[krek]

> NSA, which has been ~10 years ahead of private industry for the last couple decades, before which time they were even further ahead.

Do you have anything to back this up other than the old rumor that NSA (specifically their crypto) was ahead of private industry by 10 years, something even Bill Binney said is probably not accurate any more. And mind you, this old "10 year ahead" phrase was always specific about crypto, nothing else.

> In fact, I think it's likely that they're significantly smarter than any of us. Bear that in mind when you design your NSA-proof email applications.

I wouldn't bet on it. NSA and many other government agencies are full of incompetent or barely adequate people. Just look at our intelligence failures regarding terrorism and in both wars the last 10 years. NSA has a huge budget with billions of dollars to throw at their problems, so they get stuff done, sure, but smarter than private industry? Nah.

[tptacek]

Yes, I do have things to back it up. No, I'm not simply referring to cryptography. NSA is a very large organization; Bill Binney's say-so doesn't mean a whole lot to me. Look at the kinds of people that "graduate" from NSA TAO, and note that that's the program they let us know about.

If you want to be wishful about this point, I won't stop you.

[bazillion]

All of the truly remarkable intelligences I met, I met at NSA. There are certainly people that aren't (as with any organization), but the NSA is probably the only meritocracy in the USG. The pipeline for advancement is one of either taking a technical route or a management route. This means that you can reach the highest levels of the organization and pay grades simply by being good at what you do in an analytical sense or a leadership sense.

The thing that the average HN reader doesn't realize is how much responsibility is on the shoulders of those who choose to spend their time in service to the country (this could be for any country). I couldn't imagine the comments that I've seen about blacklisting former government workers and publicly shaming service men and women coming from anyone who has carried this kind of responsibility.

My sidelining aside, you're definitely correct about TAO people being very skilled. I would have definitely loved to join their ranks. They wanted to swap a couple bodies to trade for me, but my division head wouldn't let me go =\

[rdl]

I've met some genuinely sub-par-for-anywhere NSA people as well, though, although in the various letters which correspond to internal sysadmin support and the like.

If you believe government service has any value at all, you should also be willing to blacklist/ostracize when someone continues to support a corrupt/evil part of government. If I saw someone's resume from LAPD Rampart during certain years, I'd be quite suspect. Various foreign militaries. I'm suspect of CIA in the 1990s due to incompetence, not so much evil, DEA ~ever (which is lulzy because a lot of USG people at FBI and in LEOs in general moved from counterdrug to CT post-9/11), and while I think NSA pre-Snowden was quite defensible (and, indeed, honorable), I could imagine someone joining NSA today being viewed differently in a few years than someone who joined before.

[krek]

> I couldn't imagine the comments that I've seen about blacklisting former government workers and publicly shaming service men and women coming from anyone who has carried this kind of responsibility.

I think the 'activists' that were derided are also working hard in the interest of the country. As for blacklisting and shaming former servicemen, see the aforementioned Bill Binney, and Thomas Drake, former NSA workers who dedicated decades of their lives to their country, and were blacklisted and prosecuted by their own government for daring to blow the whistle about violations of the constitution and Americans' privacy rights.

[tptacek]

Bill Binney's complaint about the NSA was that they were wasting money on a system that did a poorer job of handling US-centric SIGINT. He was not himself opposed to collecting intelligence on US citizens; his own "ThinThread" system was designed to do exactly that, but with better technical controls over who could view the data.

The problem with the NSA's programs isn't that they lack technical controls; it's that they're allowed to supervise their own collection efforts and build their own controls in the first place.

The notion that Binney is a staunch opponent of PRISM-style surveillance is revisionist.

[krek]

> his own "ThinThread" system was designed to do exactly that, but with better technical controls over who could view the data.

That's plainly false. His system was specifically designed to throw-out private data, that is, never to store it. There is no data to view if it's not stored. See his 29C3 technical talk where he goes over it. [1]

>The notion that Binney is a staunch opponent of PRISM-style surveillance is revisionist.

This ignores nearly everything Binney has actually said when asked about why he came forward to blow the whistle on NSA's spying activities. Also, see above.

[1] https://www.youtube.com/watch?v=XDM3MqHln8U

[tptacek]

New Yorker:

Pilot tests of ThinThread proved almost too successful, according to a former intelligence expert who analyzed it. “It was nearly perfect,” the official says. “But it processed such a large amount of data that it picked up more Americans than the other systems.” Though ThinThread was intended to intercept foreign communications, it continued documenting signals when a trail crossed into the U.S. This was a big problem: federal law forbade the monitoring of domestic communications without a court warrant. And a warrant couldn’t be issued without probable cause and a known suspect. In order to comply with the law, Binney installed privacy controls and added an “anonymizing feature,” so that all American communications would be encrypted until a warrant was issued. The system would indicate when a pattern looked suspicious enough to justify a warrant.

But this was before 9/11, and the N.S.A.’s lawyers deemed ThinThread too invasive of Americans’ privacy. In addition, concerns were raised about whether the system would function on a huge scale, although preliminary tests had suggested that it would. In the fall of 2000, [General Michael Hayden, the director of the N.S.A.,] decided not to use ThinThread, largely because of his legal advisers’ concerns… .

I'm sure it discarded some things, but the basic technical control that ThinThread appeared to have that Trailblazer (and PRISM) lacked is cryptographic authorization controls.

[krek]

> Yes, I do have things to back it up.

Such as? Bill Binney, having actually been one of the top mathematicians at NSA for 30 years, carries more weight than you do, unless you want to share specifics that back up the regurgitation of the "10 year ahead" phrase.

[rdl]

Binney and Wiebe left NSA at what I think was the low point of the agency, after losing political battles internally and getting marginalized.

TAO, the shift to attacking IP networks, the shift to active attacks on commercial technologies (vs. spending years to defeat a decade-long-lifecycle foreign comm or cryptosystem), etc. mostly happened after they'd left.