Slightly off-topic but I also tried to watch "Zero Days" since the subject interest me. But, with the constant exaggeration and dumbing down of the subject, I could only watch about 20 minutes before I turned it off.

If you want something technical that is not exaggerated, you better watch something else. If someone have an recommendation, please share.

I recommend sticking through till the end. The first 20 minutes just sets the scene - the story gets a lot more interesting once it links up the technical stuff with geopolitics and the relationship between US & Iran, and what they did to the centrifuges.

The last part has some insightful commentary by a number of experts on the new world of so-called "cyber warfare" that we're entering into.

The book '@War: The Rise of the Military-Internet Complex' by Shane Harris from The Daily Beast is very good and talks about the obsessions with offensive weapons. And the embarrassingly bad defensive posture the US has via policy failure (ie: focusing on private-public info sharing deals that do nothing, instead of real defence) and inter-agency fighting.

https://www.amazon.com/War-Rise-Military-Internet-Complex/dp...

> focusing on private-public info sharing deals that do nothing, instead of real defence

Can you elaborate? I haven't been exposed to any ideas that address this without compromising civil liberties.

That is, "real defence" sounds like the government monitoring internet connections to my company for malicious activity. I don't think that's good for business.

I might be thinking a little close-minded about it though. Please share what you mean.

It's been a couple of years since I read @War, but ISTR it described interactions between public officials and private industry that were explicitly more about politics and marketing than they were about security or risk management. E.g., NSA set up public-private dialogues with tiered access, then tantalized executives with off-the-record-but-in-a-meeting-also-attended-by-other-companies reports of server pwnage, to motivate them to sign up for the next, more stringent tier of cooperation. If the idea really were to improve security, the same information could have been distributed in truly private fashion. Also, NSA could acknowledge that private security firms are generally more helpful to companies than NSA is, and simply transfer their knowledge, when appropriate, directly to one or more NSA-vetted firms. The public actions of TLAs described in that book were far too entrepreneurial, in the sense that they didn't care what they did or what effect that had, so long as they were in the middle of everything to demonstrate their budgetary importance.

Thanks! It appears that the real problem is in the supremely suboptimal execution of a potentially acceptable vision.

I'm not sure how much explanatory power your summary has: couldn't that be a description of any government fuck-up? b^)

have you read Countdown to zero day: https://www.amazon.com/dp/B00KEPLC08/ref=dp-kindle-redirect?... ?

It is ultimately penned for the masses, but even if you're technical you'll likely enjoy it. And there's plenty of scope for going off and doing your own research about bits and pieces.

A fire that they are showing they do not know how to control.

They do not know how to perfectly control it. Given the obviously huge scale at which they operate, it seems to work reasonably well. Yet the huge scale is exactly what scares the socks off of knowledgable people - even more than a fire here and there. Their PR problem is that the number of times they successfully work in the dark is somehow confidential...

You have got it right there! Breaking into a system is easy keeping yours intact is not. That is part that the US GOV still doesn't get the defensive part of the equation. BS (Before Snowden) people suspected but now we know people are listening everywhere. And even the NSA is not immune...that is scary that no matter how good your InfoSec is that your IA is lagging far behind.

It's the consequences, not their size.

"Look, we've put off 99.9% of the fires we started last week. Your complaint about we completely burning 2 cities down is baseless, you can't reasonably expect our fire-control to get any better."

Question: Does the NSA have an obligation to be ethical?

They swore an oath to protect the Constitution.

https://www.law.cornell.edu/uscode/text/5/3331

They even reaffirmed it late last year.

(sorry for the google cache link; www.nsa.gov (AkamaiGHost?) is currently returning 503 Service Unavailable)

https://webcache.googleusercontent.com/search?q=cache:-yz7S-...

I would argue yes, in the sense that all of us do (both in our professional and personal lives). The US likes to promote itself as the "good guys", and if they want that reputation, they have to earn it. NSA's activities are in direct conflict with that ideal.

Society only functions properly when people act ethically. We have laws in place for punishing those who harm others in various ways (financially, physically, etc.), as a means to discourage bad behaviour. In theory there's supposed to be international law, but sadly no-one seems to pay much attention to it.

I would only add that the NSA has politicized themselves in exchange for the expansion of their powers. Now as a political entity it seems they have a much lower standard of ethics and now it is about maintaining power.

Does anyone on earth not have an obligation to be ethical? (Yes, I know there is no universally accepted definition of "ethical".)

Yes, I don't. Because when you say "act ethical" you mean "do what pleases me". This is why you can't put forth a definition, because if you did, it would expose your hypocrisy.

And I'm not one bit interested in doing what pleases you. I'm only interested in doing what pleases ME (as is every other person on Earth, although most will never admit it out of cowardice).

So no, I don't have ANY obligation at all towards you.

Now, is it in my best interest to treat you nice and contribute to your well-being? Yes, in most circumstances I'd have to admit that it is.

Have a lovely day!

That's pseudo-intellectual hobbelgoggle.

"Pleasing" deals with emotions, so we can drop the facade of hyper-rationality right there. Cooperation is beneficial for an itdividuums' survival, as you rightfully state. It is indeed of such importance that the standards of cooperation have been internalized long ago – for non-sociopaths, altruism is an end in itself and creates positive feelings.

And if you insist on your way of looking at it you actually stopped half-way: what "pleases you" is /also/ just a useful heuristic to maximize you reproductive success. The warm feeling you get from winning the lottery is no more or less real than the warm feeling (other) people get when they see someone happily getting married.

For this whole system the borders between the individual and the group are fluid. While certainly, all else being equal, the individual's need usually trumps the group's, it is anything but clear-cut in most real scenarios. You may be willing to sacrifice someones life to save your own, but that can change if the other person is you daughter, when you get to old age or when it's not a 1:1 sacrifice but merely an assumption of a non-zero risk of death.

Calculated actions that take emotions into consideration seem pretty "hyper-rational" - you acknowledged as much with examples.

> ... but that can change if the other person is you daughter ... old age ...

It isn't as complicated as you're making it out to be, the decision made by the individual depends on the maximization of their goals. So that depends on the weight they assign to the importance of genetic immortality, reproductive years remaining, justice in an afterlife, etc. Sure, not everybody is a perfectly rational actor applying game theory in their daily interactions, but individuals are much more self interested than you're describing - even with family.

I don't really disagree that all human actions have self-interest as the core motive. I'm just saying that in an interdependent social environment, a phenomenon best described as altruism naturally emerges, either because instincts initially developed for self-serving purposes develop a life of their own, or because the still-existing individual benefits are obscured (i. e. a sort of game-theoretic justification for a middle class person to support welfare).

I'm mostly taking offense with the characterization of such "feelings" as "not real" or of lesser value than the "pure" thought of rational egoism:

1. If we take altruism as a highly developed extension of egoism, it's worth to consider it an invaluable heuristic trained over thousands of generations to intuitively make good decisions. Where a cold analysis may tell you that giving money to a poor person is wasteful, I'd say that the warm fuzzy feeling we get from giving is an encoding of results gained over millennia of experience.

This also touches another point: I'd suspect that most altruistic behaviors are actually net-negative for the individual but, when practiced by large parts of the population are beneficial for everyone. Here, emotions serve as a prehistoric solution to the tragedy of the commons. It's an idée fixe in some circles, most notably libertarians and the Ayn Rand crowd to replace this with a system of contracts or simply force but that disregards (amongst other things) that almost no idea in psychology has more empirical support than the beneficial effects of helping.

2. If we consider altruism as an emergent behavior, a sort of instinctual moral code, it should be revered as one of the highest achievements of humanity on a level with art or science.

> ... "feelings" as "not real" or of lesser value ...

Well without getting into value judgement, you seem to be on board with the idea that emotions are a much higher level of abstraction above the cold logic of genetic survival. I'd welcome an emotional appeal in a public policy discussion as much as I'd welcome a javascript based boot loader. There is a time and place for everything, but emotion is given far too much weight.

Altruism is by definition a net negative for the individual, and I agree that it is very likely deeply rooted in our gene pool. But I certainly wouldn't hold it up as any kind of great achievement, especially considering how frequently it is exploited as a weakness by those in power ("think of the children"). I don't know if we'll ever get to the point where it can be considered a vestigial adaptation, in the same way we have unused muscles for controlling the orientation of our ears, but I hope that one day we'll be able to survive without the genetic compulsion to self-sacrifice.

It has been a long time since I gave Ayn Rand any thought, but your characterization seems pretty far off the mark to me. Have you read her books? She hated libertarians, the use of force, and she didn't want to replace altruism - she wanted it gone. Her reasoning is pretty well founded, as history is full of well intended and ill-conceived calls for sacrifice - the road to hell is paved with good intentions, etc. As far as contracts... I'd love for the world to have that level of clarity. That is why the US is such an attractive setting for business vs many other well developed economies (Mexico for instance), businesses hate uncertainty.

> I'm only interested in doing what pleases ME (as is every other person on Earth, although most will never admit it out of cowardice).

This simply isn't true. Humans engage in many self sacrificing behaviors for a variety of reasons. We're a social species with complex instincts and tendencies in how we form groups and collaborate. People who understand humanity is not a cartoon of individual self interest are not cowards.

Quite the eloquent rebuttal. You've swayed me with your words.

Pretty much right, you don't need a religion or code of conduct to tell you not to be a dick. With the NSA, and many other agencies and organizations, a culture of ends justifying means is highly contagious. Human nature and our reasons for being decent moral persons and speaking the truth instead of a lie, always has some threshold defined by our world view and beliefs. When you deal with scumbags all day, those pesky rules and rights are just in the way of justice some times.

This is a circular question. One's obligations derive from one's ethics.

Yes, noone does. You are not bound by law to be ethical. There's no law about it. Are you _supposed_ to act ethical? absolutely. but you dont have an obligation

Legal obligation being the only possible meaning of "obligation", obviously.

When the best thing you can say about your position is it's not literally illegal, you should probably stop digging.

The naive point of view would be that if you're an American citizen the NSA agents are supposed to be YOUR employees so they have an obligation to be whatever you ask them.

They are indirectly doing exactly what the citizenry have asked them to do. It's just that the HN community (and me) don't agree with it.

1. The most pressing issue for debates is terrorism response. [1]

2. Lawmakers and the Executive are elected on this mandate and spend significant resources (estimated $100Bn per year). [2]

3. The NSA performs all of its functions based off of requirements generated by ODNI, DoD, the Chief Executive, and congress. [3]

4. Most individuals care deeply about privacy and think there should be greater limits to what the government collects. However, less than 10% have changed their habits to improve their privacy posture. I conjecture that this suggests that privacy is not a priority compared to physical and financial security to most citizens. [4]

In this case I think it is fair to say that the best interests of American society and its economy are being thwarted by security concerns of a plurality of citizens. The right course of action is for privacy debates to be publicized. The Pew report referenced in #4 shows a far greater skew toward privacy action after being informed of government and commercial surveillance.

[1] http://www.pewresearch.org/fact-tank/2016/08/15/in-debates-v...

[2] http://money.cnn.com/2015/11/16/news/economy/cost-of-fightin...

[3] http://fas.org/irp/offdocs/int023.html

[4] http://www.pewinternet.org/2015/05/20/americans-attitudes-ab...

Please comment civilly and substantively on HN or not at all.

Please pardon if my comment came off as uncivil. My intent was to illustrate the potential ambiguity of ethics in national security issues by quoting a speech of Col. Jessup (Jack Nicholson) from a "A Few Good Men". I saw the message of Jessup's tirade as parallel to the discussion topic and as illustritive commentary on the ethical boundaries of the NSA. Who defines those boundaries and in what context? Military, intelligence, or civilian? Peacetime or a time or threat? While the emerging activities and powers of the NSA concern me, I do not believe the agency is inhabited by evil people, but rather by people that believe (correctly or not) that they are playing a key role in protecting our nation. Their ethical boundaries are likely defined by the context of the threats that they encounter during their work. Some may believe that the critique by some nerd at a computer(me), who is ignorant to many of those threats, is ironic and a demonstration of the freedom that they protect. I did not intend to disrespect HN or it's users as this a informative and entertaining forum which is a daily stop for me. In retrospect, I probably should not have used all Caps, and I should have placed an explanation along with the quote.-Respectfully, Vibrio

>and may make it out into the public for anyone to take advantage of.

Why would they do that? Its more likely they'll be kept for other attacks or sold to nation states for vast profits.

I also suspect there's nothing magical going on at the NSA. Whatever zero days they have are probably had by other intelligence agencies and hacking groups. Whether to report them publicly is a political decision that these groups have zero incentive to make. Ethical researchers and white hats, from my understanding, are a very small part of the scene, or at least the part of the scene that gets real results.

Their adversaries likely won't make use of the tools for anything serious. They know the NSA already have detection capabilities for their own 0days, and using these tools is a dead giveaway to the NSA that they've been made. An adversary would do well to be very careful about their use of stolen knowledge.

As for it hitting the public like this; I'm not sure we'll see this happening incredibly regularly.