7 ms·

> "[...] he has demonstrated absolutely no interest in protecting it" > "The filing described Mr. Martin as computer genius who easily outsmarted government ef

> "[...] he has demonstrated absolutely no interest in protecting it" > "The filing described Mr. Martin as computer genius who easily outsmarted government efforts to protect secrets and said he possessed an advanced understanding of how to encrypt messages and hide information in cyberspace." This doesn't really make sense and the wording also hints at sensationalism. It reads like a classic case of deflection, making the accused appear considerably more powerful than he actually is. This, to me, shows a few things: - the NSA clearly has no clue who accesses "their" data, when, or how - the NSA will throw anybody under the bus to save face - the NSA, to this date, still refuse to put their own inadequacy in the balance and traded their integrity for the power to sustain the organization itself at the cost of everything else (including their original purpose) Why on earth is this organization still allowed to operate at all?

jdubs 10y ago
The leaders have determined that the value they bring outweighs the liability they are.
elcct 10y ago
The purpose of such agencies is to leech on the tax payer. Most important part is to create problems, "solve" them in the most expensive and ineffective way and spread fear.
tptacek 10y ago
It's hard to give a concise response to a comment going in so many different directions at once, but I'll take a whack at it: * Should NSA be broken up? I think so. It's a mainstream policy idea. NSA has two conflicting missions --- IAD and SIGINT --- three, if you want to count pure research separately. Splitting up NSA would solve some conflict of interest problems, but would also add the practical benefit of minimizing the number of people who might end up with access to documents like this guy collected. * Does that mean NSA is lying about the Martin case? No. They could be, but I would not put money on that. Prosecutors definitely shade facts to make their cases sound stronger. But it's less likely that in an extremely high profile federal prosecution like this one, they're going to entirely make things up. With Martin, we're talking about a case where someone hoarded extremely classified documents about ongoing operations against "known enemies of the US" (that's a term that probably has pretty specific meaning). He left them laying in his car. On the back of the printouts were handwritten explanations of tradecraft and terms of art. If I had to guess, the most likely outcome here is going to be that we are talking about someone with very serious mental health issues who NSA had no business putting within 1000 miles of the information he managed to hoard in his house.
- mikecb 10y ago
  Three missions even, if you count offensive operations, as our laws do.
  - deleted 10y ago
    [deleted]
  - tptacek 10y ago
    You mean Cyber Command, right?
    - mikecb 10y ago
      Yes.
  - nickpsecurity 10y ago
    They just have two: 1. SIGINT. Collect intelligence anywhere from anyone overseas using electronic communications. This includes offensive hacking and black bag jobs they do via other groups. 2. Information Assurance. The only real requirement I've seen is that they protect COMSEC of DOD and defense contractors. There's less requirements saying they protect computer security. I'm not sure they're even required to protect government as a whole. They have no mandate that I've seen to protect Americans. They even make it illegal for Americans to obtain Type 1, TEMPEST-certified, etc products that they recommend to Defense organizations. So, those are the jobs. I'm with Schneier and others on splitting them into two. I'd also expand IAD's mission to cover recommendations for mass market and overall government. For now, NSA has no requirement to protect our computer systems. Hard to say if they even have to protect Defense systems vs COMSEC since other laws paid for by lobbyists say DOD must try to buy COTS stuff that's almost all insecure. Can't mandate buying insecure stuff from nefarious companies plus expect strong security simultaneously. I think it's a legal, grey area they're exploiting for maximal SIGINT.
    - mikecb 10y ago
      Not sure why this is a reply to me, since it also forgets Cyber command, which I was pointing out.
nickff 10y ago
The more important question to me is how the other government agencies compare to the NSA. I have no reason to suspect that the NSA is below average; everything I have seen suggests that the are probably better than HHS, HUD, etc. and this is very troubling to me.
- tptacek 10y ago
  They are much better than the civilian agencies.
fweespeech 10y ago
> Why on earth is this organization still allowed to operate at all? If you look weak on "National Security" you lose your next election campaign the vast majority of the time. That is really the entirety of the reason and its frightening how disconnected our election process is from the reality of the results they produce.
TallGuyShort 10y ago
Unable to read the full article, but... >> easily outsmarted government efforts to protect secrets But we've all seen government website that stored and enforced passwords in plaintext Javascript. >> possessed an advanced understanding of how to encrypt messages So adding this, we now might just be talking about a guy who can 'View Source' in his browser, and use GPG. Presented like a cybernetic superspy, but might just be a dude with an IT degree.

jdubs 10y ago

The leaders have determined that the value they bring outweighs the liability they are.

elcct 10y ago

The purpose of such agencies is to leech on the tax payer. Most important part is to create problems, "solve" them in the most expensive and ineffective way and spread fear.

tptacek 10y ago

It's hard to give a concise response to a comment going in so many different directions at once, but I'll take a whack at it: * Should NSA be broken up? I think so. It's a mainstream policy idea. NSA has two conflicting missions --- IAD and SIGINT --- three, if you want to count pure research separately. Splitting up NSA would solve some conflict of interest problems, but would also add the practical benefit of minimizing the number of people who might end up with access to documents like this guy collected. * Does that mean NSA is lying about the Martin case? No. They could be, but I would not put money on that. Prosecutors definitely shade facts to make their cases sound stronger. But it's less likely that in an extremely high profile federal prosecution like this one, they're going to entirely make things up. With Martin, we're talking about a case where someone hoarded extremely classified documents about ongoing operations against "known enemies of the US" (that's a term that probably has pretty specific meaning). He left them laying in his car. On the back of the printouts were handwritten explanations of tradecraft and terms of art. If I had to guess, the most likely outcome here is going to be that we are talking about someone with very serious mental health issues who NSA had no business putting within 1000 miles of the information he managed to hoard in his house.

mikecb 10y ago
Three missions even, if you count offensive operations, as our laws do.
- deleted 10y ago
  [deleted]
- tptacek 10y ago
  You mean Cyber Command, right?
  - mikecb 10y ago
    Yes.
- nickpsecurity 10y ago
  They just have two: 1. SIGINT. Collect intelligence anywhere from anyone overseas using electronic communications. This includes offensive hacking and black bag jobs they do via other groups. 2. Information Assurance. The only real requirement I've seen is that they protect COMSEC of DOD and defense contractors. There's less requirements saying they protect computer security. I'm not sure they're even required to protect government as a whole. They have no mandate that I've seen to protect Americans. They even make it illegal for Americans to obtain Type 1, TEMPEST-certified, etc products that they recommend to Defense organizations. So, those are the jobs. I'm with Schneier and others on splitting them into two. I'd also expand IAD's mission to cover recommendations for mass market and overall government. For now, NSA has no requirement to protect our computer systems. Hard to say if they even have to protect Defense systems vs COMSEC since other laws paid for by lobbyists say DOD must try to buy COTS stuff that's almost all insecure. Can't mandate buying insecure stuff from nefarious companies plus expect strong security simultaneously. I think it's a legal, grey area they're exploiting for maximal SIGINT.
  - mikecb 10y ago
    Not sure why this is a reply to me, since it also forgets Cyber command, which I was pointing out.

nickff 10y ago

The more important question to me is how the other government agencies compare to the NSA. I have no reason to suspect that the NSA is below average; everything I have seen suggests that the are probably better than HHS, HUD, etc. and this is very troubling to me.

tptacek 10y ago
They are much better than the civilian agencies.

fweespeech 10y ago

> Why on earth is this organization still allowed to operate at all? If you look weak on "National Security" you lose your next election campaign the vast majority of the time. That is really the entirety of the reason and its frightening how disconnected our election process is from the reality of the results they produce.

TallGuyShort 10y ago

Unable to read the full article, but... >> easily outsmarted government efforts to protect secrets But we've all seen government website that stored and enforced passwords in plaintext Javascript. >> possessed an advanced understanding of how to encrypt messages So adding this, we now might just be talking about a guy who can 'View Source' in his browser, and use GPG. Presented like a cybernetic superspy, but might just be a dude with an IT degree.