I agree that the security environment is awful, but that doesn't excuse NSA making it worse.
The whole industry and economy needs to be upleveled software wise in a lot of ways for meaningfully better security to be economically possible.
Typically that requires a serious crisis and/or war. Hopefully not the case here.
Of course it does. Thinking about it in terms of ROI doesn't consider externalities. When the OPM gets hacked, nobody at the NSA worries about their budget.
Reason #7893 "run government like a business" is a self-describing category error.
The underlying issue is that large organizations have low trust (some worse than others!), and therefore large organizations tend to coarse numeric metrics, and game those metrics to look better, which makes even more low trust (and hence backstabbing, empire building, etc.) between divisions.
As a reaction, leadership also tends to err towards coarse, harder to game metrics (like ‘reduce breaches by xx%’ rather than relying on judgement and trust like ‘ensure we don’t have an unreasonable number of breaches, and work to reduce them in the ecosystem’.
Which of course provides strong incentives for chasing the number by throwing all the babies out with the bathwater, and often making the real problem worse.
It’s a size of the organization problem. Changing metrics/mission will shuffle up the specific babies being thrown out, and what is considered the bath water, but the underlying problem remains.
Solid, consistent leadership makes the problem better. That tends to be expensive and not want to deal with the political BS common in Gov’t, at least in the US.
If you think tech workers have office BS to complain about, gov’t workers are at least 10x higher on the scale.
Someone looks at it and goes ‘yeah, that might pay off’ or round files it somewhere.
Researchers who never end up finding anything notable also don’t tend to have long careers, correct?
The crazy amount of skepticism this always draws is simultaneously very funny and very saddening.
What percentage of the overall budget do you think it is?
Knowing what your adversaries are up to is invaluable.
> No it's just that the NSA used to work to make American companies more secure
1. I'm interested in that history; e.g. how it came about and how it worked.
2. Evidence that this is no longer (or less of) a goal: policy, internal priorities, spending? Congressional testimony, legislation, or guidance? Leaks?
Indeed. Once you start talking about magical constants and extremely convoluted math concepts... that's zero trust in my book.
Integer factorization is a grade school concept in most developed nations. The edge cases are far more obvious than with something like ECC, which has entire classes of no-good constants that would require a PhD in math to fully grok.
It's gotten so bad, that their recommendations for crypto are regarded with a significant degree of skepticism because of past history of deliberately undermining crypto systems which is a Terrible state of things.