Hacker News Reader

Comment by Zigurd | Hacker News Reader

Number 3 is the most likely, along with pushbutton tools that automate attacking and extracting information from endpoint devices. The market among state actors for zero-day exploits is documented, while the other possibilities are out there with other "secret weapon" theories that are predicated on fundamental scientific breakthroughs.

View on HN

Yeah, I'm not buying that the NSA has some crazy advanced technology that is kept secret.

There are highly skilled and better financed tech companies with huge R&D teams. Why would the NSA be able to outperform them?

It's more likely their power is their access to the latest zero-day exploits via sourcing information - something they are extremely good at.

There are highly skilled and better financed tech companies with huge R&D teams. Why would the NSA be able to outperform them?

More to the point, they don't (presumably) have some secret pipeline of highly talented people. I mean, the pool of graduates in mathematics, statistics, computer science, etc., year in and year out, is available to everyone, NSA, other public sector, other private sector, etc. And while the NSA probably prioritizes hiring brilliant math wonks and what-not, so do wall street hedge fund companies, tech companies, etc. And given that at least some small percentage of "really smart people" would probably refuse to work for the NSA just on ideological grounds, I don't see any reason to believe that they have a monopoly on smart people who can do crypto research and what-not.

As for their financing, however... I don't know. I'm not real big on conspiracy theories, but I don't doubt the existence of secret budgets and "off the books" stuff to fund certain government programs. I mean, just go back to the Iran/Contra affair[1] and you can see that some sneaky stuff does go on, at least on occasion.

[1]: http://en.wikipedia.org/wiki/Iran%E2%80%93Contra_affair

To add another reference to your point, you must be a US citizen to work for the NSA. That alone limits their supply of the really smart people of the world.

At the same time, at least some small percentage of really smart people would prefer to work for the NSA on ideological grounds.

Absolutely. I'm not suggesting they don't have smart people, just pointing out that they don't have all of the smart people. Or at least that's my presumption.

What tech companies have an R&D budget of $125.6 billion[1] dollars a year? And that's just what's on the books. Who knows what is classified, "for our own good."

[1]Projected US Gov't R&D spending - 2012: http://www.battelle.org/media/press-releases/battelle-r-d-ma...)

"There are...better financed tech companies."

Unlikely. And given the secrecy surrounding their budgets, how could you know for sure? Even if you did, the dollars themselves are only part of the picture. The dynamic surrounding the money also has a big influence on how it can be used. A private company needing to post a profit operates under a set of constraints that are dramatically different from those that govern R&D in the military.

Also, unlike private R&D teams, the military can unilaterally classify and restrict entirely categories of hardware (e.g. GPS units that function over specific altitudes or above certain velocities). And they can seize (in secret) any instances that threaten national security.

That's a set of competitive advantages that the private sector, almost by definition, can never hope to match. Or at least not independently.

The NSA knew about differential cryptanalysis more than 10 years before academia and the general public. It's become cool to bash the NSA, but don't make the mistake of underestimating them. (Also, remember that the NSA is far, far larger than the CIA.) They have plenty of smart people working for them--in fact, a bunch of the most prominent researchers/personalities in the security community worked for the NSA in the past.

Reply on news.ycombinator.com