This seems to be a recurring argument: they have RSA breaking magic sauce in a safe in a bunker in a fort.

If they do indeed - surely they would at least employ it in the backend to decrypt data? The documents we are seeing are geared towards analysts and provided from the groups implementing various attacks/capturing/decryption functionality. They wouldn't even have to reveal anything - just "give us data, we'll send you back decrypted results". Yet they frequently set rather low expectations for decryption. And then theres the organizational question. Why have groups targeting VPNs, IPSec, HTTPS etc. when breaking RSA gives you a golden key to any of these?

What I'm saying is these arguments routinely devolve into "it's so secret, they can't tell their own employees or analysts and they can't use it for the capability could be leaked". At that point the consequence is that the magic RSA breaking sauce becomes pointless as you can't use it, certainly not for the objective the NSA has spent the last decade on: capture everything.

I see it like the judicious use of signals intelligence in WWII. If you use it for everything, you risk tipping the enemy off that their crypto is broken. You have to balance the benefit from the inherent knowledge leak from using it.

I'm not saying they have it, but if they had it, they would be foolish to use it all over instead of only on key targets.

> This seems to be a recurring argument: they have RSA breaking magic sauce in a safe in a bunker in a fort.

That's not what I said. Don't make shit up.

I said that one cannot rule out NSA sitting on an RSA weakness merely because it's not mentioned in the Snowden document dump.

The biggest surprise I took away from the Manning and Snowden revelations was that the "Need to Know" principle is no longer part of the US security community's playbook. Every government and military computer apparently contains everything from nuclear launch codes to the stats of Obama's fantasy sports teams, never mind whether the operator of said computer has any business accessing such information.

The very fact that these low-level staffers were able to do as much damage as they're credited with should have been enough to force a house-cleaning of every affected agency, from the top down.

Snowden was low-level, but he was basically an admin doing migration to a new system. His job description required the access he was given.

Additionally, one of the lessons learned from the 9/11 attacks was that keeping data too "Need to Know" might prevent people who actually need to know information from knowing about it.

I'd recommend you read Greenwald's book, "No Place to Hide". Snowden was not exactly "low-level", he was in training for operations. He backed down to a low-level position by choice when he wanted greater access to documents. He even took a pay cut to do so.

This has been made worse by the fact that they classify almost everything as secret now - while at the same time they still have to show many others those documents. When doing that even labeling stuff as "top secret" tends to be done a lot more often (when it's not necessary), which only dilutes the secrecy of the real top secret stuff, mixing that together with the less top secret stuff, and making it just as easy to be leaked and/or shared.

When you have 10,000 documents labeled "top secret", instead of just 100, who really knows what's really important from that list, and doesn't need to be "as shared" anymore?