Commentators have long recognized the NSA had two conflicting missions: one to defend key American networks, and one to collect intelligence on our adversaries. As Wired explained three years ago:
NSA headquarters ... in Fort Meade, Maryland, is actually home to two different agencies under one roof. There's the signals intelligence directorate, the Big Brothers who, it is said, can tap into any electronic communication. And there's the information assurance directorate, the cyber security nerds who make sure our government's computers and telecommunications systems are hacker- and eavesdropper-free.
The addition of US Cybercommand to this mix made things still worse: General Alexander has warned of attacks on the US's electrical grid that might rely on vulnerabilities similar to the ones the US exploited to attack Iran's nuclear program.
Documents leaked by Edward Snowden have exposed more details about how the NSA's dual missions undermine each other. The agency uses court orders to oblige Google to turn over its users' data under the Prism program, while finding ways around Google's encryption when compiling contact lists of unsuspecting Google users in collection supervised by no court.
While the NSA points to vulnerabilities of American business networks and communications, it works with companies to "insert vulnerabilities into commercial encryption systems" and "influence policies, standards and specification for commercial public key technology". Even as NSA and other national security leaders warn that cyberattacks (pdf) present the biggest threat to the country, NSA is leaving open or even creating vulnerabilities that our adversaries can exploit.
As security expert Bruce Schneier described:
Finding a vulnerability - or creating one - and keeping it secret to attack the bad guys necessarily leaves the good guys more vulnerable.
The NSA is violating the trust needed to accomplish its goal of protecting America's networks. The NSA has exacerbated this trust problem in a slew of ways.
Last year, Alexander donned a hacker costume and went to the computer security DefCon convention to schmooze hackers. While there, he made a series of misleading statements - denying the NSA collects data on millions of Americans - that set up James Clapper's more famous repetition of the same lie in March of this year. This year, Alexander attended Black Hat conference (this time, without a hacker costume) and warned of the "terrorist walk[ing] among us". That same day, another Snowden-leaked document revealed the NSA considered encryption - used by many computer security professionals - indication of a potential terrorist under Xkeyscore.
More recently, an illustration on a slide (pdf) reviewing the NSA's efforts to crack Tor - a sophisticated encryption system used by many security experts - identifies Tor users as terrorists. In fact, the NSA's minimization procedures allow it (pdf) to keep all encrypted communication, effectively targeting those who try to protect themselves. Effectively, NSA treats hackers, who should be key allies, as terrorists.
Corporations, too, appear to be growing wary of the NSA. Shane Harris reported that "many corporate participants" in an cyber security information-sharing effort say:
General Alexander's primary motive has not been to share what the NSA knows about hackers. It's to get intelligence from the companies.
Cloud storage and security firms worry about losing business to other countries or to private storage because of NSA's snooping.
The NSA has also proven unworthy of the general public's trust for a key scheme it wants to use to catch hackers. Alexander has sought the authority for the NSA to "live on the networks", copying and analyzing data that travels within the US to find any malicious code that might indicate a cyber attack. They already conduct similar analysis (in search of cyber attacks, but also terrorists) with data presumed to be foreign that nevertheless traverses the United States. Only after three years of conducting such collection did the NSA explain what it was doing to the Fisa court. In response, in a 2011 opinion (pdf), the court not only determined the collection had been deliberate (not unintentional, as the NSA and its defenders still claim), but had also violated the fourth amendment.
Yet, despite of being caught breaking the law protecting Americans, the NSA refuses to reveal the extent of this deliberate collection of Americans' data to either the Fisa court or Congress. The NSA did not provide such information in response to a request from the Fisa court, and the NSA has blown off Senator Ron Wyden's multiple requests by claiming that to do so would infringe on Americans' privacy and threaten its ability to conduct this collection. There are even hints that the NSA relies on a secret, fairly shocking DOJ opinion to conduct some of its cyber security collection.
In short, because the NSA has prioritized collecting vast amounts of information - and getting it in bulk, rather than based on particularized suspicion - and even preparing offensive attacks, it has taken actions that increase our exposure to network attacks, all while insisting cyber attacks are the biggest threat to the country. And that has enabled it to demand new authorities to protect against the attacks it has made easier.
Metaphorically, the NSA has pursued its search for intelligence by partly disabling the locks to all our front doors. Having thus left us exposed, it demands the authority to be able to enter our homes to look around and see if those disabled locks have allowed any nasty types to get in.
Given the way the NSA's data retention procedures have gone beyond the letter of the law to allow them to keep Americans' data if it presents a threat to property (rather than just a threat of bodily harm), while the NSA is looking for nasty types, they might also make sure you don't have any music or movies for which you don't have a receipt. Thus it has happened that, in the name of preventing invaders, the NSA has itself invaded.
President Obama has claimed he welcomes a debate about the proper balance between security and privacy - though it's not at all clear privacy and security present a real tradeoff. But there is a real tradeoff between security by defense and security by aggression - the latter as currently practised by the NSA.
With all functions of the NSA and Cybercommand under "big data" enthusiast Keith Alexander, there was no debate. He inherited the Bush administration's dragnet approach, and has made it his own, claiming - despite evidence to the contrary - each dragnet program has been critical for defending against terrorism. And that approach demands access to as much data as possible with minimal technical challenge.
But now, with the need to replace Alexander, Obama has an opportunity to consider defense over "big data".
At the very least, Obama should consider breaking out the NSA's defensive and offensive functions to create competing champions, one fighting to create holes, and one fighting to plug them. The Department of Homeland Security - an agency far better prepared to defend against threats - might be a better home for such a defensive function.
Preferably, the defensive function could operate transparently, with the ability and trust to share information about vulnerabilities. Sure, that might well result in the offensive fighters hoarding their data, even from those empowered to protect the country. But that, at least, would highlight the problem.
© 2023 The Guardian
Commentators have long recognized the NSA had two conflicting missions: one to defend key American networks, and one to collect intelligence on our adversaries. As Wired explained three years ago:
NSA headquarters ... in Fort Meade, Maryland, is actually home to two different agencies under one roof. There's the signals intelligence directorate, the Big Brothers who, it is said, can tap into any electronic communication. And there's the information assurance directorate, the cyber security nerds who make sure our government's computers and telecommunications systems are hacker- and eavesdropper-free.
The addition of US Cybercommand to this mix made things still worse: General Alexander has warned of attacks on the US's electrical grid that might rely on vulnerabilities similar to the ones the US exploited to attack Iran's nuclear program.
Documents leaked by Edward Snowden have exposed more details about how the NSA's dual missions undermine each other. The agency uses court orders to oblige Google to turn over its users' data under the Prism program, while finding ways around Google's encryption when compiling contact lists of unsuspecting Google users in collection supervised by no court.
While the NSA points to vulnerabilities of American business networks and communications, it works with companies to "insert vulnerabilities into commercial encryption systems" and "influence policies, standards and specification for commercial public key technology". Even as NSA and other national security leaders warn that cyberattacks (pdf) present the biggest threat to the country, NSA is leaving open or even creating vulnerabilities that our adversaries can exploit.
As security expert Bruce Schneier described:
Finding a vulnerability - or creating one - and keeping it secret to attack the bad guys necessarily leaves the good guys more vulnerable.
The NSA is violating the trust needed to accomplish its goal of protecting America's networks. The NSA has exacerbated this trust problem in a slew of ways.
Last year, Alexander donned a hacker costume and went to the computer security DefCon convention to schmooze hackers. While there, he made a series of misleading statements - denying the NSA collects data on millions of Americans - that set up James Clapper's more famous repetition of the same lie in March of this year. This year, Alexander attended Black Hat conference (this time, without a hacker costume) and warned of the "terrorist walk[ing] among us". That same day, another Snowden-leaked document revealed the NSA considered encryption - used by many computer security professionals - indication of a potential terrorist under Xkeyscore.
More recently, an illustration on a slide (pdf) reviewing the NSA's efforts to crack Tor - a sophisticated encryption system used by many security experts - identifies Tor users as terrorists. In fact, the NSA's minimization procedures allow it (pdf) to keep all encrypted communication, effectively targeting those who try to protect themselves. Effectively, NSA treats hackers, who should be key allies, as terrorists.
Corporations, too, appear to be growing wary of the NSA. Shane Harris reported that "many corporate participants" in an cyber security information-sharing effort say:
General Alexander's primary motive has not been to share what the NSA knows about hackers. It's to get intelligence from the companies.
Cloud storage and security firms worry about losing business to other countries or to private storage because of NSA's snooping.
The NSA has also proven unworthy of the general public's trust for a key scheme it wants to use to catch hackers. Alexander has sought the authority for the NSA to "live on the networks", copying and analyzing data that travels within the US to find any malicious code that might indicate a cyber attack. They already conduct similar analysis (in search of cyber attacks, but also terrorists) with data presumed to be foreign that nevertheless traverses the United States. Only after three years of conducting such collection did the NSA explain what it was doing to the Fisa court. In response, in a 2011 opinion (pdf), the court not only determined the collection had been deliberate (not unintentional, as the NSA and its defenders still claim), but had also violated the fourth amendment.
Yet, despite of being caught breaking the law protecting Americans, the NSA refuses to reveal the extent of this deliberate collection of Americans' data to either the Fisa court or Congress. The NSA did not provide such information in response to a request from the Fisa court, and the NSA has blown off Senator Ron Wyden's multiple requests by claiming that to do so would infringe on Americans' privacy and threaten its ability to conduct this collection. There are even hints that the NSA relies on a secret, fairly shocking DOJ opinion to conduct some of its cyber security collection.
In short, because the NSA has prioritized collecting vast amounts of information - and getting it in bulk, rather than based on particularized suspicion - and even preparing offensive attacks, it has taken actions that increase our exposure to network attacks, all while insisting cyber attacks are the biggest threat to the country. And that has enabled it to demand new authorities to protect against the attacks it has made easier.
Metaphorically, the NSA has pursued its search for intelligence by partly disabling the locks to all our front doors. Having thus left us exposed, it demands the authority to be able to enter our homes to look around and see if those disabled locks have allowed any nasty types to get in.
Given the way the NSA's data retention procedures have gone beyond the letter of the law to allow them to keep Americans' data if it presents a threat to property (rather than just a threat of bodily harm), while the NSA is looking for nasty types, they might also make sure you don't have any music or movies for which you don't have a receipt. Thus it has happened that, in the name of preventing invaders, the NSA has itself invaded.
President Obama has claimed he welcomes a debate about the proper balance between security and privacy - though it's not at all clear privacy and security present a real tradeoff. But there is a real tradeoff between security by defense and security by aggression - the latter as currently practised by the NSA.
With all functions of the NSA and Cybercommand under "big data" enthusiast Keith Alexander, there was no debate. He inherited the Bush administration's dragnet approach, and has made it his own, claiming - despite evidence to the contrary - each dragnet program has been critical for defending against terrorism. And that approach demands access to as much data as possible with minimal technical challenge.
But now, with the need to replace Alexander, Obama has an opportunity to consider defense over "big data".
At the very least, Obama should consider breaking out the NSA's defensive and offensive functions to create competing champions, one fighting to create holes, and one fighting to plug them. The Department of Homeland Security - an agency far better prepared to defend against threats - might be a better home for such a defensive function.
Preferably, the defensive function could operate transparently, with the ability and trust to share information about vulnerabilities. Sure, that might well result in the offensive fighters hoarding their data, even from those empowered to protect the country. But that, at least, would highlight the problem.
Commentators have long recognized the NSA had two conflicting missions: one to defend key American networks, and one to collect intelligence on our adversaries. As Wired explained three years ago:
NSA headquarters ... in Fort Meade, Maryland, is actually home to two different agencies under one roof. There's the signals intelligence directorate, the Big Brothers who, it is said, can tap into any electronic communication. And there's the information assurance directorate, the cyber security nerds who make sure our government's computers and telecommunications systems are hacker- and eavesdropper-free.
The addition of US Cybercommand to this mix made things still worse: General Alexander has warned of attacks on the US's electrical grid that might rely on vulnerabilities similar to the ones the US exploited to attack Iran's nuclear program.
Documents leaked by Edward Snowden have exposed more details about how the NSA's dual missions undermine each other. The agency uses court orders to oblige Google to turn over its users' data under the Prism program, while finding ways around Google's encryption when compiling contact lists of unsuspecting Google users in collection supervised by no court.
While the NSA points to vulnerabilities of American business networks and communications, it works with companies to "insert vulnerabilities into commercial encryption systems" and "influence policies, standards and specification for commercial public key technology". Even as NSA and other national security leaders warn that cyberattacks (pdf) present the biggest threat to the country, NSA is leaving open or even creating vulnerabilities that our adversaries can exploit.
As security expert Bruce Schneier described:
Finding a vulnerability - or creating one - and keeping it secret to attack the bad guys necessarily leaves the good guys more vulnerable.
The NSA is violating the trust needed to accomplish its goal of protecting America's networks. The NSA has exacerbated this trust problem in a slew of ways.
Last year, Alexander donned a hacker costume and went to the computer security DefCon convention to schmooze hackers. While there, he made a series of misleading statements - denying the NSA collects data on millions of Americans - that set up James Clapper's more famous repetition of the same lie in March of this year. This year, Alexander attended Black Hat conference (this time, without a hacker costume) and warned of the "terrorist walk[ing] among us". That same day, another Snowden-leaked document revealed the NSA considered encryption - used by many computer security professionals - indication of a potential terrorist under Xkeyscore.
More recently, an illustration on a slide (pdf) reviewing the NSA's efforts to crack Tor - a sophisticated encryption system used by many security experts - identifies Tor users as terrorists. In fact, the NSA's minimization procedures allow it (pdf) to keep all encrypted communication, effectively targeting those who try to protect themselves. Effectively, NSA treats hackers, who should be key allies, as terrorists.
Corporations, too, appear to be growing wary of the NSA. Shane Harris reported that "many corporate participants" in an cyber security information-sharing effort say:
General Alexander's primary motive has not been to share what the NSA knows about hackers. It's to get intelligence from the companies.
Cloud storage and security firms worry about losing business to other countries or to private storage because of NSA's snooping.
The NSA has also proven unworthy of the general public's trust for a key scheme it wants to use to catch hackers. Alexander has sought the authority for the NSA to "live on the networks", copying and analyzing data that travels within the US to find any malicious code that might indicate a cyber attack. They already conduct similar analysis (in search of cyber attacks, but also terrorists) with data presumed to be foreign that nevertheless traverses the United States. Only after three years of conducting such collection did the NSA explain what it was doing to the Fisa court. In response, in a 2011 opinion (pdf), the court not only determined the collection had been deliberate (not unintentional, as the NSA and its defenders still claim), but had also violated the fourth amendment.
Yet, despite of being caught breaking the law protecting Americans, the NSA refuses to reveal the extent of this deliberate collection of Americans' data to either the Fisa court or Congress. The NSA did not provide such information in response to a request from the Fisa court, and the NSA has blown off Senator Ron Wyden's multiple requests by claiming that to do so would infringe on Americans' privacy and threaten its ability to conduct this collection. There are even hints that the NSA relies on a secret, fairly shocking DOJ opinion to conduct some of its cyber security collection.
In short, because the NSA has prioritized collecting vast amounts of information - and getting it in bulk, rather than based on particularized suspicion - and even preparing offensive attacks, it has taken actions that increase our exposure to network attacks, all while insisting cyber attacks are the biggest threat to the country. And that has enabled it to demand new authorities to protect against the attacks it has made easier.
Metaphorically, the NSA has pursued its search for intelligence by partly disabling the locks to all our front doors. Having thus left us exposed, it demands the authority to be able to enter our homes to look around and see if those disabled locks have allowed any nasty types to get in.
Given the way the NSA's data retention procedures have gone beyond the letter of the law to allow them to keep Americans' data if it presents a threat to property (rather than just a threat of bodily harm), while the NSA is looking for nasty types, they might also make sure you don't have any music or movies for which you don't have a receipt. Thus it has happened that, in the name of preventing invaders, the NSA has itself invaded.
President Obama has claimed he welcomes a debate about the proper balance between security and privacy - though it's not at all clear privacy and security present a real tradeoff. But there is a real tradeoff between security by defense and security by aggression - the latter as currently practised by the NSA.
With all functions of the NSA and Cybercommand under "big data" enthusiast Keith Alexander, there was no debate. He inherited the Bush administration's dragnet approach, and has made it his own, claiming - despite evidence to the contrary - each dragnet program has been critical for defending against terrorism. And that approach demands access to as much data as possible with minimal technical challenge.
But now, with the need to replace Alexander, Obama has an opportunity to consider defense over "big data".
At the very least, Obama should consider breaking out the NSA's defensive and offensive functions to create competing champions, one fighting to create holes, and one fighting to plug them. The Department of Homeland Security - an agency far better prepared to defend against threats - might be a better home for such a defensive function.
Preferably, the defensive function could operate transparently, with the ability and trust to share information about vulnerabilities. Sure, that might well result in the offensive fighters hoarding their data, even from those empowered to protect the country. But that, at least, would highlight the problem.