Hacker News Reader

Comment by fidotron | Hacker News Reader

To be fair here, the NSA should very well be doing these things, for the purpose of attacking other states. The reason is very clear as the Russian attacks on Estonia ( https://en.wikipedia.org/wiki/2007_cyberattacks_on_Estonia ) demonstrate a clear need for defensive capability in this area, and where you have defence you end up needing offence.

This persistent confusion between legitimate NSA operations such as preparing to intercept communications of foreign governments and illegitimate such as mass slurping of everyone's email merely serves to discredit the entire privacy defending position, and in the long run will just play into the hands of those that want to read everyone's email for nefarious purposes.

View on HN

So I happen to be German, and obviously I don't have a say in what commands you guys give to your own secret services. But since this appeared in a German magazine, allow me to say this: given the track record of how you treat your alleged "allies", I don't feel comfortable seeing these developments. And I wouldn't ever trust anybody with these powers, least the nsa or even the US government. These people are still trying to create a US World Empire out of their own hybris, they just cannot leave the world in peace.

Surprisingly, it turns out that this is an easy way to make enemies, as last week's action in Paris have shown. It has been shown since 2005 that the islamists that massacred twelve people were, in fact, radicalized by what they learned about the prison of Abu Ghraib.

Job well done, thank you very much guys.

Lastly, the way our own government is supporting the nsa makes me feel nauseated at some times, furious at other times. We have plenty of work to do locally, that's why usually I don't complain about foreign services. Simply allowing the nsa to gain world domination like that though, just because "that is their job", really is hard to accept for me, and it really rubs me the wrong way.

It's a good thing for allies to spy on each other to understand intentions, as this article in Foreign Affairs argues.

http://www.foreignaffairs.com/articles/140247/jennifer-sims/...

Point taken. But let's keep the CSC vs de-mail discussion for another time. I see a huge difference between spying to get to know the others' intentions, and preparing sabotage, destruction and infrastructural doom for maximum threat potential.

And industrial espionage to steal contracts form Non-US "allied" countries for economic gain.

This explains why Europe is going back into recession. The only possible threat to US power is Europe waking up but they won't even close US military bases.

> given the track record of how you treat your alleged "allies", I don't feel comfortable seeing these developments.

The USA has no allies, only clients. Some clients get more respect than others but they're all clients.

Remember, the State Department had a mole in the FDP, reporting on the German coalition negotiations. In all likelihood the CIA have a minister or more. The US does not respect anyone's sovereignty who can't and won't make them.

Your government is practically telling you that they are doing the same thing. What do you think "that is their job" means?

I can't believe it is more likely to you that your government is rolling over and "letting the NSA gain world domination", versus your government is trying to downplay it because they know they may one day be caught in exactly the same situation.

Agreed. I think the Snowden revelations have harmed the NSA's reputation to the point where most people on HN just assume NSA is a bond-level villain. The NSA serves a purpose, they are meant to be prepared offensively and defensively for the USA's security, which includes the internet. I have no problems with the NSA's purpose and would prefer they continue to exist and prepare against threats to the country.

I do believe the NSA overstepped their mandate in domestic surveillance, and should be held accountable, but let's not forget that this world does have bad guy's - plenty of nations would lose no sleep at night if they hurt America.

Sapir-Whorf and Newspeak. What does "security" mean?

I have no doubt that the NSA's job is "national security" and that some portion of that work serves the people. Nobody knows what that portion is, by design.

If you bury the difficult, complicated issues under terms like "security", "threat to the country", and "bad guys", you're basically just supporting the NSA on faith.

Forget the terminology and FUD of "threats", and let's ask ourselves what the concrete benefit to the people of the United States (or better yet, the world) is for the NSA to be arming themselves for the destruction of computer systems. Is the benefit Cold Waresque deterrence through keeping the rest of the world in fear? Is this the strategy we want our work and taxes to support?

Maybe it's too complicated to think about, and even if we wanted to critically analyse the situation, secrecy prevents us from knowing anything besides what the government desires the people to know. It's easier to just trust in benevolent "national security" protecting us from Eastasia. Let's not forget that the world does have bad guys, and besides, we've always been at war with Eastasia.

> I do believe the NSA overstepped their mandate in domestic surveillance

They've been doing it longer than the Internet. The "Five Eyes" have existed for a while, so that they can have a legal loophole for domestic spying (e.g. "We can't spy on our citizens, so we'll just ask our allies to do it for us!"). To me this indicates that, while the stated purpose behind the organization may have merits, the execution of that purpose has been flawed for some time.

The article addresses this very point.

It specifically explores the conflict of interest that the NSA must work both offensively and defensively. It makes the argument that the balance has shifted so drastically to the offensive that our defensive is being weakened.

What the article fails to mention is the NSA's instrumental efforts in weakening crypto standards and computer security in general. We don't know the extent of that undermining yet, but it's likely significant. They are also hoarding security vulnerabilities and not releasing them, as responsible researchers should. They're weakening security for everyone.

Now, the US government as a whole is in a very strong position to actually push for genuine security compliance and to ultimately defend against even the most determined state cyber warfare initiative. They haven't done that because they want a way to get into systems even if it makes people less safe on the whole.

precisely, and this is why I'm starting to think that snowden has - at least - caused as much harm as good by his revelations. if he had stopped at revealing the domestic surveillance he would be an undisputed hero/patriot. but with all of these unnecessary leaks that does nothing but harm to national interest I can understand how others might view him otherwise.

Others have said as much. Here is a quote from William Binney, another NSA whistleblower, on advice that he has for Snowden:

> I would tell him to steer away from anything that isn't a public service — like talking about the ability of the U.S. government to hack into other countries or other people is not a public service. So that's kind of compromising capabilities and sources and methods, basically. That's getting away from the public service that he did initially. And those would be the acts that people would charge him with as clearly treason.

The whole interview is a great read: http://www.usatoday.com/story/news/politics/2013/06/16/snowd...

The US public has a legitimate interest in knowing about NSA's hacking abilities, because vulnerabilities used by the NSA abroad can just as easily be used domestically by foreign or criminal attackers.

Against a well-prepared adversary, a vulnerability can only be exploited once -- a zero day. After disclosure, or evidence of an exploit in circulation, such vulnerabilities become useless towards the agency's mandate, whether or not you agree with that mandate. Realpolitik? Definitely.

Have you considered that the public interest and the national interest are not one and the same?

But shouldn't it be? At least USA has this weird motto for its government: "of the people, by the people, for the people".

The affected public is not just in the US, considering us citizens of (even) allied countries are fair game. The motto you cite probably refers to just US citizens.

Do you realize that Snowden never leaked single documents? He just delivered over 100,000 of documents to Glenn Greenwald last year, and he published them continuously over a long time.

Correct me if I'm wrong, but they said some time ago that only 1% was published. So it would be impossible for Snowden himself to read everything and choose if it should be published.

as you said, he leaked 100k documents to Glenn Greenwald. My point is that it was his responsibility to vet them himself and not rely on Glenn and whoever Glenn chooses.

Specifically which leaks harmed "national interest" without benefit to the public? I ask non-rhetorically, as GCHQ at least have shown themselves not to be above "leaking" carefully selected titbits and attributing them to Snowden, just to muddy the debate:

http://www.independent.co.uk/news/uk/politics/exclusive-uks-...

and the Guardian's "haha what":

http://www.theguardian.com/commentisfree/2013/aug/23/uk-gove...

Note that this "leak", as well as NOT coming from Snowden, isn't really in the domestic public interest, is an activity that a far larger percentage of people would support, and presumably is already known by the target anyway. The clear intent is to make people read the article and go "huh, this Snowden ballyhoo is very overblown". I wonder why the so-called "Independent" played along.

> if he had stopped at revealing the domestic surveillance he would be an undisputed hero/patriot. but with all of these unnecessary leaks that does nothing but harm to national interest

It's also important the public realize the NSA is more than just the National Stalking Agency.

I think with the domestic surveillance revelations that became abundantly clear.

I'd say it's safe to assume all 1.7 million documents, including the secrets his bot scraped that Snowden didn't want released are in the hands of the Chinese MSS already. I find it hard to believe they didn't set up shop beside his room in that HK hotel to use state intel agency methods to grab his keys, nor do I believe that his hasty destruction of his standard laptop wear-levelling flash drives in the airport before departure to Moscow actually destroyed all the data.

I bet there's a room stacked to the ceiling in printed US secret military documents in Beijing that they trade to Russia for cheap oil+gas imports. I realize Snowden never wanted that to happen but there's a reason why state's have strict methods to store and transport top secret data and they don't include using questionable XTS container software and staying in a HK hotel with the entire secret US archive stored on a commercial device.

>that this world does have bad guy's

No, movies have bad guys.

Agreed. I think the Snowden revelations have harmed the NSA's reputation to the point where most people on HN just assume NSA is a bond-level villain.

Not so much Blofeld as Klingon: http://www.dailymail.co.uk/news/article-2421112/NSA-director...

To me this goes both ways. If there is a legitimate mission for the NSA to accomplish, then perhaps they should make sure at all times to act in a way that is deserving of the public's trust. The persistent confusion you mention is not the fault of the confused.

I don't understand why there are so many comments saying that the NSA needs offensive digital capabilities. What valid reasons does the NSA have to ever be committing a cyber attack?

The obvious one: war with another nation.

Along with threat deterrent.

I can't think of any good argument for why the US military should have no offensive capabilities in the digital realm. It'd be the equivalent of staying out of the skies when flight became possible.

In any war, the US is going to come under digital attack, and it should be fully capable of responding both defensively and offensively. Besides that, shutting down the power grid of a country you're at war with via digital means, sure beats doing it with hundreds of missiles.

But by stockpiling vulnerabilities they are making civilians less safe. Offensive digital capabilities should never come at the expense of fixing software.

I ended up rescuing & then adopting a German Shepherd 18 months ago, without having planned such a thing. These days I don't even bother to read the the scarevertising from burglar alarm suppliers that turns up in the mailbox every month or two. I don't want to barricade myself into my own home or have some corporation constantly surveilling it for me. While it's far from an exact analogy, I actually feel quite a bit safer with an active deterrent than I did previously.

What is the "active deterrent" analogy in computer security that makes it worth leaving vast numbers of civilian computer systems vulnerable to stockpiled 0-days, engineered backdoors, and weaknesses surreptitiously introduced into standards?

Bombs under your neighbor's porches, according to this sister comment - more seriously, the offensive capabilities outlined in the original article. I think both of you are taking an over-literal reading of my comment despite the qualification therein.

That's a great and well-reasoned argument that is clearly relevant to the current scenario.

Oh, wait, no, it's not. Your German Shepherd isn't planting bombs underneath the neighbours' porches in case they decide to rob your house.

Well, the comment you responded to said they need offensive capabilities because they have/need defensive capabilities.

It seems like a bit of a self-fulfilling prophecy to me, which can be a very dangerous thing.

Vulnerabilities should be searched for, but when discovered they need to be disclosed and fixed, not used to create real world damage.

Possibly they're operating on the assumption that "cyber war" works like nuclear war and the most effective deterrent is the threat of retaliation.

Do you believe that NSA should be conducting economic espionage?

There is a clear need for defense. But because of lack of oversight, NSA has overstepped its bounds in both foreign and domestic spheres.

The other side of this argument, one made cogently by Snowden, is that we simply have more to lose by escalating the cyberwar.

Having offensive capabilities and actually utilizing such capabilities are two different things. You can acknowledge the need for the former alongside the dangers of the latter, just as you would with any standing military.

> Having offensive capabilities and actually utilizing such capabilities are two different things. You can acknowledge the need for the former alongside the dangers of the latter, just as you would with any standing military.

In information warfare, waiting until conflict begins is too late. The information you collect and systems you exploit prepare you for the conflict.

For example, country A wants to know about country B's new bomber years ahead of the conflict so they can design anti-aircraft defenses to stop it. Country B spends years gaining access to Country A's routers, servers, etc. so they can utilize them the moment conflict begins.

If you wait for conflict to begin to do these things, you will be much too late.

This is very true, but that still leaves a significant gap between what you're talking about (military/strategic intelligence enabled by network operations) and an actual military campaign conducted against adversary networks.

Both may well need similar capabilities but we can't tell the ability of an agency to engage in "cyberwar" just from their activities in "cyber espionage".

Mr Obama just sided with Mr Cameron on the issue of forcing companies to backdoor their products.

Do you believe that backdooring American products will have a positive effect on security?

I don't really see how that fits into this scenario. Computer Security is more like chemical warfare. Were you can either do research or try to make everyone more secure by international treaties. Here you can either undermine encryption, infiltrate networks, keep exploits to yourself or you can make everyone secure by patches, standards and encryption that works.

> Computer Security is more like chemical warfare

Ignoring this nonsensical analogy...

> undermine encryption, infiltrate networks, keep exploits to yourself

This is really the MO of any intelligence agency; that is their job.

> you can make everyone secure by patches, standards and encryption that works

Interesting statement, because it shows some things. Firstly, there is a difference in incentives -- why publish a vulnerability when it could be used to further your mandate? For the specific case of NSA though, that also ignores their broader role in securing federal communications (eg, vetting SHA, AES, FIPS, etc). Of course, there are always exceptions (DES, Dual-EC-DRBG, etc) -- but in a way, that precisely illustrates why we have intelligence agencies in the first place: trust no one.

This was the British GCHQ. They were spying on non-Europeans using their roaming networks, including US citizens.

If you think there's some sort of restraint with regards to citizens of other 'five eyes' nations, I wonder how you square that with the "but everyone spies on everyone, including allies" argument that can always be found in these threads.

Are you a US citizen? How would you react if supposedly close US allies were bugging the White House, the US senate and AT&T? Repeatedly? Five Eyes, Echelon, Merkel, Belgacom, ...

I'm not a US citizen, but I presume that US allies which have the capability do unilaterally gather intelligence on the US.

The irony of course is that the CIA did hack into the US Senate's computers. http://www.nationaljournal.com/tech/cia-admits-it-improperly...

Um.... you perhaps know less than you think you do about what "close US allies" do and do not engage in behind closed doors. Half of the reason Five Eyes even exists is to reduce the threat of espionage conducted by close allies.

I agree. The DoD/NSA and other agencies should be developing these capabilities. IT's really the oversight and legal use of weapons against civilians that is the question

I suspect that "cyberweapons", like biological weapons, are almost impossible to use in a way that does not harm civilians. Their development is practically certain to lead to use against civilians in a way hard to reconcile with the ideas behind current international law. On the other hand, the idea of fighting a war without harming civilians is a 19th century notion unlikely to survive much longer.

It's exactly this unrealistic notion of having your cake and eating it too that landed us in this mess in the first place. And what do you mean by "defensive capability"? Secretive military organizations isn't going to protect civil society. In fact their influence is often in opposition to such protection.

Reply on news.ycombinator.com