NSA director heckled on stage at Black Hat security conference

http://www.forbes.com/sites/andygreenberg/2013/07/31/nsa-director-heckled-at-conference-as-he-asks-for-security-communitys-understanding/

by tjaerv • 13 years ago

339 208 13 years ago

forbes.com

generj• 13 years ago

I think this underscores Defcon's decision to exclude the Feds this year.

jenandre• 13 years ago

Defcon and Blackhat were founded by the same dude. Why didn't they exclude feds from BlackHat as well? Guessing it was probably because that is their big money maker with all the corp/fed support.

flyt• 13 years ago

BlackHat is a more "professional" event for the security industry. People that ostensibly work in the security industry go there just like people go to o'reilly conferences for various technical areas.

DEFCON is a community event for anybody and is totally anonymous (entry fee is only payable by cash in person) and has a more freewheeling, community feel.

podperson2• 13 years ago

No idea how accurate a depiction of the speech this is, but the article is -- contrary to the title -- portraying the speech as having been warmly received, applauded, with one lone heckler. Now, whether or not one agrees with General Alexander, there are more courteous and productive ways to express yourself than yelling "bullshit".

sp3322• 13 years ago

"Heckler" usually refers to one or a few people in a crowd. Getting booed off the stage would be different.

ferdo6• 13 years ago

How does a guy that makes excuses to spy on us all and lies to Congress deserve any courtesy?

mseebach2• 13 years ago

Well, maybe he doesn't, but you're the bigger man so you do it anyway. Turning the other cheek and all.

Also, the organisers invited him because they thought you might want to hear what he has to say, so you do it out of respect for them.

SkyMarshal2• 13 years ago

How on earth does shouting "bullshit" at him like an idiot fratboy make him any more likely to give your concerns any credence?

The best it can do is surprise him for a millisecond, then let him write you off as an "unserious" person to be briefly patronized and then devoutly ignored (or worse, add you to a list of "interesting" persons).

fnordfnordfnord• 13 years ago

portraying the speech as having been warmly received, applauded,

Disappointing if true. I can't imagine anything that Keith Alexander would say that is deserving of applause. The guy deserves no quarter.

diminoten2• 13 years ago

Why, because you elected people who put him in charge?

Who really deserves no quarter here?

tomelders5• 13 years ago

Well it's not like anyones going to make a salient and logical point and the NSA is going to turn around and say "You know what, you're right, this is wrong. We'll stop it immediately". So shouting "bullshit" at the top of your voice has the same effect, which is no effect at all. So no one is any worse off for this kind of behaviour.

That said, I think the audience should have received him with absolute silence. No applause, no heckling, nothing to betray the mood of the crowd. Let's see how the General Alexander feels about a thousand eyes scrutinising him with no clue as to what they're thinking or planning. Then maybe he'll have an idea about what it feels like to be on this side of the equation.

methehack2• 13 years ago

there are more courteous and productive ways to express yourself than yelling "bullshit".

I disagree. When chatting with Faust, I think it's better to avoid the drawn out conversation and just tell him to fuck off. This Alexander guy is a liar and a felon (lying under oath to congress) and has earned our collective disrespect. He deserves a lot more than "bullshit!" He's a domestic terrorist that's infiltrated the government as far as I'm concerned.

mturmon2• 13 years ago

It does not matter what Alexander deserves.

What matters is choosing a strategy that will be effective in exposing this intel-gathering to public scrutiny. One person shouting is not such a strategy.

It's the difference between individual catharsis and effective political strategy that produces an outcome.

cracell• 13 years ago

What has he done that makes him a terrorist? Or are you just inferring that mass spying is a form of terrorism?

northwest8• 13 years ago

“No, I’m saying I don’t trust you!” shouted McCoy.

I believe that's pretty central here. I don't see how we can ever be able again to trust an organism such as the NSA - or even the government.

Transparency is the only solution here. Will we get it?

If we don't, the only other solution would be to cut budgets so drastically that such an enterprise will simply not be possible financially, anymore.

And maybe, as a general improvement: Decentralize the government and give the States back their autonomy (and here you have your link between technology and politics - see the recent cry for less "political posts" on HN).

joering2• 13 years ago

I believe that's pretty central here. I don't see how we can ever be able again to trust an organism such as the NSA - or even the government.

We won't. This cancer is a one-way street. It will kill the organism and kill itself with it. And they know it. That's why they buy billions of ammunition rounds and dispatch lightweight tanks throught the states borders. They know that history repeat itself and they don't want another fourth of July to be celebrated in 500 years now (this time US 2.0 that bunch of clever people used GIT to form a better government). NSA systems are not in place to save you and your family from terrorist -- terrorism needs to be wisely guided; some need to leak through so that you and your family keep being scared, submit to the State and pay more taxes for more "safety". Terrorism is not on their agenda. Had they not let shoe bomber and Boston bombers do what they did, me and you would protest against more surveillance (with Boston bombers officials were inconveniently kept notified by russian government) because we would have been felt safe.

Transparency is the only solution here. Will we get it?

We won't and we can't. They will oppose it saying that if we tell you what we do, bad guys will use it. Nothing will change this approach. Manning did a huge leak of gov docs and military officials said many lives will be lost as a result; other than Arab spring that did not happen on US soil, nothing happened at all. It was a bluff that they will continue using.

If we don't, the only other solution would be to cut budgets so drastically that such an enterprise will simply not be possible financially, anymore.

Its not that simple. Even President of United State does not know how many black-ops agencies exist within the goverment. Some entities of the gov sponsor themselves God only knows doing what. If you cut their air supply, they will go to CIA and say: "here are the tapes when you and other officials are negotiating deals with drug cartels in Afganistan, here is a conversation where smuggling is being organized to move tons of heroine into US on a military aircraft, sponsor our venture or we will leak the info". And there you have it. Most likely dirty branches of gov do not need public money but of course they will take it anyways.

northwest8• 13 years ago

That's why they buy billions of ammunition rounds and dispatch lightweight tanks throught the states borders.

I didn't know this, but I was thinking along the same lines when I read about the "anti-missile blimps" being deployed over DC. I mean it's as if they "prepared for what's coming".

So you seem to think that there is actually no real solution apart from letting things fall apart and then "start from scratch"?

I'd be really interested to hear what other people see as potential solutions for all this.

dutchbrit• 13 years ago

Audio here: https://soundcloud.com/larrymagid/nsa-director-general-keith

UVB-76• 13 years ago

The exchange in question starts around 33:40

EvanAnderson• 13 years ago

I listened starting a couple minutes before that and felt like I was going to fall asleep. I'm sure it loses something not being there in person but Mr. Alexander's delivery sure seems ponderous.

dragontamer• 13 years ago

Thank you for sharing. I'll be sure to listen in later.

While everyone else on this subject is going to be armchair-debating whether or not the article is a fair representation of what happened... I'm going to just listen into the audio myself and make my own opinion.

northwest8• 13 years ago

“I haven’t lied to Congress,” Alexander responded

And WTF was that, now?

EDIT: I guess this is true because actually, he lied to the chairs in the room. Or some coffee mugs that were also present.

Is that how one evades a lie detector, btw?

It really can't get any sicker. We have now reached the bottom.

mpyne4• 13 years ago

Last I checked he wasn't James Clapper (they guy who lied to Congress). But maybe I'm wrong.

moxie6• 13 years ago

First he said this in congressional testimony: https://www.youtube.com/watch?v=ZmBAxEWxDFs&feature=youtu.be...

Then this came out later: http://news.cnet.com/8301-13578_3-57589495-38/nsa-spying-fla...

And now this: http://www.theguardian.com/world/2013/jul/31/nsa-top-secret-...

whiddershins2• 13 years ago

http://www.youtube.com/watch?v=oYNXVgYhPOc#at=61

tptacek12• 13 years ago

This entire event was a staged press op. Keith Alexander is a ~30 year veteran of SIGINT, electronic warfare, and intelligence, and a Four-Star US Army General --- which is a bigger deal than you probably think it is. He's a spy chief in the truest sense and a master politician. Anyone who thinks he walked into that conference hall in Caesars without a near perfect forecast of the outcome of the speech is kidding themselves.

Heckling Alexander played right into the strategy. It gave him an opportunity to look reasonable compared to his detractors, and, more generally (and alarmingly), to have the NSA look more reasonable compared to opponents of NSA surveillance. It allowed him to "split the vote" with audience reactions, getting people who probably have serious misgivings about NSA programs to applaud his calm and graceful handling of shouted insults; many of those people probably applauded simply to protest the hecklers, who after all were making it harder for them to follow what Alexander was trying to say.

There was no serious Q&A on offer at the keynote. The questions were pre-screened; all attendees could do was vote on them. There was no possibility that anything would come of this speech other than an effectively unchallenged full-throated defense of the NSA's programs.

Even the premise of the keynote was calculated to wrong-foot NSA opponents. However much you might want to hear Alexander account for the activities of the NSA, the NSA itself is not the real oversight mechanism for the NSA! My guess is that no pol with meaningful oversight over NSA would have consented to address a room full of technology professionals about NSA's programs; they were happy to send NSA's own supremely well-trained figurehead to do that for them.

I think a walkout might have been effective, had it been organized well enough in advance (perhaps with some of the same aplomb as the [I think misguided] opposition to CISPA); at least you'd get some stinging photos.

kunai2• 13 years ago

Agreed; his extensive infosec background and smooth-talking politician talents meant that he probably had full knowledge of how this was going to go down. What's interesting is why he attempted PR reconciliation at a relatively niche conference. Black Hat doesn't have much connection to the mass public, and trying to make yourself look good in front of a mass of angry hackers is pointless anyhow because hackers tend to stay angry about topics like privacy.

Now, if he had a full blown press conference with civilian attendees, then, well...

don_draper• 13 years ago

>What's interesting is why he attempted PR reconciliation at a relatively niche conference.

He was recruiting. Don't let the tattoos and black shirts worn by the crowd fool you, many work and/or consult for the government.

josh2600• 13 years ago

I think he went to Blackhat because the feds were 'banned' from Defcon.

mechanical_fish• 13 years ago

The niche-ness of the conference could be part of the media strategy. If you want to portray your critics as part of a fringe, you find a place on the fringe and get yourself photographed there, dodging thrown beer bottles.

snowwrestler2• 13 years ago

It's not about reconciliation with hackers, it's about creating a picture that will be portrayed to the rest of the country by the popular media.

News shows and websites will tell the story about a reasonable-seeming establishment guy going to give a speech, and a bunch of weird-looking hackers acting unruly.

andy_ppp2• 13 years ago

Given what we know about the NSA, the heckler was probably a plant.

astrange• 13 years ago

Which things we know about the NSA lead to that?

mikegagnon• 13 years ago

A half hour before the keynote Moxie encouraged attendees to disrupt the talk https://twitter.com/moxie/status/362596265034399746

   "Ubiquitous surveillance prevents millions from speaking 
   freely. BlackHat keynote attendees, let's not let Gen. 
   Alexander speak freely today."

I anticipated the protest to be effective, since black-hat hackers have somewhat of a culture of booing presenters who they morally object to. See for example an undercover reporter that was booed out of DEFCON in 2007. http://www.zdnet.com/blog/ou/undercover-nbc-dateline-reporte...

I think the thing that made this disruption ineffective is the majority of attendees weren't black-hat hackers. They were mostly corporate professionals. See Black Hat's own demographic survey http://www.blackhat.com/docs/bh-us-12/sponsors/bh-us-12-spon...

It's therefore not really surprising that most of the audience wanted to hear the general speak, and was annoyed by the disruption.

If, on the other hand, the general were speaking at DEFCON I think he probably would have been almost unanimously booed off the stage. But the feds are staying away from DEFON this year (for that reason).

So in retrospect, I think the disruption was a miscalculated PR move for the hacker community.

tptacek12• 13 years ago

I think Moxie Marlinspike truly and deeply cares about these issues, isn't an outrage tourist, and has done more for online privacy than I probably ever will. I think he truly believed that attempting to disrupt the talk could be an effective strategy. But I also think he was wrong about this.

GigabyteCoin• 13 years ago

The feds are staying away from DEFCON this year because they were explicitly asked to: http://arstechnica.com/security/2013/07/for-first-time-ever-...

MisterWebz• 13 years ago

While I'm sure he's very capable and very much an expert in his field, I don't think he's this charming super politician that planned an elaborate scheme to sway the conference attendees' opinions by appearing to be sensible and calm in front of hecklers.

I mean, can you imagine how horrible this would have turned out if he didn't stay calm? It's basically standard procedure to stay calm and try to explain your way out of it. Sure, he got some applause, and the heckler got some applause too. I think anyone could have imagined something like that happening.

arh682• 13 years ago

There was no serious Q&A on offer at the keynote. The questions were pre-screened; all attendees could do was vote on them.

A joke in every sense, then. Audacious. He leads with a bit of humor, then says,

and I do want to give a chance for you to ask some questions. Hopefully they'll be easy ones, and I have a crew here that can answer the hard ones if I need to.

willholloway• 13 years ago

My main take away from your comment is that Keith Alexander is Enabran Tain & that I feel like the US is approximating the Cardassian Union more everyday.

The existence of nuclear weapons has rendered traditional warfare unprofitable, except against the very weak, and even in those cases only military contractors benefit.

We invaded and occupied Iraq and didn't even get any oil, just a trillion or so in national debt. At least in the time of Rome citizen soldiers were titled large swaths of land in the conquered territories.

I expect in the long drawn out economic warfare to come that cyber espionage and surveillance to be critical advantages & well connected military contractors with access to the NSA's total information awareness database to profit handsomely from insider trading.

Update & Question:

I'm taking a short break from work and wondering why this comment has been down voted twice?

Instead of down voting & unless you just hate ST: DS9 references, can you provide a plausible argument against the inevitability that tapping the entire world's communications will not lead to insider trading?

There are so few terrorists in the world, and so many opportunities to profit from having early access to employment reports, corporate revenue numbers and other economic data.

Please give me a compelling reason why a wiretap on all the worlds communications is more likely to be used to catch terrorists than for simple greed?

northwest8• 13 years ago

profit handsomely from insider trading.

...a "business" which companies like Google, Facebook, Twitter et al. are certainly doing/planning on doing too, at least indirectly, privately or otherwise under the radar.

They can also simply look at the correlations between the movements of their data and the market movements, and then make their predictions and thus investment decisions. It's not even rocket science.

Given their "Big Data" treasures, I don't think they will be able to resist that temptation.

This is another reason why I generally see a future of decentralization: it's simply a concept that's less prone to corruption and failure.

narrator• 13 years ago

We invaded and occupied Iraq and didn't even get any oil, just a trillion or so in national debt. At least in the time of Rome citizen soldiers were titled large swaths of land in the conquered territories.

The trillions in national debt benefits somebody. Somebody somewhere gets those interest payments and they wouldn't have if the U.S had not borrowed from them.

sriramk• 13 years ago

I was just about to get on this thread and post about how reasonable and measured his response was. Your comment is one of the better ones I've read on this whole topic.

mtgx• 13 years ago

How can you still believe that guy anymore? He could be petting bunnies, while he sings with an angel's voice about how they're protecting the nation and that their spying is really not that bad - and I wouldn't believe him.

Obama's promises sounded very compelling and believable, too - until we learned the facts of his actions after he already won his 2nd mandate. I think it's important to remember that whenever you hear a politician speaking nicely without anything real to back it up. Otherwise we'd doomed to repeat the same mistakes, over and over and over again, fooled by master actors.

fixxer• 13 years ago

I agree with the basic argument that Alexander is a savvy SOB and knew what he was in for...

BUT, you're making it sound like getting heckled on stage was desirable. I don't agree. I think it is more appropriate to say that the NSA is between a rock and a hard place. They could either...

* Get heckled and look culpable, but maintain the illusion that they give a shit what the general public thinks, or...

* Not attend and completely look like assholes hell bent on violating civil liberties.

Keith Alexander didn't win any friends by getting heckled. He just made fewer enemies.

_b8r0• 13 years ago

I think it is more appropriate to say that the NSA is between a rock and a hard place.

I think they're between breaching the constitution with far-reaching surveillance the Stasi would've given their left nut for, and hiding behind secret courts to legitimise their acts through rubber stamping. The surveillance continues. The genie is out of the bottle, justified by the biggest lie you were told - i.e. that there ever was a rock or hard place to begin with.

whiddershins2• 13 years ago

Or, they could hire a heckler (or manipulate a likely heckler in to being there) to make sure they get heckled, in just the right way, so they can respond and seem calm and win over some coverts to their cause, sow confusion and fracture the opposition.

In my mind, I imagine what I wrote above as being disinformation 101.

doki_pen• 13 years ago

every article that I saw yesterday painted the general as a hero and the heckler as a turd. It seemed like a concerted PR effort to me. It's about discrediting you opponents in the public forum.

Aside from that, It struck me that a lot of people at conferences like this are on the NSA payroll one way or another. I'd hardly call the group a bunch of freedom fighters.

tlrobinson4• 13 years ago

For being a "master politician" he was a surprisingly poor public speaker. He seemed unsure of himself and stumbled quite a bit.

(the whole keynote is available here: https://www.youtube.com/watch?v=xvVIZ4OyGnQ)

ballard• 13 years ago

Naturally.

Alexander didn't score any points for himself or his organization by coming off like he has something to defend besides American citizens.

  0. The intros were more than courteous, they were gushing 
  1. "Holding questions to the end" was an obvious grinfuck
  2. The 8 minutes of q&a seemed completely prepared
  3. It also had a sense of "we're hiring"

I don't know the guy, so I don't know where he actually stands on things. So I sure as shit don't trust anything he says just yet.

tptacek12• 13 years ago

For what it's worth: I don't the the NSA is at all interested in hiring Black Hat attendees. I don't mean "that's not why they're there at Black Hat, to recruit". I mean, "they don't want those people to begin with".

mjfl2• 13 years ago

I don't care whether the director of the NSA is a bad guy, it just makes you look bad if you heckle someone on stage. There are probably few more scrutinizing audiences for the director of the NSA than a professional security conference. I would rather have him say what he has to say and be analysed by the many bright minds at the conference than for him to be childishly interrupted and waste time that could be spent talking about the actual role of the NSA in the security of the nation.

northwest8• 13 years ago

it just makes you look bad if you heckle someone on stage.

It also takes a lot of courage to do just that. And people with courage are rare. They need our support. People who are 2 inches away from getting loud need our support. Because they are the people who can start the chain reaction that is so urgently needed now and that will not happen if we collectively shut up and just stay polite. We have been seriously betrayed and we have now every reason, right and duty to break free from the rules which were appropriate for the times "when things were good".

So I think he did just what everybody should have done - in a perfect world.

rthomas6• 13 years ago

It takes courage to be a whistleblower, or to make any decision different from your peers. It does not take courage to heckle someone on a stage from the safety of a crowd. It happens at almost every comedy show, concert, and sporting event. Heckling someone on stage when you're in the crowd isn't rare at all.

diminoten2• 13 years ago

Being loud is worthless if you're not right in what you're saying when you are loud. Even hurts your cause if you're not right.

CoryG89• 13 years ago

I agree with the sentiment. I think that most people in that crowd were probably thinking that they can't possibly believe what he's going to tell them. Why is he on stage? However, I also agree that people yelling things like this from a crowd while he was on stage plays directly into their hand. It makes people sympathize and makes the General look more reasonable. In a perfect world, everyone would have walked out and not listened to him at all.

moxie6• 13 years ago

General Alexander doesn't have to act rude when he has the power of the NSA behind him. The only power we have in a situation like that is to be disruptive and to be rude. Why should we treat him with respect given all the disrespectful things that he's instrumental in?

Those in power keep trying to present this as a "conversation" or a "dialog," but that's absolute bullshit. They're not actually trying to have a conversation, so we shouldn't behave as if that's what's happening. The most powerful thing we could have done would have been to boo him off the stage.

mindcrime2• 13 years ago

The most powerful thing we could have done would have been to boo him off the stage.

Exactly this. I was hoping that when I clicked through on this story, that I would read about that happening. Sadly, twas not to be.

Even if it was a niche hacker conference that most "regular" people have never heard of, if he'd been booed off of the stage and the media had given it any attention at all, it would have been a symbolically meaningful moment and a powerful message.

jackpirate2• 13 years ago

A person standing up in the middle of the audience, and turning their back to him, and standing there for the entire presentation would have been much more powerful.

mjfl2• 13 years ago

How about civil disobedience rather than childish disobedience?

snowwrestler2• 13 years ago

The problem with being disruptive and rude is that it is generally unpopular in America. So in the battle for "hearts and minds" (i.e. for positive press coverage), the intended message can become tainted by the delivery.

Here's one alternative idea: If you can organize enough people for it to look good on camera, a coordinated walk-out could be effective. Tip off a few key press folks in advance, so they know to shoot B roll of people walking out. Then you hold a short press avail in the hall outside the ballroom, delivering a statement with all the people who walked out massed behind you.

It's still confrontational, which the press likes, but it appears more civil and organized.

mr_spothawk2• 13 years ago

it just makes you look bad if you heckle someone on stage.

I disagree. It's important that we speak truth to power. If we don't then they won't hear our case. You don't think the president is wandering around Hacker News and Reddit looking for details do you? No. They employ PR firms or former employees of them to filter information back to reports which get filtered through various aides which finally makes it to the ear of the president.

However, when you stand and loudly speak your feelings, the message doesn't get filtered. That's an important part of the process.

JonFish85• 13 years ago

All things considered, it seems like Keith Alexander did a pretty good job of handling the situation. Personally I think the heckler sounded like a douche ("read the Constitution" sounds like a dumb thing to say to a 4 star general who probably has better knowledge of it than your average hacker), even if he (the heckler) had some good points.

It would have been easy for the situation to devolve into something much uglier, but fortunately it seems like things stayed pretty calm!

emhart• 13 years ago

I feel like we could do with some ugly right about now.

wavefunction2• 13 years ago

I'm curious why you claim that a 4-star general would have a better knowledge of the Constitution than an average hacker?

Especially one who seems to be running an illegal and unconstitutional program like Gen. Alexander.

jessaustin2• 13 years ago

Well he's got it printed on a roll of paper that hangs next to a seat he occupies twice a day, so he's had ample opportunity to read it.

mindslight• 13 years ago

For the same reason that an average hacker would have a much better knowledge of the code for various daemons than the sysadmins who administer them - they're reading critically and looking for vulnerabilities where the actual semantics differ from the purported ones. I've no doubt that what the NSA does actually is "constitutional" under the common corrupted interpretations of it - government programs are structured to avoid mortal conflicts with the constitution, sympathetic or even just probabilistic courts then assert that specific facets aren't actually over the line, and severable agents acting "independently" informally make up the difference.

Law is akin to code, and suffers from the same complexity-induced limitations that end up as the halting problem. With enough indirection, meanings and definitions divert wildly from what they purport. This divergence starts as soon as abstraction enters the picture - for example the widespread tendency to see rights as "primitives" that are acceded when forming higher-level emergent structures. Participation in the higher-level structure becomes de facto mandatory, and those purported rights end up nowhere to be seen. And once this erosion process starts, it becomes harder and harder for anybody to see that their rights should apply universally, rather than just in a nondescript wood shack on unincorporated land in Wyoming.

LoganCale• 13 years ago

Fortunately? It should have devolved into something ugly.

norswap• 13 years ago

Hackers applauded Alexander? He really has played them like pipes.

You can argue all you want, but in the end, some boundaries have to be set. What the NSA did (does actually) is way past that boundary for most people, and I think with reason, but that's another debate. He hasn't supplied any argument that would make us reconsider the boundaries. All this terrorist talk is bullshit.

mcescalante2• 13 years ago

They weren't applauding Alexander, they were applauding for the conference goers who were shouting out loud at him (and their messages).

jaekwon3• 13 years ago

Were you there? That would be a terrible reporting job by Andy Greenberg.

_delirium• 13 years ago

Despite the vaguely militant-underground name "Black Hat", it's a conference of mainstream security researchers, run by a large media firm (CMP Media, which also runs the Game Developer's Conference, and owns a bunch of magazines like InformationWeek). Many of the attendees are themselves in government positions, or serving as contractors. So I'm not sure I'd expect a particularly strong backlash. Heck, some attendees could well be in a position to have already known some of the things that were leaked.

jaekwon3• 13 years ago

Well, a militant-defensive-underground would call themselves "Grey Hat" or something. Black Hat implies exploiting flaws for personal gain, doesn't it?

I imagine a bunch of these Black Hat people fancy their big payout using their skills for evil.

sixothree• 13 years ago

I could not agree more. This terrorism talk is complete bullshit. Our lives are in danger in so many ways and terrorism is far down the list.

lawnchair_larry2• 13 years ago

There are not really any hackers at BlackHat. Some go to give a talk for their own interests, some go to see their friends talk, but the "hackers" largely skip the conference and go hang out on their company dime and go to the private after-parties. It's a running joke that the real conference is at the Galleria Bar.

tlrobinson4• 13 years ago

Blackhat costs ~$2000 to attend. It's much more of the corporate security researcher crowd than Defcon.

Still, pretty disgraceful.

JumpCrisscross• 13 years ago

"Ninety-eight percent of society has issues with this"

"The national survey by the Pew Research Center, conducted July 17-21 among 1,480 adults, finds that 50% approve of the government’s collection of telephone and internet data as part of anti-terrorism efforts, while 44% disapprove. These views are little changed from a month ago, when 48% approved and 47% disapproved."

http://www.people-press.org/2013/07/26/few-see-adequate-limi...

tomelders5• 13 years ago

I think it's possible for some people to broadly approve of the collection, but still have issues with it. Not sure where that 98% number comes from, but I think the 50% "approval" number is misleading on its own.

dmix2• 13 years ago

I highly recommend reading "The Myth of the Rational Voter: Why Democracies Choose Bad Policies" [1].

Even if polling shows a lack of discontent, it does not mean they were voting rationally. The emotional fear machine of terrorism will always sway towards totalitarianism policies. But if the majority of those citizens were honestly questioned about having their phones (and their entire families) monitored, I doubt they would be for it.

Irrationality and logical fallacies are flourishing on both ends of the spectrum (citizens and politicians), and there are few vocal voices in between correcting the bullshit.

What's missing are leaders (aka media) evaluating and promoting policies based on rationality reasoning rather than what emotional ploys that sell.

[1] http://www.amazon.com/Myth-Rational-Voter-Democracies-ebook/...

fragsworth2• 13 years ago

What's missing are leaders (aka media) evaluating and promoting policies based on rationality reasoning rather than what emotional ploys that sell.

Leaders in media have no external incentive to promote rationality. They make money by appealing to their audience, to increase the size and loyalty of that audience.

There is no solution.

bendoernberg• 13 years ago

From the same poll: 56% say that the courts do not provide adequate limits on these programs, and 47% say the programs go too far in restricting civil liberties. It's about 50-50, but the trend lines are ALL in the right direction, whether you compare to 2,5, or 10 years ago.

rbanffy• 13 years ago

I find particularly hard to believe the "6,000 NSA cryptologists who have deployed to Afghanistan and Iraq" part. Why would anyone want to deploy cryptologists into a war zone?

I also found disheartening the applause given to the general for his clever answers. "I have. So should you"?! I expected more from the Black Hat crowd.

And, finally, I applaud Jon McCoy for his sacrifice. His willingness to endure all the cavity searches he'll be subjected to before and after every flight inspires us all.

cenazoic• 13 years ago

In the Air Force I was a 'cryptologic Russian linguist' (it had nothing to do with code-breaking, although it was an intelligence field). I wonder if he was referencing linguists.

omegaham• 13 years ago

Military here.

They aren't really the same cryptologists that we think of, and they aren't the same guys who are writing programs to go through our phone records.

The majority of cryptologists who are forward deployed are there to ensure that the cryptography is used correctly. Despite many years of attempts to make it easier to use, cryptography. especially for portable radios, is a pain in the ass to use. People have to be trained. Areas have to be made where crypto equipment is stored and secured. Deficiencies in use have to be identified. That's what those people are for.

With the fact that we've had more than two million troops deployed during the War on Terror, I'm actually surprised that the number of NSA cryptologists is at 6,000. They must be very senior people.

dmix2• 13 years ago

Alexander also noted the 6,000 NSA cryptologists who have deployed to Afghanistan and Iraq, 20 of whom were killed in the line of duty according to Alexander. “Think about people willing to go forward to Iraq and Afghanistan, to make sure our soldiers, airmen and marines get the intelligence they need,” he said. “I believe these are the most noble people we have in this country.”

Having lost a brother who deployed as a signals operator in Afghanistan (to an IED), it always makes me cringe whenever they use forward-deployed soldiers as a defense of the higher-level states "nobility". There is nothing noble about mass surveillance or the invasion of privacy of non-enemy combatant nations/citizens.

The fact citizens signed up to risk their lives in combat-zones at the bottom end of the chain does not legitimize the actions of those at the top.

jessaustin2• 13 years ago

Hear, hear! When the top brass evoke these deaths, it's like they're saying "if our sainted dead soldiers followed these orders, how can you possibly disagree?" Frankly, the last general worthy of making that sort of comparison was Eisenhower, and he would have been the last man in the military to do so. He was already sickened at this leadership culture when he was President. If he were alive today he would cross the street to avoid a conversation with Alexander.

rhizome• 13 years ago

it always makes me cringe whenever they use forward-deployed soldiers as a defense of the higher-level states "nobility"

In another context they might be called human shields. Shields in the PR war.

I'm sorry for your loss.

replax2• 13 years ago

Wow, I am really, really surprised. Especially as Gen. Alexander gave the keynote speech to DEFCON last year, and explicitly said, when asked after his speech:

Q: "[..]Does the NSA really keep a file on anyone? [...]"

A: "[..] Frist, no, we don't [...]"

Absolutely astonishing!

listen/watch here: http://youtu.be/tz0ejKersnM?t=33m2s

abalone• 13 years ago

In fairness, the title could just as well be "NSA director applauded on stage at Black Hat security conference".

The crowd's reaction was definitely mixed.

IanDrake• 13 years ago

the four-star general presented a timeline of terrorist attacks around the world, from the 1993 World Trade Center bombing to the Boston Marathon attack.

Can anyone speak as to why, with the NSA's systems, they were not able to thwart an attack by the ass clowns in Boston? Russia even warned us about them and they made frequent contact with foreigners.

I'm sorry, but that terrorist event seems like low hanging fruit if their system really works to protect us.

northwest8• 13 years ago

The question is: Did they want to thwart the attack?

One obvious possibility is that the system that has been erected simply needs fear to be able to continue to exist.

Let some attacks happen (and some Taliban prisons break) from time to time and people can be and will be manipulated via fear, so the powerful stay powerful and the rich become richer. Same old, same old...

Next stop: Middle Class Gone.

Then, people will have nothing to lose again and wake up. Next, we'll have riots and one day, the old system is dead and history will repeat itself once more. So much for the long term.

lukifer4• 13 years ago

In wartime, it's not uncommon to not act on intel to stop an attack, so as to preserve its strategic value and save more lives later. For any insiders who truly believe in the NSA's mission (which is being generous), "let a few die today to preserve a system that will save thousands tomorrow" is not a big leap.

nhaehnle• 13 years ago

The obvious conclusion to draw from this - and really, that anybody should be able to draw - is that the system doesn't work to protect regular people.

This shouldn't really come as a surprise, either. Surveillance is not effective for preventing crimes. It is somewhat more useful for investigating crimes after they've happened.

McGlockenshire• 13 years ago

Can anyone speak as to why, with the NSA's systems, they were not able to thwart an attack by the ass clowns in Boston?

Dzhokhar and Tamerlan were granted legal permanent residence in 2007. Dzhokhar became a nautralized citizen in 2012. Tamerlan's application was on hold due to the DHS being a little suspicious of him.

If the system is working as it should, the NSA could have been prohibited from monitoring the brothers.

mpyne4• 13 years ago

Because the NSA is dedicated toward detecting and gaining intel on organized terror collectives abroad.

Domestic terrorism is domestic and therefore under the FBI's purview. And despite what Snowden seems to think about mind-reading programs, unless either brother put out on the public Internet or phone communications what they were planning to do, there would have been no way for NSA to pre-emptively detect it even if they were warrantlessly monitoring all domestic communications.

So in a way your question is equivalent to asking why ASLR didn't stop that CSRF attack on the web page you just viewed.

YellowRex2• 13 years ago

I hate Forbes - interstitial ads and persistent headers are super annoying. Can we stop posting Forbes links?

Boing Boing has the same coverage with a much more reader-friendly site design: http://boingboing.net/2013/07/31/nsa-capo-heckled-at-black-h...

YellowRex2• 13 years ago

Grrr, the Boing Boing article just links to Forbes.

wil421• 13 years ago

From the article: “Everyone’s thinking this, but no one’s saying it public, so everyone thinks they’re alone,” he said. “Ninety-eight percent of society has issues with this…But no one speaks up.”

While I think some people don't how to speak up, beside calling/writing my congress person, many don't care either way. In fact, many older people I have talked to (I am in my twenties) dont have a problem with what the NSA is doing. They dont really mind if their data is being sifted through as long as its being used to "Find Terrorists or what have you."

My problem is the lack of oversight and the fact court that has approved 1,789 out of 1,748 requests (97.7%!!!!). Not only that but they have legal justifications for what they are doing, therefore since its legal its allowed, forget the morals/ethics involved.

Who's to say they won't turn this around on the public at large because it will prevent smaller crimes instead of terrorists. Also whats to stop the government from calling people who oppose their views terrorists and then just spy directly at American people.

vijayboyapati• 13 years ago

Funny how Alexander says he's read the Constitution, and implores the heckler to do the same. If one can read the Constitution and square the NSA's mass surveillance with the 4th amendment then one can square a circle. There really is no point in debating people like this on the technicalities of the Constitution. What they understand is power. He has it and we don't. He knows how to pull the levers that matter, and which Congressman and executive branch bureaucrats to lean on to make sure his bailiwick is not reduced by a single inch. The rest of us, sadly, are left flailing around hoping that pointing to a piece of paper is an effective check on evil.

lukifer4• 13 years ago

My understanding is that their Constitutional dodge is rooted in Scalia's originalism: the 4th says "papers", which means specifically physical pieces of paper, not phone calls or emails.

What I've been wondering about though, is the legal definition of "effects" (noun, not verb). That term seems very broad to me, and should include emails, but I'm not a lawyer.

talmand2• 13 years ago

They don't need a dodge, they just ignore the law or get new laws that circumvent previous laws. With little or no oversight this is easily accomplished. Especially since the group that requires oversight is gathering information and information is power.

This is nothing new, read up on J. Edgar Hoover with his wiretapping and files on almost everybody. Sometimes with White House knowledge and approval, sometimes without. All this while completely ignoring that quaint document down the street called the Constitution. Doing things like that is easy if you can hand over a note to someone that starts out "It'd be a shame if people found out about [insert criminal/embarrassing act here]." Information is power.

cookiecaper4• 13 years ago

The NSA is filtering a public utility. The users of this utility choose what information they want to broadcast, and should do so with the full knowledge that this information is being bounced between dozens of routers every time it goes out, any one of which may be monitored by its owners. This information ultimately ends up at the destination IP address, whose owner is able to use this data in whichever manner he sees fit, including submittal of said data to a major governmental intelligence organization as occurs with PRISM.

The problem is that people foolishly assume that the plaintext packets they send online are private by default. As in real life, good privacy can only be assured by significant effort on the part of the communicants. Is it evil to observe something occurring on a public street corner? It is not different to observe something occuring on a public IP router.

ibejoeb• 13 years ago

That's a stretch. I don't expect privacy when I shout on the street corner; that's broadcasting. I do expect privacy when I send email, because that's totally bounded.

The postal system is a public utility. Should it be filtered? What we're arguing now is why one envelope is special. I put my communications in paper envelope and I'm protected, but when I put it in an SMTP envelope, I'm not. I'd like someone to rationalize that.

As far as I'm concerned, let's do it one way or another. Either protect email or start OCRing the post.

mr_spothawk2• 13 years ago

"The microphones in every nook and cranny are merely filtering a public good, the air. You should know that when you vibrate the air with your vocal chords to make the sound of words, you're willingly broadcasting information patterns in quadrillions of particles in the air. It's not our fault you're so stupid about your security."

Don't be dense. Letters are easily intercepted and read, but we still expect that the government is not doing so because the constitution forbids that sort of behavior and the judicial branch is supposed to protect us from it.

You're conflating privacy with security. Security requires encryption, etc... privacy exists in the absence of monitoring devices.

frenger• 13 years ago

The problem is that people foolishly assume that the plaintext packets they send online are private by default The NSA are trying to decrypt encrypted messages too though, tapping VPNs etc. It's not like they're just surveilling plaintext comms.
people foolishly assume Yes those ignorant fools deserve everything they get for not being security enthusiasts, and for assuming good faith on the part of their government, right?

rinon• 13 years ago

Video seems to be up at https://www.blackhat.com/us-13/archives.html#Alexander

stevenrace• 13 years ago

*Note the above links to an MP4.

The 2013 Keynote is now on Youtube: https://www.youtube.com/watch?v=xvVIZ4OyGnQ&t=5m

-- Alexander begins at 5 minutes in

-- no slides visible in video

-- 'heckling' @ 39minutes in)

-- TLDR: One cropped screenshot of 'telephone metadata', assurances of internal audits, a thumbup from a Senate sub-committee.

Slides: https://media.blackhat.com/us-13/us-13-Alexander-keynote.pdf

kyzyl• 13 years ago

Looks like I'm a little late for this comment party, but I'd just like to highlight one comment from the Forbes website that I thought was good:

"In general I agree with McCoy in his ad-hoc debate with Gen Alexander as well as his post presentation remarks about the distorted perspective of national security. At the same time, I do conceed that the NSA is acting in good faith and ‘within the law’ as presented to them via the Patriot Act. I have similar feeling about the value of TSA, but whereas the TSA is a publicly disclosed program, my most pressing concern with the NSA is the secrecy of it. First, the secrecy presents an extremely high degree of risk (in terms of both the probabilty of occurance as well as the dangers) of mission creep. I doubt Congressional nor FISC oversight are adequate to mitigate this risk. Second, secrecy is not really a valid tool for deterence. Anti-terrorism programs are like a doomsday devices: it’s a good deterence only if it is widely known about (see Dr Strangelove). Moreover, while secret programs might be good for support of kill/capture programs, it is far from clear that such efforts reduce terrorism.

For all I know, the government spy/drone program is to terrorists as a hammer is to an ant colony. If you have a spilled pot of honey in the kitchen, it doesn’t matter how good you are at spotting and smashing ants. I want to know these things, so that I can help shape public policy through the ballot box." --uspatriot2001

I think that's a good assessment of the high-level picture, and it's much more informative than "NSA BAD! Freedom good!" (not to belittle anyone's comments here) in that it reflects a road forward.

etiam• 13 years ago

Keith Alexander's way of bending words, and his facility with swinging a crowd and lying skillfully under pressure once again reminds me disturbingly of accounts I've read about psychopaths, and of probable psychopaths I've encountered. Those patterns could of course be stuff you pick up anyway as a top player for power, but I find the parallels highly worrisome. For those who have never read anything about the subject, may I suggest browsing e.g. "Without conscience" by Robert D. Hare. The sections with court proceedings in particular illustrate well what I mean.

jotm• 13 years ago

“And if you disagree with what we’re doing, you should help us twice as much.”

Right, so they end up like Snowden...

leke• 13 years ago

All this bad press is a great incentive for people to develop encryption skills. I'm now looking into javascript client to client encryption of certain social sites and services using greasemonkey to organise the contacts and keys database.

NSA director heckled on stage at Black Hat security conference

Related Stories