6 ms·
Bruce Schneier is falling into the trap of saying since computer security is hard, the NSA has certainly been compromised and we can assume these docs have been
by NateLawson 11y ago
Bruce Schneier is falling into the trap of saying since computer security is hard, the NSA has certainly been compromised and we can assume these docs have been out there for a while.
Yes, securing the endpoint is hard, especially given the non-hardened OS and applications we mostly use. However, you can't extrapolate from that to say with certainty what has and hasn't been exposed via security flaws.
The USSR was much more successful at espionage than the US was, and they took a low-tech approach to it. For decades, they developed contacts within the govt, gave them money, and had documents handed to them by authorized insiders.
Let's not assume computer exploitation is the only culprit. History has shown a variety of techniques, even very low-tech ones, have been employed for espionage and it's impossible as an outsider to determine how much has been taken, by whom, and by what means.
- vmorgulis 11y agoWe will know some parts of truth but probably in one or two decades from now (like for the Cambridge Five). https://en.wikipedia.org/wiki/Cambridge_Five https://en.wikipedia.org/wiki/Cambridge_Five
- kbenson 11y ago> > The vulnerability is not Snowden; it’s everyone who has access to the files. > > First, the journalists working with the documents. > Bruce Schneier is falling into the trap of saying since computer security is hard, the NSA has certainly been compromised and we can assume these docs have been out there for a while. The NSA has been compromised. By Snowden. There's no assumption there, that's fact. Now, access to the documents not longer just means having NSA access (or a complicit person with access) or hacking the NSA, it includes access to any system or person who has access to all the files, which are no longer restricted to NSA servers. It's no longer about what the NSA's security practices are.
- Sammi 11y agoYeah but the point is that the NSA is most likely much easier to compromise than the Snowden documents.
- flyryan 11y agoWait... you believe that the NSA is easier to compromise than the computers of reporters from multiple international news agencies with various levels of computer security policies and knowledge?
- Sammi 11y agoI'll let Schneier answer that, in case you didn't read the article: > The open question is which countries have sophisticated enough cyberespionage operations to mount a successful attack against one of the journalists or against the intelligence agencies themselves. And while I have my own mental list, the truth is that I don’t know. But certainly Russia and China are on the list, and it’s just as certain they didn’t have to wait for Snowden to get access to the files.
- kbenson 11y agoThat doesn't mean he thinks it's easier to hack the NSA, just that he thinks it already was, so it doesn't matter.
- rst 11y agoSnowden didn't create any flaws in NSA's internal systems (or at least, none that anyone's described publicly), but his actions certainly demonstrate that they were there. All Schneier is saying is that someone else could have taken advantage of the same flaws -- and that he thinks, given the givens, that someone else almost certainly did. He's not the only one who thinks the odds stack up like that...
- x5n1 11y agoSpying is a good thing. Real information keeps people from second guessing each other and prevents cold conflicts from becoming hot.
- Menge 11y agoSo the trouble is only when your voters get the information necessary to vote rationally?
- tsotha 11y agoSpying is a wash - what you're saying is true, but it's only half the equation. Sometimes that second guessing is what keeps the conflict from becoming hot. Spying can compromise a country's defense to the extent another country feels comfortable attacking. Also, if a weaker country can maintain the facade of strength it's less likely to be attacked. The most obvious example is when one country manages to uncover another country's nuclear assets to such a high degree of confidence it feels (rightly or wrongly) it can make a 100% successful first strike.