Massive turnover, which is what events like this create, works directly against the goal of securing more headcount: it means they're spending a big chunk of their recruiting energy just retaining the headcount numbers they already have.
Headcount is one of many metrics that can constitute success and eventual promotion. I posit that giving flashy results to customers is the #1 best way for a particular executive to make a name for herself and advance. FBI is a great example of this, constantly attempting to make splashy headlines; it presses its advantage of being able to go to the press.
I've only seen headcount increase in response to what WH, ODNI, and Congressional intelligence committees view as crises. Headcount shuffles away for objectives that aren't considered sexy, e.g. Russian linguists and analysts in the late 1990s-2000s.
To me and for the kind of work I do, this has important implications: it means that you shouldn't do things to make it harder for NSA to do their job (that's just feeding them, just like feeding in DOTA or LOL) --- you have to make things intractable for them.
Intelligence agencies are lead by people. Those people have motivations that inform their decision-making. Prestige, power, increased income, and (often, but not always) patriotism are, in my opinion, their primary motivators. This should for the most part be similar for any corporate executive.
Unless there are hard metrics tying headcount to performance reviews and promotion considerations, and simultaneously soft-power incentives for having more headcount, then other things will dominate. In the military, splashy achievements dominate. Or at the minimum, making your boss and your boss's boss like you is essential.
The current NSA chief didn't get his job because he was in charge of the largest Fleet. He got it by networking, seniority, luck, and having a reputation for excellence (I do not know if it is deserved). The same can be said about civilian executives in the IC, who are rated in a more arduous, more holistic manner.
Your bottom line is correct in the specific case. If a Latacora client is targeted by the NSA with high priority, you cannot protect it unless you make it intractable for them. For the rest of us, using boring commodity mitigations, such as TLS and MFA, and sound network architecture are fine. Intractable-for-all is a noble effort, but I don't think it's realistic.
Huge flaw in this reasoning- the fuzzbunch stuff was patched before it was leaked. Russia leaking recently-burned tools makes a lot of sense.
If this is true, I expect the CIA and/or other agencies will have gone into defense mode and tipped off the relevant vendors, giving details of vulnerabilities they either know to be leaked or have observed to be used in active attacks.
In doing that, I can't really see the CIA revealing any more than is strictly necessary, and to a very limited set of people. Certainly not dumping a whole load of compromising material to Wikileaks.
Couldn't it be to their advantage to purposefully leak a bunch of outdated and not-so-special tools (i.e. Notepad++ dll hijack) to misdirect their adversaries as to their real capabilities?
"Nobody got fired and jailed for leaking CIA tools." Except, probably, anyone who ever did.
I would never make it in government.
It makes perfect sense for an adversarial nation's intelligence agency to undermine the CIA and Americans' trust in their own government.
America is too far away from its rivals and enemies for a conventional war to be fought on its own shores. It makes more sense to use fear (9/11) and propaganda (your CIA is spying on you!!) to get Americans at each other's throats and distracted from the real threats to their wellbeing.
After all, our political parties have been doing that for my whole life, so the groundwork laid is practically an invitation.
On the other hand, it's already pissed us off something fierce, and I think the narrative in the mid-term future will ultimately be one where would-be adversaries decide they don't want to be the next poor soul to be made an example of.
I agree with your comment in general, except for its confidence in U.S. military capability. Though it would be unlikely for a battle to be waged on U.S. soil, other theaters offer plenty of opportunity for a U.S. loss, especially those that diminish traditional U.S. advantages (such as air and information superiority).