Hacker News Reader

Comment by yborg | Hacker News Reader

It took 8 years for the CIA to figure out what happened?? This certainly explains why China and Russia continue to conduct cyber operations basically at the same level of intensity they have been for years - US intelligence, despite its enormous, unaccountable budget is unable to stop them or even know where they are compromised. If there is an actual hot conflict between the US and either of these nations, I shudder to think what will happen.

I don't believe the US lacks in technical skill at the operational level. These failures are management and organizational failures.

View on HN

They had a similar failure in Iran: http://articles.latimes.com/2011/may/22/world/la-fg-iran-esp...

The problem is that the real conflict the US faces is whether it should let its foreign policy be run by facts, or whether the intelligence agencies are simply there to manufacture consent for whatever the ruling party has decided to invade next. In the latter case the intelligence on the ground doesn't actually matter, so there's no political pressure to make sure it's done well.

Yeah the recent revelation of this episode certainly made it more difficult to stomach the various retired intelligence blowhards making the rounds of the news programs this morning to firmly declare risible canards like "Intelligence is about the Truth!" Somehow getting one's clearance lifted seems less draconian than overseeing the deaths of multitudes...

I wonder if this is due to the ever increasing scale of the US intelligence services.

From my working life perspective smaller teams of talented people are often more impactful than significantly larger teams. E.g. Large teams create bureaucracy. And 'weak links' become harder to spot and typically allowed to remain.

I know nothing about this area so take my comment as curiosity only, but I wonder what USA gets/achieves for this $50-100bn intelligence budget? And what would they get at a $2bn funded group utilising a much smaller group of the best employees within the existing orgs.

I don't think that's it. I personally think the best window into this world is William Binney and his thinthread project. He developed thinthread to protect Americans privacy, and it only was going to cost a handful of millions.

His functioning program was scrapped for a billion dollar program that didn't protect Americans privacy and that didn't work because all it did was make the haystack so big finding the needle became neigh impossible.

That is a clear example of the good ol boy kickback system being allowed to take over and actually reduced national security. There is a reason that since 9/11, multiple counties in VA have the most growth of millionaires in the country.

As for the CIA, most sources I listen to (Ray McGovern, John Kirakou, Bob Bear, etc) indicate they have been getting rid of analysts who speak "truth to power" due to the over politicalization of intelligence, so combine that with good ol boy kickback cruft, it's no wonder incompetence is allowed to abound.

This is only a part of the reason the military Intel community has tended to have an adversarial attitude to the company.

Often it's not so much that the billion dollar program was created to make defense contractors rich. It's that the attitude of the US military and intelligence agencies is that if it's worth doing, it's worth overdoing. The defense and intelligence contracting industries simply aid, abet, and exploit that propensity to enrich themselves.

So where a simple and cost effective solution would work, the US Military/Spy Agencies would want a platinum-plated solution that would give them total dominance in the situation at hand, which would spiral the costs and complexity to the point that the solution doesn't work at all. Contractors are never going to be a brake in that situation because it makes them filthy rich. And any employees who object get swept aside because the powers that be want to pursue the most aggressive and ambitious solution possible.

Binney is a complete crank.. I'd be very cautious of any first person narratives that he tells, especially when he paints himself as the hero.

You can't say shit like this without backing it up. I think you are full of it and just attempting character assassination.

I mean.. Have you heard anything he's said lately?

Here's his appearance on Infowars.. where he explains to Alex Jones how the "deep state" is setting up Donald Trump by scapegoating the Russians: https://www.youtube.com/watch?v=r5XE96G5kN0

From my brief view into a federal agency:

Employee breakdown is as follows:

1/6 extremely capable and dedicated high performers

1/6 extremely capable and dedicated but go home at 5pm

1/3 average (not going to screw things up massively, but also never going to make a large contribution)

1/3 shocking (as in where do you even find people this useless and disagreeable - if you’re lucky their managers put them in an office and don’t let them touch anything, if not, they wreak havoc)

So like a normal office, then? :)

Normal offices have layoffs now and then, which in many cases target the latter third.

These numbers look pretty good compared to my experience with large corporate organizations.

So 1/3 high performers, 1/3 average, and 1/3 low performers? Not a particularly amazing revelation.

And why the differentiation between folks who leave after 8 hours of work and those that don't?

It's just silicon valley startup mentality.

You literally work inside a room with no windows, poor ventilation, and sound dampening. Anyone who doesn't go home after 8 hours has something wrong with them.

The low performers are beyond low performers, the 6th decile at the federal govnerment would be the bottom decile at most larger well run private organizations. Again i am talking white collar federal government.

At the margin, in corporate america salaried professionals have a focus on deadlines and deliverables (because a. If the company goes under They’re out of a job and b. If they consistently miss deadlines they’re out of a job), so if that means the occasional late night, or an an expectation around a 10 hr work day - ok. On the federal government side the attitude CAN be “if it’s late, it’s late - what are they going to do, fire me?” Without some sense of urgency (however that is inspired) productivity is bad and tends to get worse.

Because federal employees cannot practically be fired it is very common to try to move them sideways to get rid of them. Eventually they just get promoted.

Note that just because we are reading about it eight years later does not mean it took that long for the CIA to figure out what happened.

A decade from now, perhaps we'll learn about the CYA failure that resulted in news of this disaster being released to the public... I reckon that just like everything else about the unsupervised services, this is just the tip of the awful iceberg. Probably there are ten failures like this for every one we learn of.

For starters they can't really pay market salaries for the skills they need so to some degree this has more to do with laws on the books than with management and organizational failures.

Bingo. Larger budgets get poured into more people not better people.

But they have no qualms about paying "market rate" to defense contractors to build all their toys.

How is that relevant ?

Shows a contradiction/hypocrisy. They have the money, but just choose to spend it on corporations and not humans.

Again there a laws that cap gov. employee salaries they are not passed by CIA or NSA or whatever other 3 letter agency.

No, it shows that unfortunately you don't know what you're talking about. Federal employee salaries are set by legislation and may not be changed. They can't get bonuses or anything else. Contracts are bid and are paid out of completely different budgets.

Yes, we actually can get yearly bonuses though they are minimal and tied to the performance rating process and tenure to the agency (at least at my agency). For those that are interested, I’d check out the General Schedule pay scales on the Office of Personnel Management’s (OPM) website. OPM is the agency responsible for providing guidance to federal agencies on all matters related to HR. OPM’s pay scales: https://www.opm.gov/policy-data-oversight/pay-leave/salaries...

However, some agencies have gotten special permission from Congress to use another pay scale which was designed to allow agencies to pay for performance rather than guaranteed raises over time. Though I’ve heard that it doesn’t always work the way it was intended. I was actually initially offered a lot lower salary at another agency that used the pay for performance than my current agency that uses the General Schedule scale.

For general reference: GS-7: B.A./B.S. and GS-9: Master’s.

For all intelligence positions, you are required to pass and maintain a Top Secret/Special Compartmented Information clearance which takes about a year these days due to backlog. This hinders the agencies ability to recruit top talent. I recommend checking out the SF-86 Questionnaire for National Security Positions if you want to see what all is asked.

Right now, I could switch to the private sector and make a lot more than I am making now. But I stay because I believe in the mission and work of my agency. I get to do things that I would never get to do in the private sector. Maybe one day I will switch but for right now I am staying.

The "S" in SCI stands for Sensitive, not Special. You might be thinking of Special Access Programs.

Yes! Thanks for the correction. I am so used to the acronym soup that I occasionally slip up on definitions. Lol!

I spent the better part of two years absolutely positive it stood for Secure Compartmentalized Information. :)

"I get to do things that I would never get to do in the private sector" well I know people who switched from NSA to private sector and pretty much keep doing the same things :) So I guess it depends :)

I’ve been on both sides of the coin so to speak (contractor and Fed). I felt when I was working on site as a contractor, I was walking a delicate tight rope balancing allegiances between my contract company who paid me and the agency I actually did the work for. I only met my contract company supervisor twice for the entire year I supported that contract (1. Interview; 2. Dropping me off at my office) and technically Feds can’t fill that role so I was essentially my own boss. This sounds great but I didn’t have any support or advocate to help me progress in my career. As a Fed, I have opportunities to push my organization’s boundaries in ways I wouldn’t be able to do as a contractor because I can be frank and outspoken about issues. I am also not tied to a statement of work so I can pursue interests outside my daily tasks/assignments. The contract company I worked for was very stingy on training, but in my current position the government offers me a lot of training opportunities in my field. For me, being a Fed is a better fit at least for now.

> you don't know what you're talking about.

Personal attacks aren't welcome here.

The government has the money. As evidenced by their defense budget.

The government does not pay the money to their employees. As evidenced by NSA employees making less than high-grade truck drivers.

The government does pay billions to corporations such as Lockheed or Booz, etc.

SO let's recap: they have the money, they just choose not to pay it to their employees. But instead it inexplicably gets rerouted to rent-seeking gatekeepers.

let's recap who are they? The Congress passed the pay caps if you show me any evidence that there is a broad voter support for removing those caps the "they" claim might have some merit otherwise "they"="we"

Saying you don't know what you're talking about is not a personal attack when you seem to be going out of your way to prove me right.

"The government" is not a gigantic neolithic behemoth doing whatever it wants whenever it wants. You might be surprised to learn that there are in fact three branches of government in the United States. Congress has passed more than one law detailing the manner in which federal employees can be paid, and limiting how much each given position may be paid.[0] Similarly, Congress sets the budget for the Executive agencies. Because the Pentagon get billions of dollars does not mean that it's trivial to raise the salary of everyone at the Food & Drug Administration.

USG employees make significantly less than their private sector counterparts (usually) because they get quite a few benefits unavailable to the private sector:

* Generous paid leave in the form of sick time, vacation time, comp time, and scheduled holidays

* Accrued paid leave is paid out when you leave government employment

* Government pension Ignoring the completely nonsensical "rent-seeking gatekeepers" comment, Lockheed and BAH receive government contracts through open bid procurement processes. You'll get no argument from me that often times these bids are written so only 1-3 firms in the world even qualify, but that's sort of the nature of the beast when the bid is to develop a new missile or something.

[0] https://www.opm.gov/policy-data-oversight/pay-leave/salaries...

> Saying you don't know what you're talking about is not a personal attack

It's attacking the person, not the central point. Thus making it ad-hominem.

> You might be surprised to learn that there are in fact three branches of government in the United States

See above comment.

> you don't know what you're talking about

Please keep personal swipes out of HN comments. Your post would be fine without the first sentence.

https://news.ycombinator.com/newsguidelines.html

That's a situation created by Congress, not federal agencies. Federal agencies with dire needs for high demand/high pay skills would love nothing more than to be able to hire full-time employees at market rates but it is very difficult for them to do so because of the federal pay scale and hiring guidelines.

It's part of the whole charade of smaller government. The number of actual government employees is reduced but then the government pays contracting companies 2x or 3x (or more) for contractors and ends up with same number of butts in seats.

> but then the government pays...

That's my point. They have the money, but something-something..."policy"...something-something.... It goes to corporations instead of people.

Who are "they" in this case? If you think there is broad electoral support for removing government pay caps I have a bridge to sell you :).

The same "they" you are referring to. The ones writing the checks. I don't care about the precise technicality that enables wage suppression. I literally don't care. The constitution also says no spying on Americans, but somehow that precise word of law was elided. The bottom line is: they have billions, they suppress wages for employees, and they enrich billion dollar contracting firms. Nothing I claim is untrue.

Yes that technicality is called democracy oh well

That's why agencies like the FBl just raid people and then flip them into Confidential Human Sources (CHS). They dont have to pay them anything and use the threat of jail time in exchange for skills/information.

... and they gain deniability if the sources do anything unethical which in turns gives them more leverage over the source.

Defense is always harder than offense when it comes to computers.

Computers at its core have no clue about offense or defense, that is in the realm of context (and lawyers).

What? I am completely confused by your statement.

Computer security VERY MUCH cares about offense vs. defense.

The attacker only has to win once and he wins. The defender has to win every single time or he loses.

>>If there is an actual hot conflict between the US and either of these nations, I shudder to think what will happen.

a hot conflict entirely dependent on satellites and other means of communications. The war can end right after the first shot is fired.

The point that was being made is China/Russia perhaps is still not there with all their covert operation guns out and blazing. If situation does arise (hot conflict or otherwise) then one "shudders to think" what would be the implications.

That's I meant too,even in WWII communication was key, imagine today when all is computer controlled. China and Russia might be in the system already and waiting

I think it's pretty safe to say, while these games are always cat and mouse, that globally cyber defense is not approached with the same determination as cyber offence, and perhaps it can't be with resources in the same order.

I think personally it's pretty likely that they're in our systems, and we're in theirs, for almost any major nation - ally or not.

It's just MAD all over again.

Except accountability in Mutually Assured Destruction was always crystal clear.

Today, there is much more (potential) room for confusion and false flag attacks.

Relevant pop culture reference:

https://www.imdb.com/videoplayer/vi4020353817?playlistId=tt5...

Intelligence isn't just about human intelligence sources. Historically the US has been terrible at human intelligence and peerless at technical intelligence such as spy satellites, bugs, signals intercept, etc...

Reply on news.ycombinator.com