But I wouldn't call this guy the NSA's chief hacker. He only took over that department in 2013, after more than two decades at NSA. He is a manager, not an agent. His practical knowledge is limited to what he has been told and has bothered to read. You don't get to be head of a department in a spy agency by helping the public avoid spies.
Was that because you knew about interdiction or the fact that a 3rd party might have no security? ;)
"He only took over that department in 2013, after more than two decades at NSA. He is a manager, not an agent. His practical knowledge is limited to what he has been told and has bothered to read. "
That's probably true. In that case, though, he'd still know they attacked stuff lower in the stack, did implants, used radar, etc. It's in the basic catalog. How much he'd understand I don't know. That he neglects their methods of hitting hardware or getting physical access suggest he's misleading intentionally.
"ou don't get to be head of a department in a spy agency by helping the public avoid spies."
And that's why. I thought at headline that the guy would have to be a defector or new whistleblower if we were going to get anything out of this. He still works there? And is helping us stop TAO? Who buys this kind of BS...?
Because the interception of data flowing between data centres was/is the backbone of the prism program. NSA has access to he fibre over which those backups will travel.
That is part of what prism was tapping, data moving between google-owned data centers.
Tape comes with its own set of problems.
"A contractor working for the US Secret Service walked onto a Washington, DC Metro train carrying two tapes full of extremely sensitive data. He got off at his stop carrying neither. "
https://nakedsecurity.sophos.com/2012/12/10/secret-service-s...
So, your best case is to build something that barely functions by modern standards but still usable. Here's you some inspiration:
Good security model to start with to leverage existing code:
So, my framework and counter to the NSA guy doesn't just apply to the NSA threat. It applies to foreign, nation-states too. The barrier to entry, esp for non-app attacks, is lower than ever with even hobbyists publishing attacks on the net due to seemingly no effort at device- or router-level security.