foreign operations. - Mass surveillance of all humans is objectionable on human rights terms. - Attacks on civilian infrastructure. The NSA is executing military operations against civilian infrastructure even in NATO countries. It isn't conventional foreign policy or warfare for a military agency to be actively and continuously attack the civilian cultural and economic infrastructure in preparation for war.
- yourad_io 12y ago
  Attacking the economic infrastructure in preparation of War has been the US' m.o. since at least the 50's. Economic Hitmen, and what-not.
  - higherpurpose 12y ago
    Of all countries? I doubt that. Many people don't seem to realize the scope is the main problem here, and they are equating spying on one person in targetted surveillance, with spying on 4 billion people and saying "NSA has already been doing that!". No they haven't. So stop confusing the message. Another big problem is that NSA has started undermining crypto. Before 2001 you could maybe actually trust NSA that they're releasing crypto that is safe because you thought they actually have an interest in "security". Not anymore. Anything and everything NSA has touched now has to be considered corrupt.
UhUhUhUh 12y ago
There is also this very American reassuring belief that quantity will somehow take you to quality.
lawnchair_larry 12y ago
Here's a story for you. I'm not a party to any of this. I've done nothing wrong, I've never been suspected of doing anything wrong, and I don't know anyone who has done anything wrong. I don't even mean that in the sense of "I pissed off the wrong people but technically haven't been charged." I mean that I am a vanilla, average, 9-5 working man of no interest to anybody. My geographical location is an accident of my birth. Even still, I wasn't accidentally born in a high-conflict area, and my government is not at war. I'm a sysadmin at a legitimate ISP and my job is to keep the internet up and running smoothly. This agency has stalked me in my personal life, undermined my ability to trust my friends attempting to connect with me on LinkedIn, and infected my family's computer. They did this because they wanted to bypass legal channels and spy on a customer who pays for services from my employer. Wait, no, they wanted the ability to potentially spy on future customers. Actually, that is still not accurate - they wanted to spy on everybody in case there was a potentially bad person interacting with a customer. After seeing their complete disregard for anybody else, their immense resources, and their extremely sophisticated exploits and backdoors - knowing they will stop at nothing, and knowing that I was personally targeted - I'll be damned if I can ever trust any electronic device I own ever again. You all rationalize this by telling me that it "isn't surprising", and that I don't live in the [USA,UK] and therefore I have no rights. I just have one question. Are you people even human? [1]https://firstlook.org/theintercept/2014/09/14/nsa-stellar/ https://firstlook.org/theintercept/2014/09/14/nsa-stellar/ [2]https://firstlook.org/theintercept/2014/12/13/belgacom-hack-gchq-inside-story/ https://firstlook.org/theintercept/2014/12/13/belgacom-hack-...
- deleted 12y ago
  [deleted]
- alecco 12y ago
  Indeed, Obama and US congress made it clear we foreign people are just fair game for targeting. At least I'm lucky not to live in a country where targeted assassinations are going on. Also, it's pretty obvious terrorism is an excuse. The main reason is power and control. Corporate espionage and controlling US-unfriendly political movements is very likely the main goal.
godgod 12y ago
Only the US GOVT TAO can hack. Everyone else is a terrorist. You are a target for surveillance if you use any form of encryption. We are living in 1984!
jakeogh 12y ago
The premise that we need "beneolvient power" to "protect us" from "evil doers" is the oldest trick in the book. If there is no threat, one will be generated. Almost organically, it does not even take overt orginization. The players know cui bono.
- xnull2guest 12y ago
  She has abstained from interference in the concerns of others, even when the conflict has been for principles to which she clings, as to the last vital drop that visits the heart. She has seen that probably for centuries to come, all the contests of that Aceldama, the European World, will be contests between inveterate power, and emerging right. Wherever the standard of freedom and independence has been or shall be unfurled, there will her heart, her benedictions and her prayers be. But she goes not abroad in search of monsters to destroy. She is the well-wisher to the freedom and independence of all. She is the champion and vindicator only of her own. She will recommend the general cause, by the countenance of her voice, and the benignant sympathy of her example. - John Quincy Adams It was until recently (the early 1900s) that the policy of the United States to stay entirely out of any foreign affairs other than her own. It was acknowledged that America could spread her virtues and values by being the paragon example of them as inspiration to others to follow suit. Today she holds the opposite view - that it is her unquestioned duty and obligation to interfere everywhere with the justification and rationalization that she seeks justice - and that discarding some of these principles for her own people is necessary for this noble mission.
  - Rapzid 12y ago
    It's kinda odd that our politicians in the past used to be, for lack of better words, poets. I have often wondered about this and wondered what has happened.
    - xnull1guest 12y ago
      This is sort of off topic, but it is amusing. I would guess that it is a combination of: - A deemphasis of poetry and literary studies in the concept of being educated and cultured - The rise of writing staff and PR professionals in the practice of engaging with the public - The relative lack of importance writing has today compared to newer picture and video delivery (media is message, etc) - Inherited nostalgia for forms associated with 'classic' art styles
SCHiM 12y ago
One thing to be said about the offence vs defence side of this story is that the adage the best defence is a good offence definitively applies here. It's so much easier to attack another system than defend your own. It's inherent to the way systems are set up: A computer system has many services, programs and tasks running on it. Only one of these needs to contain a flaw for a system to be vulnerable, obviously this means that on a secure system everything must be perfect, for 1 flaw compromises everything. Therefore I don't find it strange that the NSA allocates the resources it does to research and expand it's offensive capabilities, since trying to defend the systems of the US is probably a lost cause. The question remains if this is ethical and/or legitimate. Being a non us-citizen I'm certainly opposed to the practises of weakening standards and harvesting/exploiting services on the internet. I also find the double-speak of the US government deplorable, on the one hand we have the government declaring that in many ways a cyber-attack will, and can, be reacted upon as if it were a conventional attack. And on the other hand we have the US government attacking and targeting civilians (Belgacom Sysadmins). I fail to see how attacks against the US can be labelled as a conventional attack, but that attacks from the US against civilians are apparently OK.
squozzer 12y ago
I won't pretend to know what's going on here or its implications. So far humanity has lucked out considering our capacity for building some pretty nasty weaponry. We'll probably go through a series of cyberwars before we come to our senses. I don't blame the NSA for trying to be ready to fight a cyberwar. Other nations probably wouldn't stop their programs even if the US did. Our culture isn't the only one infected with a sense of Manifest Destiny. Where we might consider drawing the line begins with necessity. Deciding which actions are necessary and which are gratuitous might prove difficult, assuming we even know, which is why I find it hard to fault Snowden for leaking this information. As fearsome as the NSA sounds, certainly they have some limits. For instance, why don't they just clean out everyone's bank accounts? Might pay their bills for a few days anyway. But why haven't they gone after certain criminals? Many shady operations keep their money in jurisdictions that probably can't compete with our cyberwar capabilities. Maybe these operations enjoy the protection of a powerful entity but probably not all of them do. And probably many operations still use cash and couriers but the US and others seem to have gotten better at tracking movements of people so it's doubtful such tactics will remain viable forever. Maybe in the end we have to somehow conquer the notion of distrust. Not sure how it can be done except through telepathy and even then the transition to a telepathic society will probably be full of misery.
Briguy2k 12y ago
Speaking as a citizen, the problem with the US's newest brand of digital weapons, is that they can be used on US population under the radar and w/o killing anyone. This may justify legally their extended use for surveillance unfortunately. The development of the atom bomb and chemical weapons had no "convenient" use on the USs own citizens, and they clearly couldn't get away with it. However, these weapons do, and they are being developed with all the same force, purpose, and financial backing as the a-bomb and chemical weapons were ~100 years ago.
- JoachimS 12y ago
  Not only could use. These weapons are built using either weaknesses introduced into civilian domestic systems, or found in domestic civilian systems and not fixed. This means that the basic premise for this weapons created to protect US citizens is to weaken their security.
deleted 12y ago
[deleted]
thefreeman 12y ago
The NSA should just leak documents showing all of the other governments doing this stuff so we can move on from the Anti US/UK circle jerk. Seriously if you think your government hasn't invested serious time and money in digital subterfuge you are living in a dream world and need to wake up.
- ramrunner800 12y ago
  This.
- woah 12y ago
  Classic straw man. Many of the documents leaked have shown that our allies are doing the same, usually with the NSA's help. Of non U.S. allies most countries are too small to have serious programs, or are plainly doing much worse. I suppose this is some sort of perverse defense of the NSA, but the fact is that luckily most people would like to hold their government to a higher standard, instead of saying "the other guys are worse". If more people had had your attitude a few hundred years ago, we wouldn't even have democracy, as there would have been plenty more brutal and totalitarian regimes to point to.
  - deleted 12y ago
    [deleted]
tete 12y ago
What I find really frightening is where they write: From a military perspective, surveillance of the Internet is merely "Phase 0" in the US digital war strategy. [...] This enables them to "control/destroy critical systems & networks at will through pre-positioned accesses (laid in Phase 0)." Critical infrastructure is considered by the agency to be anything that is important in keeping a society running: energy, communications and transportation. The internal documents state that the ultimate goal is "real time controlled escalation". This isn't about fighting terrorism. It's also not about the usual warfare it's more like the infrastructure or a set of tools to control nearly every other country or the planet or at least make sure that the US will always be able to keep them from disagreeing.
qatester 12y ago
For me the only bunch of people who wants and loves to start war is USA government, note I am not saying americans, I am saying US government. Why should you prepare if you dont have intention of war? "defense", from whom? from people where you started war? directly with Afghanistan, Iraq and some others, indirectly with Syria, even with Russia (started economically) and many others where they got governments with bribes. Now preparing for D war. Every war started with flag of "Demo hypocracy", defense and some other pseudo defensive words, reality is USA starts war and government fuckingly loves when people die. Probably you are going to downvote, thats because you didnt lost any of your brother, sister or even relatives and friends in such wars which just started because they wanted more oil and more money.
junto 12y ago
I'm pretty late to the party here but there are some fascinating parallels between the USG's actions in the physical world, as in the digital one. First to USG has made a concerted and successful attempts to place secret digital strongholds and black sites across the globe, including some 'behind the enemy lines' so to speak. In the physical world these are the equivalent to CIA black sites and safe houses, from which you can attack and spy on the enemy, feed in extra weaponry to partisans and rebels (similar to the CIA Benghazi compound, sorry 'consulate', sorry 'embassy'. The NSA has all these smart dangerous and arguably immoral minds employed to defend the digital borders of the US. But in truth these minds are busier establishing secret pathways through the digital trenchlines in order to have a definive and effective advantage when the cyberwar comes (which of course they are actively encouraging to validate their position, historical actions and future funding). At the same time they are making a concerted effort to make sure that the security protocols everyone uses are undermined and backdoored. In effect they are making sure that the digital nuclear weapons held by their enemies aren't going to get in the air when the time comes. Through strong encryption we could make sure that we have the digital equivalent of mutually assured security, but as ever the US isn't interested in this, because the reality is that the military industrial compound aims to make billions of dollars from the industry. In a world where all communications and hardware devices were secure, they wouldn't make any money. A secure, stable and safe world just isn't profitable.
kgarten 12y ago
seems to me a lot of people flaged the story (443 points, 1 day ago, on page 3 with a couple of stories with 200 points also 1 day ago) ... wondering why conspiracy theories ;)

463 points by zmanian 12y ago

At best this seems like an arms race but at worst, there are actually battles being fought (of a kind). I wonder what the digital equivalent of a nuke would be such that govts decide that diplomacy is better. Some kind of Digitally Affected Mutual Destruction (DAMD).

ancarda 12y ago

> the only law that applies is the survival of the fittest. Is this such a problem? In a world where exploits are used to break infrastructure, isn't the best solution simply to build increasingly more secure code? If that won't solve the problem I don't know if legislation will. Right now a determined hacker can harm a company via the internet (e.g. Sony). Are laws really going to stop that from happening? If not, please correct me. I know little about cyber warfare and would love to know more.

dthal 12y ago
I think you are exactly right. Any solutions to this have to be technical and largely defensive. Legal or diplomatic solutions will only bind parties that intend to follow the law. Counter-attacking and deterrence will fail if the attacker is not defending much of anything, so that approach might work against states and state-backed actors, but not against non-state actors.
- allendoerfer 12y ago
  > Legal or diplomatic solutions will only bind parties that intend to follow the law. Simple rule of thumb: This argument is always false. Our society is too complex. It is never about good guys vs. bad guys. It is mostly about money, who has the most and how laws can change incentives and prices. It is the same with drugs, guns, atomic bombs and nearly every other topic were this argument is brought up. We need to get over this because it is just slowing us down.
CaveTech 12y ago
Legislature can't prevent bad people from doing bad things. But it can prevent good people from doing bad or ignorant things, and it provides a framework to punish those who cause harm. Every law can and does get broken, but that doesn't mean laws are useless.
- throwaway349823 12y ago
  There are other ways to have an impact with laws than punish the aggressor. Airplanes aren't safe because the pilot or mechanic gets punished when something happens, it's because (very simplified) the airlines and manufacturers do.

jacquesm 12y ago

Judging by the scope of the attack on Belgacom in 2011 that battle is already underway, the surprise I guess should be that it is the allies attacking each other. If China or North Korea would have made an attack like this it would be trumpeted as an act of war, but because it is the UK with NSA assistance it's downplayed as much as possible.

stickhandle 12y ago

The last 2 articles I read were this one and the earlier piece on Google and neural nets [1]. It's easy to connect the two, add the pervasive integration of technology in our lives, mix in a healthy dose of paranoia --> see a SkyNet future. [1]https://medium.com/backchannel/google-search-will-be-your-next-brain-5207c26e4523 https://medium.com/backchannel/google-search-will-be-your-ne...

philip1209 12y ago

Domestic surveillance was controversial and surprising. Is a spy agency preparing ways to attack and cripple foreign infrastructure that unexpected or contentious?

Cakez0r 12y ago
> Is a spy agency preparing ways to attack and cripple foreign infrastructure that unexpected or contentious? In light of current revelations, it may or may not be all that surprising. Surprising or not though, it is most definitely contentious!

pdknsk 12y ago

There was a long interview with Snowden posted recently, which didn't make it to the frontpage. I guess because of Snowden penalty on HN and Snowden fatigue. Anyway, he kept repeating a point which is quite easy to understand for the public I think. https://news.ycombinator.com/item?id=8859606 https://news.ycombinator.com/item?id=8859606 And the reality is when it comes to cyber conflicts [...], we have more to lose. We spend more on research and development than these other countries, so we shouldn’t be making the internet a more hostile, a more aggressive territory. We should be cooling down the tensions, making it a more trusted environment, making it a more secure environment, making it a more reliable environment, because that’s the foundation of our economy and our future. [...] The concept there is that there’s not much value to us attacking Chinese systems. We might take a few computers offline. We might take a factory offline. We might steal secrets from a university research programs, and even something high-tech. But how much more does the United States spend on research and development than China does? Defending ourselves from internet-based attacks, internet-originated attacks, is much, much more important than our ability to launch attacks against similar targets in foreign countries [...]. [...] When you look at the problem of the U.S. prioritizing offense over defense, imagine you have two bank vaults, the United States bank vault and the Bank of China. But the U.S. bank vault is completely full. It goes all the way up to the sky. And the Chinese bank vault or the Russian bank vault of the African bank vault or whoever the adversary of the day is, theirs is only half full or a quarter full or a tenth full. But the U.S. wants to get into their bank vault. So what they do is they build backdoors into every bank vault in the world. But the problem is their vault, the U.S. bank vault, has the same backdoor. So while we’re sneaking over to China and taking things out of their vault, they’re also sneaking over to the United States and taking things out of our vault. And the problem is, because our vault is full, we have so much more to lose. So in relative terms, we gain much less from breaking into the vaults of others than we do from having others break into our vaults.

ed 12y ago
There's no reason to pick Offense vs. Defense any more than there is Social Security vs. Education. It's just a question of budgeting. Why wouldn't we invest in both?

benstein 12y ago

How is this whistleblowing? What benefit do we as the public gain from this knowledge?

deleted 12y ago
[deleted]
thomasahle 12y ago
This hurts everybody in the world. Americans too.
teamhappy 12y ago
> What benefit do we as the public gain from this knowledge? I'm from the EU, but I can imagine that, given that some of the NSA's operations today are only semi-constitutional, where these operations are supposed to be going is relevant to the debate.
moe 12y ago
I would ask the other way round. Why should this knowledge be hidden from the public?
- EpicEng 12y ago
  The obvious answer is that it becomes much harder for the NSA (and related entities) to do their job when their tactics and capabilities are known to the world. And yes, this is their job, and there's nothing wrong with it. Domestic spying is something that needs to be reigned in and tightly controlled, but to think that everyone should know everything is just naive and shows little understanding of how the real world actually operates.
  - moe 12y ago
    The obvious answer is that it becomes much harder for the NSA (and related entities) to do their job when their tactics and capabilities are known to the world. Harder as in how? That handwavy excuse gets thrown around a lot, I have yet to hear someone back it up with anything tangible. Domestic spying is something that needs to be reigned in and tightly controlled Well, we tried with blind faith for a while. Turns out that didn't work all too well. So, how do you propose we control something that we are not allowed to know anything about?

ajcarpy2005 12y ago

How should NSA spying figure into the public's view of Obama's efforts to help municipalities build out competitively priced broadband networks?

stefantalpalaru 12y ago
Add some legal pot and it will all be forgiven and forgotten.

fidotron 12y ago

To be fair here, the NSA should very well be doing these things, for the purpose of attacking other states. The reason is very clear as the Russian attacks on Estonia ( https://en.wikipedia.org/wiki/2007_cyberattacks_on_Estonia https://en.wikipedia.org/wiki/2007_cyberattacks_on_Estonia ) demonstrate a clear need for defensive capability in this area, and where you have defence you end up needing offence. This persistent confusion between legitimate NSA operations such as preparing to intercept communications of foreign governments and illegitimate such as mass slurping of everyone's email merely serves to discredit the entire privacy defending position, and in the long run will just play into the hands of those that want to read everyone's email for nefarious purposes.

Afforess 12y ago
Agreed. I think the Snowden revelations have harmed the NSA's reputation to the point where most people on HN just assume NSA is a bond-level villain. The NSA serves a purpose, they are meant to be prepared offensively and defensively for the USA's security, which includes the internet. I have no problems with the NSA's purpose and would prefer they continue to exist and prepare against threats to the country. I do believe the NSA overstepped their mandate in domestic surveillance, and should be held accountable, but let's not forget that this world does have bad guy's - plenty of nations would lose no sleep at night if they hurt America.
- sroerick 12y ago
  The article addresses this very point. It specifically explores the conflict of interest that the NSA must work both offensively and defensively. It makes the argument that the balance has shifted so drastically to the offensive that our defensive is being weakened.
  - iwwr 12y ago
    What the article fails to mention is the NSA's instrumental efforts in weakening crypto standards and computer security in general. We don't know the extent of that undermining yet, but it's likely significant. They are also hoarding security vulnerabilities and not releasing them, as responsible researchers should. They're weakening security for everyone. Now, the US government as a whole is in a very strong position to actually push for genuine security compliance and to ultimately defend against even the most determined state cyber warfare initiative. They haven't done that because they want a way to get into systems even if it makes people less safe on the whole.

tosser002 12y ago

I can understand the support of Snowden for blowing the whistle on domestic spying, but how is this defensible?

tlear 12y ago
It does not. This stuff gives argument that Snowden went over to FSB long time ago and that the whole thing is a Russian op a lot more weight.
- username 12y ago
  No, it doesn't. Snowden isn't the one who's been releasing these documents; the journalists are. For your claim to make any sense, you'd have to believe Der Spiegel is secretly working for the Russians.
  - tlear 12y ago
    They can disclose it because they were given it. Do you think he did not know this will get published sooner or later? Also depth of Russian penetration of security services and media in Europe.. in many places it is quite complete. It would not actually be surprising at all if Spiegel had someone working for FSB/GRU. Having said that it is not 100% certainty. If he was not turned before the disclosures then US whistleblower witchhunt that drove him into arms of FSB is even worse because he really had no choice once US started hunting him.
- hobs 12y ago
  Did Snowden go to his superiors about the program? Did anyone care? If the Russians wanted to steal our information why not just steal the information? They have many of the secrets Snowden talked about already (via their own intelligence agencies, Russia is no slouch) and could publicize them if they wanted to, or release them anonymously and pretend it was some hackers on steroids. It just doesnt hang together that Snowden is a spy for me, whether or not you approve of what he did.
  - 12y ago

Animats 12y ago

Everything at the lowest levels needs to be tightened up now. Buffer overflows in trusted code have to go. This means getting rid of the languages with buffer overflow problems. Mostly C and C++. Fortunately we have Go and Rust, plus all the semi-interpreted languages, now, and can do it. We need something that runs Docker-like containers and, all the way down the bare metal, has no unsafe code. We need dumber server boards, with BIOS and NIC code that's simpler and well-understood. The big cloud companies, Amazon, Facebook, and Google are already doing their own server boards. Companies which put in "backdoors" should face felony criminal prosecution. That doesn't happen by accident. Latest CERT advisory: "Vulnerability Note VU#936356 Ceragon FiberAir IP-10 Microwave Bridge contains a hard-coded root password ... Ceragon FiberAir IP-10 Microwave Bridges contain an undocumented default root password. The root account can be accessed through ssh, telnet, command line interface, or via HTTP. ... CERT/CC has attempted to contact the vendor prior to publication without success." All Ceragon customers should demand their money back, and their products should be seized at US customs as supporting terrorism.

saryant 12y ago
The chair of the computer science department at my university liked to say that CS could just as easily be considered the Computer Security department. This guy wasn't a pragmatic programmer whatsoever, he always claimed he didn't even know how to code (he was a theory guy), but he was right.
dmix 12y ago
> Buffer overflows in trusted code have to go. This means getting rid of the languages with buffer overflow problems. In the meantime, since moving away from C will take years, we need to invest in better exploit-mitigation technology instead of relying on bug-hunting-driven-security. That means OS/kernel developers need to start taking security seriously and keeping up with attackers. This means adding proactive measures instead of slowly reacting only when a new CVE comes out. Which sadly far from the reality at the moment. For example, OpenBSD made headlines for adding W^X to the whole kernel but hackers have already been bypassing W^X on iOS for years: http://bsd.slashdot.org/comments.pl?sid=6723643&cid=48812833 http://bsd.slashdot.org/comments.pl?sid=6723643&cid=48812833 >> These protections may guard against a (very small subset of) casual attackers, but they're just another minor hurdle for determined attackers. In addition we need to move away from signature-based AV towards host-based intrusion detection systems (HIDS). It is not accident that all the feds who left government cybersecurity jobs in recent years moved to build private companies creating HIDS products and making millions selling them to big corps (FireEye, Crowdstrike, etc). The only options available for consumers and the average sys admin are security tools easily bypassed by any semi-sophisticated adversary (for ex: Anti-virus/RKhunter/SELinux/most trusted computing code-integrity systems/etc).

pa7ch 12y ago

Looking at the comments in support of the NSA here makes me suspect an astroturfing campaign is happening. Edit: I should add that my suspicion came from noticing that the vast majority of the comments when this was first posted seemed aligned in favor of the NSA's mission. It wasn't the presence of pro-NSA comments that was interesting but rather that these opinions were the overwhelming majority. This is, of course, how astroturfing becomes effective, it is not the rhetoric that is important but the cognitive bias imparted by the facade of so many people falling to one side of an issue. This is of course, only a suspicion, but it seemed worth noting.

sroerick 12y ago
Hacker News is quite astroturfed. Every web forum is.
- omphalos 12y ago
  One approach to countering sock-puppetry as a general problem is with increased transparency. Personally, I think lobste.rs' notion of a user tree is a step in the right direction: https://lobste.rs/u https://lobste.rs/u
  - sroerick 12y ago
    Very interesting. I like that a lot. However I'm not sure it would ever work with an open forum. Invite only is awesome, but open forums are important too.
  - mikegioia 12y ago
    Do you have an account there? I would love to get an invite if so, that site looks really cool.
    - alecco 12y ago
      The introduction tree is a great idea. But lobsters community is junk. If you dare have an opinion against their hivemind you get donwvoted to oblivion. It's like a clique took over. Reddit had a similar problem with truthers taking over discourse at the beginning, luckily it went away. Perhaps because there was a popular parody account mocking them all the time (something like 9_11_was_an_inside_job), and that account retired in time when it's job was done.

zmanian 12y ago

There are a number of objectionable elements to the NSA foreign operations. - Mass surveillance of all humans is objectionable on human rights terms. - Attacks on civilian infrastructure. The NSA is executing military operations against civilian infrastructure even in NATO countries. It isn't conventional foreign policy or warfare for a military agency to be actively and continuously attack the civilian cultural and economic infrastructure in preparation for war.

yourad_io 12y ago
Attacking the economic infrastructure in preparation of War has been the US' m.o. since at least the 50's. Economic Hitmen, and what-not.
- higherpurpose 12y ago
  Of all countries? I doubt that. Many people don't seem to realize the scope is the main problem here, and they are equating spying on one person in targetted surveillance, with spying on 4 billion people and saying "NSA has already been doing that!". No they haven't. So stop confusing the message. Another big problem is that NSA has started undermining crypto. Before 2001 you could maybe actually trust NSA that they're releasing crypto that is safe because you thought they actually have an interest in "security". Not anymore. Anything and everything NSA has touched now has to be considered corrupt.

UhUhUhUh 12y ago

There is also this very American reassuring belief that quantity will somehow take you to quality.

lawnchair_larry 12y ago

Here's a story for you. I'm not a party to any of this. I've done nothing wrong, I've never been suspected of doing anything wrong, and I don't know anyone who has done anything wrong. I don't even mean that in the sense of "I pissed off the wrong people but technically haven't been charged." I mean that I am a vanilla, average, 9-5 working man of no interest to anybody. My geographical location is an accident of my birth. Even still, I wasn't accidentally born in a high-conflict area, and my government is not at war. I'm a sysadmin at a legitimate ISP and my job is to keep the internet up and running smoothly. This agency has stalked me in my personal life, undermined my ability to trust my friends attempting to connect with me on LinkedIn, and infected my family's computer. They did this because they wanted to bypass legal channels and spy on a customer who pays for services from my employer. Wait, no, they wanted the ability to potentially spy on future customers. Actually, that is still not accurate - they wanted to spy on everybody in case there was a potentially bad person interacting with a customer. After seeing their complete disregard for anybody else, their immense resources, and their extremely sophisticated exploits and backdoors - knowing they will stop at nothing, and knowing that I was personally targeted - I'll be damned if I can ever trust any electronic device I own ever again. You all rationalize this by telling me that it "isn't surprising", and that I don't live in the [USA,UK] and therefore I have no rights. I just have one question. Are you people even human? [1]https://firstlook.org/theintercept/2014/09/14/nsa-stellar/ https://firstlook.org/theintercept/2014/09/14/nsa-stellar/ [2]https://firstlook.org/theintercept/2014/12/13/belgacom-hack-gchq-inside-story/ https://firstlook.org/theintercept/2014/12/13/belgacom-hack-...

deleted 12y ago
[deleted]
alecco 12y ago
Indeed, Obama and US congress made it clear we foreign people are just fair game for targeting. At least I'm lucky not to live in a country where targeted assassinations are going on. Also, it's pretty obvious terrorism is an excuse. The main reason is power and control. Corporate espionage and controlling US-unfriendly political movements is very likely the main goal.

godgod 12y ago

Only the US GOVT TAO can hack. Everyone else is a terrorist. You are a target for surveillance if you use any form of encryption. We are living in 1984!

jakeogh 12y ago

The premise that we need "beneolvient power" to "protect us" from "evil doers" is the oldest trick in the book. If there is no threat, one will be generated. Almost organically, it does not even take overt orginization. The players know cui bono.

xnull2guest 12y ago
She has abstained from interference in the concerns of others, even when the conflict has been for principles to which she clings, as to the last vital drop that visits the heart. She has seen that probably for centuries to come, all the contests of that Aceldama, the European World, will be contests between inveterate power, and emerging right. Wherever the standard of freedom and independence has been or shall be unfurled, there will her heart, her benedictions and her prayers be. But she goes not abroad in search of monsters to destroy. She is the well-wisher to the freedom and independence of all. She is the champion and vindicator only of her own. She will recommend the general cause, by the countenance of her voice, and the benignant sympathy of her example. - John Quincy Adams It was until recently (the early 1900s) that the policy of the United States to stay entirely out of any foreign affairs other than her own. It was acknowledged that America could spread her virtues and values by being the paragon example of them as inspiration to others to follow suit. Today she holds the opposite view - that it is her unquestioned duty and obligation to interfere everywhere with the justification and rationalization that she seeks justice - and that discarding some of these principles for her own people is necessary for this noble mission.
- Rapzid 12y ago
  It's kinda odd that our politicians in the past used to be, for lack of better words, poets. I have often wondered about this and wondered what has happened.
  - xnull1guest 12y ago
    This is sort of off topic, but it is amusing. I would guess that it is a combination of: - A deemphasis of poetry and literary studies in the concept of being educated and cultured - The rise of writing staff and PR professionals in the practice of engaging with the public - The relative lack of importance writing has today compared to newer picture and video delivery (media is message, etc) - Inherited nostalgia for forms associated with 'classic' art styles

SCHiM 12y ago

One thing to be said about the offence vs defence side of this story is that the adage the best defence is a good offence definitively applies here. It's so much easier to attack another system than defend your own. It's inherent to the way systems are set up: A computer system has many services, programs and tasks running on it. Only one of these needs to contain a flaw for a system to be vulnerable, obviously this means that on a secure system everything must be perfect, for 1 flaw compromises everything. Therefore I don't find it strange that the NSA allocates the resources it does to research and expand it's offensive capabilities, since trying to defend the systems of the US is probably a lost cause. The question remains if this is ethical and/or legitimate. Being a non us-citizen I'm certainly opposed to the practises of weakening standards and harvesting/exploiting services on the internet. I also find the double-speak of the US government deplorable, on the one hand we have the government declaring that in many ways a cyber-attack will, and can, be reacted upon as if it were a conventional attack. And on the other hand we have the US government attacking and targeting civilians (Belgacom Sysadmins). I fail to see how attacks against the US can be labelled as a conventional attack, but that attacks from the US against civilians are apparently OK.

squozzer 12y ago

I won't pretend to know what's going on here or its implications. So far humanity has lucked out considering our capacity for building some pretty nasty weaponry. We'll probably go through a series of cyberwars before we come to our senses. I don't blame the NSA for trying to be ready to fight a cyberwar. Other nations probably wouldn't stop their programs even if the US did. Our culture isn't the only one infected with a sense of Manifest Destiny. Where we might consider drawing the line begins with necessity. Deciding which actions are necessary and which are gratuitous might prove difficult, assuming we even know, which is why I find it hard to fault Snowden for leaking this information. As fearsome as the NSA sounds, certainly they have some limits. For instance, why don't they just clean out everyone's bank accounts? Might pay their bills for a few days anyway. But why haven't they gone after certain criminals? Many shady operations keep their money in jurisdictions that probably can't compete with our cyberwar capabilities. Maybe these operations enjoy the protection of a powerful entity but probably not all of them do. And probably many operations still use cash and couriers but the US and others seem to have gotten better at tracking movements of people so it's doubtful such tactics will remain viable forever. Maybe in the end we have to somehow conquer the notion of distrust. Not sure how it can be done except through telepathy and even then the transition to a telepathic society will probably be full of misery.

Briguy2k 12y ago

Speaking as a citizen, the problem with the US's newest brand of digital weapons, is that they can be used on US population under the radar and w/o killing anyone. This may justify legally their extended use for surveillance unfortunately. The development of the atom bomb and chemical weapons had no "convenient" use on the USs own citizens, and they clearly couldn't get away with it. However, these weapons do, and they are being developed with all the same force, purpose, and financial backing as the a-bomb and chemical weapons were ~100 years ago.

JoachimS 12y ago
Not only could use. These weapons are built using either weaknesses introduced into civilian domestic systems, or found in domestic civilian systems and not fixed. This means that the basic premise for this weapons created to protect US citizens is to weaken their security.

deleted 12y ago

[deleted]

thefreeman 12y ago

The NSA should just leak documents showing all of the other governments doing this stuff so we can move on from the Anti US/UK circle jerk. Seriously if you think your government hasn't invested serious time and money in digital subterfuge you are living in a dream world and need to wake up.

ramrunner800 12y ago
This.
woah 12y ago
Classic straw man. Many of the documents leaked have shown that our allies are doing the same, usually with the NSA's help. Of non U.S. allies most countries are too small to have serious programs, or are plainly doing much worse. I suppose this is some sort of perverse defense of the NSA, but the fact is that luckily most people would like to hold their government to a higher standard, instead of saying "the other guys are worse". If more people had had your attitude a few hundred years ago, we wouldn't even have democracy, as there would have been plenty more brutal and totalitarian regimes to point to.
- deleted 12y ago
  [deleted]

tete 12y ago

What I find really frightening is where they write: From a military perspective, surveillance of the Internet is merely "Phase 0" in the US digital war strategy. [...] This enables them to "control/destroy critical systems & networks at will through pre-positioned accesses (laid in Phase 0)." Critical infrastructure is considered by the agency to be anything that is important in keeping a society running: energy, communications and transportation. The internal documents state that the ultimate goal is "real time controlled escalation". This isn't about fighting terrorism. It's also not about the usual warfare it's more like the infrastructure or a set of tools to control nearly every other country or the planet or at least make sure that the US will always be able to keep them from disagreeing.

qatester 12y ago

For me the only bunch of people who wants and loves to start war is USA government, note I am not saying americans, I am saying US government. Why should you prepare if you dont have intention of war? "defense", from whom? from people where you started war? directly with Afghanistan, Iraq and some others, indirectly with Syria, even with Russia (started economically) and many others where they got governments with bribes. Now preparing for D war. Every war started with flag of "Demo hypocracy", defense and some other pseudo defensive words, reality is USA starts war and government fuckingly loves when people die. Probably you are going to downvote, thats because you didnt lost any of your brother, sister or even relatives and friends in such wars which just started because they wanted more oil and more money.

junto 12y ago

I'm pretty late to the party here but there are some fascinating parallels between the USG's actions in the physical world, as in the digital one. First to USG has made a concerted and successful attempts to place secret digital strongholds and black sites across the globe, including some 'behind the enemy lines' so to speak. In the physical world these are the equivalent to CIA black sites and safe houses, from which you can attack and spy on the enemy, feed in extra weaponry to partisans and rebels (similar to the CIA Benghazi compound, sorry 'consulate', sorry 'embassy'. The NSA has all these smart dangerous and arguably immoral minds employed to defend the digital borders of the US. But in truth these minds are busier establishing secret pathways through the digital trenchlines in order to have a definive and effective advantage when the cyberwar comes (which of course they are actively encouraging to validate their position, historical actions and future funding). At the same time they are making a concerted effort to make sure that the security protocols everyone uses are undermined and backdoored. In effect they are making sure that the digital nuclear weapons held by their enemies aren't going to get in the air when the time comes. Through strong encryption we could make sure that we have the digital equivalent of mutually assured security, but as ever the US isn't interested in this, because the reality is that the military industrial compound aims to make billions of dollars from the industry. In a world where all communications and hardware devices were secure, they wouldn't make any money. A secure, stable and safe world just isn't profitable.

kgarten 12y ago

seems to me a lot of people flaged the story (443 points, 1 day ago, on page 3 with a couple of stories with 200 points also 1 day ago) ... wondering why conspiracy theories ;)