Slashdot Mirror
Obama Says He May Or May Not Let the NSA Exploit the Next Heartbleed
An anonymous reader writes "The White House has joined the public debate about Heartbleed. The administration denied any prior knowledge of Heartbleed, and said the NSA should reveal such flaws once discovered. Unfortunately, this statement was hedged. The NSA should reveal these flaws unless 'a clear national security or law enforcement need' exists. Since that can be construed to apply to virtually any situation, we're left with the same dilemma as before: do we take them at their word or not? The use of such an exploit is certainly not without precedent: 'The NSA made use of four "zero day" vulnerabilities in its attack on Iran's nuclear enrichment sites. That operation, code-named "Olympic Games," managed to damage roughly 1,000 Iranian centrifuges, and by some accounts helped drive the country to the negotiating table.' A senior White House official is quoted saying, 'I can't imagine the president — any president — entirely giving up a technology that might enable him some day to take a covert action that could avoid a shooting war.'"
Side note: CloudFlare has named several winners in its challenge to prove it was possible to steal private keys using the Heartbleed exploit.
Spy agency's job is to spy. It'd be remiss of them not to use such a security hole.
The question is, would he allow the NSA to exploit a similar vulnerability against Americans. And I think we already know the answer to that one too.
Just because you're paranoid doesn't mean there isn't an invisible demon about to eat your face
There are almost certainly ongoing exploits of vulnerable systems.
People will very often tell you their intentions if you listen closely enough.
Happiness in intelligent people is the rarest thing I know.
Ernest Hemingway
The information content of a sentence whose structure is, "I may x or I may not x" is 0.
[Signature omitted due to copyright restrictions.]
Really, anybody who thinks anybody cabinet level or higher even knows about this kind of logistical detail is an idiot. This isn't at all like the torture thing which is a basic human rights violation; nobody is questioning the NSA's right to spy on certain people, and this has nothing to do with any accusation that they're spying on people they shouldn't be spying on. This is about technological implementation, and it's part of NSA's purview as a spy agency to explore technologies that further their ability to do their job. Part of that is discovering weaknesses in cryptographic systems which are trusted by the people you want to spy on. Having discovered such a useful weakness they aren't obliged to report it, although they are obliged not to use it (or any of their other techniques) against our own citizens.
Brackets contain world's first nanosig, highly magnified:[.]
you're a moron. Don't trust liars who have been proven to lie and then continue lying. In fact you probably shouldn't trust liars in general.
The problem with saying "unless 'a clear national security or law enforcement need' exists" is that it actually compromises national security. What is more important. That you can easily hack in and skill data from the KGB, or some mafia site; or that every last American Citizen can be hacked by the KGB, or mafia? Keeping a bug like heartbleed a secret is something only an idiot or black hat would do. If the NSA knew of heartbleed early, and kept it a secret they are arrogant idiots. They ether wanted criminals to have free rain to steal anything they wanted, or they believed that criminals are too stupid to have found this bug.
The NSA is part of the Executive Branch. Obama could immediately, at the very least, put a temporary halt on all of these types of activities and conduct a review gauging the potential impact on ordinary US citizens as collateral damage. He has done no such thing -- not with mass surveillance, not with HeartBleed, not with any of the other nasty shit disclosed in the Snowden leaks. Don't DARE give him a pass on anything NSA-related -- he doesn't need Congress in this case and can personally shut it all down at any time.
The problem with our world is that a high level of competency is actually required for an awful lot of things, and nobody wants to be competent anymore.
Not completely true. Many want to be competent, however nobody wants to pay what this competency worth. You have to invest a lot of time to become competent and at the end, it must pay otherwise you are better to do something else. There is a lot of well paid jobs which don't require the efforts you need to put on something to become competent.
Achille Talon
Hop!
There is no naivete. I expect nothing but thuggery from the government, so it isn't a surprise when we see the NSA being evil pieces of trash. It is, however, something that must be stopped.
[End Of Line]
The job of any government agency to defend the constitution. It's the job of the judicial branch. Furthermore, you actually expect a spy agency to protect the constitution? That's not even close to their job.
The naivete some have on this issue is rather surprising given the demographics of the site.
Employees at the NSA take an oath to defend the constitution. From the NSA's website:
NSA/CSS employees are Americans first, last, and always. We treasure the U.S. Constitution and the rights it secures for all the people. Each employee takes a solemn oath to support and defend the Constitution of the United States against all enemies, foreign and domestic.
It's not naivete, it's just expecting them to do what they SWORE TO DO.
Enigma
If the "primary directive" of the NSA were actually National Security (rather than spying) what they should do would be obvious.
In the interest of national security, should the NSA discover such an exploit, they should quietly work with public and private organizations to get as much of the infrastructure fixed before the exploit becomes generally known.
Instead, though, what we have is that the NSA has likely had free access. Along with the rest of the world's spy agencies. And hackers and crime networks. That doesn't foster national security, IMO.
The US government has the ability to spy on every electronic communication you make, it has been exploiting that ability to the fullest for many years now, and it will continue to do so forevermore. It will do so for the sole purpose of increasing its own power. If put to the inconvenience, it will lie to your face about it. This state of affairs will prevail regardless of which branch of the Money Party is in power. And there isn't thing one you can do about it.
Rules with broad sweeping generalized caveats basically means, no rules. It means WE (as in the people who made the rules) are going to decide on in a subjective way whether we broke the rules or not... and anyone who even knows the most basic aspects of human nature, knows that we as people in general don't like incriminating ourselves, and a government is just a group of people.
So this is basically just lip service from the government, to calm public anger while at the same time giving us the finger.
Might be bit hard to check after the fact, but if their servers were leaking data on unpatched version of heartbleed it would suggest innocence. If their servers (important ones) were somehow immune to this attack before it went public... they knew something.