NSA is also responsible for establishing computer security practices for the rest of the government to follow. That they don't eat their own dogfood is damning.

They do typically eat their own dogfood when it comes to the security practices they propose. Dual_EC_DRBG is the big exception, but it's generally considered that most of the rest of their cryptographic standards are secure and suitable for public and government use.

There are likely many conflicting departments and teams within NSA. Many are probably trying to fight for the public's security and have for years, with cryptographers earnestly trying to develop secure and efficient algorithms. They are probably at odds with the other forces in the organization that seek to play the espionage game, even if it puts the country at risk.

> Many are probably trying to fight for the public's security and have for years, with cryptographers earnestly trying to develop secure and efficient algorithms. They are probably at odds with the other forces in the organization that seek to play the espionage game, even if it puts the country at risk.

Directly at odds. I don’t believe you should encourage anyone to trust known espionage. If it’s good advice, someone else will say it too you can trust independently.

We should also keep in mind that finding an exploit or two is much easier than making sure that nothing on your network can be exploited. I wouldn't expect even the best in the world to be able to thwart all attacks.

> Focusing on one of them doesn't automatically benefit your efforts on the other.

Uh, yeah. It isn't saying, "why did defense fail to automatically follow from offense?" It's literally just saying they failed to protect their own network, whether technically or organizationally.

I don't think I see it that way.

If you have the best then you should test your systems against being exploited by the best. And then harden from there. If you have the knowledge - knowing you're a prome target- why not double its value?

As it is, their approach strikes me as one of arrogance, or (ironically) lack of intelligence about foreign threats, or worse...both.

Both is not what we're paying them for.

The hope is that one's level of expertise in those areas are correlated.