Hacker News Reader

Comment by NateLawson | Hacker News Reader

Bruce Schneier is falling into the trap of saying since computer security is hard, the NSA has certainly been compromised and we can assume these docs have been out there for a while.

Yes, securing the endpoint is hard, especially given the non-hardened OS and applications we mostly use. However, you can't extrapolate from that to say with certainty what has and hasn't been exposed via security flaws.

The USSR was much more successful at espionage than the US was, and they took a low-tech approach to it. For decades, they developed contacts within the govt, gave them money, and had documents handed to them by authorized insiders.

Let's not assume computer exploitation is the only culprit. History has shown a variety of techniques, even very low-tech ones, have been employed for espionage and it's impossible as an outsider to determine how much has been taken, by whom, and by what means.

View on HN

> > The vulnerability is not Snowden; it’s everyone who has access to the files.

> > First, the journalists working with the documents.

> Bruce Schneier is falling into the trap of saying since computer security is hard, the NSA has certainly been compromised and we can assume these docs have been out there for a while.

The NSA has been compromised. By Snowden. There's no assumption there, that's fact. Now, access to the documents not longer just means having NSA access (or a complicit person with access) or hacking the NSA, it includes access to any system or person who has access to all the files, which are no longer restricted to NSA servers. It's no longer about what the NSA's security practices are.

Yeah but the point is that the NSA is most likely much easier to compromise than the Snowden documents.

Wait... you believe that the NSA is easier to compromise than the computers of reporters from multiple international news agencies with various levels of computer security policies and knowledge?

I'll let Schneier answer that, in case you didn't read the article:

> The open question is which countries have sophisticated enough cyberespionage operations to mount a successful attack against one of the journalists or against the intelligence agencies themselves. And while I have my own mental list, the truth is that I don’t know. But certainly Russia and China are on the list, and it’s just as certain they didn’t have to wait for Snowden to get access to the files.

That doesn't mean he thinks it's easier to hack the NSA, just that he thinks it already was, so it doesn't matter.

Snowden didn't create any flaws in NSA's internal systems (or at least, none that anyone's described publicly), but his actions certainly demonstrate that they were there. All Schneier is saying is that someone else could have taken advantage of the same flaws -- and that he thinks, given the givens, that someone else almost certainly did. He's not the only one who thinks the odds stack up like that...

Spying is a good thing. Real information keeps people from second guessing each other and prevents cold conflicts from becoming hot.

So the trouble is only when your voters get the information necessary to vote rationally?

Spying is a wash - what you're saying is true, but it's only half the equation. Sometimes that second guessing is what keeps the conflict from becoming hot. Spying can compromise a country's defense to the extent another country feels comfortable attacking. Also, if a weaker country can maintain the facade of strength it's less likely to be attacked.

The most obvious example is when one country manages to uncover another country's nuclear assets to such a high degree of confidence it feels (rightly or wrongly) it can make a 100% successful first strike.

You need mutual spying, but if you have that, then the week country will know that it is 100% vulnerable to first strike, and surrender before it comes to that.

That never, ever happens.

How would you know that?

Give me one historical example.

You want me to give an example of something I'm claiming we don't know?

Surely if this is possible you could find one example in all of human history.

If I had better knowledge of military history, maybe. But I find it extremely unlikely that there has never been a situation where somebody knew some secret about their enemy that encouraged them into a concession instead of resistance. I mean, it happens in legal situations every day.

I'm not so sure you can count on a country to act in rational self-interest. Individual people aren't so good at that, and collectives can be less rational than individuals.

We will know some parts of truth but probably in one or two decades from now (like for the Cambridge Five).

https://en.wikipedia.org/wiki/Cambridge_Five

Reply on news.ycombinator.com