How the NSA Profits Off of Its Surveillance Technology

blottsie writes: The National Security Agency has been making money on the side by licensing its technology to private businesses for more than two decades. It's called the Technology Transfer Program, under which the NSA declassifies some of its technologies that it developed for previous operations, patents them, and, if they're swayed by an American company's business plan and nondisclosure agreements, rents them out. The products include tools to transcribe voice recordings in any language, a foolproof method to tell if someone's touched your phone's SIM card, or a version of email encryption that isn't available on the open market.

Comments

I can't quite decide

[i kan reed]

I know that the default majority slashdot opinion is, and for good reason, that everything the NSA is poisoned with malicious intent. But I can't actually decide if making useful security tools available is somehow against our citizens' interests.

I mean the compounding factors of large corporations, and big dumps of money, and selective availability all suggest problems too, but in a circumstantial way.

I can't make up my mind this time.

Re:I can't quite decide

[Anonymous Coward]

The NSA has done a lot of things over the years, most of them cool, useful, and in the best interests of the American people.
When they caught foreign companies committing bribery, that was good work.
When they hardened DES against differential cryptanalysis, that was good work.
The problem with the Clipper chip was the key escrow; Skipjack was an awesome algorithm for its time.

I'm also undecided on the TTP; I'm pretty sure TFS misrepresents it.
How can the same technology be protected by both patents and NDAs? You have to give away the secret sauce to get a patent on it.

Re:I can't quite decide

[gstoddart]

One of the things which concerns me, is you're putting all powerful surveillance tools into the hands of private corporations.

Those corporations can then use and abuse that technology in ways which may ignore the law, and bypass any oversight.

And then if the NSA has included in their contract a share of the take, or simply invoke the PATRIOT act to demand it ... then you can effectively have government outsourcing things they're not legally allowed to do out to private industry, but then it doesn't break the law when private industry hands back the data they'd not have been able to collect legally.

At which point, they can basically do an end run around the law, and the people who are tasked with oversight.

And since we know they already lie to the people who are supposed to be overseeing the ... I have zero way that you can treat an organization like this as anything other than a rabid dog.

At this point, I think the only way to get the truth out of the NSA is to waterboard it out of them. Because they've demonstrated they don't give a damn about providing it to us.

I rank this as being massively creepy, and with legal implications which boggle the mind.

And, yes, I do come down heavily on the tinfoil hat end of the spectrum. But paranoia doesn't preclude malfeasance, especially when there's already evidence of malfeasance.

Big Brother is scary. Big Brother in bed with private industry is terrifying.

Re:I can't quite decide

[gmanterry]

Let me fix that for you...

Those corporations can then use and abuse that technology in ways which may ignore the law, and bypass any oversight, just like the NSA.

Re:I can't quite decide

[fustakrakich]

In this case "circumstantial" is all you need, especially when based on past performance. When they swim in abuse, they no longer consider as such. They release this stuff because it is obsolete and vulnerable to detection, like Tor. In other words, they won't blend into the WAN.

And, the summary also proves a point I've been making for a long time, that even semi effective encryption is not available to the public. It is just not there, and the issue is being attacked from wrong angle entirely anyway.

And why are allowing them to patent this?

Re:I can't quite decide

[CaptainDork]

Truly, I feel the big bad monster out there is business. They have ways of getting their tentacles into everything.

It all started when the shoe shine boy started taking tips for information.

Re:I can't quite decide

[Anonymous Coward]

Former TTP contractor here: First, there are PLENTY of issues one can have today with NSA and the American defense and intelligence community as a whole (note: FORMER federal contractor)... but it can be argued that TTP is one of the few unqualified "good" things the agency does.

In short, there are a bunch of federal regulations and statutes dictating that technologies paid for by the federal taxpayers should (barring lingering classification concerns) be made available for licensing and further development by those taxpayers, usually in the form of private companies, universities, the staffs of other public agencies, etc. There are different rules and processes for each, with the "fees" often being nominal and dependent on the scope and extent of the patent's application, and working to the benefit of the actual inventor(s).

Also, this is NOT an NSA-specific exercise. Most (and I imagine all, but can't confirm individually!) federal laboratories participate in technology transfer - the Federal Laboratory Consortium is a publicly available entity maintained for just that specific purpose.

And as a final aside... if you had seen the size of the Agency's TTP office (manned by a skeleton crew of administrative staff and often at the mercy of the general counsel/patent attornies) and the numbers TTP actually deals with, you would find a lot of the scare language in the original article patently (puns!) ridiculous. It took us two years to get an update on the NSA.gov website, which apparently only ended up being a basic refresh of content - so much for all the hidden Agency slush fund pull!

Re:I can't quite decide

[Nyder]

I know that the default majority slashdot opinion is, and for good reason, that everything the NSA is poisoned with malicious intent. But I can't actually decide if making useful security tools available is somehow against our citizens' interests.

I mean the compounding factors of large corporations, and big dumps of money, and selective availability all suggest problems too, but in a circumstantial way.

I can't make up my mind this time.

I can. Corporation are bad. They don't care about people, they only care about profit, so how is them having crap no one else has be any good?

Re:I can't quite decide

[ColdWetDog]

Three Rings for the Fortune 100 in New York City.
Seven for Haliburton in its halls of stone,
Nine for FBI doomed to lie,
One for the Dark Lord on his dark throne
In Fort Meade where the Shadows lie.
One Program to rule them all, One Program to find them,
One Program to bring them all and in the darkness bind them
In Fort Meade where the Shadows lie

Re:I can't quite decide

[sabri]

The NSA has done a lot of things over the years, most of them

Funded by the taxpayer already.

Now if companies are paying the NSA to get access to their research, they're paying twice: once as a taxpayer, and now as a "customer".

If the technology can be declassified, the information should be public property, as its research was funded by the taxpayer.

Re:I can't quite decide

[hey!]

It depends on how the money is handled. If it goes into the general fund, then I think this is great. If it is used to fund NSA operations, I think it is bad. That would make it too easy for the agency to avoid Congressional oversight.

In general self-funding government agencies are terrible idea-- that's why running the government "like a business" sounds good but is a lousy idea. Government agencies should serve the public, they shouldn't be profit centers. That's a conflict of interest. In places where police funding depends on seizing property involved in crimes -- typically drug crimes -- there's an incentive to do it to make money rather than fight crime.

There are some exceptions, like water districts that are funded by water and sewer fees, but these are essentially utilities that are run by the public, their rates set by boards elected by the ratepayers. But no agency should be self-funding except that it is controlled by the people providing the funding.

Re:I can't quite decide

[king neckbeard]

I'm not opposed to the development of technology with public funding, but I am far less keen on that.technology not being open to the public, especially when it is developed directly by a government agency.

Re:I can't quite decide

[matbury]

The premise of the article is misleading. The NSA is usually presented as this govt. monolith in that shiny blue glass building in the middle of a parking lot. 80% of the NSA's work is done by private subcontractors. There are 1,000's of them and, as Edward Snowden has pointed out, their security systems and auditing don't have much oversight, e.g. look at what happened to Stratfor and how easy it was for Snowden to get all that data and cover his tracks until he was ready to go to the press. The NSA still don't know what he took.

The NSA almost certainly offers its services and software to corporations and regimes around the world, regardless of their human rights records.

Re:I can't quite decide

[nucrash]

I have mixed feelings on this as well.

Here we have taxpayer funded technology which the NSA is making a profit off of in order to provide funding for the NSA. The problem is that while they are creating revenue off of something that was initially purchased by the tax payer. Selling such technology or research to companies in a strange way privatizes that research or technology. I firmly believe that these things should be handed over to the populace that developed them. There are some exceptions to this like for example if the NSA contracted an individual company and the individual company patents the tech, then they are trying to secure their contract with the NSA. However, when the NSA makes a discovery should become public domain.

Imagine if NASA only released their data to people who subscribed to the premium NASA network or if our armed services only provided protection to countries or states that rented our services. Imagine if FEMA only brought aid or created a tiered service to which they dispersed aid to those who donated to them.

I understand that this is how the world works, but I feel that allowing the NSA to do this, they can justify their existence by saying they are self-sustaining while other agencies don't have the ability to monetize their research but actually do more for this rocky mass orbiting third in order from Sol.

In summary, cool, you can sustain yourself, bad, you are using that to justify your existence instead of your actual excuse for existence.

Re:I can't quite decide

[obarthelemy]

Actually, they're not so much security tools as spying tools. I read TFA as "NSA has been helping US corps spy on allies's corps". Well, after spying on Germany's Chancelor and others, that's par for the course for the US I guess.

Re:I can't quite decide

[gstoddart]

their security systems and auditing don't have much oversight

So, they're incompetent then?

That makes me feel a whole lot better.

So, now instead of a bunch of lying bastards who abuse their power, ignore the law, and lie to the people who provide oversight ... they're a bunch of incompetent, lying bastards who abuse their power, ignore the law, and lie to the people who provide oversight.

That's what we need.

Re:I can't quite decide

[IndustrialComplex]

It IS public property. Just like the National Parks, or mineral rights under public land. Public property does not mean free. The government has a responsibility to manage public property in the way that best represents the interests of the owners of that property.

Licensing technology developed on the public dime seems like a rather responsible thing to do, just like negotiating for maximum compensation for oil on public land is the smart thing to do.

Re:I can't quite decide

[K. S. Kyosuke]

Yet university research funded with public money is obligatorily in the public domain in the US, isn't it? And here, taxpayer's money used for tech research is going to save money of government-picked private companies instead of the money of any taxpayer who'd wish to do so.

Re:I can't quite decide

[sabri]

Licensing technology developed on the public dime seems like a rather responsible thing to do, just like negotiating for maximum compensation for oil on public land is the smart thing to do.

You're conveniently omitting the fact that oil on the public land has not already been paid by the taxpayer.

In your world, the taxpayer pays twice for procuring the technology. First for the development, then for the licensing.

Re:I can't quite decide

[Empiric]

I have a bit of a conceptual issue with the "be made available for licensing and further development by those taxpayers" rationale.

If you're the type of taxpayer that runs a corporation, it is available to you, because you have the resources to commercially exploit the tax-funded technologies. If you are a common taxpayer, you have no actual ability to do this, given the costs of carrying on research and/or implementing and distributing something derived from it.

So, essentially, this comes down to "if you're a rich taxpayer, it is available to you, if you're a not-rich taxpayer, it's 'available' to you only in name". This seems to do nothing but accelerate the government-corporate power integration trend we've seen quite clearly of late.

Re:I can't quite decide

[sumdumass]

I'm not so sure where the now comes from. This has been true since Snowden walked away with unknown amounts of data and left the NSA scratching their heads wondering how it happened.

Re:I can't quite decide

[rtb61]

Restricting access to major corporations when it comes to surveillance technology without informing the general public seems of course, 'WILDLY SUSPECT'. Seriously WTF are these idiots thinking. Their private for profit partners and contractors are now actively sharing in the deployment and use of various espionage devices without detailing what is being done and providing that information to the public.

Re:I can't quite decide

[mysidia]

In general self-funding government agencies are terrible idea-- that's why running the government "like a business" sounds good but is a lousy idea. Government agencies should serve the public, they shouldn't be profit centers.

Even in businesses..... a department cannot do other things on the side that generate lots of extra revenue and keep the proceeds within the department -- all inflows have to go to receivables accounting, and use of moneys to fund a department is at the discretion of management; just because department X generated an extra $1 million in revenue this year, does not mean all the extra cash coming in will be allocated to that department; it may be used to fund a new project, or it might be returned to shareholders ([taxpayers]) instead.

Re:I can't quite decide

[Guest316]

If a branch of government is going to do gross Constitutional violations, I think I'd prefer they were terrible at it. Maybe that's just me though.

Re:I can't quite decide

[AHuxley]

re "But I can't actually decide if making useful security tools available is somehow against our citizens' interests."
The tools offered will protect against distant man, expected in the wild man in the middle efforts.
The tools, tame crypto, tame academics, tame OS, tame source code will not protect against modern version or equivalents of TEMPEST like ideas.
The plain text, voice, call, gps, voice print or other network details will always be in the clear for gov tracking and parallel construction.
Just good enough for international work, always easy enough for realtime domestic decryption.

Re:I can't quite decide

[Pepebuho]

The NSA should be split in three, similar to what they did to MaBell.
One part would be pure R&D
The Second part should be Apps to help their spying and data collection for foreign purposes (What they usually do today)
The Third part should be Apps to defend the country from someone else using apps similar to those used by the Second Part against USA.

The Second and Third part should have a real Chinesse wall, never talking, never knowing what each one is doing.
It is the only way we could trust again whatever help the Third Part provides to cryptographic standards and stuff like SELINUX. Likewise, the Third Part should work in the open in a as transparent way as possible.

JP

Security is Big Business

[WillAffleckUW]

And as we all know from Atty Gen Holder, Big Crime never goes punished.

Can't lock up people for the big crimes.

Instead we let them break the Constitution, like the NSA, and profit by their actions.

Re:Security is Big Business

[smooth wombat]

Considering Bush and his Attorney General didn't have a problem with gutting the Constitution, don't see why the next AG couldn't do the same. Precedent had already been set.

Re:Security is Big Business

[i kan reed]

Let them break the constitution

Like it's some kind of ordinance with jail time attached. I don't know how you're imagining constitutional enforcement works, but whatever it is you're thinking, it's not accurate.

1. Elected officials can break the law(this is the only thing that entails punishment).
2. Laws can be unconstitutional in whole or in part, and executive can decide that, and refuse to enforce, or the courts can decide that(more commonly), and throw it out, in whole or in part.
3. The manner of executive enforcement of constitutional laws can be unconstitutional, and courts can give orders throwing out cases that match those criteria.
4. The courts can rule in an unconstitutional way about constitutional enforcement of constitutional laws, in which case you're fucked.

Re:Security is Big Business

[Cro Magnon]

The obvious solution is to elect a President who will appoint a law-abiding AG. The obvious problem with that is, most candidates don't admit that they'll violate your rights while campaigning. :-P

Re:Security is Big Business

[ageoffri]

The Bush Defense has gone beyond beating a dead horse, now people like you are beating a smear that might be the remnants of the horse. Obama and Holder have gone so far past the transgressions that Bush started that it isn't funny. Yet the biggest defense I hear is either "Bush did it" or "At least it isn't Bush doing it".

Re:Security is Big Business

[Anonymous Coward]

Precedent had already been set.

By Clinton lying to Grand Juries. By Reagan and Iran Contra. By Carter...oh wait Carter never did shit other than show up, shake some hands, and talk about peanuts and saving gas. Most people on /. are probably to young to remember but I find it funny that Jimmy Carter was more of a black president that Obama will ever be. I don't mean that in a bad way, Carter had is own impediments, mostly from the liberal wing of the Democratic party, that prevented him from really accomplishing anything significant. And if it wasn't for Ted Kennedy maybe Carter wouldn't have suffered the complete ass kicking in the 1980 election, but there was no way he was going to beat Reagan. Anyways off topic, why Carter got elected....By Nixon and watergate.

I'm sure someone older than me could keep the chain going....my theory is every 2 term president will have something to tarnish their record and every single term president is basically just an unempowered placeholder that either road their immediate predecessor's coattails (i.e. Bush 1) or took advantage of a a conveniently timed disgruntled public (i.e. Carter).

Re:Security is Big Business

[fustakrakich]

Precedent had already been set.

Oof! Over 40 years ago... Even the threat of prison doesn't stop these guys. And the ones that appoint them still win elections and reelection. I figure that if the voters thought this was important, they would actually do something. Who am I to argue with success?

Re:Security is Big Business

[swb]

Well, give Ashcroft some credit. He pushed back while sick in the hospital against Bush White House cronies and refused to sign off on domestic spying when they wanted him to.

http://www.washingtonpost.com/...

Re:Security is Big Business

[DamnOregonian]

Wow- I had never heard that.
Thanks for posting it

Re:Security is Big Business

[Anonymous Coward]

Breaking constitutional law is in fact a statutory offense. See Title 5 USC 7311.

Re:Security is Big Business

[rogoshen1]

Eisenhower.
FD Roosevelt.
I think those were the last two solidly good presidents we've had.

Re:Security is Big Business

[i kan reed]

No it isn't.

Do you pull things from your ass?

That's clearly a prohibition of holding government office while vocally opposing the idea constitutional government itself. And ironically, it probably wouldn't hold up as constitutional in court, because, you know, test of office problems, freedom of association problems, redress of grievances, and naturally, freedom of speech.

It doesn't say anything about "breaking constitutional law"

Re:Security is Big Business

[brrant]

... and every single term president is basically just an unempowered placeholder...

You my friend are on the path to understanding.

The President is very much a figurehead ... the qualities he is required to display are not those of leadership ... His job is not to wield power but to draw attention away from it.

Sorry for the obligatory quote, but more and more I believe this is actually the truth. That is, that the purpose of the job is to distract from power. Sadly, the president does wield actual power, much to our sorrow.

Re:how many copies of that encryption ...

[i kan reed]

If you're the NSA, do you hand out new secret encryption that you, yourself can't break? Or do you deal in purposefully flawed encryption, that generally works pretty well, but you can break in the back room when you want?

This is very creepy ...

[gstoddart]

So, all of those things we can't get funding for because they might be illegal?

No problem, we'll just raise the money by selling some technology.

And, while we're at it, we've also got a sideline business of charging shakedown money to politicians.

If they're a government agency, and developed these technologies with tax-payer money, are the technologies theirs to sell or patent?

This sounds like an agency which has more or less decided it is entitled to do anything it wants to, and the more it moves some of its operations into the private sector, the less oversight it comes under.

This sounds like some class A bullshit to me.

Licensing *what* technology and information?

[ron_ivi]

I imagine with their surveilance on foreign corporations there's a huge amount of technology the could license.

And imagine how much money they could make licensing insider information of stock markets of enemy countries.

Might even be part of their job descriptions, if their job is to undermine such countries. It probably works better to destablize an enemy's economy than sanctions.

Re:Licensing *what* technology and information?

[brrant]

I imagine with their surveilance on foreign corporations there's a huge amount of technology the could license.

How long until the NSA files it's first patent application?

Honestly?

[s.petry]

Perhaps providing a few facts will help you decide. In order to do so, lets remove the term "security tools" because this is not the only thing they are renting out. Let us also remove "NSA", as they are not the only Government agency that does this.

1. Government agencies are funded with Tax dollars. They do not use their own capital to develop products, they use your money and my money.
2. Your taxes have never been reduced by the Government reselling this technology. That is absolutely zero dollars you or I have seen in refunds due to "selling" what your investment pays for.
3. Government agencies are supposed to be reigned in by their Budgets. Lawful requests receive lawful funding, unlawful requests are supposed to be removed from the budget by Congressional committee prior to approving the budget.

These facts should then lead to several key questions that should be answered by not just the NSA, but all Government agency following similar procedures.

1. Does the funding reduce the tax payer footprint for the agency, or extend the budget beyond what Congress is approving?
2. What accountability is there for how revenue from "renting" is being spent?

Given that the answer to those two question are "increases budget, does not decrease tax payer burden" and "no accountability" this should be illegal on all fronts. It is used to bypass both Congressional oversight and legal restrictions on spending.

I'm right there with you if you were to say "Not all technology developed by the Government is bad.", but that is not the point of debate we should be making. Most technology is not inherently bad, it's the implementation and abuse that is bad.

Re:Honestly?

[i kan reed]

2. Your taxes have never been reduced by the Government reselling this technology. That is absolutely zero dollars you or I have seen in refunds due to "selling" what your investment pays for.

Claim made without evidence, dismissed without evidence.

Re:Honestly?

[s.petry]

An appeal to ignorance (fallacy). You could easily prove me wrong by sharing budget line items, or income tax returns which showed someone received benefit from the income generated these programs generated.

Re:Honestly?

[i kan reed]

Or I could prove you wrong by saying that money doesn't vanish into thin air. hey look. Logical deduction.

Re:Honestly?

[s.petry]

Troll much? You moved from a formal fallacy to a fabrication. I never stated that the money vanished, go back and read my post again.

Re:Honestly?

[i kan reed]

Do you claim to know where the money went?

Post-Snowden...

[Anonymous Coward]

Why would a company buy tech from the NSA knowing it has to be riddled with backdoors?

Hm.....

[thieh]

I wonder whether making FinFisher involves the NSA. Also is SELinux becoming a problem as well?

Does NASA get paid this way?

[whitroth]

I know that NASA has had a technology transfer program for decades. Funny, I've never heard of *them* getting paid for this stuff: as far as I know, since it was done by and for the people of the US, on tax dollars, it was supposed to be free.

If that's the case... how does the NSA get away with getting paid?

                  mark

My first thought was -

[Anonymous Coward]

That's ok right? I mean technology transfer to the public sector is a good thing. But then I thought, wait a second, why should this only be available to a few select businesses who can afford to pay for it? This work was funded by the American taxpayer. These businesses then acquire it without having taken the investment risk and cost of R&D. So basically, they've (the businesses) foisted their development costs off onto the American public, with the explicit and directed complicity of an agency that's supposed to be working in the public's interests. If the tech transfer is a good thing to do (irrespective of value judgements of the actual tech and its usage), then it should be made available back to the entire American public, not to give a competitive edge to selected corporations.

So yeah, I have an issue with the ethics of this.

Necessary

[carrier lost]

Do they have anything that can tell you if your roommate has touched any of your stuff while you were gone?

Re:Necessary

[Cardoor]

i rubbed my balls all over your drumset!!!

Re:Necessary

[carrier lost]

i rubbed my balls all over your drumset!!!

Right here! See this? this is what I'm talking about.

Why won't the NSA take me seriously?

Are we even sure this is legal?

[Immerman]

As I recall the US government is not allowed to own copyrights for exactly this reason - hence the fact that all those NASA images etc. generated by government institutions are public domain. I'm frankly surprised that the government would be allowed to own patents since exactly the same reasoning should apply.

Re: Are we even sure this is legal?

[chill]

Amateur! The government *is* allowed to *hold* copyright created on their behalf. If the copyright items in question are created by contractors, then the copyright exists and is transferred to the government.

You honestly didn't think there wasn't a loophole, did you?

Re:Are we even sure this is legal?

[laughingskeptic]

My thoughts exactly! How can patents developed with public dollars be anything other than in the public domain?

PAT. NO. 12,642,185

[DanielHenneberger]

Abstract Method for generating inherently weak p-r seed values for elliptical curve cryptography for the purpose of subterfuge. Prior art: This technique has been employed in the popular NIST elliptical curve random seed values as well as a variety of consumer grade equipment.

So...

[Charliemopps]

So... the federal government can hold patents? No one has a problem with this?

But Not For Me

[Anonymous Coward]

This is a stunning example of just why our nation is in trouble. A business can purchase such software but the public will never know it exists. This gives power to on e segment of society and will deprive all of us of equality, liberty, justice and a few other trivial things, So what do we tell the school kids when they are being indoctrinated with concepts like our Bill of Rights?

Headline written by an idiot

[supadjg]

How the NSA Profits From Its Surveillance Technology

not

How the NSA Profits Off of Its Surveillance Technology

Slightly different take on that.

[khasim]

If the government develops X then X belongs to the people and should be released to them.

Unless X is vital to security/war/whatever. Then X should not be released to ANYONE outside of government.

The NSA is developing X and licensing it to selected corporations. So, 100% wrong to be licensing it and 100% wrong to be doing so to non-government entities and 100% to be doing so selectively.

Re:Slightly different take on that.

[mysidia]

The NSA is developing X and licensing it to selected corporations. So, 100% wrong to be licensing it and 100% wrong to be doing so to non-government entities and 100% to be doing so selectively.

And if the NSA IS generating any revenue, then all that revenue should be going to the treasury slush fund.

The purpose of government departments is NOT to create a profit for the department.

MIB

[joinfork]

"Oh, we hold a few patents on gadgets we confiscated from our out-of-state visitors. Velcro. Microwave Ovens. Liposuction..."