NSA to cut system administrators by 90 percent to limit data access
preview.reuters.com
preview.reuters.com
The problem at the NSA isn't that there are too many sysadmins, although apparently that plays well with tech illiterate politicians. The problem is too many morally unconscionable programs which lead to a growing revulsion in the ranks.
Mr. Alexander defends his agency's conduct and claims the press is distorting the facts. "No one has willfully or knowingly disobeyed the law or tried to invade your civil liberties or privacies," he said. "There were no mistakes like that at all." Except we know that even FISA says that's not true, in a report so damning apparently even elected members of congress can't read it.
I have news for you Keith, blanket collection of the "meta-data" of every call on Verizon's network is ex vi termini, invasion of privacy and civil liberty. DEA's SOD (Special Operations Division) handing off your clandestine intercepts to civilian law enforcement is just the latest, but not the last, sickening revelation. The leaks won't stop until you stop, and I hope your hubris continues to blind you to how close the political tides are to turning against you. It seems to me that your 'ends justify the means' mentality conflicts with your sworn oath to uphold the Constitution, and I can only hope history will look back on this whole endeavor as a dark stain in American history, and view you like a McCarthy of our time. Machiavelli would be proud of you, sir.
Au contraire, it's extremely morally conscionable to people who see law enforcement as a noble profession empowered to rid the nation (and beyond) of people they see as the scum of the earth. These programs are run by people who, I can guarantee you, do not wake up in the morning wondering what morals and ethics they can ignore that day.
However.
"No one has willfully or knowingly disobeyed the law or tried to invade your civil liberties or privacies," he said.
And he's right. And that's the problem: these things are likely not against the law. The law has both been perverted inch by inch and the agencies have been allowed to operate under looser legal interpretations than you and I receive for parking tickets. This means that to the degree that laws exist that permit their behavior (PATRIOT Act, FISAA), those who would constrain them to even the loose boundaries do not (and by all accounts refuse to) do so. This goes for the FISC as much as Dianne Feinstein and Eric Holder. This means they can say it's legal for them to do pretty much whatever they want. So now what?
The alternative is the public getting exactly what they deserve, receiving the full consequences of their actions, and reaping a bounty of oppression.
It's always easy to do the right thing when everybody agrees with you.
"Oh, agents don't have easy access to our personal information? You've just got it all recorded on your servers and you constantly datamine it, but the analysts only look at outputs from the mining and not the specific data? Well OK then" seems to be the response of the press at least.
Oh and everybody has to work with a partner so the work output of our remaining workforce is halved.
Idiots.
If anything it stands there will be a higher concentration of work and monies given to the immune likes of Booz Allen Hamilton.
I'm entirely willing to believe it is CYA - based on my experience working classified programs practically all security procedures are CYA: Provably follow the checklist and you won't get fired if something goes wrong. Don't worry that the checklist is full of holes like swiss cheese, the checklist is more important than actual security.
Yes, most people will just go along and do whatever they are told - even if they are told to hurt or kill people. Very few people will resist if they perceive someone else as being in control and bearing the responsibility. BUT there is an exception to this. Once ONE person decides to rebel and refuses, it spreads like wildfire.
If Snowden had had to work with a team of a dozen people and he decided to resist their secrecy, it's most likely that the rest of the group would agree and join him. At least as likely as it is that the group will go along without question for awhile and that people like Snowden will be rare.
It's a little like pairing up soldiers when you order them to commit a war crime: refusal to obey orders will get you shot -- it raises the bar of refusal by having to convince someone else to risk their life by not taking yours.
Which is more likely?
Can you tell me the last time a President said the military had gotten bloated, and needed to go on a diet? Not counting screwing over veterans, of course.
President Dwight D. Eisenhower's famous exit speech of 17 JAN 1961 warning of the dangers of the "military-industrial complex."
I'm not sure how well it would translate to things like sysadmin tasks which can't all be pre-scripted checklists, but something like a pair-programming model, combined with a full audit log of actions taken, along with actual independent auditors randomly pulling logs and checking for naughtiness could work.
I dread to think of the bureaucracy overhead involved though - I suspect it would probably end up increasing staff headcount several-fold.
Technical measures and policies can go some of the way, but I think protecting against a motivated internal attacker with some level of elevated permissions is going to be a tough thing to achieve.
The only recourse is better cryptography.
Encryption is now a means of making yourself a suspect. Referencing or communicating with suspects is means to make yourself a suspect.
There is no technical solution away from this.
edit: What, no rebuttal? No eloquent summary on how crypto can lead people out of this? My assertion of no technical solution has no more or no less merit than the one above. But in addition I provided reason on how crypto makes one a suspect, how associating with suspects makes one a suspect as well, a refutation of the above comment.
Let's further discussion.
Privacy is a basic human right and cannot be granted or taken away. But you need to defend it all the same.
This is a technical oriented community so I do feel the need to highlight the problem with focusing on technical solutions, let alone touting them as the only recourse. The writing so to speak was on the wall when recent exposed wrong-doings were made legal, immunity rendered with payments processed to the collaborators. Attempts at technical solutions have brought drone missiles upon Yemenis and others, Australians trapped in diplomatic buildings, valiant whistle-blowers imprisoned/deposed to Russia, data researchers jailed for gazing upon contractor information[1].
There is no technical solution to this. Technical solutions are getting people killed, renditioned, deposed, hunted, prosecuted, tracked, analyzed. Enough with the technical solutions already.
[1] http://motherboard.vice.com/blog/the-doj-is-suing-barrett-br...
2. Reduce leak surface area.
3. Would-be whistleblowers might be more tempted to exchange information for money, ie become spies, at which point you could nail them and nobody bats an eyelid.
4. At least spies sell their information in secret instead of blurting it out all over the place.
5. Dead people/prisoners don't count in unemployment statistics.
It's a win-win-win-win-win situation. Brilliant move.
"Not at all" is such a strong statement. Like Iraq had no WMD at all, right? The US is really bad at admitting its own mistakes.
I don't see many downsides to reducing the number of people with administrator access. The more administrators there are the more possibility there is for abuse as it is normally very easy for administrators to bypass audit controls as well as, obviously, access controls. The rule of least privilege should apply.
Call me cynical of the human race but I worry more about rogue admins selling information to criminal elements than cutting off would-be whistleblowers.
"Other security measures that Alexander has previously discussed include requiring at least two people to be present before certain data can be accessed on the agency's computer systems."
CORRECT:
Before admins or analysts view native text, a preprocessor regex substitutes innocuous synonym barium canaries for parts of speech, puncuation, possibly with Google capable proper noun recognition, places and people too. These substitution events are hashed with each specific tractable viewers, and the viewers, so informed of this preprocessor, know it, so they don't rat.
This is also `panopticonable', say this occurs only 10% of the time.
and...with theguardian.com currently:
Breaking news: US orders non-essential staff to leave consulate in Lahore, Pakistan, citing terrorist threat. More details to follow ...
you suppose whatever intercepted intel causing all these embassy closures are `tainted' with `barium' so the threat is scanning NSA's global surveillance to see what activates a hwall alert and what does not? Eg, peaking traffic volume, how to do this with a machine generated sustained random crypto-noise spike?
But I have problems believing in the existence of conspirators though. Opportunists, yes, but not conspirators. Our species blows at foresight.
LOL!!! In their eyes, we are total morons.
"No one has willfully or knowingly disobeyed the law or tried to invade your civil liberties or privacies," he said. "There were no mistakes like that at all."
... then why did they lie about it to congress?
This sounds like they are just trimming a bloated IT department, and just using security as an excuse.
First off I doubt much of a cut on spending or a hindrance to the vast expansion of the world's surveillance state.
But if this does mean a cut in those employed it implies less targets to battle back judicially, legislatively, socially. Less 'independent' opinions (dismissing a probable increase of automated bots) attempting to justify their salary. Plus automation is king only to a point, how do most hacker seminars end? "Its always about the people."
With a clearer trail of monetary remuneration to follow that gives those in the dissenting camp a better chance to isolate and make examples of the collaborators who seek to route around justice to enforce their vision of law while hiding in the legal shadows collecting cash.
edit: Be on the look-out for a large increase in marketing of surveillance state tools to nations like Saudi Arabia, or torture loving UAE, typical nations that companies that Booz Allen Hamilton and others whore themselves out to for monies.
Parsing that data will help us figure out moles and real traitors.
/sarcasm. I prefer they shut down NSA completely.
So their big plan is, "if our agents can use a UI to get all the info they need, we won't need to worry about those pesky left-leaning IT types."
The amount of stupid here is unbearable!! Good luck to them when they need another feature developed.