Hacker News Reader

Comment by betterunix | Hacker News Reader

This is news? Your IT people have to have privileged access to your computers; they maintain security policies, they issue smartcards, they reimage hard drives. They have physical access to the machines. Of course they are your biggest risk.

View on HN

1) NSA had official policies in the 1980s/1990s which would have prevented individual sysadmins from having broad authority.

A few changes have happened: explosion in number of systems, decline in quality of NSA staff (due to better opportunities elsewhere) on the tech/IT side, increase in contractors (who also tend to suck), politicization (since in the 1990s there was no clear mission, and in the 2000s there was not as morally justifiable a mission).

The NSA IT people I've met in the 2000s would not be people I'd hire to do IT/security. The older "former NSA" people I know are people I would gladly work with.

2) It appears Snowden has somewhat overrepresented the level of access he had.

If the rest of the intelligence community treats their IT people same as Schindler in his tweets, it's no wonder they can't get quality staff.

The essential problem is that once the IT people were held to an objectively lower standard AND paid better (because the government was having a hard time recruiting), it turned into a death spiral. Resentful career people shit on them more and thus they had to be paid better and overseen less and thus resented more and thus shit on more...

The correct solution would have been using more military people at NSA and accepting a much longer in-house training pipeline. The benefit is I'd trust an 8-12 year military IT veteran who served in general military IT then got put at NSA a lot more than someone hired as a contractor; much harder for the enemy to infiltrate someone, and someone who has been in for 8-12 years probably has a pattern of behavior, family, ties, etc. to make it less likely he'd accidentally or intentionally fuck you.

Schindler seems to be particularly upset (which is probably understandable) and maybe not representative of how people treat contractors normally :)

I concur with your correct solution. The military has been the normal source of reliable labor, even for support tasks.

The problem is that it's expensive and much more difficult to administer, but hopefully NSA and DoD in general will realize why mere difficulty of administration should not hold them back now.

Honestly the NSA is lucky that the first (known?) insider leak of this type came from a do-gooder instead of something more sinister.

I will say that civil servants tend to despise the contractors. I can't say I blame them either, it's literally a case of "dey turk our jeerrbs!". But fixing the rise of contractors would require both a decoupling of the military-industrial complex and possibly an overhaul of the civil service benefits/retirement scheme (as the whole point to hiring a contractor is that their staff are cheaper overall).

I don't think "contractor staff are cheaper overall" applies to IT or other specialty services staff. A Boozer getting $200k/yr is probably billed at...$350k? Assuming you need the position for 10y, that's 3.5mm.

You could keep a civil servant for $80k/yr and give him a $60k/yr pension for (say, $120k/yr for his working life) for an entire career of 30 years for that. Spend the first 5-10 on training (much of which is OJT, so he's still doing useful work), and you're still 10-15 years ahead, even today.

That's a great point, but unfortunately there's a real political cost to having civil servant headcount. People already complain all the time about how many people work for the Federal government alone, but if they knew how many civil servants there would be if we limited contractors to actual common business functions I think they'd be stunned.

That's partially the point :) If we had to account for headcount, we'd scale back our missions to things which were essential to national security.

It's not just opportunities elsewhere. I specifically chose not to apply for an NSA scholarship in college because I didn't want to end up as an Edward Snowden. And I'm sure there are plenty of others -- pretty much anybody worth trusting is bound to self-elect to exclude themselves from working for the NSA.

I'd actually be happy to help with NSA's COMSEC (defense of USG vs. foreign countries) mission. I wouldn't want to be stuck in bureaucracy, secrecy, etc. though.

I wish NSA would separate into COMSEC and SI at the agency level.

Re point 2: The PowerPoint that was leaked has TOP SECRET on it. That is one of the highest levels of access imaginable.

There are so many levels of "TOP SECRET" (channels, SAPs and other restrictive markings). TOP SECRET is essentially the beginning of "actually important" (and I believe there is even plenty of SECRET stuff with restrictive markings which is thus more sensitive in practice than generic TS; some of the restricted markings are in US Code explicitly and pre-date the C/S/TS system). The "SI" part of TOP SECRET/SI was probably more significant. The presentation itself wasn't hugely sensitive (somewhat informed speculation -- at least based on the parts which were published, and a generally informed but not specifically informed review). No specific collection techniques, etc.

eeeehhhhh... not really. A surprisingly large number of people have TS clearances, otherwise he'd have been making even more money.

I think the published numbers are 4.5mm clearance holders (mostly S or the DOE L; I've personally never met a C-holder); 900k TS+ (including TS/SSBI, etc.)

Essentially every military officer is S or better, I think, and virtually everyone in certain military units is S (IT, etc.) or in some cases TS (CI). That is a lot of people. A lot of 18 year olds :(

Reply on news.ycombinator.com