>...on what basis does his genius rest?

It rests on some of his co-workers thinking he was very smart. Is there anything wrong with that?

>AFAIK there is no record of Snowden doing any kind of work out there that'll suggest he knew anything about computing security.

But how far do you know, exactly, about the work that Snowden was doing, or how good he was at it?

The basis for his genius appears to be the opinion of his colleague, which you're free to accept or reject. If his colleague's claims are to be believed, his activities and accolades within the NSA would be sufficient record of his computing security experience.

Not everyone has to publish a white paper or open a GitHub account in order to be taken seriously.

When people are labeled geniuses, independent evidence is important, especially when they've become a cause célèbre.

Geniuses generally have a body of work to stand on, not just a friend/family/colleague opinion.

I would say being a self-taught computer expert who out-smarted the most technically advanced intelligence agency in the history of the world at their own game would lend itself to being a body of work. He also outmaneuvered the State Department and as a lone actor has been able to thumb his nose at the most powerful people in the world while his data has been front page news in dozens of countries around the world for months. It's all quite surreal and I would not underestimate the man.

> ...out-smarted the most technically advanced intelligence agency in the history of the world at their own game...

The lifting of sensitive NSA documents smells to me of gross incompetence. It troubles me that this hasn't gotten more discussion.

Snowden was working for Booz Allen Hamilton in Hawaii. While working for this government contractor, he managed to copy a great many secrets that were probably supposed to be very inaccessible to him.

1) Why does the NSA outsource IT work (and, more critically, the storage of extremely sensitive information) to a third party? (Or do I misunderstand BAH's role in the matter?)

2) One of the NSA's missions is to provide computer security to USGov and the nation as a whole. How good at that job could they possibly be if they can't keep their secrets from insiders who wish to obtain them?

3) Snowden has not been outed as black, white, or grey-hat hacker. It has been claimed that Snowden asked other co-workers with greater access for their credentials and used those to copy sensitive data. Either that claim is true, or BAH seriously fucked up their SELinux permissions and gave sysadmins read access to everything. Either way, the documents were likely not obtained through technical wizardry, but were likely acquired through exploitation of human incompetence. Snowden may be a very skilled individual, but it seems very likely that his skills had nothing to do with the acquisition of that document cache.

You seem to think that exploiting human weakness is somehow out-of-bounds for attackers. Do you, by any chance, set policy for the NSA?

Exploiting human weakness is totally fair game. I am not an NSA policy setter. I have never directly worked for any government agency, but I have worked as a computer security auditor. If you don't account for human weakness in the threat models for your high value assets, you've already lost.

While there are no silver bullets, there are auditing policies [0] and technological mechanisms [1] that attempt to prevent improper use of credentials or improper access of information, and can detect instances of the same after the fact.

Yes, this sort of thing requires a lot of thought to set up, personnel to maintain, political capital to keep going, and regular objective and honest reevaluations to ensure continued effectiveness. However, I don't see any other way to do this if you've data that you need to protect from your enemies.

If protecting the NSA's highly sensitive information isn't worth all that trouble, is it actually worth protecting?

[0] Such as daily inspection of badge-in, badge-out, log-in, log-out, and document/resource access logs to verify physical presence and ensure that one isn't reading things that one's not supposed to have access to.

[1] Such as proper use of SELinux for fine-grained access control, WORM logging devices for tamper-resistant logging, account lockouts on detection of data access or log-in irregularities to minimize damage from account "spoofing" [You're at lunch, but you logged in to another computer? You badged-out for the day, but pulled some document from backup at the office? Instant lockout, termination of all of your processes across all systems, and message to facility security.], etc. etc..

Exactly. Exploiting the human elements of a system is often the best way into any system that is trying to be secure. It's been that way since forever. There's even an entire book on the subject by Kevin Mitnick that is very well known, "The Art of Deception: Controlling the Human Element of Security"

Aye. Would one think that the computer security guys at the NSA are unaware of the vast body of literature on social engineering? ;) (I don't think that you do, it's a rhetorical question.)

I suspect that it's very likely that the NSA fucked up, big-time when they designed their internal security and auditing system. With the system in the state that it must have been, would they even know if an agent from $ENEMY_COUNTRY_OF_THE_MONTH had siphoned off sensitive data, shipped it back home, and vanished into the night?

I mean, the only way we became aware of this leak was the Guardian's announcement of it. It kinda feels like the NSA became aware of the situation at about the same time that we did.

I think we're on the same page here; sorry for misunderstanding before. b^)

If NSA have failed as hard in securing their systems as they seem to have, it makes me think that in the past they've relied on the vetting process to screen out decent Americans like Snowden. I don't think that's enough to keep out determined nations with cosmopolitan citizens, so it's a good bet that Snowden was preceded, and will be followed, by spies of all stripes. If we don't really need an NSA capable of keeping secrets, we probably don't need an NSA at all.

(Moved to another post, as editing posts after an hour seems kinda tacky.)

The media has been banging the "Snowden was the SMARTEST HACKER! NOONE ELSE COULD EVER HAVE DONE THIS BECAUSE HE WAS SO SMART AND STRANGE!!" drum really, really hard. I'm mentioning the human factors because human and internal policy fuck-ups are simply a far more likely explanation.

The Government would love for everyone to believe that this was a one-off event by an exceedingly clever adversary. "We were outsmarted by a super-smart guy who hates America" sounds so much better than "We failed to properly plan for an internal threat, and have failed to do so for years".

I really wonder how many times this sort of thing has been pulled off, undetected, by hostile actors. Just how much of the NSA's massive trove of data has been siphoned off by state-level actors?

His achievements, in so short a life, are nothing less than astounding.

Independent evidence is clearly going to be thin on the ground if he was doing work for the NSA. As mentioned before, it's the opinion of his co-worker. Now that co-worker may have been an incompetent and saw everything that Snowden did as 'genius'. Or, it may be the case that he really was one. Who knows, but at least it's a slightly different viewpoint on the thing.

Body of work? Perhaps you may have heard about his NSA leaks?

He could configure sharepoint AND backup systems. May not seem like much but in a federal government department that's like being Jesus and, I don't know, Buddha at the same time.

Frankly, someone who knows how to wield Sharepoint qualifies more as a Marquis de Sade to me.

It doesn't mention anything about security. There's a backup system, and a web front-end. Whatever his work was, it was impressive enough to get him an invite to the Tailored Access Operations. Not all work at the NSA was cutting-edge encryption.

How did you miss that? the whole article speaks to his supposed security prowess:

* Snowden had been brought to Hawaii as a cybersecurity expert working for Dell’s services division but due to a problem with the contract was reassigned to become an administrator for the Microsoft intranet management system known as Sharepoint.

And the next sentence starts Impressed with his technical abilities, Snowden’s managers decided that he was the most qualified candidate to build a new web front-end So whatever he did that was impressive, it wasn't security-related.

How can you tell from that statement that his impressive act was 100% not security related.... All you can really say is that it wasn't necessarily security related.

Anyone building a web front-end needs to have a lot of security-related knowledge (implement https correctly, cross site scripting and other js vulnerabilities, sql injection, buffer overflows in your apps, etc.)

It's a character reference from a co-worker, not a declaration of objective fact.

>It seems people have forgotten that there are a ton of freely available computer security tools out there that any body can take and do a lot of damage with.

I used to think that sort of thing would be noticed pretty quickly at the NSA. Nowadays, I am not so sure.

That quote is apparently the opinion of one of the NSA staffers that worked with him. Apparently he was more talented than most of the other employees and contractors.

Indeed; a statement like that is either reflective of Snowden's skill level, or the average skill level of his co-workers. I haven't personally seen anything out of the ordinary yet for a generic sysadmin/developer/hacker/internet freedom fighter character.

adds more to the hollywood story