What If China Hacks the NSA's Massive Data Trove?

http://mashable.com/2013/06/08/china-hack-nsa/

by LemonadeBoy • 13 years ago

135 55 13 years ago

ott2• 13 years ago

As with any juicy enough collection of data, the relevant question is not "what if an adversary gains access" but "when".

andr• 13 years ago

Do not mistake the NSA's security to that of your average government office.

Since we are probably talking about petabytes of data, this would not be a one-time download, but would require continuous access to query the dataset interactively, which wouldn't be hard to detect if you are on the look out for it.

Drakim• 13 years ago

It's easy to say that "it probably won't happen" today. But so much can happen to change the game in the future. Budget cuts to security, internal employees being "in" on the hack, etc.

And what happens when it actually gets hacked? Nothing. Nobody will come out and say "our bad we shouldn't have collected and stored all this sensitive data". Heck, you would be lucky if it's not used as evidence for why further pushes for massive surveillance is needed.

Then there is also the issue that even though the data might be stored with good intentions today, we don't know who is going to be in charge tomorrow, or after that. Whatever Obama promises only lasts until somebody else becomes president, who thinks that all this data that is already stored and ready, should be used in new interesting ways. The data doesn't even need to leak and be hacked for it to be misused, when the owners of the data are in constant flux.

cmiles742• 13 years ago

I'm not sure why we should take for granted that the NSA has a better security story than other branches of government. I have not been impressed with any of the US government offices I've worked with at any level.

I would find it somewhat relieving to find out that the NSA is run better than the rest of the government, but I don't see any reason to believe that's the case. If anything, they are likely as over-confident and technically out-of-touch at the higher administrative levels as their peers.

einhverfr• 13 years ago

So the question is what they could download before getting caught... each time....

Also another possible threat scenario would be a spearphishing attack that would plant a virus on the network which would slowly (in botnet fashion) access pieces and send it to China a little bit at a time, uncoordinated, many little connections inside the network.

Ask yourself, if you had unlimited funds, spies in the US, and so forth, how would you attack the NSA? Those resources make a sophisticated and successful largescale attack a lot more possible and feasible.

Irishsteve• 13 years ago

Imagine if the US hacked into the Chinese data repository on their citizens?

Imagine if the US hacked into the Russian data repository on their citizens?

I'm sure it's already happened, and I'm sure it is not a huge coincidence that Google and Facebook are not the biggest search / social networking companies in those countries.

No idea about the others mentioned.

Oh and what about if those countries respective agencies have an agreement to share certain data amongst each other to make things a little easier?

nolok4• 13 years ago

Imagine if the US hacked into the Chinese data repository on their citizens? Imagine if the US hacked into the Russian data repository on their citizens?

"Your copying all of my private data from several sources to the nsa, what is another country hacks that and copy it ?" "No worry, we can hack them and copy their citizens data too"

I fail to see how to answer the concern for the question, or how that should be reassuring in anyway. That we can, or cannot, or already do similar data repository in other countries is irrelevant to the question "should all of my data be aggregated in a single juicy store".

I'm not even sure I agree with OP's premises (especially since I'm an European, for me the NSA thing is a foreign governement spying on me and I expect the EU new data privacy laws to be much more strict than the safe harbor joke we've had so far), but your answer doesn't address it at all.

dm29• 13 years ago

That's part of the reason for the Utah datacenter. Consolidating several NSA datacenters around the country into one super-secure fortress.

First, separate offline networks and the most advanced network security ever conceived will be put in place at this new datacenter.

If you're thinking that a reverse engineered Stuxnet might be able to hop over to the secure network, I doubt it, and even if it does then what will it do to transmit the data out?

It is slightly insulting to the engineers and security experts whose full-time job is to keep the NSA secure, but I suppose this scenario is worth discussing just in-case someone thinks of a clever way which the NSA has not.

The most vulnerable aspect is any remote access either to company servers or to the NSA search tools. I would hope that a data dump or unrestricted access to the NSAs "database" would be completely impossible. Even with extensive insider knowledge of the Utah datacenters systems, an ex-employee would have zero chance of gaining unauthorized access.

nolok4• 13 years ago

"No worry, it's impossible to break/hack/destroy/do !" is the start of so many disasters.

Especially funny (in a way) at a time where leaks of secret/classified data and informations is becoming endemic.

dm29• 13 years ago

Whistle-blowing does not equal hacking.

rmc3• 13 years ago

Yeah and the Titanic was too big to sink.

Humanity can often get it wrong.

mikeash• 13 years ago

Insulting? Really?

It's a truism in computing that the only really secure computer is one that has been disconnected from the network, turned off, encased in solid concrete, and sunk to the bottom of the ocean.

Even then, better hope James Cameron doesn't want what's inside.

I'm sure NSA's security people are aware of this. If they are not, then they're not very good at their job.

dm29• 13 years ago

Why doesn't simply being disconnected from the internet and located in the middle of nowhere Utah locked in a super-secure fortress with the best network engineers, computer experts, and cryptologists suffice?

And yes, it is insulting. The NSA has been at the forefront of encryption and network security for the past 60 years.

Am I giving the NSA too much undeserved credit?

cmiles742• 13 years ago

This isn't a blockbuster action film, it's a data center. I think this sort of thing is interesting but I write software. I wouldn't bet any amount of money that everyone along the PRISM chain of decision making is as impressed with the idea of a super-fortress data center. Corners get cut, work is pushed towards those with connections instead of the ones who can best do the job. Compromises are made, money goes here instead of there.

I find the idea of a super-fortress of data a bit far-fetched to begin with, that such a place would be goverment run seems even more ridiculous.

dm29• 13 years ago

The Utah data center is more of a consolidating effort than some new spy program. It's suppose to save money and increase security (and storage ability).

The NSA has computer security technology that the public and other government do not. They also have an unfathomable amount of processing power without the Utah data center (Tordella).

What congress in their right mind would slash the NSAs budget and put the entire nation at risk?

Also, it isn't a set fact of life that all government agencies / programs are inefficient and incompetent.

greedo• 13 years ago

No, the most vulnerable aspect is almost always users. Human, fallible, greedy, lazy, sloppy, mismanaged users.

elorant• 13 years ago

We don't even know if this thing has a public interface and even if it did access would probably be limited to a couple dozen IPs.

Furthermore, the article assumes that an adversary gets somehow the data. We're probably talking about petabytes of storage, how on earth could you get hold of all that data? Download it? That would raise a gazillion alarms.

DoubleMalt• 13 years ago

These are immaterial obstacles. It will have a public interface otherwise data would not get in (and there does not exist anything like a one way street in computer networking). Extracting interesting parts of the data can be done with the tools that are available to the agents. If someone breaks in successfully, they will have someone inside feeding them. Wetware is still the weakest link in security most of the times.

shailesh2• 13 years ago

The scenario that a bigger adversary gaining access to the data is definitely troublesome. We also need to consider other scenarios.

How about the ramifications of the pipes created for NSA, getting leveraged by other actors?

What happens when a rogue employee hacks the infrastructure created for providing the pipe to NSA?

What if a group of such rogue employees across multiple companies act in concert, may be creating a cartel?

Such things have the potential to remain unnoticed for a pretty long time, ruining lives of innocent people.

Now, let's replace the word rogue with innocent and intelligent but cleverly manipulated by sophisticated player and the scenario reads bleaker.

To believe that such things haven't happened before or aren't happening now, in some part of the world, will be pointless.

Consider a scenario in developing countries: let's say you wrote some piece of code (unrelated to telecom) for a businessman. Let's also say that the businessman runs many companies, one of which provides BPO services to telecom companies. Let's say that the businessman wants to exploit you. He can very well track your location using the network of the telecom company without that company knowing it, let alone the law enforcement officials. He can remain under the radar because the request can be clubbed with other legitimate ones.

This is not just a US problem, it's a global problem.

It is precisely for such reasons, that we need a manifesto about data collection policies, like "Do No Evil" or "The Patent Pledge."

drKarl• 13 years ago

"He can remain under the radar because the request can be clubbed with other legitimate ones."

I still don´t see the legitimacy of the US government accessing citizen´s data. Perhaps it´s because I´m from an european country, and governments in europe have laws to proctect citizen´s private data.

shailesh2• 13 years ago

I still don´t see the legitimacy of the US government accessing citizen´s data.

I agree with you. My point was related to a legitimate telecom request, for example to track the telephone of a person declared missing.

oarks• 13 years ago

What country do you live in that doesn't have any thing like warrants that let police look at your private records?

mtgx• 13 years ago

Do you think they'll ever admit they are responsible for something like that?

They'll just make the "cyberwarfare" campaign even louder, and say how new laws and bigger budgets are needed to keep you safe (and of course continue their spying and their hacking on others).

The "cyberwarfare" will be the new war on terror, 5-10 years from now.

AnthonyMouse3• 13 years ago

Do you think they'll ever admit they are responsible for something like that?

Probably not. Doesn't that just make the whole thing even more of a bad idea though?

bediger4000• 13 years ago

The "cyberwarfare" will be the new war on terror, 5-10 years from now.

Yes, just like the war on terror is the new war on communism.

By 1990, all the defence contractors figured out that without a boogey man to scare people with, the US government has a lot of things it would rather spend money on than billable hours.

ForFreedom• 13 years ago

Or have they already done that

brown9-2• 13 years ago

According to the Washington Post, "An estimated 854,000 people, nearly 1.5 times as many people as live in Washington, D.C., hold top-secret security clearances."

It's worth noting that having a Top Secret clearance does not automatically mean you have access to all information classified as Top Secret.

http://en.wikipedia.org/wiki/Classified_information_in_the_U...

Tycho• 13 years ago

What would happen? Well then they'd have an almost unlimited supply of individuals within our institutions whom they could easily blackmail and use to subvert those institutions.

But I don't find it much more terrifying than people in our own government having that power.

happywolf• 13 years ago

Sounds like the Cold War line of thinking. It was Russia then, now China takes over the place. What if Country_X does Y? Oh we must keep up the pace! What history tells me is when a government starts to draw people's attention to some public enemy abroad, usually it has some ax to grind and some shit to hide.

rapind2• 13 years ago

I kind of think the China idea is far fetched too. Sounds a little too boogey-man. Why not a private interest like a cartel / mafia? Or maybe anonymous, etc.?

venomsnake• 13 years ago

The fact you are paranoid doesn't mean that there is not someone out there to get you.

This is useful information. Having access to someones social graph and contact list could go a long way to subverting dissidents.

If by chance NSA is aiding Russia and China by helping them secure internal stability and giving them more energy to play on the international scene is rather ironic.

Also it is not about downloading. Thing about the things you could do by just altering the data.

jdc• 13 years ago

It wouldn't be the first time an unintended party gained access to unsuspecting parties' personal information via government surveillance systems. The Prime Minister of Greece, among others, had their cellphones tapped by a hacker using a law enforcement agency's backdoor.

http://www.schneier.com/blog/archives/2007/07/story_of_the_g...

chmars2• 13 years ago

What if China hacks Google's data trove? Oh, that already happened:

http://www.washingtonpost.com/world/national-security/chines...

And in Denmark, hackers gained full access to many security services databases, among others the European 'most wanted' database, the driver's license database, passwords of 10'000 password officers etc.:

http://www.berliner-zeitung.de/politik/hacker-angriff-datenl...

(Newspaper article in German, sorry …)

silvestrov• 13 years ago

Article in English: http://cphpost.dk/news/national/hacker-charged-stealing-poli...

chmars2• 13 years ago

Thank you!

fiatmoney• 13 years ago

What's more likely is, convinced they're legally obliged to turn over data to anyone with a plausible government letterhead, private companies start being subjected to an enormous amount of false flag / social engineering attacks.

technoslut2• 13 years ago

I'd doubt that's possible. The NSA has the best mathematicians and cryptologists in the world. They probably also have the most.

JonFish85• 13 years ago

I'd also imagine that it's far easier to just go after the sources (whoever is allegedly forking over the data). Not to mention that it's probably much better organized at the source than in some sort of data dump format. Just a guess, though.

technoslut2• 13 years ago

Tell me when the NSA, or the US in general pre-NSA, has ever endangered or compromised their encryptions? There surely is enough stories of how the CIA screwed up and stories like the FBI helping Whitey Bulger to continue murdering while he was an FBI informant.

Nux• 13 years ago

It's more a question of "when", not "if".

What If China Hacks the NSA's Massive Data Trove?

Related Stories