Senators Offer to Let NSA Hunt Cyber Actors Inside the US
defenseone.com
defenseone.com
I provided their charter. It seems like many people want to falsely over simplify the NSA mission into something different than what the document states.
In summary:
* NSA derives authority as a component agency under the DOD, a defense agency
* The primary mission is to collect signals intelligence and conduct information assurance
* perform as executive agency of operational security over inter-agency communications
* liaison with foreign governments to conduct sharing of classified materials for signals intelligence
There isn’t anything in the charter that specifically separates the NSA responsibilities or areas of operation from such of the FBI. The largest difference is that FBI is a law enforcement agency, as derived from the Department of Justice while the NSA is not. That means the NSA does not have fourth amendment interests which limits information sharing to the FBI. The Wikipedia page on the NSA documents a few scandals in this regard.
The tl;dr is that agencies in the intelligence communities must take full consideration of Americans’ rights when collecting information, and historically have not found suitable procedures to operate internally that satisfy the lawyers.
That is how we ended up with FISA because we determined that the only way to protect Americans from the IC trampling on their rights (but still enable internal collection when necessary) was to have a judge examine every request to collect intelligence on US soil. The counter argument to this article is that the NSA doesn’t need specific permission from Congress to collect within the borders of the US- they just have to come up with a way to do it that their general counsel and the Attorney General agree protects the rights of Americans. I know FISA has shortfalls, but we shouldn’t get rid of it and enable mass surveillance of Americans by the NSA just because election security is a hot topic. The erosion of rights is nearly irreversible. There are other options that don’t worry me, such as asking the NSA to assist in securing our election process and critical infrastructure, to decrease the size of the blind spot they have and enable the FBI to do the internal monitoring as intended.
https://www.archives.gov/federal-register/codification/execu...
From those points I suspect the concerns are foreign government intrusion into US information systems and data exfiltration generally speaking.
My thesis is that the existing rules and authorities aren't the problem, and Congress doesn't need let the NSA have any more authorities. Especially so because the NSA director didn't even ask. They can/should work within their existing orders to secure the nation's critical systems, to reduce the vulnerabilities to a level that the FBI can handle them. Congress pushing to enable government overreach is not the solution.
The reason is simple. No American is ever supposed to be ‘the enemy’.
Huh? The Ohio National Guard was putting bullets into 13 unarmed students as long ago as 1970.
That ship has sailed.
https://en.m.wikipedia.org/wiki/Posse_Comitatus_Act
This comment, like the GP comment, serves to illustrate many people hold strong opinions on subjects where those opinions do not align with any evidence.
I don’t know what you’re talking about with ‘evidence’. These are rules of man, not of god or nature.
Since you mention not knowing what evidence is here is a definition: https://en.m.wikipedia.org/wiki/Evidence
In short evidence largely means not inventing your own imaginary bullshit.
The "Five Guys" committee that President Obama authorized, reported back with findings and recommendations. One of them, which that committee felt was the most important one, was to split NSA and US Cyber Command apart. They felt it was dangerous to have one person in charge of both communications security, and in command of their own Army, Navy, and Air Force.
Giving them more authority, especially authority that is already vested in a different agency, is a Yuge mistake.
The NSA is a US Code Title 50 organization. USCYBERCOM is a Title 10 organization. This means NSA is confined to intelligence and only USCYBERCOM is authorized for performing offensive capabilities. Having them together can create potential legal complications.
Things like working with companies and institutions to ensure they have proper security and encryption.
Thus, one of the most common good-government proposals that gets floated in this area is to divide the NSA in two, one group devoted solely to offense, and one devoted solely to defense. At that point, at least you can know whether one group did something wrong. The job of the offense group is to find vulnerabilities, hoard them, and use them to attack people. But the job of the defense group is to find vulnerabilities, publicize them, and make sure they get fixed.
Currently we have the offense group, but they like to pretend to be the defense group for PR reasons. This is not a great situation.
Your tanks are quite different from Turkish tanks: Turkish tanks are located in Turkey. You can bomb Turkey as much as you want without compromising a single American tank.
So once you have the attack, you know that
(1) The evil Turks have a hole in their defenses, and you can use it to spy on them;
(2) The righteous Americans have a hole -- exactly the same hole -- in their defenses, and you can use it to spy on them;
(3) Everyone else in the world can also spy on the righteous Americans, just like you can.
Now you have to choose whether your job is protecting the Americans or undermining the Turks. You can do exactly one of those things. If you protect the Americans, the Turks will receive the same protection. If you keep silent to let the Turks embarrass themselves, you're also letting the Americans embarrass themselves.
The parent poster said the NSA "can" do attacks that don't reduce the security US assets. They didn't claim that all possible attacks fit this description. For example they can try to guess at bad passwords used on that foreign computer system.
>>> how about the NSA used its powers to defend Americans instead of hoarding zero days and spying on them?
>> why does this have to be XOR?
Because these are opposed goals. Defending Americans means invalidating zero-days. You could restrict yourself solely to attacks that don't rely on flaws in the software. In that case, you would have no reason to hoard zero-days, because you are ideologically committed to never use them.
That would be weird in a few different ways. But most relevant here, it answers "Why can't we do both?" with "We can, as long as we never do the second one!"
This is not really a compelling response.
Saying "when these two goals come into conflict, I believe the first one should always take priority over the second one" does not actually amount to a claim that the two goals are not in conflict.
Having group doing both would be ridiculous. And this is happening with say NSA.
And situation is much worse than with bridges! Typically you can bomb bridge far away without affecting your own, it is often not possible with 0days and similar - we have one internet.
And if there aren't enough domestic terrorists, they'll take care of that, just as they did with the war on drugs (not enough criminals? make some).
They'll turn the US military industrial complex inward as they do it, mauling human rights further. Which is exactly what is being done in DC with the national guard and the entirely fraudulent reasoning for it. It's why Pelosi & Co. have repeatedly said that a 9/11 like response is needed to the riots at the Capitol, they're telling you exactly what they intend, it's comically out in the open. Their intention is to militarize permanently, their ideal is that the national guard never leaves and or is replaced by a new standing quasi-military force (if the US military can't operate freely domestically, they'll create something new that can that is a de facto military). It's just another notch in the authoritarian creep that has ramped up since 9/11.
If you made a wishlist that they're going to pursue, mangling encryption is right at or near the top.
And I don't understand how greater access would have helped with the Exchange exploits, except if the NSA was aware of what zero-days were being used they could contribute their knowledge gained from their exploitation of them.
When thousands and thousands of things happen which justify increased police oversight you hear "it's a complicated issue, we should debate it for a few more decades".
> Nakasone told senators that the U.S. was unable to keep up with the threat in large part because laws prevent NSA and Cyber Command from adequately observing adversaries operating on U.S. networks. “They’re no longer just launching their attacks from different parts of the world. They understand that they come into the United States, use our infrastructure, and there’s a blind spot for us not being able to see them.”
It seems like the gist is, FBI focuses on internal only threats, NSA focuses on threats from outsiders, but if you want to track threats on a global information network properly, you need someone whose purview covers both.
> “What I am identifying right now is our adversaries understand that they can come into the United States and rapidly utilize an internet service provider, come up and do their activities, and take that down before a warrant can be issued, before we can have surveillance by a civilian authority here in the United States.”