Hacker News Reader

Comment by Pwntastic | Hacker News Reader

The FOIA documents are up on archive.org now: https://archive.org/details/nsa-furby-memo/

I'm amused at page 8 of the listserve doc, in which someone points out that the ongoing discussion may at some point be released to the public under FOIA and to consider how it might look after showing up on the front page of a news site

View on HN

It's interesting to see how quickly the norms around cybersecurity changed. In 1999 the NSA was worried about avoiding ridicule for banning simple electronics in secure areas. In 2010 Stuxnet was introduced via simple electronics into a secure area and set back the Iranian nuclear program by several years.

Some of the people receiving these furby emails were probably already conceiving of (or actively working on) Stuxnet-like capabilities. Maybe a future FOIA request will reveal several teams quietly emailing up the org chart to absolutely not relax the rule for furbies.

NSA is a military agency; their norm has always been to protect US assets and attack others.

The NSA is not a military agency. It is within the dod, it provides combat support. But it is emphatically not a military agency.

Emphatically? The director of the NSA is required to be a four star general and concurrently serves as commander of US Cyber Command. Ostensibly non-military, perhaps.

The director is required to be a commissioned officer (and upon taking the role gets the O-10 grade) because they also head Cyber Command and the CSS (Central Security Service) but they don't really "run" the NSA like you'd expect say the director of the FBI or CIA to. Their role instead is mostly to coordinate the interaction between the NSA, CSS, and CYBERCOM on top of running CYBERCOM itself.

When it comes to actual day to day operations however the deputy director (who is required to be a technically experienced civilian) actually runs things and reports directly to the president. The director isn't actually in the deputy director's chain of command however one of their job roles is to provide advisory support to the director when needed.

The assistant Secretary of Health is also a commissioned 4 star admiral but they have never seen been the inside of a Navy ship. The last one was a pediatrician before joining. There's a lot of symbolic and tradition based commissions like that through the US gov.

Commissioned in the US Public Health Service, not the US Navy. Their ranks are the same as the Navy's, but they have no connection to the Navy.

The NSA literally performs cyber attacks on foreign countries.

You are incorrect. There are two categories of intelligence agencies in the US as a matter of law, with significantly different legal authority and structure.

Intelligence agencies like the CIA, FBI, et al are non-military. NSA is explicitly a military agency and operates under military authority. The easiest way to tell the difference is that the Director of military agencies is always an active military flag officer. It isn't just a superficial distinction, they operate quite differently.

It’s important to remember that “DOD” is a pathetic rebranding attempt of what it was originally founded as and continues to operate as: the Department of War.

How are you defining "military"?

Subscribed.

It is no more a military agency than NASA or the USGS. Having military customers doesn't make an agency or company part of that military.

NSA is in the Department of Defense, commanded by a uniformed officer, employing many (how many?) members of the military.

NSA dealt with cases of espionage via the introduction of simple electronics into secure areas decades before [1] [2], so awareness of the risk was likely widespread.

The issue here seems to have been that in 1999, it was a relative novelty for random consumer devices to have a recording functionality. Hard to imagine now, but there we are.

[1] https://en.wikipedia.org/wiki/The_Thing_(listening_device)

[2] https://www.cryptomuseum.com/covert/bugs/selectric/index.htm

>in 1999, it was a relative novelty for random consumer devices to have a recording functionality. Hard to imagine now, but there we are.

For added context, the plot of the movie Charlie's Angels from the year 2000, was about stopping an evil guy from using some evil software he developed to ... track people using their cellphones. (ㆆ _ ㆆ)

> For added context, the plot of the movie Charlie's Angels from the year 2000, was about stopping an evil guy from using some evil software he developed to ... track people using their cellphones.

This makes me think we should have a big revival for that movie.

On the other hand, essentially the same functionality in a more grandiose presentation was prominently featured in Batman Begins (2005) and the explicit message was "not even Batman should be able to do this".

I believe you’re thinking of the sequel, the dark knight, 2008

You appear to be correct.

Enemy of the State came out in 1998. It was only post Snowden leaks that some of the tin-foil hat conspiracy stuff was confirmed.

Welp I’m still waiting for my 360-degree camera tech…

Just bought a dash cam that does this for my Camaro - works wonders!

That wasn't a 360 camera, that was the computer assuming what the other angles could look like, and you could do that now with ML.

Which is, of course, completely ridiculous for us in the year 2024 where random consumer devices feed every bit of data they can conceive about their surroundings into semi legal data aggregators 24/7

Wikipedia claims the nsa's active cyber mission (anachronistic terminology ) was up and running from as early as 1997, so there were definitely people having those thoughts and working those capabilities. And we're totally ignoring people like Markus Hess in the 80s. Thank you for taking the time to add perspective to the knee jerk reactions.

The IR transmit capability of the Furby was a legitimate threat. PalmPilots of the era were permitted inside a SCIF providing they had their IR ports covered by an opaque sticker and weren't a model with a radio.

Yep. Who would have guessed 25 years later I'd be bored and then a year later this packet showed up at my doorstep? It's oddly perfect timing, around all the AI discourse. :)

I'm surprised it only took them a year. Would you care to share more about your experience on filing FOIA? The circles I run in seem to view it as a clunky, bloated process, but I feel like it has gotten better than when it was introduced. I have zero first-hand experience, though.

No problem to help, but bad news: Every government agency has different processes. You'll have to go through their own FOIA office.

The NSA FOIA form is actually really easy: https://www.nsa.gov/about/contact-us/Submit-a-FOIA-Request/

I simply asked for what I wanted (information about policy memos about 'Furby Alerts' and recording devices at the NSA from late 1998 to early 1999) and submitted the form. About a month later I got a response back from the NSA acknowledging they got my request, and located records that were part of another FOIA request being processed as well, so I'd get those documents as well once released.

And then... yesterday afternoon I got the message "hey what did you get from the DoD?" - bewildered, sending me a photo of the cover (in the full article). They finally delivered, and I hastily scanned my spoils for everyone. :)

And to piggyback on your comment. State FOIA is a different beast to federal FOIA. Lots of states have much tighter timelines. Illinois requires the government body to respond with the records within 5 business days.

https://www.muckrock.com/ seems to have a lot of good information on this too, and fun-to-look-through archives of requests and responses.

I need to redo my FOIA request [0]. I was investigated by the Secret Service in 1996 as they thought I intended to assassinate President Clinton. This was down to me selling a selling a shell account on a Linux server to someone, who in retrospect, might have had fundamentalist ideals and that person sending a detailed email to the White House outlining their plot, from my domain.

I always wanted to see the chain of events that led to the Special Branch turning up on my door step in England.

[0] I FOIA'd this a couple of years back, but I changed address and never got the documents, only a letter to say it was being worked on.

They wanted to avoid FURBYGATE. They avoided FURBYGATE. Sounds reasonable to me!

Right. The whole email thread seems very reasonable to me. TFA characterizing this as "freaking out" is nonsense.

Reply on news.ycombinator.com