Hacker News Reader

Comment by bambataa | Hacker News Reader

I once worked in the Commission, briefly. Technical security seemed to be non-existent as far as I could tell (in an admittedly very junior role).

Once all of the interns got invited to the U.S. embassy to meet the Ambassador (some guy who literally said he got the job because he was friends with Obama). On the way out the nice embassy staff gave us goodie-bags, complete with handy pen drives...

Basically everyone was giving away free pen drives in Brussels then. I would be surprised to find that the U.S. didn't already have access to a large number of EU institution computers.

View on HN

> some guy who literally said he got the job because he was friends with Obama

There are two kinds of U.S. ambassadors:

1) Career foreign service people

2) Friends of the presidential administration at the time

Examples of the latter aren't hard to find. Off the top of my head I'm familiar with William Timken, a US businessman who was appointed Ambassador to Germany by George W. Bush because he was a huge supporter [0,1]. Colloquially we could say he got the job because "he was a friend of Bush."

I remember being surprised to learn that US Ambassadors were (maybe still are) individually responsible for paying for a good part of their formal duties as Ambassadors(eg throwing parties, travel, etc). So historically, having wealthy people in the role was a requisite. I gleaned this from reading "In the Garden of Beasts" by Erik Larson [2].

The bits I have cobbled together suggest there is an interesting history surrounding the practice of selecting and acting as a US Ambassador.

[0] https://2001-2009.state.gov/outofdate/bios/t/53349.htm

[1] https://www.spiegel.de/international/spiegel/us-german-relat...

[2] https://www.goodreads.com/book/show/9938498-in-the-garden-of...

All US ambassadorships are political appointment, therefore option 2 is the only answer. These positions are almost always ceremonial. They are there to execute the will of the president.

The real work is done by the diplomats who are appointed through the US Foreign Service office. They do the actual work of the embassies.

> All US ambassadorships are political appointment, therefore option 2 is the only answer. These positions are almost always ceremonial. They are there to execute the will of the president.

Not really, a foreign service officer can be appointed by a president to be an ambassador. A recent example from the news is Marie Yovanovitch. In regular times, my impression was that foreign service officers were appointed to the more difficult and critical ambassadorships (e.g. Ambassador to the USSR), and friends of the president were appointed to "easy" ambassadorships (e.g. to a staunch ally with a fashionable capital).

A president can appoint a politically connected friend or choose one from the diplomatic corp. But in any case they are all political appointments selected by the president.

Now, for sensitive countries you want a specialist. Like your probably not sending golfing buddies to broker Israel/Palestine peace agreements. But they'll probably do alright being the Ambassador to Belgium or Canada. Those embassies are practically on rails.

In this case instead of a golfing buddy, his son-in-law was appointed to deal with Israel/Palestine.

Nepotism is a problem, as is cronyism.

Just to reinforce that this is correct and to add detail - the Deputy Chief of Mission is the senior career foreign service person responsible for actual embassy operations.

Or, to put that another way—there are two kinds of ambassadors/diplomats:

1. People the administration is paying to go out and brown-nose foreign leaders, or those leaders’ own ambassadors/diplomats, in a combination “outbound sales” and “customer service” sort of way;

2. People who presumably have the ear of the administration, where foreign leaders want to pay to impress them in order to access the administration through them.

Whether or not you call someone who’s a friend of the president an “ambassador”, foreign leaders are going to want to treat them as an ambassador, so you may as well give them the protections that playing that role requires—even if they never normally leave the country—on the off-chance that a foreign leader either runs into them or intentionally pursues and {hires through a proxy, seduces, coerces, etc.} them.

In this second sense, “ambassador” is short for “a person a state leader is worried about the welfare and mental sanctity of, in the face of global political machinery trying to manipulate the leader by any means necessary.”

That’s interesting. Elsewhere (Eastern Europe during communism) ambassadors were often political opponents of the government - a form of isolation and payoff in a cushier government supported role abroad. Their job is to parrot the government’s policy instead of spreading their own.

The US typically sends Type 2 ambassadors to plush, comfortable countries, and Type 1 ambassadors to postings in difficult or very poor countries. I knew my small Eastern European country had made it when we started getting incompetent ambassadors.

And I work at a European cybersecurity company and we are routinely tasked to inspect USB drives and devices EU politicians receive at conferences, so I guess we've come full circle.

I'm sure the NSA has implants in the EU systems but they're not dumb enough to just hand them out on USB drives that can be traced back to them.

What kind of tools do you use for that? Would they catch BadUSB-like malware?

Lasers, electron microscopes and x-ray scanners used for testing and verification in the semiconductor manufacturing industry plus loads of custom and open source tools.

Can it really be economically viable to have these scanned rather than just toss them out? I would imagine that anyone high enough in the EU to be a target is only using drives provided to them

It's not so much about being able to use a free USB drive; more about knowing if someone is distributing malware.

The economical viability of things is way above my pay grade but if I were to hazard a guess it could be just to know who is "out to get you" or it could also be one of many forms of corporate welfare the same way the US shovels money into the F-35 bonfire to keep its arms industry afloat, the EU could be doing similar thing to keep its own security critical industries going, especially since Snowden. My €0.02

Yes, x-ray scanners seem to of made big inroads and only recently I learned that companies use them to verify phones as in the past they would visual check them - but copies have gotten so good that xray is the only real way now.

Though even then, you have to have something to compare it with and also know what you are looking at and able to eliminate what should and shouldn't be there.

Though when you have multilayer flash, the possibility to have a nefarious layer, sandwiched between good layers, makes things way harder.

All that said, as a rule, I'd just downright ban any non-company/entity USB drive or any tech. Keyboards and Mice, more so.

>I'm sure the NSA has implants in the EU systems but they're not dumb enough to just hand them out on USB drives that can be traced back to them.

Why not? The US was found to be spying on Merkel and nothing seemed to come from that.

That's a good point. How much tracing back can be done if, say, I stuck the drive in my workstation and it proliferated over the DG's intranet? Assuming it's at least vaguely sophisticated wouldn't it obfuscate things like how long it's been on the system for?

Reply on news.ycombinator.com