Comment by adrianmonk | Hacker News Reader

Comment by adrianmonk | Hacker News Reader

Parent Full thread

Theoretically, the NSA has a dual mission:

1. Gain access to information where that would be in US interests.

2. Protect US information from being accessed by others.

From their web site ( https://www.nsa.gov/about/faqs/about-nsa-faqs.shtml ):

> NSA/CSS has two interconnected missions: Signals Intelligence (SIGINT) and Information Assurance (IA). Through SIGINT, we respond to customer requirements for information relating to the plans, intentions, capabilities, and locations of foreign powers, organizations, terrorist groups, or persons, or their agents, who threaten America’s national security. Under Information Assurance, we protect our nation’s vital national security systems and information from theft or damage by others.

Whether you trust them is another question. Many argue that this dual mission creates an inherent conflict of interest. But if you believe they take both halves of it seriously, you might see them as having a legitimate interest in ensuring good crypto is available. (I'm not advocating for that position, but it doesn't seem totally irrational to me either.)

When I looked at it, they were only required to protect defense systems. For civilians, they had no strong, legal requirements. They did have a mandate to spy on them, though.This is why you can't get ahold of their TEMPEST- or Type 1-certified gear despite the nation's enemies using attacks those block with high confidence. The stuff they recommend is the stuff rated by them to be easy to moderately-difficult to attack.

So, dual nature is misleading unless you're a defense contractor or agency. The SIGINT group has all the money, power, and executive backing. That last part means even IAD's honest folks will get overruled at some point forced to compromise somehow. There's definitely people trying with the security guides, funding things like Cryptol, and so on.

Yes, in theory. In practice, they've proven they are much more interested in everyone having vulnerable computers vs everyone having super-secure virtually unhackable computers.

This "dual-mission" thing reminds of some tv networks presenting "equal sides" on a debate on climate change. In 99% of the cases, the NSA will choose to keep its vulnerabilities for computers rather than try to fix or disclose them.

This comment doesn't really add anything to the discussion; it simply restates the concern that started the subthread.

Reply on news.ycombinator.com