Exactly this. The US government thinks about computer security as a kind of war - cyberwar - and for better or for worse it has adapted the mindset that "security by demonstrated capability to drop scary bombs with brutal precision and efficiency" is more realistic than "security by making every building bomb proof."

Geopolitics these days isn't about impenetrable borders, it's about deterrence by ability to project force. They are looking at IT security the same way.

Re-orienting the NSA's mission to focus on improving security through public research and technology transfer (like SELinux) is the most viable option for stopping the current arms race. There seem to be a shortage of people at the NSA who have the visionary power to imagine a future in which computing is secure. Which is a shame, because it is a future we can realize; the building blocks are here.

As other people touch on, a good offense is something the NSA can actually do themselves. They don't have the authority to be a good defense. They had - and have - no ability to compel OPM to get their shit together.

In terms of defense, they've got a severe case of Congress-induces toothlessness.

Here's the kicker, technically NSA can't even do offense (attack). That's what US Cybercom is for. The NSA primary missions are SIGNIT and IA as a combat support agency. So they can gather information on foreign adversaries (and defend DoD networks), but they don't have the mandate to actually perform cyberwarfare. Or for that matter defend civilian networks against attack.

NSA and USCC is a distinction without a difference. They've even got the same head honcho.

Both organizations focus on similar concepts (after all exploitation and attack are two sides of the same coin). But there is a legal distinction which is important. NSA legally cannot do all that CYBERCOM can do.

You're absolutely correct, it's legally a massive difference. In practice, they're more or less the same people groups of the same people.

So I tend to view the distinction between the two as something of a legal fiction.