32 ms·

To be fair here, the NSA should very well be doing these things, for the purpose of attacking other states. The reason is very clear as the Russian attacks on E

To be fair here, the NSA should very well be doing these things, for the purpose of attacking other states. The reason is very clear as the Russian attacks on Estonia ( https://en.wikipedia.org/wiki/2007_cyberattacks_on_Estonia https://en.wikipedia.org/wiki/2007_cyberattacks_on_Estonia ) demonstrate a clear need for defensive capability in this area, and where you have defence you end up needing offence. This persistent confusion between legitimate NSA operations such as preparing to intercept communications of foreign governments and illegitimate such as mass slurping of everyone's email merely serves to discredit the entire privacy defending position, and in the long run will just play into the hands of those that want to read everyone's email for nefarious purposes.

Afforess 12y ago
Agreed. I think the Snowden revelations have harmed the NSA's reputation to the point where most people on HN just assume NSA is a bond-level villain. The NSA serves a purpose, they are meant to be prepared offensively and defensively for the USA's security, which includes the internet. I have no problems with the NSA's purpose and would prefer they continue to exist and prepare against threats to the country. I do believe the NSA overstepped their mandate in domestic surveillance, and should be held accountable, but let's not forget that this world does have bad guy's - plenty of nations would lose no sleep at night if they hurt America.
- sroerick 12y ago
  The article addresses this very point. It specifically explores the conflict of interest that the NSA must work both offensively and defensively. It makes the argument that the balance has shifted so drastically to the offensive that our defensive is being weakened.
  - iwwr 12y ago
    What the article fails to mention is the NSA's instrumental efforts in weakening crypto standards and computer security in general. We don't know the extent of that undermining yet, but it's likely significant. They are also hoarding security vulnerabilities and not releasing them, as responsible researchers should. They're weakening security for everyone. Now, the US government as a whole is in a very strong position to actually push for genuine security compliance and to ultimately defend against even the most determined state cyber warfare initiative. They haven't done that because they want a way to get into systems even if it makes people less safe on the whole.
- TheOsiris 12y ago
  precisely, and this is why I'm starting to think that snowden has - at least - caused as much harm as good by his revelations. if he had stopped at revealing the domestic surveillance he would be an undisputed hero/patriot. but with all of these unnecessary leaks that does nothing but harm to national interest I can understand how others might view him otherwise.
  - jallmann 12y ago
    Others have said as much. Here is a quote from William Binney, another NSA whistleblower, on advice that he has for Snowden: > I would tell him to steer away from anything that isn't a public service — like talking about the ability of the U.S. government to hack into other countries or other people is not a public service. So that's kind of compromising capabilities and sources and methods, basically. That's getting away from the public service that he did initially. And those would be the acts that people would charge him with as clearly treason. The whole interview is a great read: http://www.usatoday.com/story/news/politics/2013/06/16/snowden-whistleblower-nsa-officials-roundtable/2428809/ http://www.usatoday.com/story/news/politics/2013/06/16/snowd...
    - nitrogen 12y ago
      The US public has a legitimate interest in knowing about NSA's hacking abilities, because vulnerabilities used by the NSA abroad can just as easily be used domestically by foreign or criminal attackers.
      - jallmann 12y ago
        Against a well-prepared adversary, a vulnerability can only be exploited once -- a zero day. After disclosure, or evidence of an exploit in circulation, such vulnerabilities become useless towards the agency's mandate, whether or not you agree with that mandate. Realpolitik? Definitely.
  - vorg 12y ago
    > if he had stopped at revealing the domestic surveillance he would be an undisputed hero/patriot. but with all of these unnecessary leaks that does nothing but harm to national interest It's also important the public realize the NSA is more than just the National Stalking Agency.
- CamperBob2 12y ago
  Agreed. I think the Snowden revelations have harmed the NSA's reputation to the point where most people on HN just assume NSA is a bond-level villain. Not so much Blofeld as Klingon: http://www.dailymail.co.uk/news/article-2421112/NSA-director-Keith-Alexander-modeled-secret-war-room-Star-Treks-Enterprise.html http://www.dailymail.co.uk/news/article-2421112/NSA-director...
  - deleted 12y ago
    [deleted]
- deleted 12y ago
  [deleted]
- pyre 12y ago
  > I do believe the NSA overstepped their mandate in domestic surveillance They've been doing it longer than the Internet. The "Five Eyes" have existed for a while, so that they can have a legal loophole for domestic spying (e.g. "We can't spy on our citizens, so we'll just ask our allies to do it for us!"). To me this indicates that, while the stated purpose behind the organization may have merits, the execution of that purpose has been flawed for some time.
- tintwash 12y ago
  Sapir-Whorf and Newspeak. What does "security" mean? I have no doubt that the NSA's job is "national security" and that some portion of that work serves the people. Nobody knows what that portion is, by design. If you bury the difficult, complicated issues under terms like "security", "threat to the country", and "bad guys", you're basically just supporting the NSA on faith. Forget the terminology and FUD of "threats", and let's ask ourselves what the concrete benefit to the people of the United States (or better yet, the world) is for the NSA to be arming themselves for the destruction of computer systems. Is the benefit Cold Waresque deterrence through keeping the rest of the world in fear? Is this the strategy we want our work and taxes to support? Maybe it's too complicated to think about, and even if we wanted to critically analyse the situation, secrecy prevents us from knowing anything besides what the government desires the people to know. It's easier to just trust in benevolent "national security" protecting us from Eastasia. Let's not forget that the world does have bad guys, and besides, we've always been at war with Eastasia.
- foldr 12y ago
  >that this world does have bad guy's No, movies have bad guys.
sroerick 12y ago
Do you believe that NSA should be conducting economic espionage? There is a clear need for defense. But because of lack of oversight, NSA has overstepped its bounds in both foreign and domestic spheres. The other side of this argument, one made cogently by Snowden, is that we simply have more to lose by escalating the cyberwar.
- jallmann 12y ago
  Having offensive capabilities and actually utilizing such capabilities are two different things. You can acknowledge the need for the former alongside the dangers of the latter, just as you would with any standing military.
  - throwaway349823 12y ago
    I don't really see how that fits into this scenario. Computer Security is more like chemical warfare. Were you can either do research or try to make everyone more secure by international treaties. Here you can either undermine encryption, infiltrate networks, keep exploits to yourself or you can make everyone secure by patches, standards and encryption that works.
    - jallmann 12y ago
      > Computer Security is more like chemical warfare Ignoring this nonsensical analogy... > undermine encryption, infiltrate networks, keep exploits to yourself This is really the MO of any intelligence agency; that is their job. > you can make everyone secure by patches, standards and encryption that works Interesting statement, because it shows some things. Firstly, there is a difference in incentives -- why publish a vulnerability when it could be used to further your mandate? For the specific case of NSA though, that also ignores their broader role in securing federal communications (eg, vetting SHA, AES, FIPS, etc). Of course, there are always exceptions (DES, Dual-EC-DRBG, etc) -- but in a way, that precisely illustrates why we have intelligence agencies in the first place: trust no one.
  - sroerick 12y ago
koepked 12y ago
To me this goes both ways. If there is a legitimate mission for the NSA to accomplish, then perhaps they should make sure at all times to act in a way that is deserving of the public's trust. The persistent confusion you mention is not the fault of the confused.
deleted 12y ago
[deleted]
Cakez0r 12y ago
I don't understand why there are so many comments saying that the NSA needs offensive digital capabilities. What valid reasons does the NSA have to ever be committing a cyber attack?
- mmagin 12y ago
  Possibly they're operating on the assumption that "cyber war" works like nuclear war and the most effective deterrent is the threat of retaliation.
- adventured 12y ago
  The obvious one: war with another nation. Along with threat deterrent. I can't think of any good argument for why the US military should have no offensive capabilities in the digital realm. It'd be the equivalent of staying out of the skies when flight became possible. In any war, the US is going to come under digital attack, and it should be fully capable of responding both defensively and offensively. Besides that, shutting down the power grid of a country you're at war with via digital means, sure beats doing it with hundreds of missiles.
  - nitrogen 12y ago
    But by stockpiling vulnerabilities they are making civilians less safe. Offensive digital capabilities should never come at the expense of fixing software.
    - anigbrowl 12y ago
      I ended up rescuing & then adopting a German Shepherd 18 months ago, without having planned such a thing. These days I don't even bother to read the the scarevertising from burglar alarm suppliers that turns up in the mailbox every month or two. I don't want to barricade myself into my own home or have some corporation constantly surveilling it for me. While it's far from an exact analogy, I actually feel quite a bit safer with an active deterrent than I did previously.
      - 12y ago
caycep 12y ago
I agree. The DoD/NSA and other agencies should be developing these capabilities. IT's really the oversight and legal use of weapons against civilians that is the question
- elwin 12y ago
  I suspect that "cyberweapons", like biological weapons, are almost impossible to use in a way that does not harm civilians. Their development is practically certain to lead to use against civilians in a way hard to reconcile with the ideas behind current international law. On the other hand, the idea of fighting a war without harming civilians is a 19th century notion unlikely to survive much longer.
deleted 12y ago
[deleted]
throwaway349823 12y ago
It's exactly this unrealistic notion of having your cake and eating it too that landed us in this mess in the first place. And what do you mean by "defensive capability"? Secretive military organizations isn't going to protect civil society. In fact their influence is often in opposition to such protection.
deleted 12y ago
[deleted]
markvdb 12y ago
Are you a US citizen? How would you react if supposedly close US allies were bugging the White House, the US senate and AT&T? Repeatedly? Five Eyes, Echelon, Merkel, Belgacom, ...
- throwaway344 12y ago
  The irony of course is that the CIA did hack into the US Senate's computers. http://www.nationaljournal.com/tech/cia-admits-it-improperly-hacking-senate-computers-20140731 http://www.nationaljournal.com/tech/cia-admits-it-improperly...
- anigbrowl 12y ago
  I'm not a US citizen, but I presume that US allies which have the capability do unilaterally gather intelligence on the US.
- mpyne 12y ago
  Um.... you perhaps know less than you think you do about what "close US allies" do and do not engage in behind closed doors. Half of the reason Five Eyes even exists is to reduce the threat of espionage conducted by close allies.
hengheng 12y ago
So I happen to be German, and obviously I don't have a say in what commands you guys give to your own secret services. But since this appeared in a German magazine, allow me to say this: given the track record of how you treat your alleged "allies", I don't feel comfortable seeing these developments. And I wouldn't ever trust anybody with these powers, least the nsa or even the US government. These people are still trying to create a US World Empire out of their own hybris, they just cannot leave the world in peace. Surprisingly, it turns out that this is an easy way to make enemies, as last week's action in Paris have shown. It has been shown since 2005 that the islamists that massacred twelve people were, in fact, radicalized by what they learned about the prison of Abu Ghraib. Job well done, thank you very much guys. Lastly, the way our own government is supporting the nsa makes me feel nauseated at some times, furious at other times. We have plenty of work to do locally, that's why usually I don't complain about foreign services. Simply allowing the nsa to gain world domination like that though, just because "that is their job", really is hard to accept for me, and it really rubs me the wrong way.
- IBM 12y ago
  It's a good thing for allies to spy on each other to understand intentions, as this article in Foreign Affairs argues. http://www.foreignaffairs.com/articles/140247/jennifer-sims/i-spy http://www.foreignaffairs.com/articles/140247/jennifer-sims/...
  - hengheng 12y ago
    Point taken. But let's keep the CSC vs de-mail discussion for another time. I see a huge difference between spying to get to know the others' intentions, and preparing sabotage, destruction and infrastructural doom for maximum threat potential.
    - koonsolo 12y ago
      And industrial espionage to steal contracts form Non-US "allied" countries for economic gain.
matt4077 12y ago
This was the British GCHQ. They were spying on non-Europeans using their roaming networks, including US citizens. If you think there's some sort of restraint with regards to citizens of other 'five eyes' nations, I wonder how you square that with the "but everyone spies on everyone, including allies" argument that can always be found in these threads.

Afforess 12y ago

Agreed. I think the Snowden revelations have harmed the NSA's reputation to the point where most people on HN just assume NSA is a bond-level villain. The NSA serves a purpose, they are meant to be prepared offensively and defensively for the USA's security, which includes the internet. I have no problems with the NSA's purpose and would prefer they continue to exist and prepare against threats to the country. I do believe the NSA overstepped their mandate in domestic surveillance, and should be held accountable, but let's not forget that this world does have bad guy's - plenty of nations would lose no sleep at night if they hurt America.

sroerick 12y ago
The article addresses this very point. It specifically explores the conflict of interest that the NSA must work both offensively and defensively. It makes the argument that the balance has shifted so drastically to the offensive that our defensive is being weakened.
- iwwr 12y ago
  What the article fails to mention is the NSA's instrumental efforts in weakening crypto standards and computer security in general. We don't know the extent of that undermining yet, but it's likely significant. They are also hoarding security vulnerabilities and not releasing them, as responsible researchers should. They're weakening security for everyone. Now, the US government as a whole is in a very strong position to actually push for genuine security compliance and to ultimately defend against even the most determined state cyber warfare initiative. They haven't done that because they want a way to get into systems even if it makes people less safe on the whole.
TheOsiris 12y ago
precisely, and this is why I'm starting to think that snowden has - at least - caused as much harm as good by his revelations. if he had stopped at revealing the domestic surveillance he would be an undisputed hero/patriot. but with all of these unnecessary leaks that does nothing but harm to national interest I can understand how others might view him otherwise.
- jallmann 12y ago
  Others have said as much. Here is a quote from William Binney, another NSA whistleblower, on advice that he has for Snowden: > I would tell him to steer away from anything that isn't a public service — like talking about the ability of the U.S. government to hack into other countries or other people is not a public service. So that's kind of compromising capabilities and sources and methods, basically. That's getting away from the public service that he did initially. And those would be the acts that people would charge him with as clearly treason. The whole interview is a great read: http://www.usatoday.com/story/news/politics/2013/06/16/snowden-whistleblower-nsa-officials-roundtable/2428809/ http://www.usatoday.com/story/news/politics/2013/06/16/snowd...
  - nitrogen 12y ago
    The US public has a legitimate interest in knowing about NSA's hacking abilities, because vulnerabilities used by the NSA abroad can just as easily be used domestically by foreign or criminal attackers.
    - jallmann 12y ago
      Against a well-prepared adversary, a vulnerability can only be exploited once -- a zero day. After disclosure, or evidence of an exploit in circulation, such vulnerabilities become useless towards the agency's mandate, whether or not you agree with that mandate. Realpolitik? Definitely.
- vorg 12y ago
  > if he had stopped at revealing the domestic surveillance he would be an undisputed hero/patriot. but with all of these unnecessary leaks that does nothing but harm to national interest It's also important the public realize the NSA is more than just the National Stalking Agency.
CamperBob2 12y ago
Agreed. I think the Snowden revelations have harmed the NSA's reputation to the point where most people on HN just assume NSA is a bond-level villain. Not so much Blofeld as Klingon: http://www.dailymail.co.uk/news/article-2421112/NSA-director-Keith-Alexander-modeled-secret-war-room-Star-Treks-Enterprise.html http://www.dailymail.co.uk/news/article-2421112/NSA-director...
- deleted 12y ago
  [deleted]
deleted 12y ago
[deleted]
pyre 12y ago
> I do believe the NSA overstepped their mandate in domestic surveillance They've been doing it longer than the Internet. The "Five Eyes" have existed for a while, so that they can have a legal loophole for domestic spying (e.g. "We can't spy on our citizens, so we'll just ask our allies to do it for us!"). To me this indicates that, while the stated purpose behind the organization may have merits, the execution of that purpose has been flawed for some time.
tintwash 12y ago
Sapir-Whorf and Newspeak. What does "security" mean? I have no doubt that the NSA's job is "national security" and that some portion of that work serves the people. Nobody knows what that portion is, by design. If you bury the difficult, complicated issues under terms like "security", "threat to the country", and "bad guys", you're basically just supporting the NSA on faith. Forget the terminology and FUD of "threats", and let's ask ourselves what the concrete benefit to the people of the United States (or better yet, the world) is for the NSA to be arming themselves for the destruction of computer systems. Is the benefit Cold Waresque deterrence through keeping the rest of the world in fear? Is this the strategy we want our work and taxes to support? Maybe it's too complicated to think about, and even if we wanted to critically analyse the situation, secrecy prevents us from knowing anything besides what the government desires the people to know. It's easier to just trust in benevolent "national security" protecting us from Eastasia. Let's not forget that the world does have bad guys, and besides, we've always been at war with Eastasia.
foldr 12y ago
>that this world does have bad guy's No, movies have bad guys.

sroerick 12y ago

Do you believe that NSA should be conducting economic espionage? There is a clear need for defense. But because of lack of oversight, NSA has overstepped its bounds in both foreign and domestic spheres. The other side of this argument, one made cogently by Snowden, is that we simply have more to lose by escalating the cyberwar.

jallmann 12y ago
Having offensive capabilities and actually utilizing such capabilities are two different things. You can acknowledge the need for the former alongside the dangers of the latter, just as you would with any standing military.
- throwaway349823 12y ago
  I don't really see how that fits into this scenario. Computer Security is more like chemical warfare. Were you can either do research or try to make everyone more secure by international treaties. Here you can either undermine encryption, infiltrate networks, keep exploits to yourself or you can make everyone secure by patches, standards and encryption that works.
  - jallmann 12y ago
    > Computer Security is more like chemical warfare Ignoring this nonsensical analogy... > undermine encryption, infiltrate networks, keep exploits to yourself This is really the MO of any intelligence agency; that is their job. > you can make everyone secure by patches, standards and encryption that works Interesting statement, because it shows some things. Firstly, there is a difference in incentives -- why publish a vulnerability when it could be used to further your mandate? For the specific case of NSA though, that also ignores their broader role in securing federal communications (eg, vetting SHA, AES, FIPS, etc). Of course, there are always exceptions (DES, Dual-EC-DRBG, etc) -- but in a way, that precisely illustrates why we have intelligence agencies in the first place: trust no one.
- sroerick 12y ago

koepked 12y ago

To me this goes both ways. If there is a legitimate mission for the NSA to accomplish, then perhaps they should make sure at all times to act in a way that is deserving of the public's trust. The persistent confusion you mention is not the fault of the confused.

deleted 12y ago

[deleted]

Cakez0r 12y ago

I don't understand why there are so many comments saying that the NSA needs offensive digital capabilities. What valid reasons does the NSA have to ever be committing a cyber attack?

mmagin 12y ago
Possibly they're operating on the assumption that "cyber war" works like nuclear war and the most effective deterrent is the threat of retaliation.
adventured 12y ago
The obvious one: war with another nation. Along with threat deterrent. I can't think of any good argument for why the US military should have no offensive capabilities in the digital realm. It'd be the equivalent of staying out of the skies when flight became possible. In any war, the US is going to come under digital attack, and it should be fully capable of responding both defensively and offensively. Besides that, shutting down the power grid of a country you're at war with via digital means, sure beats doing it with hundreds of missiles.
- nitrogen 12y ago
  But by stockpiling vulnerabilities they are making civilians less safe. Offensive digital capabilities should never come at the expense of fixing software.
  - anigbrowl 12y ago
    I ended up rescuing & then adopting a German Shepherd 18 months ago, without having planned such a thing. These days I don't even bother to read the the scarevertising from burglar alarm suppliers that turns up in the mailbox every month or two. I don't want to barricade myself into my own home or have some corporation constantly surveilling it for me. While it's far from an exact analogy, I actually feel quite a bit safer with an active deterrent than I did previously.
    - 12y ago

caycep 12y ago

I agree. The DoD/NSA and other agencies should be developing these capabilities. IT's really the oversight and legal use of weapons against civilians that is the question

elwin 12y ago
I suspect that "cyberweapons", like biological weapons, are almost impossible to use in a way that does not harm civilians. Their development is practically certain to lead to use against civilians in a way hard to reconcile with the ideas behind current international law. On the other hand, the idea of fighting a war without harming civilians is a 19th century notion unlikely to survive much longer.

deleted 12y ago

[deleted]

throwaway349823 12y ago

It's exactly this unrealistic notion of having your cake and eating it too that landed us in this mess in the first place. And what do you mean by "defensive capability"? Secretive military organizations isn't going to protect civil society. In fact their influence is often in opposition to such protection.

deleted 12y ago

[deleted]

markvdb 12y ago

Are you a US citizen? How would you react if supposedly close US allies were bugging the White House, the US senate and AT&T? Repeatedly? Five Eyes, Echelon, Merkel, Belgacom, ...

throwaway344 12y ago
The irony of course is that the CIA did hack into the US Senate's computers. http://www.nationaljournal.com/tech/cia-admits-it-improperly-hacking-senate-computers-20140731 http://www.nationaljournal.com/tech/cia-admits-it-improperly...
anigbrowl 12y ago
I'm not a US citizen, but I presume that US allies which have the capability do unilaterally gather intelligence on the US.
mpyne 12y ago
Um.... you perhaps know less than you think you do about what "close US allies" do and do not engage in behind closed doors. Half of the reason Five Eyes even exists is to reduce the threat of espionage conducted by close allies.

hengheng 12y ago

So I happen to be German, and obviously I don't have a say in what commands you guys give to your own secret services. But since this appeared in a German magazine, allow me to say this: given the track record of how you treat your alleged "allies", I don't feel comfortable seeing these developments. And I wouldn't ever trust anybody with these powers, least the nsa or even the US government. These people are still trying to create a US World Empire out of their own hybris, they just cannot leave the world in peace. Surprisingly, it turns out that this is an easy way to make enemies, as last week's action in Paris have shown. It has been shown since 2005 that the islamists that massacred twelve people were, in fact, radicalized by what they learned about the prison of Abu Ghraib. Job well done, thank you very much guys. Lastly, the way our own government is supporting the nsa makes me feel nauseated at some times, furious at other times. We have plenty of work to do locally, that's why usually I don't complain about foreign services. Simply allowing the nsa to gain world domination like that though, just because "that is their job", really is hard to accept for me, and it really rubs me the wrong way.

IBM 12y ago
It's a good thing for allies to spy on each other to understand intentions, as this article in Foreign Affairs argues. http://www.foreignaffairs.com/articles/140247/jennifer-sims/i-spy http://www.foreignaffairs.com/articles/140247/jennifer-sims/...
- hengheng 12y ago
  Point taken. But let's keep the CSC vs de-mail discussion for another time. I see a huge difference between spying to get to know the others' intentions, and preparing sabotage, destruction and infrastructural doom for maximum threat potential.
  - koonsolo 12y ago
    And industrial espionage to steal contracts form Non-US "allied" countries for economic gain.

matt4077 12y ago

This was the British GCHQ. They were spying on non-Europeans using their roaming networks, including US citizens. If you think there's some sort of restraint with regards to citizens of other 'five eyes' nations, I wonder how you square that with the "but everyone spies on everyone, including allies" argument that can always be found in these threads.