Hacker News Reader

Comment by dylan604 | Hacker News Reader

From under my tinfoil hat, I have to wonder why we would listen to any recommendations from the NSA? Why would we not believe they are going to make recommendations of methods they know how to exploit?

Taking off my tinfoil hat, I understand that one of the purposes of the NSA is to keep US information safe. Following their recommendations should make your data safer.

However, Snowden showed us that the NSA doesn't always follow the rules it is supposed to operate within. Does that mean they are always be suspect? How do we decide when their recos are for the good fo all?

View on HN

This is one of the arguments to separate USCYBERCOM and NSA.

IMO, the US should really strictly separate the offensive/SIGINT and defensive aspects of NSA into separate agencies, and move the defensive part out of the intelligence community. Make it part of NIST or something. It would restore at least a little credibility to documents like this.

The tricky bit is that offense and defense actually require the same knowledge. A 0-day is immediately applicable for offense and must be immediately patched for defense.

Not necessarily. In fact, depending on how they're structured, they can be quite complimentary. Red team strategies thrive off of this sort of competitive environment.

And for efficiency's sake they might even roll them into the same org, to remove red tape and logistical complications

A 0-day is immediately applicable for offense and must be immediately patched for defense.

This outlines why there's a problem with a single agency tasked with offense and defense. If you had agency tasked only with the defense of US infrastructure, it would have a clear mandate to patch zero days. Any "offensive" agency would have to deal with it doing this (just as such offensive agencies deal with zero days being patched by others).

It seems entirely reasonable to prioritize protecting US infrastructure over the possibility of a spy agency culling another nations' secret.

Legal mechanisms for one way doors seem possible. The offensive agency can communicate info about 0 days to the defensive one, but not the other way around.

Except bureaucracies are going to do what they do. The offensive agency will hold back information, and when an attack occurs on the defensive agency, calls for bringing the defensive agency under the umbrella of the offensive agency will be made.

Brats fighting over resources while Mom just wants to sleep. It's not their fault, it's the nature of political organizations.

Sure, you could fix it with centralized oversight and stringent information sharing rules. But eventually you're either strangling them with rules or building one conceptual agency.

The NSA has a long history [0](PDF) of providing guidance for "best practices" for securing USA corporate networks. It's part of their job.

[0](PDF) https://apps.nsa.gov/iaarchive/customcf/openAttachment.cfm?F...

Yes, I stipulated that in my post. However, we have seen how the NSA wants data from US corporations. If they make a "recommendation" for corps to use, then how do we know it is solely for the corporation's best interests rather than the NSA's own interests in more easily accessing the corp's data while providing false sense of security?

We do know that the NSA pushed for a particular type of RSA encryption to become the default because they already knew how to break the encryption. Once something like that is known in the wild, credibility will from then on be suspect at best as to true motive.

I feel it wouldn't be completely unjustified to trust NSA recommendations simply because America isn't the only country in the world with intelligence agencies. The NSA is commonly assumed to be offensive, but part of their job is to aid in defence as well. Ensuring (malicious) foreign actors have trouble gaining information is a National interest just as much as the NSA themselves gaining access.

Only if it doesn't make their own work any harder. NSA prefer weak security for everyone if securing US assets might risk others to be more secure too:

>NIST failed to exercise independent judgment but instead deferred extensively to NSA. After DUAL_EC was proposed, two major red flags emerged. Either one should have caused NIST to remove DUAL_EC from the standard, but in both cases NIST deferred to NSA requests to keep DUAL_EC"

https://www.nist.gov/system/files/documents/2017/05/09/VCAT-... [PDF warning]

I mean this question sincerely, as I'm a US Government employee currently and former Intelligence Officer:

What is it going to take to restore, or maybe even just establish, trust in US Government institutions by people in the US?

A free Snowden would be a good start

Not just freeing. Give the guy some kind of lofty award and have the next US president give it to him together with a speech explaining how great the things are that he did.

Actually, I don't think Snowden did that much. He exposed crimes, sure. But they still happen in darkness now. So there's this drifting time element to his story. It's in the past. And the systems that are in place for accountability didn't result in any accountability. Rather things just went dark.

Maybe have a ponder about, if Snowden didn't happen, what would be different about today?

Upside from Snowden, the intel community got better controls around administrator access on their networks.

The point of Snowden's actions was to reveal what our government is doing in an attempt to force them to change it. The immediate branding him as a traitor and foreign agent both allows the government to continue the illicit activity and discourages others from revealing damaging material.

By pardoning him and then rewarding him for his actions, it at least signals that government organizations shouldn't engage in similar activities and will lead to other people stepping forward if they do.

>it at least signals that government organizations shouldn't engage in similar activities.

This is the worst way for the executive to send signals to the organizations it controls.

It also assumes that the alphabet agencies were building these systems without government knowledge. But, everyone knew. They got the money for the project from the government. Sending a signal would be better achieved via legislation. Snowden should have leaked to members of congress.

I strongly doubt Snowden will ever get a pardon. It would be rewarding people declassifying large government programs based on their feelings about those programs.

>But, everyone knew.

So why would Clapper lie about it to Wyden? Additionally, what good would leaking it to Congress do then?

As a whole, I agree that the pardon alone would be a poor signal. Ideally it would be accompanied by additional changes. You argued that Snowden didn't accomplish much though and part of the reason is the hostile reaction from the government.

>It would be rewarding people declassifying large government programs based on their feelings about those programs

If a program is classified, it shouldn't be in a moral gray area. The public should be aware if we're committing unethical acts.

I agree with you but I think Snowden could have gone a different route. Probably to the same effect, with less damage to his own life.

Most things that are classified are in the morale grey area.

Strict civilian oversight, transparency, protections for whistleblowers, and culling much of the current leadership

Prosecution of government employees and officeholders. You don't gain trust without a reason to trust you. There is no magic reset button. After COINTELPRO and Iran/Contra and Snowden, the USA Intel establishment has a solid record of attacking their own citizens and behaving as though laws don't apply to them and there is no oversight. Valerie Plame?

And then there's the last five years, starting with the Clinton email server. The Intel community can't prevent that, and then the FBI goes political at the end of election season?

There is no trust of intelligence agencies because they have proven they deserve none.

I logged in just to upvote you. This! 100%

Put Edward Snowden in charge of NSA.

I know that sounds ridiculous, but you asked.

Human civilization has a long history of people who were exiled for their priciples returning as great leaders. It's a hard-to-fake signal.

In addition to what others have already said, actually preventing major breaches like the recent Solarwinds hack. Eg, besides the tinfoil hat stuff, just getting the basics right.

Personally I'd like to see the entire US govt IT infrastructure rebuilt around DARPA's HACMS project [1]. Get rid of Windows, base it all on SEL4 Linux or similar, rebuild the apps (everything in userspace), etc. That would significantly reduce the attack surface. Huge project obviously, but one can wish.

[1]:https://www.darpa.mil/program/high-assurance-cyber-military-...

You probably don't need HACM. Microsoft Research has produce quite a number of software and compilers for producing provably secure low level code and drivers.

You missed the part about basing everything on SELinux4. That would mean drop Windows. I'm all onboard for that.

When are we getting that in Windows? It needs to start with a formally verified OS (and firmware), then build a provably-correct protocol/driver/app/etc stack on top.

MS was working on Singularity [1] a while back, but its webpage speaks of it in past tense, so it doesn't appear to be an ongoing project.

[1]:https://www.microsoft.com/en-us/research/project/singularity...

Microsoft, and more importantly Microsoft Research, have many, many projects tackling this. Off the top of my head: the P programming language, F*, Dafny, and a bunch of others (I think the last two are part of something called Project Everest). Microsoft Research is one of the biggest players in this field. A lot of their efforts span multiple departments so you will have to search around.

Yup, I'm aware they do a lot of work on this, and hired up half the Haskell and PLT researchers in the world, and have a bunch of projects on it scattered across their web properties.

And maybe some of it is trickling down into parts of Windows or .NET, like F# and others, but I wish they'd develop an entire ecosystem around it and make stronger push to commercialize it.

With all the aforementioned resources MS has at their disposal, by now they should have their own version of SEL4, comprehensive tooling for secure-by-design and correct-by-construction application development, and optionally secure sandboxed containers for backward compatibility with legacy apps. Though ideally MS funds a Manhattan project for rewriting the most popular apps using their SxD and CxC tooling.

Singularity was on the right track, but they let it languish and die for some reason, when instead they could be rebuilding an entire secure/correct ecosystem with Singularity as the focal point, and commercializing it with enterprise support, and selling it to governments and large enterprises with significant security concerns.

I wonder why this hasn't happened yet.

https://en.wikipedia.org/wiki/Secure_by_design

https://us-cert.cisa.gov/bsi/articles/knowledge/sdlc-process...

It is hard to iterate and make changes when your codebase relies on human/machine assisted proofs. Great for airplanes and cars when regulatory approval means iteration is slow. Not so great for consumer software.

Good point, though I’d suggest most consumer software, at least office apps and similar needed by the government, are mature enough they don’t need rapid iteration. Most new features being added to them these days are optional at best.

Decades of transparency and trustworthiness.

James Clapper is still a free man despite lying to Congress and the American public, so I don't see why anyone should trust a word anyone says from any US intelligence agency.

Well, Clapper did come back for another visit with a statement that could best be summarized as "Oops, my bad". So, to Congress, that's apparently enough. Congress basically has battered spouse syndrome*. They desperately want to believe things will change, but it never does. Instead, time after time, intelligence communities run roughshod over whatever civilian oversight they subject themselves.

*I absolutely am not trying to belittle abuse by using that phrase.

Your successes are secret, your failures are known. That's your industry's catch phrase.

Here's a list of things I can think of:

1. If you're the CIA/NSA, stop spying on American citizens.

2. See #1

3. Stop NSLs. If you want data, get a valid warrant visible to the public. Allow companies to inform their users/customers that their entire platform is vulnerable.

4. Subject yourself to non-govt over view.

5. Stop hoarding 0-days, and actively work with vendors to fix vulns.

Don't know how to fix it, but until you're no longer in the news for screwing up, this is where we are. Your internal documents show that all of that data slurping has not led to significant positive results. Why spend the money on it then? Why erode the trust that you want? You don't want to tip off the advesary, but your own citizen's rights are much more valuable than what little information you are getting.

Want to add one more thing:

6. Whenever coming up with a new spying/data collection scheme, ask yourself "in the light of public outcry in the past, how would this new thing be perceived?" Be honest about it, and not hand wavy "the public will be okay as long as we catch bad guys".

For odd family reasons I have a lot of acquantances in SOCOM and intelligence orgs, and I've been around these sorts of people long enough to know that the vast majority of them are well meaning and sincerely eager to do the right thing. But see, that's the problem: they're all employees, and they all report up the chain to an unelected appointee, far removed from any voting-based accountability.

I don't think the trust will ever come back because I don't believe the government has the right incentives in place to restore trust. It only gets worse from here. And certainly nothing I've learned about them in the last 10 years would convince me otherwise.

Nuremberg set the principle of "just following orders" isn't an excuse. Employed or employee; both are guilty.

Sure they set a precedent for war crimes. Spying on your own citizens? It's not even apparent that that is a crime, just abhorrent.

It is the nature of trust that it is easily lost and difficult to regain. Basically trust is based on experience over the long term. If there are good experiences for a long time trust grows. Any breach of trust resets the trust clock to zero (or even to a negative value).

A number of years of good behavior.

The numbers going to be a bit different for everyone, but as the years go on trust will be built with a larger and larger portion of the public.

Host all their secrets and vulnerabilities on their site and shut down everything else. Prosecute everyone involved. Follow Nuremberg principles set by the US itself (IE. "I followed orders" is not an excuse.)

NSA recommendations for the securing of government infrastructure should be listened to by corps with the normal grain of salt of understanding when and where it is appropriate to apply such measures.

NSA recommendations for the securing of enterprises and corporations should be ignored or avoided. If it was actually secure, they would also recommend it for government use

I can see the logic in your theory. Further testing would be required for validation though. I would almost expect the public recommendations for corporations to be different than a company like a defense contractor.

At the end of the day, it's ther own damn fault that their recommendations are viewed so skeptically.

That's the frustrating thing. The NSA actually used to be good, and generally useful towards securing our digital borders. SELinux, for example, was a contribution to the linux kernel that is generally highly regarded and well vetted, and it was freely given to us plebs that don't have nuclear arsenals to secure.

But now, everything is different. They've been telling us to use flawed crypto algorithms simply because they know how to break them and they can have access to whatever they want. With our current-day NSA, our least risky choice is to consider the NSA an adversary, just like North Korea, Russia, or China. Nothing they say should be taken at face value.

Pretty shitty that we have to treat our own government security agencies like that.

Let us not forget the elliptic curve backdoor they gave themselves a few years ago. https://www.wired.com/2013/09/nsa-backdoor/

> I have to wonder why we would listen to any recommendations from the NSA?

Because the NSA is a defensive as well as offensive institution, they defend the home front as well as they attack adversaries

> they defend the home front as well

No they clearly do not, not if it makes it any harder for themselves. They include weaknesses and backdoors in products and encryption used by US companies too. That is the direct opposite of "defending the home front".

Under what threat model would you be threatened by a domestic spy agency having a backdoor? Ignoring the red herring that "backdoors don't stay hidden".

That's far from a red herring. Lawful intercept features have been hacked before, and NSA tools have been leaked before.

Apart from that, do you really want your infra to be someone's pawn on a virtual battlefield? Nothing they do is going to be in your direct interest.

Apart from that, there is parallel construction and rapidly shifting social/political winds that can turn inoccuous one day into verboten the next.

My instinct would be to say to verify what they are saying, but it seems like we should just take advice from the people who we would verify with it in the first place

Reply on news.ycombinator.com