There was a time when the NSA was in the white hat business; securing networks, identifying vulnerabilities and contributing to net sec projects. SELinux has been their most famous contribution. This all changed with the war on terrorism. Finding and exploiting vulnerabilities was the mission.

> There was a time when the NSA was in the white hat business; securing networks, identifying vulnerabilities and contributing to net sec projects. SELinux has been their most famous contribution. This all changed with the war on terrorism. Finding and exploiting vulnerabilities was the mission.

No, they've always had both roles. For instance, their experience and knowledge of advanced code-breaking techniques allowed them to strengthen the DES cipher's S-boxes in ways that weren't publicly understood until decades later.

https://en.wikipedia.org/wiki/Data_Encryption_Standard#NSA%2...

It hasn’t changed. Why you’re referring to falls under Information Assurance in their mission statement.

Exactly. It tends to not make the news, but it's all there still.

If we assume they're "there still", TFA seems to indicate that they could be doing a better job?

The CIA has a tendency to do its own thing, and the NSA found the vulnerabilities. To my mind, this suggests that the NSA is competent at their job when allowed to do it. Further, the CIA could stand to benefit by allowing the specialists at the NSA to perform their function rather than trying to replicate it in-house.

This is naught but my opinion, and I understand where others might differ in their reading of the situation presented to us.