No, Intel agencies have always been too powerful and Truman saw it when disbanding the OSS (Office of strategic services) after WWII. Then, he begrudgingly created the CIA to compete in the cold war.

They've always undermined American security so they could have more information and power.

I don't have references, apologies, but in the 90s and 00s there were reports of NSA making polite suggestions to private companies to improve their cryptosystems and secure crucial infrastructure. That advice was always viewed with suspicion and verified, but was often genuinely helpful. Over time NSA started using that influence more and more to implant back doors. Dual_EC_DRBG is a particularly well documented example. I assume now most companies absolutely don't trust the NSA as a partner in designing security systems since they have worked so often to undermine them.

Do you think trust in the agency depends on who was heading the NSA at the time? This is something I'm increasingly curious about with all the US Alphabet Agencies since they are appointed positions.

And, I would add, how does that position SELinux?

> It used to be the US government worked to secure American communications.

When was this? As far as I remember (but I'm not that old to be honest), it seems to mostly been about the US government making sure the government has secure communications, while the rest get to fend for themselves.

Fend for themselves, and if they don't cooperate with the wishes of the TLAs they get legal trouble nobody could possibly afford. And if you end up in the secret FISA courts, you basically can't get legal representation because it's secret, or ever really talk about it. Also there's no real oversight for this stuff because it's that secret.

Not to be that guy, but if you're going to drop conspiracy theories on HN, you need to cite your sources. Less hand waving and more fact checking.

What part of the claim in question do you feel is conspiratorial in theory?

I know there’s a mechanism for 3 letter agencies to get a warrant allowing them to break into insecure hardware owned by US citizens and companies, to patch said vulnerability.

The FBI did that recently[1]

[1] https://www.malwarebytes.com/blog/news/2024/02/fbi-removes-m...

Both statements are simultaneously true.

The goal is to protect the physical and institutional USA (and equivalent for other countries' intel agencies); this requires making sure there's no successful conspiracies, from within or without, to destroy it; this requires all the things we here all agree are bad for digital security, including the security necessary to running e.g. electronic banking ledgers or votes.

I don't have any actual solutions here, that's just a description of the problem space as I understand it to be.

There's a bunch of US agencies sponsoring Tor, presumably to undermine hostile governments, even though there's also US agencies trying to subvert it.

^ this guy is about to learn about the crypto wars.

You misunderstood "American security" to mean "security of Americans" instead of the intended meaning "security of the American regime"

you are not wrong, but this has always been the case, from the earliest times. Similar problems with the institution of the military. It calls for moving past the initial indignation, and engaging somehow.. otherwise you get the government you deserved, as they say.

That has always been the case. The danger is accepted for additional capabilities. The alleged security is pure propaganda.

"That there is no safe backdoor" has more or less been the statement of any expert on the topic. In a time we still had experts since security consultants of today are often as shady as the scammers trying to get access to your data/system.

I have heard several anecdotes going back the last 15 years from folks who have had surprise meetings or phone calls with the FBI to inform them that some of their IT infrastructure had been compromised by foreign actors.

In each case the FBI wanted to keep the breach open as a honeypot so they could investigate the bad actors, regardless of considering the cost to the business of continuing to leak data about their products/customers/employees.