It doesn't matter. We've invested so heavily in offense that we can tell people how to defend themselves and we'll still own them.

Here's one of my favorite talks,

NSA TAO Chief on Disrupting Nation State Hackers

https://www.youtube.com/watch?v=bDJb8WOJYdA

This is the NSA Chief of Tailored Access Operations telling people how to defend themselves against the NSA (and other similar capabilities organizations), and it's all really valuable. None of it is fancy ML 0day detection or whatever, it's just about understanding your network better than an attacker can.

https://www.nsa.gov/what-we-do/research/selinux/

> The NSA, the original primary developer of SELinux, released the first version to the open source development community under the GNU GPL on December 22, 2000.

https://en.wikipedia.org/wiki/Security-Enhanced_Linux

Suffice to say, these attackers will already have ensured they maintain persistence even with closing their initial entry points.

Likewise, the NSA has many avenues to get into a device, or (more practically, when it concerns most of the public instead of specific users and devices they need access too) they use mechanisms that aren't affected.

As they've proven, they have a huge catalog of malware and similar, but that's for actual targets. People they already believe to be threats or targets, that they need to directly attack.

But for the majority of the public? The information will come from the companies themselves, not the user devices. Why would you spend thousands or millions on developing and maintaining an application you can put on everyone's devices, and may be removed, or even just disabled due to an upgrade (until you can patch it) when you can find and obtain data from a company that already has common apps on a device, across the public, and the public not only knows they are there, they WANT the app and will take steps to complain if access is rejected? And the companies will gather as much as they legally can (and sometimes more), put it into databases, sort it, categorize it, etc?

Why would you duplicate ALL of that, when you can just take the finished product, the sorted data that's stored, either legally and knowingly, or unknowingly from a company?

And you ensure that while you can maintain that access, either to the company or the device, you direct the users and company on how to protect themselves from random attacks, or other entities that want to target the users, often with automated software that hits the "low hanging fruit".

I’m sure NSA has an important role in managing the cyber risks of US citizens, in addition to the offensive ops.

https://www.youtube.com/watch?v=y5g7Z1qC7-k

"Most likely?" More than Facebook or Google or some other human profiling company?

But let's be real, if you truly can evade them, you've probably already received a job offer.

Defense will always be harder than offense. The best you can do is make it extremely EXPENSIVE for an attacker. But can you outspend the NSA on your defense? (the answer is NO)

Not even Snowden thought it wise to reveal secrets related to ongoing operations. That would have been TOO expensive for him. We would not have known his name if he had done that.