[paulluuk]

After reading "Permanent Record" by Edward Snowden and "Cult of the Dead Cow" by Joseph Menn, I can't help but feel like the NSA is basically "the bad guys", and I assumed most hackers would feel the same. Are people really excited to do challenges like these for them?

I don't mean that in an accusatory way, just genuinely curious as my perspectives (one from a whistleblower and one from 80s hacker culture) are obviously not the same as those of a modern day hacker.

[jjtheblunt]

I'd recommend reading James Bamford for a more positive look at NSA and their charter...which is essentially math, math, and more math, and unrelated to politics within NSA anyway.

The Snowden stuff is extraordinarily excerpted to that which a contractor (Snowden) was seeing in a post 9/11 strange fiasco which did bring politics into play. Bamford predates that mess.

Here's a link, for example.

https://a.co/d/eMTidtP

[tptacek]

NSA is an enormous organization with many chartered activities, some small amount of which involve math, some of which is defensive and benign, some of which is offensive but understandable in the same sense our maintenance of a fleet of nuclear-powered aircraft carriers, and some of which is probably hard for anybody to get comfortable with (much of which should be halted). A lot of what NSA does is ultra-boring, and some of that should be halted too. Like every major federal government bureaucracy, NSA's most important charter is to secure more budget for NSA (which I maintain is actually an important fact to keep in mind when designing technical security countermeasures).

My point being: be wary of any attempt to characterize NSA in just a sentence or two.

Some of this puts me in mind of people's mental model of NIST as a hive of USG cryptologic activity when it is in reality like 3 very overworked cryptographers and a bunch of project managers. (Someone correct me on this, and then reach out about being on the podcast).

[jjtheblunt]

Have you been in Fort Meade? The Bamford books are much longer than a sentence.

[rcbdev]

> The Snowden stuff is extraordinarily excerpted to that which a contractor (Snowden) was seeing

I highly recommend you read his autobiography. The typical Beltway career in IT is getting clearance and then coming in as a contractor, there is nothing out of the ordinary here.

Adding to that, he was directly employed by the CIA from 2006 to 2009. The "contractor" line is a really sad attempt to discredit him.

[jjtheblunt]

The point is not discrediting but scoping what he was involved in, which for example does not intersect a different area I know personally.

[ziddoap]

While I don't really like the NSA, I certainly respect their expertise.

And their expertise is exactly what makes a challenge like this difficult and fun.

[tptacek]

I would love to hear more about how Menn's book about a clique of nerdy teenagers shaped your opinion of NSA. (Some of those nerdy teenagers are friends of mine; we were nerdy teenagers of the same vintage. I'm not dunking on them.)

[sneak]

You’re right. The US IC has shown time and time again that they have no moral compass, no regard for the US Constitution, and no regard for human rights or the rule of law.

That said, neither do a lot of hackers. There is a long history of collaboration between hackers and the military-industrial complex. Silicon Valley is Silicon Valley because of the DoD. And the director of the NSA once gave the keynote at DEF-CON.

Even the best hacker movie, from which I take my nick, ends with the hackers assisting the NSA as if they are the good guys. :(

Intelligent people like Snowden don’t become as deep into the NSA as they are without a whole lot of “good guys” propaganda for many years first.

[jonnybgood]

I’m sure you’re aware of this but Snowden wasn’t in the NSA. He worked for a contractor to manage their IT.

[StrauXX]

He was both! Initially working for a contractor, then for them directly. He may have again gone back to a contractor afterwards.

[tptacek]

My understanding is that he worked for some time at CIA, but never directly for NSA.

[throwaway48476]

It doesn't matter which 3 letter agency is violating the constitution. They all need to stop.

[tptacek]

Yes. Only the 4 letter agencies are allowed to do that.

[sneak]

That’s a distinction without a difference. He was directly CIA for a bit, and went through the revolving door to a contractor who was placed at the NSA. It really doesn’t matter which corporate entity’s name is on the pay stub; it’s all the same public-private scam. Whether or not Booz gets a percentage of the tax money firehose for running the payroll or not is of no import.

All of this is covered in his book, which is a decent read. I recommend it because it’s information dense and quick.

Furthermore, I said he was deep into the NSA (which he was), not that he was employed by them.

[YinglingHeavy]

Someone isn't Comms Aware.

Biggest event of 2013: Snowden.

Biggest film of 2013: Frozen (Let I.T. Go)

Biggest game of 2013: Last of U.S.

The NSA was effectively blinded for a period of time. Do you think bad actors didn't take full advantage of this? Where did Snowden work prior to NSA? Why doesn't Julian Assange have a Hollywood film?

[ricksunny]

>Assange film

The Fifth Estate.