Hacker News Reader

Comment by dekhn | Hacker News Reader

I once took a call with an ex-NSA guy who was a CEO selling email security software- your MX would point to them, they'd scan your incoming email for exploits, then deliver it on to you. When I spoke to the guy, I expressed my concern, having working for a large multinational corporate whose fiber optic lines were tapped by UK intelligence to avoid NSA laws against spying on americans, that if I couldn't inspect his software, I couldn't feel confident of the security and integrity of the scanning system.

I said, in good faith, that I would consider his product if I could inspect the running system and the code.

He said several things: 1) the NSA never did anything illegal 2) the software was too large to audit 3) it was an insult to his employment in the NSA that I was even asking these questions.

Then he hung up.

View on HN

Obviously he fired you as a customer.

This is how the misspellings in Nigerian Prince emails market to the "right" customers.

The NSA would never do anything illegal; if you have a problem with highly misleading and unethical actions being undertaken with flimsy pretenses established by classified memos citing dubious legal justification- then that’s obviously your problem, not theirs. Also, didn’t the director of the NSA perjure himself when he lied under oath during his sworn testimony before SSCI? No, sorry, he actually gave the “least untruthful answer” and then changed his answer when contradictory facts became public. I would have called that illegal but obviously the NSA has a legal theory and justification as to when they need to provide “untruthful” “facts” to the institutions exercising oversight.

> 1) the NSA never did anything illegal

Okay... but even if it was legal that doesn't mean what they did is "right". There's a big difference.

Yeah, one is objective, the other is so subjective it depends not only who you ask but when and how you ask it.

Neither is objective. There's no pretense of objectivity in the legal system. This is why you see people say things like "we'll find out if this was legal when they rule on the case".

The difference is that I knew he wasn't on the level when he said it, because the NSA has been sued and it's come out they've done things that were illegal, as found by a court of law, in public. That's just one example that we know of.

Please define "right"

the precursor to law

Or perhaps the precursor to “just” law. Unjust laws abound.

They never got an official, judicial, slap, which certainly means it must be legal, isn't it?

Found to be illegal at the judicial level: https://www.nytimes.com/2010/04/01/us/01nsa.html then overturned by the 9th court. Then Congress stepped in and changed laws to make the situation "clearer".

> whose fiber optic lines were tapped by UK intelligence to avoid NSA laws against spying on americans

Who did you work for? This appears to be a 180deg misunderstanding of the 5 Eyes agreement. GCHQ is not allowed to spy on Americans.

https://www.nytimes.com/2013/10/31/technology/nsa-is-mining-...

"In partnership with the British agency known as Government Communications Headquarters, or GCHQ, the N.S.A. has apparently taken advantage of the vast amounts of data stored in and traveling among global data centers, which run all modern online computing, according to a report Wednesday by The Washington Post. N.S.A. collection activities abroad face fewer legal restrictions and less oversight than its actions in the United States."

Note there's a fair amount of speculation on the specific details of how and what data is collected and shared.

This source doesn't remotely support what you said, in fact it explicitly contradicts it;

> "pushed back against the notion that it was collecting abroad to “get around” legal limits imposed by domestic surveillance laws"

There's been public claims about it, and honestly thinking that they wouldnt do it once they have the power to seems naive?

https://www.zdnet.com/article/thatcher-ordered-echelon-surve... > Ex-spy Mike Frost told the CBS 60 Minutes programme that Thatcher had ordered surveillance on two cabinet colleagues according to excerpts released on Thursday. The allegation comes in the same week that a European Parliament report said Echelon, a surveillance system run by the United States, Canada, Britain, Australia and New Zealand, was used for industrial espionage.

"pushed back"? Like how the director of the NSA "pushed back" on congressional questions of whether the NSA was broadly collecting any data from American citizens?

Don't forget that Snowden leaks revealed that there is a huge open sharing pipe directly with Israel.

I can't recall the details - Ill have to go look it up again, but apparently Israel gets more data than any of the others, IIRC.

Source?

When someone says something about mysterious unseen evil activities and Israel it raises my conspiracy theory detector to yellow alert

https://www.latimes.com/world/la-xpm-2013-sep-11-la-fg-wn-ns...

Not "more data than any of the others" - just a specific kind of access that usually comes with much closer intelligence relationships (e.g. Five Eyes), rather than the more wary relationship the Israeli and US intelligence communities generally have with each other.

> GCHQ is not allowed to spy on Americans.

Since when do spy agencies avoid doing things just because they're "not allowed" to do them? An activity being disallowed only means that they'll avoid telling people that they're doing it.

All of your emails and text messages have been saved on NSA server harddisks, without a warrent. You are asking the right questions.

> the software was too large to audit

That part's probably true.

Try to audit something like OpenSSL.

Open ssl has be audited and fips validated for some versions

You might be interested in this evidence of the incompleteness of FIPS validation as a talisman of security.

Edit: more importantly, the FIPS version of OpenSSL was vulnerable to HeartBleed.

https://www.engadget.com/2019/06/13/yubico-recalls-governmen...

I am pretty sure that the fips validated versions could not even compile.

That's up to the auditor to decide, not the auditee.

AUditing is a negotiation between the auditor and the auditee. The auditor rarely gets to dictate absolute terms (and in my experience, will often listen to well-reasoned and prepared arguments and plans from auditees).

Is there no more subtle way of turning down a customer, as an ex-spook? He seemed to imply more than he needed to for someone trained.

> 1) the NSA never did anything illegal

This is simply not true.

I bet I can guess who this is

Why are we supposed to respect secrecy in this moment?

Who is it?

Sounds like Area_1

It is just plain rude to apply his previous employer's actions, who employ over 30k people, solely on him.

He's the one asking for your data, trust, and money. A little scrutiny is warranted.

That applies to every B2B company pretty much. Did he also ask other companies for access to their code?

Who said anything about “solely”? It’s entirely reasonable to have the concerns OP had.

Since I was effectively the CTO for a startup that cared about the security of its messaging, I think I made a reasoned judgement about the nature of the security of their product, offered a way that he could help increase my confidence that he wasn't just sending a copy of my unecrypted email (the email has to be unencrypted for their scanner to work) off wherever.

I don't really find that rude. A cloud customer certainly can go to a cloud provider, say "you know, it's possible you have rogue internal actors, I've read articles that said you've fired SREs before who snooped on user data, can I see your audits that show you deal with insider risk properly?"

I encourage you to go to cloud providers and ask to see their code. They will laugh in your face.

If the NSA guy is selling himself based on his past experience, then he himself is the one dragging those issues into the conversation.

Yes, he sells himself on that experience (I had already done due diligence on a previous company he founded, sqrrl, which was organized around open source software, but touted the NSA creds):

Oren Falkowitz CEO and Co-founder Oren Falkowitz co-founded Area 1 Security to discover and eliminate targeted phishing attacks before they cause damage to organizations. Previously, he held senior positions at the National Security Agency (NSA) and United States Cyber Command (USCYBERCOM), where he focused on Computer Network Operations & Big Data. That’s where he realized the immense need for preemptive cybersecurity.

> those issues

What issues?

I think it's acceptable to wonder if the ex-employee's attitudes and beliefs are similar to the organization he spent the bulk of his time working at.

Then perhaps ask him about his attitudes and beliefs- not for access to his code.

They told him about their attitudes and beliefs: "The NSA did nothing wrong".

Honestly, why are you defending someone who believes that??

Yeah you should be able to work for whatever unethical employer you like, and defend their actions without consequence.

-5 insightful.

This post could turn into +5 informative if names and contact details were added for this unidentified "ex-NSA guy" and the "security software."

As-is, this is post is becoming popular because people are replying with random experiences and hate they have for NSA and insecure systems. But instead it could be helpful by damaging the reputation of a specific person that is peddling insecure systems.

This is why I browse with -5 insightful.

Reply on news.ycombinator.com