Hacker News Reader

Comment by WestCoastJustin | Hacker News Reader

> No offense, but I feel you're arguing against the existence of large trucks because you've never had any reason to drive one.

I'm not saying that companies don't have 50TB of documents, or that you cannot transfer 50TB, either via the network or physically. I am saying that for a place which prides itself as the "National Security Agency", they should have extremely tight security about transferring 50TB of their crown jewels, either via the network or physically. So, I think we are talking about different things. Goldman Sachs and DEC are in totally different ballparks, or should be, compared to the NSA.

I don't really care either way. I just think logistically this is a crazy amount of data for someone to walk off with at a place that should be the model of a secure site.

View on HN

Ah, you wanted a Secure National Agency :-)

I'm sure they do have elaborate security procedures but the size and scope of the organization means that any operational issue (including security) is almost always Someone Else's Problem. And since the NSA's purview is basically ELINT + crypto, they don't have the same sensitivity to more traditional espionage methods that a HUMINT organization like the CIA does.

Incidentally I'm thinking of setting up an OSINT entity if you're interested.

OSINT is super-interesting to me. What did you have in mind?

Gopher 2.0: Massive Dynamic Directed Acyclic Graph edition. The #1 problem for intelligence gathering is the difficulty of synthesizing disparate siloed information. 99.99% of our time on the internet is spent inspecting individual nodes and edges, putting us in the same position as the blind people trying to make sense of an elephant.

I have a vision for the post-web environment, but it's inchoate and will take many years to realize. In the more immediate term, I want to build a prototype and use it to thwart my political enemies :)

same name at gmail for anyone who's interested.

"they should have extremely tight security about transferring 50TB of their crown jewels"

Does anyone monitor amounts of data transferred? Honest question, I don't know of any ACL levels that say 'after x MB, deny access' (or send alerts or whatever). You monitor/restrict directories or servers, i.e. pieces of information, whether they're 5KB or 5TB (I mean, that's what I've seen, I'm not in opsec/admin myself). Still you'd need to make several trips to take out that much data; although you can fit 6GB on a $35 LTO tape...

Some of the high-end SIEM (security information and event management) systems do this, they'll alert if a machine that previously transferred low volumes of data from a database, such as a PC connecting to a database to query a few records, suddently transfers significantly more data.

I don't know why I'm asking, cause we won't be able to afford it...but which can do this? This has come up a couple times recently.

When I worked with law enforcement, in Australia, the onsite admin got an alert every time a device was plugged into a secure-access machine.

It also alerted if in the last hour more than 80gb was moved around.

I would have thought that the NSA would have similar policies...

Quis custodiet ipsos custodes?

This is a common (if not universal) practice for large law firms. My employer has software that enforces ethical requirements and triggers alerts when people open, export, or email too many documents.

I'm on the outside looking in, but various reports and speakers I have seen imply that without trust the intelligence community can't function. I also imagine the compartmentalization would make it hard to observe any but the most blatant violations of security policy.

Reply on news.ycombinator.com