New Snowden Docs Indicate Scope of NSA Preparations for Cyber Battle

http://www.spiegel.de/international/world/new-snowden-docs-indicate-scope-of-nsa-preparations-for-cyber-battle-a-1013409.html

by zmanian • 12 years ago

463 272 12 years ago

spiegel.de

jacquesm• 12 years ago

Judging by the scope of the attack on Belgacom in 2011 that battle is already underway, the surprise I guess should be that it is the allies attacking each other. If China or North Korea would have made an attack like this it would be trumpeted as an act of war, but because it is the UK with NSA assistance it's downplayed as much as possible.

amirmc2• 12 years ago

At best this seems like an arms race but at worst, there are actually battles being fought (of a kind). I wonder what the digital equivalent of a nuke would be such that govts decide that diplomacy is better. Some kind of Digitally Affected Mutual Destruction (DAMD).

ancarda• 12 years ago

the only law that applies is the survival of the fittest.

Is this such a problem? In a world where exploits are used to break infrastructure, isn't the best solution simply to build increasingly more secure code? If that won't solve the problem I don't know if legislation will. Right now a determined hacker can harm a company via the internet (e.g. Sony). Are laws really going to stop that from happening?

If not, please correct me. I know little about cyber warfare and would love to know more.

dthal• 12 years ago

I think you are exactly right. Any solutions to this have to be technical and largely defensive. Legal or diplomatic solutions will only bind parties that intend to follow the law. Counter-attacking and deterrence will fail if the attacker is not defending much of anything, so that approach might work against states and state-backed actors, but not against non-state actors.

allendoerfer• 12 years ago

Legal or diplomatic solutions will only bind parties that intend to follow the law.

Simple rule of thumb: This argument is always false.

Our society is too complex. It is never about good guys vs. bad guys. It is mostly about money, who has the most and how laws can change incentives and prices.

It is the same with drugs, guns, atomic bombs and nearly every other topic were this argument is brought up. We need to get over this because it is just slowing us down.

CaveTech• 12 years ago

Legislature can't prevent bad people from doing bad things. But it can prevent good people from doing bad or ignorant things, and it provides a framework to punish those who cause harm.

Every law can and does get broken, but that doesn't mean laws are useless.

throwaway3498233• 12 years ago

There are other ways to have an impact with laws than punish the aggressor. Airplanes aren't safe because the pilot or mechanic gets punished when something happens, it's because (very simplified) the airlines and manufacturers do.

stickhandle• 12 years ago

The last 2 articles I read were this one and the earlier piece on Google and neural nets [1]. It's easy to connect the two, add the pervasive integration of technology in our lives, mix in a healthy dose of paranoia --> see a SkyNet future.

[1]https://medium.com/backchannel/google-search-will-be-your-ne...

philip1209• 12 years ago

Domestic surveillance was controversial and surprising. Is a spy agency preparing ways to attack and cripple foreign infrastructure that unexpected or contentious?

Cakez0r4• 12 years ago

Is a spy agency preparing ways to attack and cripple foreign infrastructure that unexpected or contentious?

In light of current revelations, it may or may not be all that surprising. Surprising or not though, it is most definitely contentious!

pdknsk• 12 years ago

There was a long interview with Snowden posted recently, which didn't make it to the frontpage. I guess because of Snowden penalty on HN and Snowden fatigue. Anyway, he kept repeating a point which is quite easy to understand for the public I think.

https://news.ycombinator.com/item?id=8859606

And the reality is when it comes to cyber conflicts [...], we have more to lose.

We spend more on research and development than these other countries, so we shouldn’t be making the internet a more hostile, a more aggressive territory. We should be cooling down the tensions, making it a more trusted environment, making it a more secure environment, making it a more reliable environment, because that’s the foundation of our economy and our future.

[...]

The concept there is that there’s not much value to us attacking Chinese systems. We might take a few computers offline. We might take a factory offline. We might steal secrets from a university research programs, and even something high-tech. But how much more does the United States spend on research and development than China does? Defending ourselves from internet-based attacks, internet-originated attacks, is much, much more important than our ability to launch attacks against similar targets in foreign countries [...].

[...]

When you look at the problem of the U.S. prioritizing offense over defense, imagine you have two bank vaults, the United States bank vault and the Bank of China. But the U.S. bank vault is completely full. It goes all the way up to the sky. And the Chinese bank vault or the Russian bank vault of the African bank vault or whoever the adversary of the day is, theirs is only half full or a quarter full or a tenth full.

But the U.S. wants to get into their bank vault. So what they do is they build backdoors into every bank vault in the world. But the problem is their vault, the U.S. bank vault, has the same backdoor. So while we’re sneaking over to China and taking things out of their vault, they’re also sneaking over to the United States and taking things out of our vault. And the problem is, because our vault is full, we have so much more to lose. So in relative terms, we gain much less from breaking into the vaults of others than we do from having others break into our vaults.

ed• 12 years ago

There's no reason to pick Offense vs. Defense any more than there is Social Security vs. Education. It's just a question of budgeting. Why wouldn't we invest in both?

AgentME• 12 years ago

If offense includes things like trying to ban or secretly weaken defensive measures like encryption, then that doesn't work out so nicely.

Cakez0r4• 12 years ago

I think offensive vs defensive is a very easy choice. We want to prevent our systems from being compromised, but don't have any business provoking attacks by breaking into systems. Invest in defense.

pyre2• 12 years ago

In this situation, you can't pick both. The offensive measures we are discussing exist by breaking the defensive measures. The problem is breaking the defensive measures breaks not only their defensive measures, but ours as well. Hence Snowden's analogy to making a secret entrance to all bank vaults, even ours.

In this case, the idea is that the NSA will keep knowledge the secret door to the bank vault to themselves, and we'll all be secure. The problem with this is that other countries can inspect the bank vault and discover the secret door for themselves, or steal said knowledge from the NSA via espionage. Now our bank vault is just as exposed as theirs.

MichaelApproved• 12 years ago

I thought the back doors into our vaults were intentional, so that NSA could get in. Is the NSA willing to allow local companies have a completely secure network if it means they can't get into it also? Seems like they're comfortanle with the risk of hacks as long as they can get to go into the vault and look around too.

dang3• 12 years ago

I guess because of Snowden penalty on HN

There hasn't been any such penalty for many months. There used to be a weak penalty, which started during the period when there were hundreds of NSA/Snowden stories. But our intention was always to remove that once the quantity normalized, and so we did.

benstein• 12 years ago

How is this whistleblowing? What benefit do we as the public gain from this knowledge?

thomasahle• 12 years ago

This hurts everybody in the world. Americans too.

teamhappy• 12 years ago

What benefit do we as the public gain from this knowledge?

I'm from the EU, but I can imagine that, given that some of the NSA's operations today are only semi-constitutional, where these operations are supposed to be going is relevant to the debate.

moe5• 12 years ago

I would ask the other way round. Why should this knowledge be hidden from the public?

EpicEng2• 12 years ago

The obvious answer is that it becomes much harder for the NSA (and related entities) to do their job when their tactics and capabilities are known to the world. And yes, this is their job, and there's nothing wrong with it. Domestic spying is something that needs to be reigned in and tightly controlled, but to think that everyone should know everything is just naive and shows little understanding of how the real world actually operates.

username2• 12 years ago

I agree. I don't believe this report includes anything that could pose a legitimate threat to national security. If the NSA has begun militarizing the internet, the public has a right to know.

krapp9• 12 years ago

Snowden revelations have become a media franchise in their own right. This is not about public gain anymore, it's about fame and revenue on the part of the outlets covering the stories.

askmike• 12 years ago

The NSA behaves very hostile against everyone not from the US. As an EU resident I think it is very important to have an idea on the lines the NSA is crossing to protect US citizens that might put me at risk.

dogma11384• 12 years ago

But that puts it under espionage not "whistleblowing", we don't call a N. Korean scientist that defected to the west who spills light on N. Korea's nuclear program a whistleblower, we call him a defector and a spy.

Intelligence Agencies act on the behalf of their respective nations, there is nothing surprising about the US spying on the EU and vice versa.

As we already know the extent of the collection programmes the NSA operates i really do not see any real value in spewing more and more content about it, especially things that start to touch on the operational know-how of such programmes.

As much as we don't like the Americans spying on us there are far worse nations out there that i would actually fear if they will ever gain even a shred of the capabilities the NSA and some other western allied nations have.

Sadly this incident will be a very bad thing to whistleblowing in the long run, good luck passing any whistleblowing protection laws in the US (and many other countries including in the EU who took notice) any time soon.

While i do respect the sentiment behind Snowden's leak, I do actually have a bone to pick with how it was executed. There were NSA leakers before him, there will hopefully be some after him that will speak out when a line is crossed. However grabbing which ever documents you can put your hands on, and then seeking shelter in what is now a defacto hostile state isn't really responsible behavior.

Just few years before Snowden we already had an NSA leak from which the "secret interpretation of the FISA act" fiasco was made public. Snowden could've made the same effective impact with a handful of slides, not 1000's of documents (if not more, some numbers which were flying in the early days of the leak pointed at anywhere between 50 and 250 thousands documents) of which many probably contain actionable information which i would dare to say puts the EU as a organisation, and you as an individual at more risk than anything the NSA will ever did or do.

matt40772• 12 years ago

Belgacom was also targeted because its networks are a hub for non-Europeans roaming on the continent – including US citizens. Since this is the British intelligence service, US citizens aren't protected.

Remember as well that one of the CIA's targets in 2014 was the US Senate. Anything that damages the national security complex is a benefit to the US public.

ajcarpy2005• 12 years ago

How should NSA spying figure into the public's view of Obama's efforts to help municipalities build out competitively priced broadband networks?

stefantalpalaru2• 12 years ago

Add some legal pot and it will all be forgiven and forgotten.

fidotron• 12 years ago

To be fair here, the NSA should very well be doing these things, for the purpose of attacking other states. The reason is very clear as the Russian attacks on Estonia ( https://en.wikipedia.org/wiki/2007_cyberattacks_on_Estonia ) demonstrate a clear need for defensive capability in this area, and where you have defence you end up needing offence.

This persistent confusion between legitimate NSA operations such as preparing to intercept communications of foreign governments and illegitimate such as mass slurping of everyone's email merely serves to discredit the entire privacy defending position, and in the long run will just play into the hands of those that want to read everyone's email for nefarious purposes.

Afforess• 12 years ago

Agreed. I think the Snowden revelations have harmed the NSA's reputation to the point where most people on HN just assume NSA is a bond-level villain. The NSA serves a purpose, they are meant to be prepared offensively and defensively for the USA's security, which includes the internet. I have no problems with the NSA's purpose and would prefer they continue to exist and prepare against threats to the country.

I do believe the NSA overstepped their mandate in domestic surveillance, and should be held accountable, but let's not forget that this world does have bad guy's - plenty of nations would lose no sleep at night if they hurt America.

sroerick8• 12 years ago

The article addresses this very point.

It specifically explores the conflict of interest that the NSA must work both offensively and defensively. It makes the argument that the balance has shifted so drastically to the offensive that our defensive is being weakened.

TheOsiris4• 12 years ago

precisely, and this is why I'm starting to think that snowden has - at least - caused as much harm as good by his revelations. if he had stopped at revealing the domestic surveillance he would be an undisputed hero/patriot. but with all of these unnecessary leaks that does nothing but harm to national interest I can understand how others might view him otherwise.

CamperBob2• 12 years ago

Agreed. I think the Snowden revelations have harmed the NSA's reputation to the point where most people on HN just assume NSA is a bond-level villain.

Not so much Blofeld as Klingon: http://www.dailymail.co.uk/news/article-2421112/NSA-director...

pyre2• 12 years ago

I do believe the NSA overstepped their mandate in domestic surveillance

They've been doing it longer than the Internet. The "Five Eyes" have existed for a while, so that they can have a legal loophole for domestic spying (e.g. "We can't spy on our citizens, so we'll just ask our allies to do it for us!"). To me this indicates that, while the stated purpose behind the organization may have merits, the execution of that purpose has been flawed for some time.

tintwash• 12 years ago

Sapir-Whorf and Newspeak. What does "security" mean?

I have no doubt that the NSA's job is "national security" and that some portion of that work serves the people. Nobody knows what that portion is, by design.

If you bury the difficult, complicated issues under terms like "security", "threat to the country", and "bad guys", you're basically just supporting the NSA on faith.

Forget the terminology and FUD of "threats", and let's ask ourselves what the concrete benefit to the people of the United States (or better yet, the world) is for the NSA to be arming themselves for the destruction of computer systems. Is the benefit Cold Waresque deterrence through keeping the rest of the world in fear? Is this the strategy we want our work and taxes to support?

Maybe it's too complicated to think about, and even if we wanted to critically analyse the situation, secrecy prevents us from knowing anything besides what the government desires the people to know. It's easier to just trust in benevolent "national security" protecting us from Eastasia. Let's not forget that the world does have bad guys, and besides, we've always been at war with Eastasia.

foldr• 12 years ago

that this world does have bad guy's

No, movies have bad guys.

sroerick8• 12 years ago

Do you believe that NSA should be conducting economic espionage?

There is a clear need for defense. But because of lack of oversight, NSA has overstepped its bounds in both foreign and domestic spheres.

The other side of this argument, one made cogently by Snowden, is that we simply have more to lose by escalating the cyberwar.

jallmann4• 12 years ago

Having offensive capabilities and actually utilizing such capabilities are two different things. You can acknowledge the need for the former alongside the dangers of the latter, just as you would with any standing military.

koepked• 12 years ago

To me this goes both ways. If there is a legitimate mission for the NSA to accomplish, then perhaps they should make sure at all times to act in a way that is deserving of the public's trust. The persistent confusion you mention is not the fault of the confused.

Cakez0r4• 12 years ago

I don't understand why there are so many comments saying that the NSA needs offensive digital capabilities. What valid reasons does the NSA have to ever be committing a cyber attack?

mmagin2• 12 years ago

Possibly they're operating on the assumption that "cyber war" works like nuclear war and the most effective deterrent is the threat of retaliation.

adventured• 12 years ago

The obvious one: war with another nation.

Along with threat deterrent.

I can't think of any good argument for why the US military should have no offensive capabilities in the digital realm. It'd be the equivalent of staying out of the skies when flight became possible.

In any war, the US is going to come under digital attack, and it should be fully capable of responding both defensively and offensively. Besides that, shutting down the power grid of a country you're at war with via digital means, sure beats doing it with hundreds of missiles.

jsprogrammer• 12 years ago

Well, the comment you responded to said they need offensive capabilities because they have/need defensive capabilities.

It seems like a bit of a self-fulfilling prophecy to me, which can be a very dangerous thing.

Vulnerabilities should be searched for, but when discovered they need to be disclosed and fixed, not used to create real world damage.

caycep• 12 years ago

I agree. The DoD/NSA and other agencies should be developing these capabilities. IT's really the oversight and legal use of weapons against civilians that is the question

elwin2• 12 years ago

I suspect that "cyberweapons", like biological weapons, are almost impossible to use in a way that does not harm civilians. Their development is practically certain to lead to use against civilians in a way hard to reconcile with the ideas behind current international law. On the other hand, the idea of fighting a war without harming civilians is a 19th century notion unlikely to survive much longer.

throwaway3498233• 12 years ago

It's exactly this unrealistic notion of having your cake and eating it too that landed us in this mess in the first place. And what do you mean by "defensive capability"? Secretive military organizations isn't going to protect civil society. In fact their influence is often in opposition to such protection.

markvdb• 12 years ago

Are you a US citizen? How would you react if supposedly close US allies were bugging the White House, the US senate and AT&T? Repeatedly? Five Eyes, Echelon, Merkel, Belgacom, ...

throwaway344• 12 years ago

The irony of course is that the CIA did hack into the US Senate's computers. http://www.nationaljournal.com/tech/cia-admits-it-improperly...

anigbrowl4• 12 years ago

I'm not a US citizen, but I presume that US allies which have the capability do unilaterally gather intelligence on the US.

mpyne2• 12 years ago

Um.... you perhaps know less than you think you do about what "close US allies" do and do not engage in behind closed doors. Half of the reason Five Eyes even exists is to reduce the threat of espionage conducted by close allies.

hengheng2• 12 years ago

So I happen to be German, and obviously I don't have a say in what commands you guys give to your own secret services. But since this appeared in a German magazine, allow me to say this: given the track record of how you treat your alleged "allies", I don't feel comfortable seeing these developments. And I wouldn't ever trust anybody with these powers, least the nsa or even the US government. These people are still trying to create a US World Empire out of their own hybris, they just cannot leave the world in peace.

Surprisingly, it turns out that this is an easy way to make enemies, as last week's action in Paris have shown. It has been shown since 2005 that the islamists that massacred twelve people were, in fact, radicalized by what they learned about the prison of Abu Ghraib.

Job well done, thank you very much guys.

Lastly, the way our own government is supporting the nsa makes me feel nauseated at some times, furious at other times. We have plenty of work to do locally, that's why usually I don't complain about foreign services. Simply allowing the nsa to gain world domination like that though, just because "that is their job", really is hard to accept for me, and it really rubs me the wrong way.

IBM• 12 years ago

It's a good thing for allies to spy on each other to understand intentions, as this article in Foreign Affairs argues.

http://www.foreignaffairs.com/articles/140247/jennifer-sims/...

barry-cotter• 12 years ago

given the track record of how you treat your alleged "allies", I don't feel comfortable seeing these developments.

The USA has no allies, only clients. Some clients get more respect than others but they're all clients.

Remember, the State Department had a mole in the FDP, reporting on the German coalition negotiations. In all likelihood the CIA have a minister or more. The US does not respect anyone's sovereignty who can't and won't make them.

thefreeman2• 12 years ago

Your government is practically telling you that they are doing the same thing. What do you think "that is their job" means?

I can't believe it is more likely to you that your government is rolling over and "letting the NSA gain world domination", versus your government is trying to downplay it because they know they may one day be caught in exactly the same situation.

matt40772• 12 years ago

This was the British GCHQ. They were spying on non-Europeans using their roaming networks, including US citizens.

If you think there's some sort of restraint with regards to citizens of other 'five eyes' nations, I wonder how you square that with the "but everyone spies on everyone, including allies" argument that can always be found in these threads.

tosser002• 12 years ago

I can understand the support of Snowden for blowing the whistle on domestic spying, but how is this defensible?

tlear3• 12 years ago

It does not. This stuff gives argument that Snowden went over to FSB long time ago and that the whole thing is a Russian op a lot more weight.

username2• 12 years ago

No, it doesn't. Snowden isn't the one who's been releasing these documents; the journalists are. For your claim to make any sense, you'd have to believe Der Spiegel is secretly working for the Russians.

hobs• 12 years ago

Did Snowden go to his superiors about the program? Did anyone care? If the Russians wanted to steal our information why not just steal the information? They have many of the secrets Snowden talked about already (via their own intelligence agencies, Russia is no slouch) and could publicize them if they wanted to, or release them anonymously and pretend it was some hackers on steroids.

It just doesnt hang together that Snowden is a spy for me, whether or not you approve of what he did.

TheOsiris4• 12 years ago

that's why I never understood why he agreed to turn over all the docs to greenwald. he should've been in control of what's revealed and used the rest as insurance.

no one benefitted by revealing that the U.S. spied on merkle. that's what nations do, even Israel spies on the U.S. all the time. then this, how does this knowledge benefit anyone but the bad guys?

iamedward• 12 years ago

I am glad for any document that has been leaked. Although we might not be able to see the whole picture yet it made one thing clear: the US government is at the same moral level as countries like Russia, North Korea or the Iran to me. They do neither respect the privacy of their citizens nor the privacy of any other person in the world. They might have some moral concepts that are a little bit more close to mine as a European (aside from the gun laws, death penalty). The problem is that they have much more power and influence than any of these countries.

What kind of idiot would ever want to stand on the wrong side in this world? We see that communication is not private, maybe every technical device could be used to spy on you and in a war against the USA you would not even see the enemy's soldiers. THIS is a reign of terror.

ramrunner8002• 12 years ago

Good to know you see reading your mail as equivalent to executing people for their sexuality, interning hundreds of thousands in labor camps, and jailing all who dare oppose you. That definitely doesn't devalue the lives of all those people or reveal you as hysterically self-important.

mmagin2• 12 years ago

What if some people believe developing offensive "cyber war" capabilities in secret is immoral?

Consider, for example, whether you would be opposed to someone leaking information as to whether one of the nuclear powers had nuclear capability in excess of what was publicly known?

Oh, sure you can dance around the fact that the latter may be more of a violation of treaties, etc., but just because their are no treaties covering "cyber war" (correct me if I'm wrong), does not make it morally acceptable.

xnull2guest2• 12 years ago

Snowden did not write this article or blow this whistle. He handed materials directly over to journalists, which is protected by US law. This reporting has been done by journalists who have access to the Snowden documents, which is protected by US law.

Animats2• 12 years ago

Everything at the lowest levels needs to be tightened up now.

Buffer overflows in trusted code have to go. This means getting rid of the languages with buffer overflow problems. Mostly C and C++. Fortunately we have Go and Rust, plus all the semi-interpreted languages, now, and can do it.

We need something that runs Docker-like containers and, all the way down the bare metal, has no unsafe code. We need dumber server boards, with BIOS and NIC code that's simpler and well-understood. The big cloud companies, Amazon, Facebook, and Google are already doing their own server boards.

Companies which put in "backdoors" should face felony criminal prosecution. That doesn't happen by accident.

Latest CERT advisory: "Vulnerability Note VU#936356 Ceragon FiberAir IP-10 Microwave Bridge contains a hard-coded root password ... Ceragon FiberAir IP-10 Microwave Bridges contain an undocumented default root password. The root account can be accessed through ssh, telnet, command line interface, or via HTTP. ... CERT/CC has attempted to contact the vendor prior to publication without success."

All Ceragon customers should demand their money back, and their products should be seized at US customs as supporting terrorism.

saryant• 12 years ago

The chair of the computer science department at my university liked to say that CS could just as easily be considered the Computer Security department. This guy wasn't a pragmatic programmer whatsoever, he always claimed he didn't even know how to code (he was a theory guy), but he was right.

dmix• 12 years ago

Buffer overflows in trusted code have to go. This means getting rid of the languages with buffer overflow problems.

In the meantime, since moving away from C will take years, we need to invest in better exploit-mitigation technology instead of relying on bug-hunting-driven-security. That means OS/kernel developers need to start taking security seriously and keeping up with attackers. This means adding proactive measures instead of slowly reacting only when a new CVE comes out. Which sadly far from the reality at the moment.

For example, OpenBSD made headlines for adding W^X to the whole kernel but hackers have already been bypassing W^X on iOS for years:

http://bsd.slashdot.org/comments.pl?sid=6723643&cid=48812833

> These protections may guard against a (very small subset of) casual attackers, but they're just another minor hurdle for determined attackers.

In addition we need to move away from signature-based AV towards host-based intrusion detection systems (HIDS). It is not accident that all the feds who left government cybersecurity jobs in recent years moved to build private companies creating HIDS products and making millions selling them to big corps (FireEye, Crowdstrike, etc).

The only options available for consumers and the average sys admin are security tools easily bypassed by any semi-sophisticated adversary (for ex: Anti-virus/RKhunter/SELinux/most trusted computing code-integrity systems/etc).

bhouston• 12 years ago

One problem with most "interpreted languages" you cite as preferable is that they rely on C/C++ run-times for now. This means these languages are only as safe as the underlying C/C++ run-times and the core libraries they rely upon (glibc and the like.)

We need to start to think of replacing underlying runtimes and core libraries with Rust and Go-based alternatives (or similar) to make them safer. Ultra-large goal and probably impossible in the near term, but it should be done.

Animats2• 12 years ago

It may not be that big a task. How much code do you really need to run a container instance? If you could get an airtight Xen-like system, you might not need much of an OS inside each container. Xen already does memory allocation, CPU dispatching, I/O handling, timer handling, and message passing, which is all an OS really needs.

Rust programs running on "libnative" do not, I think, use "libc" any more.

nly• 12 years ago

Removing whole classes of software bugs, even if the cost were bearable, won't make a huge dent.

If you fix the software, the NSA will just backdoor the firmare/hardware (if they haven't already) and, even on an Android phone running AOSP, there are literally still millions of lines of proprietary, unaudited, closed-source code. Not to mention half dozen microprocessors containing circuitry you can't possible inspect. PCs are the same these days. Do you really expect these multi-billion $ industries to change? There's only a niche commercial interest for consumers of 'simple and well-understood'(read: secure) firmware.

And it's not like the hardware/consumer industry is sitting pretty as a lone miserable failure from a security sensitive standpoint. Then entire Internet stack from Ethernet and BGP up the way up to HTTP is complete and utter garbage. Our standards bodies (IETF, W3C etc) are failing to protect us and there's no sign of it getting better because the cost of starting over is simply too damn high.

Juz16• 12 years ago

Companies which put in "backdoors" should face felony criminal prosecution. That doesn't happen by accident.

Hard to do that when refusing to put in a backdoor can have even worse consequences.

frabcus• 12 years ago

I agree - I've just made a simple promise pledge, as a ceremony to commit to not using C/C++ for new projects: http://www.flourish.org/promise/

bronekk• 12 years ago

I wonder, how switching to different programming language would have prevented backdoor in network hardware?

Juz 16 is right that the companies concerned should face criminal prosecution, this is not technological problem and technology cannot (ultimately) solve it.

pa7ch2• 12 years ago

Looking at the comments in support of the NSA here makes me suspect an astroturfing campaign is happening.

Edit: I should add that my suspicion came from noticing that the vast majority of the comments when this was first posted seemed aligned in favor of the NSA's mission.

It wasn't the presence of pro-NSA comments that was interesting but rather that these opinions were the overwhelming majority. This is, of course, how astroturfing becomes effective, it is not the rhetoric that is important but the cognitive bias imparted by the facade of so many people falling to one side of an issue.

This is of course, only a suspicion, but it seemed worth noting.

sroerick8• 12 years ago

Hacker News is quite astroturfed. Every web forum is.

omphalos• 12 years ago

One approach to countering sock-puppetry as a general problem is with increased transparency. Personally, I think lobste.rs' notion of a user tree is a step in the right direction: https://lobste.rs/u

krapp9• 12 years ago

You're probably right.

No need to consider the arguments made by people who don't agree entirely with a particular point of view, or even discuss it at all. They're obviously just shills.

Edit: Much of the 'pro NSA' comments I see here seem merely to suggest that not everything the NSA does is evil, and not every disclosure is necessarily useful. As often happens in threads like these, any such comments are dismissed as the work of astroturfing or shills.

To imply that disagreement with any narrative presented by the Guardian and Spiegel Online must make one an agent with ulterior motives, is precisely the kind of propagandist trolling any forum which cares about truth should avoid.

Yes, the NSA has a covert program to attempt to influence online messageboard and social media accounts. No, this program does not account for every even remotely 'pro-NSA' opinion one might find online. And even if it did, judge them on their own merits and move on, because you really can't tell. It's all just text in a box.

Seeing spooks everywhere doesn't make you free, it just makes you paranoid.

pa7ch2• 12 years ago

In the interest of facilitating a open and fair discussion on the larger issue of state surveillance, I highly recommend checking out the 2014 Munk debates: http://www.munkdebates.com/debates/state-surveillance

General Hayden and Glenn Greenwald are given fair time to discuss the issue and to give rebuttals to each other.

Its much more informative then trying to parse HN comments to form an opinion about state surveillance. It also forces you to consider the views of people who don't agree with you.

elwin2• 12 years ago

Try looking at the comments from a different angle. Instead of grouping them into "pro-NSA" and "anti-NSA" categories, try checking for technical ignorance. Look for ideas about cyberwarfare based on bad analogies with real warfare. Look for a mindset that puts winning an arms race first and never considers ethical implications. Look for vague statements about protecting or harming America that don't explain whether they mean the American military, the civilian government, or ordinary citizens. Look for equation of the NSA's offensive and defensive capabilities.

The other side of the debate has its own poorly reasoned comments. I haven't noticed many on this article yet, but they should arrive soon.

I doubt such comments are written by people with NSA connections, but their sudden appearance is odd. The only other subject that produces so many strongly opinionated, poor-quality comments is systemd.

JoachimS3• 12 years ago

Being paranoid does not mean they are not targeting you.

srj3• 12 years ago

The parent poster didn't advise ignoring the pro-NSA opinions but gave his opinion that he felt there might be an astroturf campaign. And why follow a comment agreeing that astroturf campaigns are employed with one slanting those pointing it out as 'spooks' and 'paranoid'?

I think it's worth reminding fellow readers that this sort of manipulation happens, and likely on HN.

Cakez0r4• 12 years ago

Was thinking the same thing. Comments asking unbiased and valid questions are being downvoted...

diminoten19• 12 years ago

There is absolutely no reason for the NSA to give a flying fuck about what you or I think.

There just isn't, and it'd be a waste of resources to even attempt something like this.

People do exist (I am one of them) who think the NSA is doing a nasty job that isn't very appealing, but is absolutely necessary for me to be able to sleep in my bed at night safely. They may not have the best guidance from the government, but there are people who do believe they're doing the best they can.

Why must there be a conspiratorial astroturfing campaign taking place? Why can't there just be people who actually agree with some/most of what the NSA has done, based on the laws that govern it?

task_queue• 12 years ago

I agree that it's best to assume earnestness in opinions, I disagree with your opening. There absolutely is a reason for the NSA to give a fuck what you or I think. They are an intelligence and security agency, operating covertly with plausible deniability is what they do. More importantly, there are laws trying to be passed that can strengthen or weaken their funding and power. Making people at home feel that the agency needs to keep up the good work is not a waste of funds to that end.

They just got caught with their pants down spying on the American people. If they don't try to take hold of the narrative they might see themselves at the shit end of the political stick.

rhizome8• 12 years ago

People do exist (I am one of them) who think the NSA is doing a nasty job that isn't very appealing, but is absolutely necessary for me to be able to sleep in my bed at night safely.

I don't buy the Col. Jessup rationalization at all, and I think it's simpleminded. The threats these people are defending against are ones created by their own actions, and the actions of the governments they act on behalf. Regular citizens of whatever country are affected by these activities but they don't get a voice in how or whether the "nasty job" (and it's precursors) are in their interest.

benaiah2• 12 years ago

Why must there be a conspiratorial astroturfing campaign taking place?

Regardless of how you feel about it, there is a conspiratorial astroturfing campaign taking place - it's a well documented NSA activity. Whether it accounts for specific comments is impossible to say, but it does exist. Why then is it so absurd to think that it may be in play?

srj3• 12 years ago

Which NSA activities have been necessary for you to sleep in safety?

And as to the 'nasty unappealing job', what has led you to believe that is a common perspective among those who work there? The project detailings that have been released often seem downright giddy.

JoachimS3• 12 years ago

"There is absolutely no reason for the NSA to give a flying fuck about what you or I think.

There just isn't, and it'd be a waste of resources to even attempt something like this."

You and I are not the ones defining the reasons of and what NSA are interested in. You might think there are no reasons, but NSA may have a totally different view. For an organization that for real wants to capture ALL communication on this planet, waste of resources may seem like a minor issue.

Thanks to Snowden, we do know that NSA and GCHQ are actively doing astroturfing.

Without overstate the importance of HN, this is one place where a lot of technical talent hangs out. Talent that also talks, informs and educates others. If one want to moderate criticism from people that others listen to and rely on for information about security, privacy, HN would probably be a good place to focus on.

fit2rule• 12 years ago

There is absolutely no reason for the NSA to give a flying fuck about what you or I think.

True. But that's not what this is about. What the NSA care about is what resources he has, which they would want to use for their own purposes - this is why they monitor such individuals as work at major ISP's. Its not about thought - its about action. What actions can they perform if they gain access to this persons electronic life - in the case of sysadmins for major ISP's, there is much to be gained from infiltration, exploitation, and subterfuge.

woah2• 12 years ago

What are you afraid of?

patcon• 12 years ago

Assume that since there is something to be gained by the more powerful on one side, that a certain portion of the comments siding with the more empowered source are owned. It's not worth calling out individual commenters, because you can't know. But assume that some portion is shilling.

The hard part is guessing what portion. 10 percent? 30 percent? What's the time-graph? Is it 50% of initial comments, tapering off to just us Real Folk to dither around with the wondering phase of the conversation? The important thing is to assume that you're often witnessing a deceit in some capacity, in most any important conversation.

Needless to say, all this is pretty fucked up.

EDIT: Changed percentages, because I honestly don't know what's reasonable :/

Rapzid2• 12 years ago

I've been reading the comments and it looks like typical political bickering. People have been made so polarized on these issues by propaganda, astroturfing, the two party system, mainstream media, and etc. that they can't have a conversation about these topics without going for the throat. Shockingly, or not so shockingly, even on Hacker News we can not seem to have constructive conversations about this stuff.

dreamfactory23• 12 years ago

Job done I guess

foxhedgehog• 12 years ago

wait so if somebody disagrees with you, even on principle, it's evidence of astroturfing?

aurelius• 12 years ago

What comments in support of the NSA? Any comments in support of the NSA here are IMMEDIATELY flag-killed by the HN Nazis who love to suppress any kind of free speech they don't agree with.

jeangenie• 12 years ago

It's interesting to note that it's not just comments that can be manipulated but also the stories that are upvoted.

zmanian• 12 years ago

There are a number of objectionable elements to the NSA foreign operations.

- Mass surveillance of all humans is objectionable on human rights terms.

- Attacks on civilian infrastructure. The NSA is executing military operations against civilian infrastructure even in NATO countries.

It isn't conventional foreign policy or warfare for a military agency to be actively and continuously attack the civilian cultural and economic infrastructure in preparation for war.

yourad_io• 12 years ago

Attacking the economic infrastructure in preparation of War has been the US' m.o. since at least the 50's. Economic Hitmen, and what-not.

higherpurpose2• 12 years ago

Of all countries? I doubt that. Many people don't seem to realize the scope is the main problem here, and they are equating spying on one person in targetted surveillance, with spying on 4 billion people and saying "NSA has already been doing that!". No they haven't. So stop confusing the message.

Another big problem is that NSA has started undermining crypto. Before 2001 you could maybe actually trust NSA that they're releasing crypto that is safe because you thought they actually have an interest in "security". Not anymore. Anything and everything NSA has touched now has to be considered corrupt.

UhUhUhUh• 12 years ago

There is also this very American reassuring belief that quantity will somehow take you to quality.

lawnchair_larry4• 12 years ago

Here's a story for you.

I'm not a party to any of this. I've done nothing wrong, I've never been suspected of doing anything wrong, and I don't know anyone who has done anything wrong. I don't even mean that in the sense of "I pissed off the wrong people but technically haven't been charged." I mean that I am a vanilla, average, 9-5 working man of no interest to anybody. My geographical location is an accident of my birth. Even still, I wasn't accidentally born in a high-conflict area, and my government is not at war. I'm a sysadmin at a legitimate ISP and my job is to keep the internet up and running smoothly.

This agency has stalked me in my personal life, undermined my ability to trust my friends attempting to connect with me on LinkedIn, and infected my family's computer. They did this because they wanted to bypass legal channels and spy on a customer who pays for services from my employer. Wait, no, they wanted the ability to potentially spy on future customers. Actually, that is still not accurate - they wanted to spy on everybody in case there was a potentially bad person interacting with a customer.

After seeing their complete disregard for anybody else, their immense resources, and their extremely sophisticated exploits and backdoors - knowing they will stop at nothing, and knowing that I was personally targeted - I'll be damned if I can ever trust any electronic device I own ever again.

You all rationalize this by telling me that it "isn't surprising", and that I don't live in the [USA,UK] and therefore I have no rights.

I just have one question.

Are you people even human?

[1]https://firstlook.org/theintercept/2014/09/14/nsa-stellar/

[2]https://firstlook.org/theintercept/2014/12/13/belgacom-hack-...

alecco3• 12 years ago

Indeed, Obama and US congress made it clear we foreign people are just fair game for targeting. At least I'm lucky not to live in a country where targeted assassinations are going on.

Also, it's pretty obvious terrorism is an excuse. The main reason is power and control. Corporate espionage and controlling US-unfriendly political movements is very likely the main goal.

AndrewKemendo4• 12 years ago

we foreign people are just fair game for targeting

That's not exactly true in that not every non-U.S. citizen is an interest to the U.S. Government.

To your broader point though, the idea that a state's Security, Defense or Military arms are singularly focused on foreign "threats" or potential threats is a fundamental assumption of nearly every international relations theory. Why would you think it would be otherwise?

TeMPOraL4• 12 years ago

Also, it's pretty obvious terrorism is an excuse.

Terrorism is indeed very real, and is happening all the time. Hundreds of acts of terror have been committed in the years since 9/11, resulting in deaths of thousands of civilians, including hundreds of children. They those acts have pretty much 0 media coverage, and no one is doing anything to stop them. The US is free to keep on terrorizing civilian populations around the globe.

http://www.thebureauinvestigates.com/category/projects/drone...

pekk• 12 years ago

What do you think that nation-states do?

rational-future• 12 years ago

What do you think you're doing right now?

tacoman• 12 years ago

I read this post a dozen times. As a sysadmin for a sizable ISP in a non-US/UK country, the Belgacom story has haunted me.

Is this the first time you've talked about it?

edwinyzh• 12 years ago

FWIW, this is my first time reading this. Some stories worth spreading.

lawnchair_larry4• 12 years ago

My story isn't about me. It's a hypothetical based on things that have actually been done to someone else.

stiffled2• 12 years ago

Welcome to my world. "You all rationalize this by telling me that it "isn't surprising", and that I don't live in the [USA,UK] and therefore I have no rights." This is because Americans are naive enough to think we have rights. And I was once one of the fools that thought this was a free country until what made us similar happened to me. And anyone who thinks that they are 2 far removed to be affected by this is in for a rude awakening that I don't wish on anyone and if we don't open peoples eyes 2 how close it is to them before it happens to them they will find out for themselves when it's a moot point. So my question to you is how do you let go and move past something as violating as this? It is rape of epic proportions!

karmacondon• 12 years ago

This agency gathered information on you, attempted to friend you on linkedin and infected your family's computer.

I don't think any of those actions warrant accusations of inhumanity. I can understand that it's disturbing to feel that you're being stalked, or even just monitored. But it doesn't sound like anyone took action to intervene in your private affairs or intentionally lead you to feel threatened. It's legal and at least arguably moral to hire a private investigator to follow a private citizen around, so long as they follow certain rules. Attempting to friend someone on linkedin under false pretenses is also legal and arguably moral. Infecting a computer with a virus is not legal as far as I know, but I think the real concern there is the nature of the software and not it's existence. As long as they did not harm, the morality of even infecting a computer is questionable.

These people are spies, their job is to spy. To them at least, it isn't a question of the rights granted to you by your citizenship status. It's a tradeoff between the emotional discomfort that you may feel and their job requirement to develop resources that will allow them to stop bad people from doing bad things. I think they made the right decision. If influencing an employee at an ISP can give them more insight into the capability and intent of people they suspect to be up to no good, and the main cost is the distress that said employee or employees will feel as a result of being spied upon, then do it. The needs of the many outweigh the needs of the few.

I understand that we disagree on that, and there is ample room for both sides of the disagreement to be right or one of them to be utterly wrong. But I don't think that either decision is inhumane in any way.

stiffled2• 12 years ago

Much like trying to comprehend what it is like to be a parent when you are not a parent. You will not grasp how clueless you were about it until you become one.

maximilian2• 12 years ago

Infecting a computer with a virus... As long as they did not harm, the morality of even infecting a computer is questionable.

This is bullshit. Even if a virus doesn't intentionally harm, it does anyway harm.

Connections will become very slow, because high priority is given to uploading stuff from one's computer to nsa. User will get inexpicable blue screens or exotic error messages that nobody can help to fix: asking for help in forums will just bring annoying answers of "experts" suggesting to upgrade Windows/Flash/HW/programs versions. Installation or execution of some programs will be prevented, making computer usage a pain.

Infecting a computer is legally and morally a crime.

ant6n• 12 years ago

We'll get them evil-doers!

mh_• 12 years ago

Agree completely..

When the docs first leaked, I wrote this: https://medium.com/@haroonmeer/why-discussions-on-cyber-snoo...

VooDoo6Actual• 12 years ago

PANARCHY

jokoon• 12 years ago

If government money can put people on the moon for military or security reasons, they will easily be able to spy on you no matter what if the same motives apply.

It's not a matter of humanity, society often puts itself before individuals to make sure society can exists the longest it can. A civilization will easily sacrifice many things to secure its survival.

That's how the strongest defend themselves, it's very hard to stay on top for a long time, so often, those countries will take huge leap of faith and risks to crush their enemies, even if they're on the other side of the world.

If you're an american, you have free speech, and all the democracy and the things around it. If you're outside America, you better be an ally or look like one. Intelligence agencies are a lot about crushing people who might make america look bad, it's about public image, it's almost the same job of a journalist, except you defend your country's interests.

Survival of the fittest. Democracy is just internal management.

returnofthejedi• 12 years ago

Star Wars The Empire Strikes Back..

https://www.youtube.com/watch?v=WASr5-mS238

But do we know how this ends?

lawnchair_larry4• 12 years ago

Note: This story is meant to reference the two examples listed, and isn't my personal story. It is someone's story, and has almost certainly happened to many others who are unaware, given the MO described in the leaks.

I would not be surprised to find out that it has happened to me, but I don't think that is the case.

I can't edit anymore to clarify, but since it's not obvious from the post, especially if you don't read the references: I'm not either of the individuals who this happened to.

smokingsalmon• 12 years ago

Hello.

jakeogh• 12 years ago

The premise that we need "beneolvient power" to "protect us" from "evil doers" is the oldest trick in the book. If there is no threat, one will be generated. Almost organically, it does not even take overt orginization. The players know cui bono.

xnull2guest2• 12 years ago

She has abstained from interference in the concerns of others, even when the conflict has been for principles to which she clings, as to the last vital drop that visits the heart. She has seen that probably for centuries to come, all the contests of that Aceldama, the European World, will be contests between inveterate power, and emerging right.

Wherever the standard of freedom and independence has been or shall be unfurled, there will her heart, her benedictions and her prayers be. But she goes not abroad in search of monsters to destroy. She is the well-wisher to the freedom and independence of all. She is the champion and vindicator only of her own. She will recommend the general cause, by the countenance of her voice, and the benignant sympathy of her example. - John Quincy Adams

It was until recently (the early 1900s) that the policy of the United States to stay entirely out of any foreign affairs other than her own. It was acknowledged that America could spread her virtues and values by being the paragon example of them as inspiration to others to follow suit.

Today she holds the opposite view - that it is her unquestioned duty and obligation to interfere everywhere with the justification and rationalization that she seeks justice - and that discarding some of these principles for her own people is necessary for this noble mission.

Rapzid2• 12 years ago

It's kinda odd that our politicians in the past used to be, for lack of better words, poets. I have often wondered about this and wondered what has happened.

SCHiM• 12 years ago

One thing to be said about the offence vs defence side of this story is that the adage the best defence is a good offence definitively applies here. It's so much easier to attack another system than defend your own. It's inherent to the way systems are set up:

A computer system has many services, programs and tasks running on it. Only one of these needs to contain a flaw for a system to be vulnerable, obviously this means that on a secure system everything must be perfect, for 1 flaw compromises everything.

Therefore I don't find it strange that the NSA allocates the resources it does to research and expand it's offensive capabilities, since trying to defend the systems of the US is probably a lost cause. The question remains if this is ethical and/or legitimate. Being a non us-citizen I'm certainly opposed to the practises of weakening standards and harvesting/exploiting services on the internet.

I also find the double-speak of the US government deplorable, on the one hand we have the government declaring that in many ways a cyber-attack will, and can, be reacted upon as if it were a conventional attack. And on the other hand we have the US government attacking and targeting civilians (Belgacom Sysadmins). I fail to see how attacks against the US can be labelled as a conventional attack, but that attacks from the US against civilians are apparently OK.

squozzer• 12 years ago

I won't pretend to know what's going on here or its implications. So far humanity has lucked out considering our capacity for building some pretty nasty weaponry. We'll probably go through a series of cyberwars before we come to our senses.

I don't blame the NSA for trying to be ready to fight a cyberwar. Other nations probably wouldn't stop their programs even if the US did. Our culture isn't the only one infected with a sense of Manifest Destiny.

Where we might consider drawing the line begins with necessity. Deciding which actions are necessary and which are gratuitous might prove difficult, assuming we even know, which is why I find it hard to fault Snowden for leaking this information.

As fearsome as the NSA sounds, certainly they have some limits. For instance, why don't they just clean out everyone's bank accounts? Might pay their bills for a few days anyway. But why haven't they gone after certain criminals? Many shady operations keep their money in jurisdictions that probably can't compete with our cyberwar capabilities. Maybe these operations enjoy the protection of a powerful entity but probably not all of them do. And probably many operations still use cash and couriers but the US and others seem to have gotten better at tracking movements of people so it's doubtful such tactics will remain viable forever.

Maybe in the end we have to somehow conquer the notion of distrust. Not sure how it can be done except through telepathy and even then the transition to a telepathic society will probably be full of misery.

Briguy2k• 12 years ago

Speaking as a citizen, the problem with the US's newest brand of digital weapons, is that they can be used on US population under the radar and w/o killing anyone. This may justify legally their extended use for surveillance unfortunately. The development of the atom bomb and chemical weapons had no "convenient" use on the USs own citizens, and they clearly couldn't get away with it. However, these weapons do, and they are being developed with all the same force, purpose, and financial backing as the a-bomb and chemical weapons were ~100 years ago.

JoachimS3• 12 years ago

Not only could use. These weapons are built using either weaknesses introduced into civilian domestic systems, or found in domestic civilian systems and not fixed. This means that the basic premise for this weapons created to protect US citizens is to weaken their security.

thefreeman2• 12 years ago

The NSA should just leak documents showing all of the other governments doing this stuff so we can move on from the Anti US/UK circle jerk. Seriously if you think your government hasn't invested serious time and money in digital subterfuge you are living in a dream world and need to wake up.

ramrunner8002• 12 years ago

This.

woah2• 12 years ago

Classic straw man. Many of the documents leaked have shown that our allies are doing the same, usually with the NSA's help. Of non U.S. allies most countries are too small to have serious programs, or are plainly doing much worse. I suppose this is some sort of perverse defense of the NSA, but the fact is that luckily most people would like to hold their government to a higher standard, instead of saying "the other guys are worse". If more people had had your attitude a few hundred years ago, we wouldn't even have democracy, as there would have been plenty more brutal and totalitarian regimes to point to.

tete• 12 years ago

What I find really frightening is where they write:

From a military perspective, surveillance of the Internet is merely "Phase 0" in the US digital war strategy.

[...]

This enables them to "control/destroy critical systems & networks at will through pre-positioned accesses (laid in Phase 0)." Critical infrastructure is considered by the agency to be anything that is important in keeping a society running: energy, communications and transportation. The internal documents state that the ultimate goal is "real time controlled escalation".

This isn't about fighting terrorism. It's also not about the usual warfare it's more like the infrastructure or a set of tools to control nearly every other country or the planet or at least make sure that the US will always be able to keep them from disagreeing.

qatester• 12 years ago

For me the only bunch of people who wants and loves to start war is USA government, note I am not saying americans, I am saying US government. Why should you prepare if you dont have intention of war? "defense", from whom? from people where you started war? directly with Afghanistan, Iraq and some others, indirectly with Syria, even with Russia (started economically) and many others where they got governments with bribes. Now preparing for D war. Every war started with flag of "Demo hypocracy", defense and some other pseudo defensive words, reality is USA starts war and government fuckingly loves when people die. Probably you are going to downvote, thats because you didnt lost any of your brother, sister or even relatives and friends in such wars which just started because they wanted more oil and more money.

junto• 12 years ago

I'm pretty late to the party here but there are some fascinating parallels between the USG's actions in the physical world, as in the digital one.

First to USG has made a concerted and successful attempts to place secret digital strongholds and black sites across the globe, including some 'behind the enemy lines' so to speak. In the physical world these are the equivalent to CIA black sites and safe houses, from which you can attack and spy on the enemy, feed in extra weaponry to partisans and rebels (similar to the CIA Benghazi compound, sorry 'consulate', sorry 'embassy'.

The NSA has all these smart dangerous and arguably immoral minds employed to defend the digital borders of the US. But in truth these minds are busier establishing secret pathways through the digital trenchlines in order to have a definive and effective advantage when the cyberwar comes (which of course they are actively encouraging to validate their position, historical actions and future funding).

At the same time they are making a concerted effort to make sure that the security protocols everyone uses are undermined and backdoored. In effect they are making sure that the digital nuclear weapons held by their enemies aren't going to get in the air when the time comes.

Through strong encryption we could make sure that we have the digital equivalent of mutually assured security, but as ever the US isn't interested in this, because the reality is that the military industrial compound aims to make billions of dollars from the industry.

In a world where all communications and hardware devices were secure, they wouldn't make any money. A secure, stable and safe world just isn't profitable.

kgarten2• 12 years ago

seems to me a lot of people flaged the story (443 points, 1 day ago, on page 3 with a couple of stories with 200 points also 1 day ago) ... wondering why conspiracy theories ;)

New Snowden Docs Indicate Scope of NSA Preparations for Cyber Battle

Related Stories