Edward Snowden's lesson to both businesses and NSA | Hacker News Reader

Edward Snowden's lesson to both businesses and NSA

qz.com

62 pointsrdl23 comments

Is anybody else reading this guy's twitter account? He comes off like a massive asshole, and he throws around his PhD like Officer Farva. Is this indicative of the people who run the country's intelligence community?

It feels like they have no sense of perspective for the rest of society; it's like they're saying, "trust us you nerds, the ends-justify-the-means." Do they not realize that this nation is democracy, and the country decides as a whole our course, not just a select few? Wonder what his opinion on Aaron Schwartz is.

After reading through some of his tweets, I find myself more confused than not. Bizarre name-calling aside, his views are pretty inconsistent.

For instance, in the tweets cited in the linked article, he repeatedly mentions that IT [dorks / weenies / etc.] have low status and wide access. This is in line with the general premise, and makes sense.

However, some of his other tweets paint a starkly different picture, namely one in which Snowden is a "poseur", and agrees with other commenters' disparaging comments such as "he probably only had access to a printer and copier" or "was given powerpoint 100 training and has delusions of grandeur".

I agree. It all comes off as super-defensive, 'you guys just wouldn't understand' rhetoric. Not to mention all the insider backslapping. And the consistent claims that Snowden defected to China is clearly taking the situation out of context. Terrible PR for their side of the argument, at least, but fascinating (if not terrifying) insight into a bit of the minds behind the curtains at the NSA.

Maybe it's damage control? "No you guys, there are definitely absolutely no true Americans who are against the NSA. This guy? Oh, this guy is a Chinese spy!"

Character assassination. They are going to try and rip Snowden apart. I don't think they'll succeed though.

This is news? Your IT people have to have privileged access to your computers; they maintain security policies, they issue smartcards, they reimage hard drives. They have physical access to the machines. Of course they are your biggest risk.

1) NSA had official policies in the 1980s/1990s which would have prevented individual sysadmins from having broad authority.

A few changes have happened: explosion in number of systems, decline in quality of NSA staff (due to better opportunities elsewhere) on the tech/IT side, increase in contractors (who also tend to suck), politicization (since in the 1990s there was no clear mission, and in the 2000s there was not as morally justifiable a mission).

The NSA IT people I've met in the 2000s would not be people I'd hire to do IT/security. The older "former NSA" people I know are people I would gladly work with.

2) It appears Snowden has somewhat overrepresented the level of access he had.

If the rest of the intelligence community treats their IT people same as Schindler in his tweets, it's no wonder they can't get quality staff.

The essential problem is that once the IT people were held to an objectively lower standard AND paid better (because the government was having a hard time recruiting), it turned into a death spiral. Resentful career people shit on them more and thus they had to be paid better and overseen less and thus resented more and thus shit on more...

The correct solution would have been using more military people at NSA and accepting a much longer in-house training pipeline. The benefit is I'd trust an 8-12 year military IT veteran who served in general military IT then got put at NSA a lot more than someone hired as a contractor; much harder for the enemy to infiltrate someone, and someone who has been in for 8-12 years probably has a pattern of behavior, family, ties, etc. to make it less likely he'd accidentally or intentionally fuck you.

Schindler seems to be particularly upset (which is probably understandable) and maybe not representative of how people treat contractors normally :)

I concur with your correct solution. The military has been the normal source of reliable labor, even for support tasks.

The problem is that it's expensive and much more difficult to administer, but hopefully NSA and DoD in general will realize why mere difficulty of administration should not hold them back now.

Honestly the NSA is lucky that the first (known?) insider leak of this type came from a do-gooder instead of something more sinister.

I will say that civil servants tend to despise the contractors. I can't say I blame them either, it's literally a case of "dey turk our jeerrbs!". But fixing the rise of contractors would require both a decoupling of the military-industrial complex and possibly an overhaul of the civil service benefits/retirement scheme (as the whole point to hiring a contractor is that their staff are cheaper overall).

I don't think "contractor staff are cheaper overall" applies to IT or other specialty services staff. A Boozer getting $200k/yr is probably billed at...$350k? Assuming you need the position for 10y, that's 3.5mm.

You could keep a civil servant for $80k/yr and give him a $60k/yr pension for (say, $120k/yr for his working life) for an entire career of 30 years for that. Spend the first 5-10 on training (much of which is OJT, so he's still doing useful work), and you're still 10-15 years ahead, even today.

That's a great point, but unfortunately there's a real political cost to having civil servant headcount. People already complain all the time about how many people work for the Federal government alone, but if they knew how many civil servants there would be if we limited contractors to actual common business functions I think they'd be stunned.

That's partially the point :) If we had to account for headcount, we'd scale back our missions to things which were essential to national security.

Re point 2: The PowerPoint that was leaked has TOP SECRET on it. That is one of the highest levels of access imaginable.

eeeehhhhh... not really. A surprisingly large number of people have TS clearances, otherwise he'd have been making even more money.

I think the published numbers are 4.5mm clearance holders (mostly S or the DOE L; I've personally never met a C-holder); 900k TS+ (including TS/SSBI, etc.)

Essentially every military officer is S or better, I think, and virtually everyone in certain military units is S (IT, etc.) or in some cases TS (CI). That is a lot of people. A lot of 18 year olds :(

There are so many levels of "TOP SECRET" (channels, SAPs and other restrictive markings). TOP SECRET is essentially the beginning of "actually important" (and I believe there is even plenty of SECRET stuff with restrictive markings which is thus more sensitive in practice than generic TS; some of the restricted markings are in US Code explicitly and pre-date the C/S/TS system). The "SI" part of TOP SECRET/SI was probably more significant. The presentation itself wasn't hugely sensitive (somewhat informed speculation -- at least based on the parts which were published, and a generally informed but not specifically informed review). No specific collection techniques, etc.

It's not just opportunities elsewhere. I specifically chose not to apply for an NSA scholarship in college because I didn't want to end up as an Edward Snowden. And I'm sure there are plenty of others -- pretty much anybody worth trusting is bound to self-elect to exclude themselves from working for the NSA.

I'd actually be happy to help with NSA's COMSEC (defense of USG vs. foreign countries) mission. I wouldn't want to be stuck in bureaucracy, secrecy, etc. though.

I wish NSA would separate into COMSEC and SI at the agency level.

To be honest, when these things happen 6 out of 7 times I empathize with the 'disgruntled' IT guy more than the object of his revenge. IT is thankless and when smart people end up being forced to work for sickening immoral egos you can't expect it to end well. We're probably lucky that most of them use computers for their revenge and don't go for violence.

Oh, and the way these "blue badgers" talk is sickening. It's like they think they're the nobility or something. They should go join a monarchy if they want to act like they're the only ones who can make judgments or comprehend things.

They've already got it. It's called the NSA.

This has been true for a long time, however I am wondering if there is an opportunity here.

Why do IT admins get full rights to read data? Their job is to get the systems running, but somehow right now this means carte blanche from a systems perspective. It is easier to build a tool like that of course.

The problem arises with configuration of access rights, whoever has edit rights on that config, controls the system. Nuclear launch procedures have the famous 2 keys sequence where at least two people need to be involved - even if this is only Hollywood, the idea itself is quite interesting.

In IT systems this would mean some sort of approval process where any risky operation would need to get requested and confirmed by another party. You want a full data dump? Wait a sec, care to explain why?

Of course this wouldn't be foolproof, but better than the systems today, no?

Reply on news.ycombinator.com