Live on C-SPAN now: NSA Chief Testifies at Cybersecurity Hearing | Hacker News Reader

Live on C-SPAN now: NSA Chief Testifies at Cybersecurity Hearing

c-spanvideo.org

147 pointsgravitronic98 comments

In this hearing there has been so much smearing in reguards to Snowden's educational background. There are plenty of smart people who didn't graduate from high school.

It may be true that people without traditional education credentials are likely to be less conformist/more likely to cause trouble.

Whether that so-called "trouble" is good or bad and for whom is another thing, which can be quite subjective even.

Problems at school aren't necessarily an indicator of a failure. There are many examples of bad school performance which doesn't result in bad performance in whatever the person pursues. As far as I am aware, even Einstein didn't really like being in school and had problems concentrating, yet his scientific achievements are undeniabe.

Hence the problem with focusing on educational background is that it gives the false impression that bad background -> bad person. What Snowden did is, as far as I am aware, considered an extremely good thing when it comes to privacy of US and non-US citizens alike. So again, Snowdens lack of educational background could be viewed in similar light that of those others who haven't been hindered by the lack of school performance in the past(and in the future).

I claim that school and educational performance doesn't mean a shit in individual basis(as in case of Snowden, he's an individual after all), although it might mean when one evaluates people collectively as a group. And even then exceptional individuals come up.

I think what Snowden did is a great thing, but it probably isn't great from the NSA's perspective. The NSA probably wants smart people who can do what they're told and keep their mouths shut.

As far as I am aware, even Einstein didn't really like being in school and had problems concentrating, yet his scientific achievements are undeniabe.

Not sure about that: http://www.abc.net.au/science/articles/2004/06/23/1115185.ht...

He certainly excelled in many scientific subjects but the rest didn't interest him.

I don't have anything to cite this with(apart from knowing that there's talk about this in Wikipedia) due to time constraints right now, but many very well developed individuals get bored at school because the education is outright boring for them, the rest are so far behind to them that they are forced to deal with stuff which they already excell at very well and thus they get bored. I think this is how people like Einstein must have felt, and there are many cases of this happening all the time.

People simply are different, others learn faster and are more developed than others, and for many of those the slower pace of education feels outright boring and demotivational -- it's not the lack of intelligence, willingness or ability to learn but rather the school system itself.

Such people are among school dropouts for sure. I too dropped vocational school because of the mere reason that I'd rather study math and compsci on my own than about metal surfaces and lubricants with a bunch of retards. Yet, I have "failed" the most basic secondary education in this country. Yay, what a failure with tons of willingness to learn and understand. This is partly the reason why I hate it when people judice others based on their education, there are cases where it tells absolutely nothing about the person's ability and motivation to learn when the subjects match it.

And the intelligence community actively recruits high school graduates because allowing them to go to college decreases the chances they can recruit them later.

Plus, Congress serves as evidence that you can have plenty of college graduates who are complete morons.

This is like watching a super awkward scene in a movie or TV show that just won't end.

The word "cyber" has been applied to every noun, and I've apparently been out of the loop on terms like "techno-boondoggle".

This is just a little terrifying.

What about cybernouns? Do we have those yet?

#yeswedo

Cyberhope, cyberchange, etc

im !american so really not backing hope and change here... but should not you/we be directing our vitriol in a bipartisan fashion?

with regards to the mass expansion of surveillance, shit seems pretty fucked up across the political divide.

It's really funny. Civil liberties seem to be the one thing that both Democrats and Republicans can agree is worth protecting, but both Democrat and Republican politicians tend to give bipartisan support towards programs that infringe on them.

It is like "verbing", but infinitely more annoying.

Since about 2001 I've considered anyone who used the word "cyber" to either be internet-illiterate or a politician (usually both).

It always makes me think of the Cybermen from Doctor Who. Fits perfectly.

I honestly cringed at "Cyber-warriors"

[1]The term arose from a 1935 New York Times report that more than $3 million had been spent on recreational activities for the jobless as part of the New Deal. Among these activities were crafts classes, where the production of "boon doggles[2],"

[1] http://en.wikipedia.org/wiki/Boondoggle_(project) [2] http://en.wikipedia.org/wiki/Scoubidou

Oh, this is awesome: Keith Alexander explaining how what we really should do is let the NSA have a database that stores absolutely everything, and then they promise only to search through it when it is "reasonable."

See, I'm personally of the same opinion. I couldn't figure it out, but then it hit me. It's the same line of logic that the military uses in their security clearances. Back in the day I used to work for a JAG lawyer, and have several friends that are/were in the military. So I do have some knowledge of the matter.

The way they do things is this. There's clearance and then there's need to know. So for instance one of my friends worked in network IT for the military. So had access to computers with "top secret" information on them. However, he wasn't allowed to access any of the information on the computers. Simply to use them for his job. Sound familiar to what the NSA is saying?

If there's other people on here that are closer to the military than I was please correct me, but it all starts to make "sense" when you think about it that way. I'm not saying it's right, in fact I think this system is likely problematic in a non military setting (and perhaps even within one as well)

I was in the military, with a clearance. You describe it reasonably well. A clearance means you can have access, if needed. I am completely against collection of information as they are doing because of time. A warrant gives them access to data from all time. This is a departure from current warrants that allow them to collect and examine data starting now (or as far back as it was stored by external parties). It's the difference between getting a warrant to wiretap a phone and getting a warrant to listen to every phone call ever made with a phone. In my mind, a warrant says we have have reasonable suspicion to collect more information as it stands right now, not reasonable suspicion to examine past behavior. Then again, I believe that the U.S.'s definition of rights are great and should be extended to all humans by the U.S., not just citizens or those on U.S. soil.

This is pretty basic stuff for those in the security industry. Read about mandatory access control if you are more familiar with discretionary access control (what happens in most off-the-shelf operating systems) as an interesting example of how things are done differently.

Access control is one thing but:

1) How can we guarantee that the control cannot be bypassed when everything is secret? 2) How can we guarantee that someone with clearance is not selling information to criminals?

Here's something I've been thinking about, let me know your thoughts: I'm thinking of the nuclear bomb analog. Other people have nukes, so we need nukes, and we have to trust the government not to turn nukes against us. Is it possible this is a similar example...and what we really should be doing is having oversight on the analogous launch codes...etc?

Note: this is not saying what they did was legal.

Problem with that comparison is that while a government could make and store nukes without people knowing, it's hard to start exploding them without attracting attention. Accessing a database, on the other hand..

Right so what I'm imagining is basically (for lack of a better term) a QA framework that tests that the instrumentation for tracking access...etc is legit. You could say that blowing up even one nuke without proper oversight is unacceptable and thus we have mechanisms in place to make sure the right bells and whistles are trigged.

EOD launching a nuke and using PRISM data are keystrokes on a computer.

Sure they're keystrokes, but if the software/audits/etc. are run by the same people who might want to abuse it, it doesn't mean much. And put yourself in their shoes: if you abuse a secret database, you likely won't get found out. If you abuse the nukes you most likely will.

Right so it's more difficult to do, but you can separate out the testing team or do other things to be rigorous about detection. At the very least you can make it more difficult than sitting down at a terminal and hitting go. One sort of simple solution I can think of is having passwords just like nuke authcodes that have similar restrictions that are passwords for access and decryption...etc.

And if the government (right at the top) decides they want to start accessing it regularly without the public knowing (like the current situation), they control those separate testing teams, and can authorize secret access at any time?

I think if it involved Presidential and Congressional approval and had things like exact query logging and required declassification prior to prosecution than that would be reasonable.

No - launching a nuke results in a thermonuclear explosion detectable from space - not just keystrokes on a computer. Keystrokes on a computer can be hidden, those mechanisms can be by-passed - and no satellite from space is going to detect all that and alert us to the problem in the reliable and impartial way that would be necessary.

My point was that even 1 unauthorized nuke is completely unacceptable and we have mechanisms to prevent it.

I see. I understand that a little more. I still disagree, however. There's a huge incentive for the government to keep those mechanisms working, and we'd all know it if they didn't. That's definitely not the case with the NSA. How will we know there isn't some secret backdoor?

It would be so much more difficult to detect unauthorized searching vs unauthorized nuke use that you can't really compare them.

I find it deeply disturbing that Sen Mikulski clearly does not understand the meaning of the words she is reading.

I noticed the same thing. I wonder if someone from NSA wrote all of that for her to read.

The NSA is a huge employer in her state of Maryland.

Since I am unable to access the stream at this time, in which way is her lack of understanding noticeable?

Mostly the words she's using and how she seems to stumble over them. Every single noun has been affixed with "cyber" and I keep hearing the word "technoboondoggle". I have no clue what that is.

Keith Alexander is a true politician, regardless of his title. When asked a question "could these powers be used in this way" answered the question he wanted to answer "we only use the power in this way."

He also dodged the question "can you get Google contacts?" by rambling off. And then he apologized and said he was afraid he'd reveal something important and that he'd answer the question in a private non-public meeting.

It's as if all the important decisions have already been made and they are just going through the motions.

That's exactly it.

Yeah. They are all reading from scripts. "This is something that we take looks down at script very seriously." Also, it appears that they were all privy to what each other was going to say before the hearing. "looks down at script As you said ..." Does that disturb anyone else?

It is already known that the NSA chief received the questions Sen. Wyden planned to ask him in advance, to give him time to prepare a response, a few months ago. This is said as if it is business as usual (and used to paint him in a worse light, since he lied before Congress after being given time to plan his answers), and I have no reason to think it is not.

Yet another reason to vote third party.

I had a little trouble parsing your first paragraph. But vote third party? Now you're speaking my language :)

It was a clever move by Wyden to try to catch him in a perjury trap.

Maybe so, but the fact that nobody even seemed surprised that someone would be sent questions in advance of their appearance before Congress is what concerns me. This seems to be a normal, expected thing that happens when powerful people are questioned by Congress -- the whole thing is just for show. If you are going to email your questions to the person in advance, you might as well just have them email their responses.

I don't know what I find more disturbing: the complete and utter disregard for the rule of law by our elected and appointed officials, or the fact that some people find no fault with that.

It's not always the case. But sending a witness questions in advance: a) increases the odds you can nail them for perjury and b) takes away the opportunity to say "I haven't been briefed on this and I'll get back to you later."

This came up about 10 minutes ago with FBI director Mueller's Judiciary appearance as well. Chaffetz wanted to nail him on geolocation surveillance and sent questions in advance, and Mueller said he ignored his aides and didn't read the briefing. Bad form.

If you notice, many of the papers were passed to him as he read, so it's possible one of his advisers had many prepared answers or simply wrote them down as the senator asked him questions.

It wasn't just him, it was everyone, the senators included.

The delivery was a bit weak though, maybe they should get some professional actors in.

Every time she says "protect the american people from" I keep filling in "the NSA and other overreaching government agencies" in my head.

This is really an incredible spectacle of audacity.

The depressing thing is Durbin wasn't smart enough to articulate it, but when he tried to ask "do you collect metadata or other data about non-telephone communications", GEN Alexander did a great job of misdirecting to being about court orders and getting access to a specific individual's information.

Knowing if metadata is collected broadly, and what metadata is collected, is key. There's probably no chance of that in unclassified congressional hearings; only via leaks.

We know they collect credit cards and some other records (air travel and customs/immigration for sure, and probably hotels and DMV and other government records, what else).

Oregon's senators are far better than I reasonably would have expected. Watch Senator Merkley question at 1:21 "exactly how did you get from these restrictions to collecting EVERYTHING, including my god-damn cellphone right here" (or something more polite, possibly). GEN Alexander decides to defer to the Feinstein classified hearing; i.e. not answering, by saying, "let me make sure I get this exactly right, because it is a complex area."

Mikulski keeps calling "identity theft" war. This is a crime, it is not an act of war!

They're talking about their battle against cyber-crime as war - which is a reasonable statement to make. It's just the same as when governments and new agencies talk about the "war on drugs" etc.

Exactly, that is what scares me!

What's what scares you? The fact that the term "war" is used informally?

Drawing comparisons to "the war on drugs" brings to mind a perpetual hopelessly misguided attempt to completely squash the unsquashable by throwing money at the police (or the equivalent), the escalating militarization of the police (or the equivalent) and the abridgement and/or suspension of civil rights (most notably the fourth).

So I've got to say, it scares me too.

That kinda makes me want to see everyone that uses that rhetoric from the president downwards sent to base camp and then few tours of duty to Afghanistan to see exactly what war is.

Then they probably would use something softer.

I don't particularly like that particular symbolism either, but I do think you're overstating things somewhat as the term is clearly meant as a metaphor rather than a literal analogy.

It's not even as if they're glorifying nor trivialising real life war. It's just an expression.

However I do agree with you (and the OP) that the term was clearly picked because it has more impact than just saying "our project to cut down on x"

But anyway, I'm sure there's more relevant things we can discuss on this topic than arguing the justification for one word. :)

War on privacy?

"Protect our domains .gov .mil .com" -- so it's all about DNS attacks?

I guess I intellectually knew, but didn't fully appreciate, just how old all of those people are. Working in Silicon Valley, I'm used to seeing 20-45 year olds in lots of useful roles. Everyone in that room seemed to be late-40s or older (the military people were the youngest).

Well...

No offense...

but I wouldn't want the younger crowd sitting around deciding when to launch a nuke.

It's fine to put us in charge of the "like" buttons, Farmville tractors, or a web pages like Yahoo or Facebook. But some things are a bit more important.

It's fine to have younger aids or advisers. Probably good to have youthful energy INFORM certain decisions. Not so sure it's a good idea, however, to have youthful energy MAKING certain decisions.

And I say that, I guess, as part of what's considered the "younger crowd".

There is also a difference between not having younger people (like, ahem, '30') in charge vs not even having them as part of the discussion at all. Experience has value, so does a diversity of backgrounds.

I really want artists to decide solutions to my power and infrastructure problems.

Now you get lawyers and a social worker doing so! (well, after they spent ~30 years in Washington mainly fundraising).

Having the old farts make all the decisions about technology is what got us into this situation in the first place.

A bit of life experience helps in governing a country. That being said, it is unfortunate that as people age, their minds tend to "solidify" and they have trouble understanding new things. The problem (which is evident over and over) is that Congress, while full of useful experience and wisdom accumulated with age, is also 20+ years behind the times on many issues.

Most of the good IT/security people I know are in the 30s/40s. That seems fine for judgment; I just don't want all of our legislators in their 60s+.

The conclusion seems to be that in order for the NSA chief to answer any interesting questions they have to declassify information. Which the NSA chief believes is a good idea as long as it doesn't harm the american people. What pieces of information they should declassify and make available to the public will be discussed in the closed hearing.

Edit: Spelling

Sounds like we're going to see CISPA and CALEA-2 pass, especially with such a large emphasis on public-private partnerships and 'embedding' security methodologies/frameworks into products and services.

Mikulski has no idea what she's saying.

Nope. Oddly enough it comes across as even more bizarre because she appears reach a level of semi consciousness during the passages where she talks about her apparently highly competent colleagues.

Quote:

>>Preventing criminals and hackers from...<<

Ugh....

A 65 year old lady starts using words like Techno-boondoggles, and everyone bought it. It's worse than I thought.

What the heck is a techno boondoggle? What a hillbilly sounding term that only makes me cringe at what kind things the US government is going to cook up for us cyber pros, lol.

>techno boondoggle

A government organisation that wastes money making a piece of technology.

A notable quote from our public servants:

"The executive order, as you know, is this administration's effort after an attempt to get legislation last year."

Let that soak in for a bit.

"Pay no attention to that man behind the curtain." -Wizard of Oz

Hope someone out there will post a Youtube link once it's over, or something comparable - can't seem to access it at all.

Who is the woman behind Keith Alexander passing him notes?

"oh woops, NIST has never seen 215 billion. thats' the defense guys"

is this real life?

This is pretty much a circle jerk…

Yeah. They probably made it before the one against NSA starts, to show that what NSA is doing is useful.

"We want the nation to know that we are being transparent. For example, We don't look into what is going into Wall St." - Gen. Alexander

Note to "Terrorists": go IPO :P

Lol - don't worry citizens we're only monitoring you, not banks or big business.

Reminds me how the FBI will only do sting operations to illiterate, 16 year old Somali immigrants. Nobody every sting ops bankers with insider information, even though doing this even occasionally would drastically reduce it.

I wish they were looking into Wall St...

I love how Gen. Alexander and friends are like, "We're so vulnerable!", and see no problem with storing mass amounts of information that is begging to be hacked.

Facepalm! Does she even know what she is talking about?

Key quotes: "Techno-boondoggles" "The government is very good at spending money" "Protect our domains: .mil, .gov and .com" "This is a committee that is loaded with talent!" "Rarely has a committee had so much talent!" "We are in a cyberwar every day. Every time someone steals our identity." "...continue to warn us against 'cyber', as a continuous threat." "I bring to your attention, the President's budget document" "The President has asked congress for 13 billion dollars in order to execute the cybersecurity strategy" "Protecting the taxpayer, in their role as both citizen and taxpayer." General Alexander introduced @ 8:00. General Alexander begins @ 13:30. General Alexander quotes: "So this is a bright future that we have! But it's complicated by cyberespionage, by cyberhacking..." Interesting @ 18:30 .. General Alexander mentions operating lawfully and the chairwoman's evil knowing grin is filmed.

I was wondering if anyone else noticed the chairwoman's grin when General Alexander talked about operating lawfully. Made me sick. The whole charade made me sick...

FYI: interesting discussions happening at 45:00+ minutes. Talking about Snowden's education and training, phone tapping and investigation, various authorities, etc. Interesting that they keep asking Alexander about what he thinks he is allowed to do or is doing?!

Grand-ma Milkuski seems to have a good understanding of what she is talking about...

Reply on news.ycombinator.com