Hacker News Reader

Comment by theboss | Hacker News Reader

This is stupid. You severe ties with the NSA but what about the FBI, CIA, DEA, DISA, DIA, the list goes on. What about contractors who do business for the NSA? The big primes. Lockheed, Grumman, SAIC, CGIFederal, BAE, Booz, etc.etc.

It's pointless to say you won't do business with one when they are all interconnected. Coming from someone raised in Beltway culture.

edit: It is also funny when people say things to the effect of "Beyond what conspiracy theorist could have ever imagined". I'm honestly surprised when people say they didn't know or expect this was happening.

View on HN

"I'm honestly surprised when people say they didn't know or expect this was happening."

Then you must not have much experience with people in the academic crypto community. Most people assumed that the NSA was engaged in wiretapping activity, but BULLRUN was a big shock. People generally assumed that information assurance was at least as important to the NSA as signals intelligence and pointed to things like DES (which the NSA strengthened) as evidence. The idea that the NSA was deliberately subverting crypto and security software, including software that vast swaths of the US government uses, was considered to be an out-there conspiracy theory.

So while I think the author is a little extreme in saying that this is beyond what conspiracy theorists imagined, it is not wrong to say that people in the academic community were surprised. You can look at what people said on the cryptography mailing list and in sci.crypt prior to these revelations if you do not believe me.

including software that vast swaths of the US government uses

This always ceases to amaze me

Are you sure you don't mean never ceases to amaze me?

He means he could care less.

> Most people assumed that the NSA was engaged in wiretapping activity, but BULLRUN was a big shock. People generally assumed that information assurance was at least as important to the NSA as signals intelligence and pointed to things like DES (which the NSA strengthened) as evidence.

Why would people have assumed that after the failure to enforce Clipper chip usage, that NSA would have simply given up on getting access to the plaintext of messages? That makes no sense whatsoever; NSA has been breaking codes (not merely wiretapping) since NSA has been around, just like it has long been an open secret (if unacknowledged publically) that NSA hacks into specific systems if they can.

It is true that COMSEC is a core function of NSA, but that is not inconsistent with NSA performing targeted SIGINT or general cryptanalysis. If their codebreakers can break into equipment used by the US government or major commercial interests then so can foreign entities, and therefore NSA needs to try anyways, even if we're talking about "pure" information assurance.

Likewise the history of NSA has shown them before to be willing to give people cryptosystems that are strong against everyone but the NSA. That's also in keeping with NSA's drive for COMSEC, since (from their POV) they won't be needlessly decrypting 'innocent' information anyways.

So I'm not saying you're wrong about what the academic community was assuming, but I am saying I can't imagine why the academic community was so naïve. Indeed, I thought the ever-present distrust of NSA was exactly why they looked for backdoors in things like Dual_EC_DRBG, and used "nothing up my sleeve" constants in algorithms designed in academia.

> "Why would people have assumed that after the failure to enforce Clipper chip usage, that NSA would have simply given up on getting access to the plaintext of messages?"

Consider this exchange on HN nearly three years ago:

  @moe: I had always considered the Clipper-Chip
        incident to hint at the tip of an iceberg.

        Do you really think that was an isolated one-time
        event?

  @kgo: The Clipper Chip was introduced in the open.
        They tried to push it through legislation. It's
        not like the NSA blackmailed Intel executives to
        include the capabilities secretly in their
        Pentium Processors without notifying their
        customers.

        Same with the new proposed legislation. But all
        that demonstrates is that the NSA has an
        interest in being able to (legally) monitor
        encrypted communications. Which everyone already
        knows.

        If someone had 'busted' the NSA trying to do
        something sneaky and/or covert and/or illegal,
        then you could argue that it's the tip of some
        iceberg of nefarious activity. But like I said
        this was all done out in the open.

        You might as well say that because we know the
        FBI wiretaps phones through legally obtained
        court orders, that's the tip of the iceberg that
        points to millions of illegal wiretaps. It's a
        bad inference.

(I would emphasis certain parts of kgo's response that I find particularly... accidentally prescient?... but the result would just be me emphasizing the whole damn thing...)

https://news.ycombinator.com/item?id=2018456

The gist here is that Clipper, being a public effort to subvert encryption, should not be seen as evidence that the NSA was interested in non-public subversion of security.

Was this naive? In retrospect? Obviously. At the time? Arguably.

Where people, who reasonably should have been informed, caught off guard by the revelations brought to us by Snowden? You betcha.

[edited for formatting]

Thanks for the quote, it's quite illuminating.

This is actually essentially what I was arguing, not just moe's point:

        But all
        that demonstrates is that the NSA has an
        interest in being able to (legally) monitor
        encrypted communications. Which everyone already
        knows.

I don't condone designing backdoors into products. Maybe I can research into BULLRUN more but the impression I had was that the intention was to subvert crypto in a way that only NSA could use (either via escrow or constants-up-their-sleeve), perhaps to take advantage of exploits that happened to get shipped to the commercial sector, but not to design broken gear that anyone could subvert if they know the secret handshake. Obviously even this is sneaky and shady as can be, but that goes with the territory (though @kgo would seem to agree that it's nefarious :-D).

But even assuming malice here, I'd have said even at the time, with the ongoing changes to communication patterns across the world, that there's simply no way you can assume NSA isn't trying to hack everything they can. When I was reading Schneier a decade or more ago they were the very definition of Mallory, and nothing has changed on that since. But I suppose you're right, that people at the time weren't seeing NSA the same way I was.

"NSA has been breaking codes (not merely wiretapping) since NSA has been around, just like it has long been an open secret (if unacknowledged publically) that NSA hacks into specific systems if they can."

BULLRUN is not a cryptanalysis program, and it is a stretch to call it a "hacking" program -- and certainly not one that targets specific systems. BULLRUN is the NSA program to deliberately introduce exploitable bugs in cryptographic protocols, software, and so forth.

"the history of NSA has shown them before to be willing to give people cryptosystems that are strong against everyone but the NSA."

First of all, the NSA does not frequently give cryptosystems to anyone outside of the US government. That being said, there are two prominent counterexamples to your statement: DES and DSA.

"I thought the ever-present distrust of NSA was exactly why they looked for backdoors in things like Dual_EC_DRBG, and used "nothing up my sleeve" constants in algorithms designed in academia."

It is worth noting that even when the Dual_EC_DRBG backdoor was discovered, there were people who were skeptical about it being deliberate. Even Bruce Schneier expressed some skepticism about it being an NSA backdoor:

https://www.schneier.com/blog/archives/2007/11/the_strange_s...

I don't understand why the NSA was so insistent about including Dual_EC_DRBG in the standard. It makes no sense as a trap door: It's public, and rather obvious.

As for nothing up my sleeve constants, that goes beyond just showing that there is no back door. Suppose you were analyzing a cryptosystem, and it required some particular constant. What about that choice of constant makes the system secure? If a different constant were used, would system still be secure? Even if you never gave any thought to backdoors, nothing-up-my-sleeve numbers would matter -- cryptographers like to know the reasoning behind design decisions, and it is much easier to explain why you picked 1234567890 as a constant than 43895762356157265.

You'll note that Schneier's criticism of NSA as the source of the DRBG backdoor is that it was too obvious (i.e. the work of clowns, not the work of the most-advanced cryptography outfit in the world), not that NSA wouldn't engage in that kind of activity.

He also mentioned how it was NSA (and NSA specifically) who were 'so insistent' on including that 'obviously' broken algorithm in the standard. I mean, that question kind of answers itself (even at the time!) as long as you're not presupposing that NSA turned pure white in 1995.

It's not pointless. The goal is not to destroy US government and everything to do with it. The goal is to effect change - namely, put NSA surveillance programs back under strict public control and within the borders of reason and limits that must exist in a democratic society valuing liberty and privacy. For this, public pressure exerted on persons helping NSA to do what they do is not a bad measure. You don't need to destroy the NSA, you need to create an environment in which changing their ways would be more attractive that continuing as is. If working for NSA would create a social stigma among mathematicians, that would influence the quality of people they would be able to hire, at least publicly, and thus may contribute to change being considered as more attractive alternative.

> This is stupid... [there are too many, they are all interconnected].

Really? Ever tried to get in shape? There's always that first step. Also -- quoting someone here who, whatever his faults, did get rid of a lot of american colonial bullshit -- it does not matter how slowly you go, so long as you do not stop.

It is very clear that you are a beltway product, and I eagerly anticipate never doing business with you, never inviting you to a convention, and never taking your money. Because the guy behind you is getting impatient. NEXT!

I didn't try to get in shape actually, I succeeded.

On topic though I don't even know what you're talking about. There are plenty of other mathematicians lined up to work for the government from thousands of schools around the country. There are plenty of PhDs in DC/MD/Va who have no problem taking the money at a R&D Firm or at the University they teach at.

As long as the NSA shells out money then smart people will take it.

This isn't a dichotomy: "no one will work with the NSA" or "this is totally pointless". This approach can at least decrease the quality of people the NSA has working with them, specifically to people who can't get funding another way.

I came across that quote earlier today (on http://slowtravels.tumblr.com/), attributed to Confucius. Who do you think it is by?

“It does not matter how slow you go so long as you do not stop.” — Wisdom of Confucius

A shame Confucius and Zeno never got a chance to sit down and hash things out. That would make for an interesting dialog.

Like it or not Silicon Valley is a beltway product too. It's genesis was in the huge amounts of money that the government showered on universities and companies in the area during the 60's and 70's. They've diversified some since but there are still plenty of companies that are supported by it Palantir for example http://www.palantir.com/solutions/

So?

I honestly don't know what your point is here. This isn't some sort of "'free market' vs 'government', and who gets credit for various achievements" discussion.

The point is that the valley isn't an innocent victim here they have in the past and still do facilitate the surveillance state. To act as if refusing to deal with anyone involved would only mean uninviting some government employees from a few conferences and black balling a collection of beltway bandits is naive. The uncomfortable truth is that you would probably have to stop dealing with a lot more people and companies than you would be comfortable with.

Consider the possibility of blackballing anybody who continues to be involved.

Would that mean blackballing people who continue to work for government contractors as well? Possibly. I'd say that is left up to the individual implementor. We don't need to all literally agree on a list of individuals to blackball. A general trend across some subset of the community would do just fine. Some people may take it to the extreme, some may only dissociate from a narrowly defined group of people. This sort of social tension, or pressure, doesn't need to be engineered with exacting precision. A respected professor here, an influential ex-boss there, one of your college buddies that you might consider asking for a recommendation one day... all can contribute to this ostracism in their own way.

If the NSA and other national SIGINT organizations are the biggest employers of mathematicians I'd say their social and industry reputation matters quite a bit.

But most of the kids are recruited and indoctrinated to these agencies straight out of school. So I'm sure they'll still find plenty of people to hire.

Let's say every mathematician agreed to no longer talk to NSA at all. NSA would just hire Computer Scientists and dump loads of money into security research. Or they would hire computer scientists to work as insiders at M$, Apple, Cisco, etc.etc. and push well hidden vulnerable code

There's no shortage of things you can do when you have a lot of money.

During South Africa's Apartheid its leadership did lots of things to combat the sanctions other countries placed against the country. Eventually it wasn't worth the effort.

So you are suggesting that if the NSA is working against us, we should just throw our hands in the air and say, "Oh well!" I think perhaps you are a bit too cynical. Why shouldn't the relevant academic communities -- CS, math, EE, etc. -- raise the social cost of working for the NSA? If a biologist learned that one of his colleagues was working on biological weapons, should he just shrug it off or should he reconsider his friendship?

No. I'm only saying that if your goal is to prevent the NSA from working against you then this isn't the way to prevent that. People seem to be a bit upset that I think so also.

If there are whole countries that are angry and the US Govt doesn't care then why would they care when a subset of a subset of their possible employees are mad.

> "I'm only saying that if your goal is to prevent the NSA from working against you then this isn't the way to prevent that"

We shouldn't be looking for "the way". We should be looking for "ways"

This is something that mathematicians can do (and I would say CS people as well). This action is not meant to exclude other action. Programmers can also work on systems that are more difficult to subvert, companies can find new ways to not collect personal information in the first place, the general population can call for reform and ultimately trials for the guilty parties, individuals in trusted positions can leak details and/or engage in sabotage...

Every potential avenue for change should be explored. In parallel. Deeply.

Raising the social cost of working for the NSA means raising the difficulty the NSA faces in attracting talented employees. Already the NSA has to convince mathematicians and computer scientists to give up certain career paths when they begin work for the NSA. That alone makes it difficult for the NSA to attract talent.

So adding a social cost to working for the NSA would make it that much harder. A grad student considering a career with the NSA should be forced to consider the possibility that their adviser and their friends might not be willing to even talk to them as a result. It may not seem like much, but every time a talented researcher chooses to work for the public instead for the NSA, the public wins a small victory.

You might ask, why should the NSA worry if the common attitude to whistleblowing/leaking/being the next Edward Snowden among their possible employees is 'yea, I'd do that, partly because I know that most of my peers would approve of me for it'?

If the NSA et al. are the largest employers of mathematicians, and they pay typical low government wages, then those mathematicians mostly don't have anywhere else to go, except for the odd patriot.

So I don't expect much beyond a statement from the Society, if that.

Anecdotally I have heard that NSA wages are pretty good. They're competing for talent with finance after all. But compensation aside, by far the awesomest perk that comes with working for the NSA (I'm told) is that under no circumstances whatsoever are you allowed to take your work home with you (or even out of the building). I can't think of very many other researchy STEM jobs where you could make that claim. Even tenured professors at the best schools seem to work 24/7.

Don't underestimate the power of symbolism.

Imagine if Gandhi had said "Britain will never leave India - look at all the British companies that have ties here"?

Instead, he (illegally) picked up a single grain of salt[1].

[1] https://en.wikipedia.org/wiki/Salt_March

You sever ties with the ones who are close enough to the problem. You don't assign guilt by mere association.

What would you do against legal but obviously wrong behavior?

You have to play by DC's rules which means you have to go the legal route. Just saying "Sorry we won't play with you anymore" won't work because there are a lot of other smart kids with PhDs on the playground.

Yes it could be difficult to keep your job or maybe even your career. Snowden faced that same decision point.

what kind of BS is this? DC's rules are their rules, not yours. This is like asking the mafia if they could kindly reconsider extorting you by sending a petition.

Hahah. If you refuse to go the legal route there is nothing you can do but live with the surveillance and protect yourself. It's the only route that could possibly work.

I laugh because the legal route is the route people are supposed to trust (you know...checks and balances). It's just funny to see people with no faith in the system.

"It's just funny to see people with no faith in the system."

I think it is more "alarming" than "funny." It is not a new phenomenon, of course, but it is one that should cause us a great deal of concern. We have governments, laws, and legal processes to ensure that various disputes are resolved peacefully and with respect for everyone's rights. When people start losing their faith in the system, they must also start finding "alternative" ways to resolve their conflicts.

It's not like this is an entirely theoretical question, or a quaint question from history books. There are people in America who have stepped outside the bounds of civilization.

What do you think should be done with the MDs who designed and supervised methods of torture at Guantanamo, or the torturers themselves?

The people at the telcos who enable mass surveillance are comparable to the Stasi informants. These people had severely restricted career prospects after their roles were revealed.

It's funny to see you being so naive as to think that there are forces in politics that have gone to great lengths to ensure that peaceful dissent has no substantial effect.

There are the same organizations that have conspired in the murder, shaming, and threatening of peace activists across the whole world. What makes you think you are invulnerable from this?

Do you remember the case of the DC Madam, the lady who was being charged of running a prostitution ring in DC, who "committed suicide"? Remember Iran-Contra? Do you not see what they do against whistleblowers? Do you realize the only reason why you're hearing about Snowden is because he is the only dissenter out of many who actually got and change done? And this is because he went public so that, unlike all the poor saps who "believed in the system", and "went through the proper channels", the NSA had no choice but to do some damage control.

Do you remember the goverment talking heads calling Snowden "incompetent"?

You can go and believe in whatever you want, but the people who do that believing are not the ones doing positive change right now.

You speak as if the mathematicians are proposing something illegal......

They're considering a perfectly legal route. Legal, and also most likely more effective than, say, sending letters to senators.

For some people, the concept of action outside of the officially endorsed channels is so alien, they implicitly treat it as though it is categorically illegal and unethical.

I don't even think it is intentional, they just aren't familiar with grappling with such concepts and make fundamental blunders when talking about this sort of thing.

Why depend on lawyers?

"The reasonable man adapts himself to the world. The unreasonable one persists in trying to adapt the world to himself. Therefore, all progress depends upon the unreasonable man." — George Bernard Shaw

Unconventional thinking is what hackers and founders use to shape their world -- it's part of what makes Silicon Valley great. And creative, unconventional approaches doesn't mean illegal, quite the opposite. Creativity is design within constraints.

Today it's a letter by Sasha Beilinson in the "Notices of the American Mathematical Society". Tomorrow there could be another, then another.

To understand why Sasha's Belinson's letter is important, see Derek Sivers' 5 min talk, "How to Start a Movement" (http://www.ted.com/talks/derek_sivers_how_to_start_a_movemen...)

This was specifically targeted at mathematicians, and pure mathematicians are a lot more likely to be hired by the NSA than any of those other organizations that you mention.

Engineers, programmers, and so on all already have to grapple with this issue with big defense contractors. It's more rare that mathematicians have to deal with it.

I tend to assume people pretend to be surprised because it allows them to be more outraged. This assumption could easily be egocentric bias, but I have difficulty seeing how any moderately informed person would be truly surprised by these 'revelations.' Some interesting specific details, sure -- but nothing particularly strange has surfaced.

I'm sure this has been said before, but having proof (such as it is) makes a bit of a difference that just might have political/societal consequences.

I guess it depends on what you mean by "moderately informed." I've been on HN for a while now. The HN community obviously cares about the NSA's activities, but how many posts were there on HN about the NSA collecting all of this information before Snowden? Or are you just talking about people in the academic crypto community?

I basically mean people with an interest in privacy and implications of information technology on society. If someone doesn't have that interest, I wouldn't expect them to assume the NSA is collecting all the info it can. With a basic background I would expect other people to recognize how powerful vacuuming up everything is. This expectation is strengthened by personal experience (moderate n, but selection bias). Certainly having the leaks makes people actually talk about it -- partially because assumed isn't the same as proved when you are an activist. Furthermore the extent to which the NSA hands this information over to eg the FBI was unknown. IMHO the real danger of spying on everyone is 3 felonies a day style selective enforcement. If the NSA keeps everything well barricaded from political and personal motivations and only pursues genuine threats to national security I frankly think that might be best for everyone. That possibility is seeming less likely because of information the leaks have provided.

"This is stupid. You severe ties with the NSA but what about the FBI, CIA, DEA, DISA, DIA, the list goes on."

Well, I wouldn't call it stupid. Perhaps I would call it "incomplete". Or "hey, that's a start!".

Reply on news.ycombinator.com