It's Time to Break Up the NSA (2014)

Yes. Imagine if the NSA were tasked with being a gatekeeper for data privacy and integrity that large companies like Facebook had to work with any time they pushed an update that sent data somewhere new, in the same way that the FDA verifies safety and efficacy of pharmaceuticals when they're applied to a new problem-domain. (I know that sounds almost satirically over-the-top, but it could work—if it were limited to companies [and branches of government] that were handling enough user data that, say, identity fraud attacks would be made possible just by having it. And any system where the government itself has specified the data-integrity requirements: voting terminals, library checkout systems, etc.)

Come to think of it, this NSA would probably also be responsible for chasing down companies who ask you for your SSN, wouldn't it?

They could also offer free pen-testing services (presumably through their defense subcontractors; they wouldn't have to employ any whitehats themselves) for small businesses who can't afford pen-testers, like a specialized form of industrial-development grant.

And, of course, they could also do the only legitimate/legal "active no-advance-notice" pen-testing for infrastructure they're concerned about (ISPs, hosts like AWS, etc.), converting taxpayer dollars directly into those "eyes that make bugs shallow."

Effectively, the NSA are to our sovereign data boundaries as the coast guard is to (most of) our physical ones. Since that's the case—where's our Lighthouse Service?

Indeed. Compromising cybersecurity as a means of defense is fighting with a gripless sword. It makes no sense that planting backdoors in all of your systems is somehow supposed to help security.

For one, there has been little appreciable gain from this practice, but it's also way too easy for an adversary to subvert a backdoor planted for purposes of peeping around, and use it to do very serious damage. The more entrenched surveillance via cyberespionage becomes, the more it expands the attack surface for a foreign actor to exploit it.

Second, there is no guarantee at all that the NSA is impervious to the same sort of infiltration methods. If they become compromised themselves by a foreign hacking entity, then that's it for everyone they're "surveying".

From The Article:

"And third, the remainder of the NSA needs to be rebalanced so COMSEC (communications security) has priority over SIGINT (signals intelligence). Instead of working to deliberately weaken security for everyone, the NSA should work to improve security for everyone.

Computer and network security is hard, and we need the NSA's expertise to secure our social networks, business systems, computers, phones and critical infrastructure. Just recall the recent incidents of hacked accounts—from Target to Kickstarter. What once seemed occasional now seems routine. Any NSA work to secure our networks and infrastructure can be done openly—no secrecy required."

The NSA's Information Assurance wing considers itself responsible for the security of classified US Government systems only—specifically not unclassified US Government systems, or any civilian systems whatsoever, which they feel falls under NIST's domain.

But yes, it's much smaller than their SIGINT wing, and yes, I also feel that having both teams under the same roof (so to speak) is not just an 'equities problem' - it's a full-scale irreconcilable conflict of interest.

You might feel that surely the NSA wouldn't backdoor their own stuff? But no: there they are, actually using Dual_EC_DRBG even in their own most trusted crypto hardware - in, I presume, the firm belief that "nobody but us" has the private key to use the backdoor. Which seems somewhat reckless in light of a working distinguisher and how very fragile (EC)DSA is… and a stark reminder of how the recent return to talk of backdoors - sorry, "front doors" or "secure golden keys", because they want to control the language to frame the debate in the way they want - are so much bullshit, and the only reasonable discussion we can have about things which undermine all of our collective security is one where the people who are asking for such idiotic things to - they think - make their jobs easier should kindly shut the fuck up.

Ahem.

GCHQ over here have the exact same issue with CESG and the MoD CRYPTO group versus the COMINT/ELINT/SIGINT bulk of their mission. GCHQ have even selected their own suppliers and political and other infrastructure for targeted surveillance in some cases! So for those who choose to try to work with them - surprise! - that doesn't mean they're not also working against you too. It just gives them another angle.

Isn't the PCI standard a better, although certainly imperfect, model for addressing this without roping the Beltway into the process?

This is actually against the law.

Title 10 explicitly disallows the NSA to proactively interfere (good or bad) with private industry services unless specifically requested by a law enforcement agency and in cases like you propose would have had to be requested by the private organization to the LEA in the first place.

Schneier addresses that later in his essay:

And third, the remainder of the NSA needs to be rebalanced so COMSEC (communications security) has priority over SIGINT (signals intelligence). Instead of working to deliberately weaken security for everyone, the NSA should work to improve security for everyone.

As long as there's a chance that the NSA could be able to break strong encryption and thus gain a huge leg up on other nations/potential lawbreakers, the governmental sentiment will remain in favor of retaining the NSA in the face of whatever pie-in-the-face leaks come out. Last I heard, they're working on a quantum computer to do exactly that.

http://www.cnet.com/news/nsa-working-on-quantum-computer-to-...

People being inconvenient in pushing for social change are insufficiently protected. The CIA spied on MLK Jr., discovered he was having affairs, and used that to try to blackmail him into committing suicide. If he had, that would have been a major loss to society.

And now we have reports of the NSA developing dossiers of minor crimes and non-crimes of inconvenient people's behaviors for future use in discrediting them.

Is your suggestion that anyone who is (or may in the future) choose to be politically inconvenient should use strong encryption for everything even slightly unpopular they may do?

We can't contain cryptography, but neither can we depend on it being universally and effectively applied.

1- tor is broken. 2- they know and use ways to get around encrypting. We got to give them some credit they knew encryption was an issue that at some point they had to dealt with. And they found ways to do just that from the beginning.

Encryption is orthogonal to policy, which is the topic of the article.

>>> The NSA internet data collection is perhaps the most frivolous government program in the history of the United States.

This.

If you listen to the old NSA guys who worked during the heights of the Cold War, who keep tabs on Russians and all the chaos in the Middle East, and had some of these tools at their disposal, they all say the NSA was a great machine for intelligence. It was a great machine for developing assets and tracking bad people. As soon as those weapons and the machine were turned inward on the people they were supposed to protect, they all said it was the worst possible scenario.

Also, if you look at some of the higher profile hacker cases, and to some degree the Ross Ulbricht case, how were they all cracked? Not by the NSA and all its tools, they were all done with your standard, "feet on the street" agents developing leads, connecting dots, and capturing human surveillance.

It wasn't some Flame or Stuxnet bug that brought down these guys, it was just solid detective work.

letsencrypt.org looks like an awesome project! Can't wait to try it out.

Minor point: conservatives and liberals love their guns. What they say publicly doesn't change the fact that the gun manufacturers hold huge political power in the form of the NRA over both parties, and that's not likely to change. If this was not so, we'd have an Australia-style buyout a long time ago. As is, we are stuck with monthly (or is it weekly now?) mass shootings, staggering numbers of handgun murders, and a crazy amount of police brutality simply because access to guns is easy and protected by the NRA.

To bring it back to crypto: there is a correlation between easy to obtain $TECH and use of $TECH. Currently, HTTPS is not as easy as HTTP, so its adoption is less. Let's Encrypt will change that. Currently, access to guns is easy, so their adoption and use is high. With the current political climate that will never change.

I agree with the point about cryto, but I'm not sure your general point about society being unable to contain anything is sound.

Guns are controlled in many countries quite effectively. Not completely of course, but compare for example gun crime in the UK with the US.

There are fewer (if any) examples of drugs being controlled effectively (in non repressive regimes) I'll agree though.

But.. what about parallel construction? We know that the NSA is feeding tips to, among others, the DEA and ATFE -- they're just pretending to find out about criminal activity in other-than-blanket-surveilance ways. The practice is so commonplace that the NSA has a special division for seeding the evidence to other agencies, and there are indications that even state and local law enforcement agencies are in on the fun.

But this sort of spying clearly isn't like ordering a bombing run on Berlin or sending a tank division to capture Athens.

Spying isn't even a military operation, it is mostly diplomatic.

Spying has always been common even amongst allies. It is a form of hacked transparency. Countries hide as much as they can.

Yeah, you hit the nail on the head.

Right now it's Orwellian and sophisticated-- if they have Amazon's level of data crunching and prediction ability, they might be able to predict certain things about you, and, on average, be more right than wrong.

Wait until they have 20 more years of data on you, and 20 more years of advancing the quality of their algorithms and machine intelligences. You will be owned, and your buttons will be pushed as necessary to maintain what has already been built.

This reminds me of the surreal world of the stock market, where organizations largely make their own rules and regulate and enforce them themselves.

In 1971, the National Association of Securities Dealers (NASD) gave birth to NASDAQ, which became publicly traded in 2000, and then a national securities exchange in 2006. NASDAQ wasn't really independent of NASD until 2000, so for a while the same people who owned the exchange also regulated it.

The NYSE is much older and became a Not-for-Profit in 1971. In 2006 it merged with ArcaEx and became a publicly owned for-profit, later merging with Euronext in 2007 and acquiring AMEX in 2008.

Here's the weird thing: exchanges are supposed to self-regulate, with the SEC basically just approving the rules they make for themselves. And the exchanges kind of 'outsource' their regulation - but not all of it - and that's not all that well defined anyway.

In 2007, NASD's and NYSE's regulatory and enforcement committees were merged into a new organization, FINRA, which basically makes the rules their members are supposed to abide by and enforces them in coordination with the SEC.

The SEC has been investigating exchanges since the "flash crash" of 2010, when it was shown how completely fragile the market had become by large players making very large trades, as well as new high-frequency automated trading.

In 2011, NYSE Euronext tried to merge with Deutsche Börse, which would have become the largest stock market in the world by far. It actually passed US antitrust investigation. But in 2012 the European Commission blocked the merger as it would have created a 93% monopoly on European derivatives trading. This doesn't have anything to do with the exchanges violating rules, but it does show how without regulation, monopolies would be a virtual certainty.

In 2012 NYSE was fined 5 million for giving data to its customers before the public. In 2014 NYSE was fined 4.5 million when it was found to have violated its own rules, or lacked rules it should have had.

Compare this to NASDAQ settling with the SEC for 10 million just for mishandling Facebook's IPO in 2013. This is apparently because the SEC stopped short of finding the NYSE's actions as felonies. And all of this is relatively new, as exchanges historically were never legally scrutinized or punished for their actions. (Their revenue is in the billions, so these fines are basically just for show)

It seems to be a sort of universal truth in that the people trying to break a system will always be ahead of people trying to secure/protect it. Why then, would prioritizing COMSEC over SIGINT change any of that? COMSEC will never catch up to SIGINT.

I'm curious to know what exactly the NSA currently does to protect the US. Do they already use their existing SIGINT knowledge to update systems ahead of attacks?

So we should be left in the dark? I would not want the NSA/CIA shutdown unless the same is done with Russia's FSB or Pakistan's ISI.

It's better to keep the good parts and reform the bad parts than to throw the entire baby out completely.

Let's draw a parallel to something more tangible than the cyberwar we don't see. Recently there was a number of high-profile cases where police got into a clash with unarmed civilians, with disastrous results. Should police be shut down completely? Would you be safe in a city with no police? Many cities in the world have places where the police don't go, and those are dangerous places.

NSA and CIA serve important functions. They just need to be properly balanced.

The US Army kills people. What does the US Army have to do to get shut down completely? Do we wait until genocide?

The fundamental issue isn't their culture or organizational structure, it's their unethical missions, which breed cultures of secrecy and opaque, unaccountable and defensive institutions. I don't see how you can set up a spy agency to prevent it from evolving in that direction. Would love to hear of counter-examples, though.

>Regarding NSA and CIA, what do they have to do to get shut down completely?

The US signs a complete unconditional surrender on the deck of the $SHIP of $NEW_WORLD_POWER - at least that would be my guess based on history.

We don't stop for genocide.

I think that is a excellent example of how information might get abused.

While the level of corruption may not be that much bigger, the ability of the corrupt to cause harm has greatly increase through use of modern technology.

True, I think the Snowden events have uncovered the unfortunate reality that there is a gigantic hole in the boat. In the end, the only way we get out of this is to redesign the system, from hardware on up, to be secure. The NSA, as per their mandate from Congress as an expression of the will of the people of the USA, is using the holes in the boat to advance the security of the nation. It is literally their job to do this. Again, the issue is that the boat is leaky. Maybe we humans decide that this leaky problem is not all that bad, and like biology, a certain percentage of 'sinking' is acceptable versus the cost to make a better boat. I dont think this is true though, because lawyers. Making a better and more secure net is the end of the game, it is only time that stands between us.

> Why commit ourselves to a massive overhaul of the entire NSA when we can address the actual problem here with some granularity and minimal cost yielding an impact almost all of us would enjoy?

Because they've been exposed as untrustworthy. Any attempt at reasonable reform will be met with obstruction, obfuscation, and lies.

> 0day exploits, software and hardware backdooring

Up until it was proven, they denied doing these kind of things. What makes you think they'd tell the truth in the future?

Technically, you are wrong. NSA has a signals intelligence side and an information assurance side. It does have two dual missions. You may argue that they haven't done a good job with the information assurance side of their mission, but you cannot argue that it is not a stated mission of the NSA.

Security is their objective; using all encompassing communication spying is their strategy for accomplishing that objective.

This comment is not an endorsement of any NSA policies.

Never mind that "security" is literally their middle name--the second L of their TLA.

It wouldn't be the first time that a government enterprise had a misleading name.

Finally, a pragmatic voice amongst those calling for an anarchist solution. I will add my vote to those calling for increased oversight, and regulation over the all out "scrapping" of these programs.

> NSA already minimizes American information

While this is the PR, in practice it's categorically untrue.

As long as you believe in Santa Claus, how about the NSA also be put in charge of delivering Christmas presents to children who are nice by drone, and punishing children who are naughty (also by drone), since they are already monitoring everyone and everything, and they make it their business to know who's naughty and nice.

I think holding the position "the United States should not be spying on anyone, ever" is perhaps too far over on the spectrum of idealism. You do need some spying on countries that pose genuine threats such as North Korea, Iran, China, Russia and the like.

I've got an idea. In the faux name of net neutrality, let's give one of the most abusive governments when it comes to privacy, vast control over regulating the domestic Internet, and let's allow them pass those new regulations without anyone external being allowed to review them ahead of time. What could possibly go wrong? It's not like the government will massively expand their direct control of the Internet, and use that to chill free speech. And it's not like we'll be sitting here in ten years, listening to pro net neutrality campaigners making excuses about how those weren't the laws they had in mind; after all, who knew the government would abuse their new powers, nobody could have guessed such a thing.

Whoops, too late:

https://www.eff.org/deeplinks/2015/02/dear-fcc-rethink-those...

Not necessarily. It's just a matter of dis-empowering the people who are on a die-hard mission of "spy on everything, and to hell with civil rights."

That is not the whole NSA; it's just a few key people in leadership positions that have been steering the ship lately.

If you keep those same people in power but split up the agency, yes, you'll just get the same thing again.

Defund them, it's not perfect (as with the CIA and it's ah interesting funding mechanisms) but it is one of the more effective of the least worst options.

What has changed in the past year?