The scope of these activities, especially when combined with the NSA's (and GCHQ's) indiscriminate "hack everything" attitude. When the NSA attacks so much infrastructure - including standards they are supposed to be supporting - at some point they start creating a reasonable doubt about the true actors behind any network attack.

This could have various consequences, but one obvious one is how it affects a jury. It would probably be a lot easier to conclude there is a reasonable doubt the accused did not commit some type of computer or network crime when the NSA is attacking so much infrastructure. If the NSA was known to be targeting legitimate targets with limited, targeted activities that did not affect everybody else, the doubt that any random computer crime could have been the NSA's responsibility would not be reasonable.

It's unlikely that someone who knows about this would serve on a jury in a computer crime case, or that evidence of NSA activities would be admitted in trial.

Juries don't know about a lot of topics. In an adversarial system, it is the responsibility of the each party to inform the judge and jury what is relevant to the case.

Hence the second half of my comment:

> or that evidence of NSA activities would be admitted in trial.

If the NSA is really that overwhelmingly powerful, it is irrelevant whether a jury can be convinced of some random hacker's guilt. Let him go free if you must. If he is legitimately dangerous, the NSA can shut him down or point him the right way.

Spreading malware is a big deal, and I am sure many people would get quite upset if important US infrastructure was targeted. What would the reactions be if the 911 system got hit by untested malware, or some traffic control systems crash because of spying activities.

What repercussion should the US have received if the Iranian uranium enrichment had exploded and thrown fine radioactive dust into the environment? Would NSA take responsibility for the deaths and environment damage for their spying, or would they hide and put the blame on a third-party?

The answer to your question is that the potential for damage that malware has, and the responsibility we expect from those who make it is extremely disproportional. It is a big deal, and the risk/cost to human lives is why we should be very careful allowing organizations to spread malware.

I don't know what repercussions there should be for that, but any consideration of repercussions has to consider the alternative to electronic attack, which is airplanes dropping munitions from great heights onto buildings with people in them.

People should probably not kid themselves about geopolitics and military competition vanishing if we somehow manage to regulate "electronic warfare".

We recently had a article from Schneier that made a similar observation comparing electronic attack to airplanes dropping munitions from great heights, which is why the conclusion was that electronic attacks should be under the control of the military and not by NSA. We expect the military to strike other nations civil infrastructure (or at least the subject can be debated), but we also expect them to take responsibility for it.

That makes a lot of sense to me, too. Also: this isn't to say that there aren't grave concerns with using self-propagating malware as a vector for attacks. It's just to keep things in perspective.

The chances of a full-blown Iranian nuclear weapons program not eventually bearing an attack by explosive munitions are pretty close to zero; see Osirak. If malware that only really impacts centrifuges forestalls that for a couple years, I see it as a good thing.

Schneier is also the one who said these are the types of things the NSA should be doing[1].

[1] https://www.schneier.com/blog/archives/2013/12/more_about_th...

The NSA is subordinate to the Department of Defense - it is part of the military.

> alternative to electronic attack, which is airplanes dropping munitions from great heights onto buildings with people in them.

I'd actually like to see the outcome of that. By all means, please go ahead and do this -- in Brussels.

>which is airplanes dropping munitions from great heights onto buildings with people in them.

I know that you didn't mean for your comment to be taken literally but there is literally zero chance of enemy airplanes invading US skies and dropping munitions from great heights onto buildings with people in them. It is a silly thing to say and it does nothing to justify the current situation vis a vis the NSA et al. Try not to hyperventilate.

No, I mean literally: if Stuxnet really did target the Iranian nuclear project and really did set Iran back by a year or so, then Stuxnet forestalled an aerial bombardment of Iran by a year or so.

It's an ugly situation, since Iran's geopolitical strategy involves gaining concessions through a game of chicken with the US counter-proliferation regime. At some point, unless it's resolved in a way that ends the Iranian nuclear arms program, it is going to end in explosions, and scores of lost lives.

This is a descriptive observation, not a normative one.

It is also true that if Iran somehow arranged for explosions at US nuclear facilities, the USG's response would be world- historically horrific. Any reasonable observer knows this to be a fact, so we can acknowledge it without getting into philosophy and move on.

Of course there isn't. The US would be the attacker in this scenario. And we most certainly still do bomb people with aircraft.

This is a false dichotomy of the most offensive kind.

Please explain. I am still on the fence about Stuxnet, but the conventional wisdom is that it did exactly what I suggested that it did: it forestalled a military attack on Iran's nuclear program. And "forestall" is all it did; we're presumably a phone call and double-digit seconds away from that attack today.

> or would they hide and put the blame on a third-party?

That's usually the point of this sort of work, yes. Espionage isn't just about acquiring information, it's about spreading false information, and dragging your enemies through the mud.

I don't approve of this shit, but "the them" have been up to it since forever, and the answers to your queries are a straightforward: "None", "No", "Yes" - unless someone else's intelligence agency outwits them, and has a media mouthpiece that can't be drowned out by chaff.

Edit: Your post got me thinking about Chernobyl and Reagan. The CIA had a programme to export defective technology to the USSR - which (apparently) culminated in http://en.wikipedia.org/wiki/Siberian_pipeline_sabotage

One has to wonder. Yes, I'm aware that the questions as to how Chernobyl are well answered, and all the rest, case closed, etc. - but one still has to wonder. Nothing should be trusted 100%.

Since the NSA has shown that they really don't care who they spy on all news about more efficient surveillance by them is relevant to both US citizens and non-citizens imo.

As a citizen I'd be pretty alarmed by NSA-level activities of my local agencies because quite frankly it's way too excessive and privacy is a lot more important to me than the supposed security massive and not very transparent surveillance activities alledgedly brings. Most importantly it just shows a worldview that doesn't care about privacy at all and just wants to absorb all data. Which is very alarming.

It's the way of the world. Everything has impact on everything else.

In the past, you had "privacy" speaking with someone in your own home. Even though the vibrations could theoretically be felt through the walls, we didn't have sufficiently sensitive instruments to recover that into speech. Now we do, and that technology is never going to be uninvented - it's only going to get better.

If you can't adapt to changing times, no hard feelings. The same thing happens every generation. The world can move on after you grow old and die.

Yeah, it's all getting a little ridiculous. Every country has been spying on every other country since the beginning of countries. The leaks from Snowden, Greenwald, et al are becoming less about privacy violations and unjustified data collection and more about legitimate spying efforts, but they're still being met with breathless outrage here and elsewhere.

Also, are we really thinking "Grok" is some sort of identifying name/tag?

The information on the Equations Group/TAO are coming from Kaspersky Labs via Ars Technica. They are unaffiliated with Snowden/Greewald/et al.

The leaks from Snowden that I've read thus far they do not mention anything about what TAO does. They are hinted at as the "big guns" you go talk to when you have actionable intelligence.

There was a large leak that included what was basically an internal catalog of TAO-created devices and modules. That's what they are crossreferencing the codenames against.

Just because something has been done "Since the dawn of time" is not a valid reason to keep doing it whatsoever.

As a foreign citizen of the US (or UK) where this type of activity seems king, I'm threatened and consider these activities hostile and reason enough to not do any sort of business with US based companies or US residents.

There are no legitimate spying efforts, these agencies from day one have used and abused their positions to misdirect the public, start wars, spy on those they had no business spying, hack infrastructure on foreign land (which should be considered an act of war pure and simple), and the list goes on, including torture and murder.

I have no respect for these agencies and the work they do and they have no business existing.

Whatever country you're from is trying to do what the US is doing, they just aren't as good at it, so they likely are resorting to using hard techniques. Think lead pipes.

> They were doing exactly what NSA was supposed to do.

It's fairly unclear what the NSA is supposed to be doing. They appear to be attempting to destabilize the internet in a way that is advantageous to them and them only.

Because a government hacking another government to disable military infrastructure is clearly an act of war. Spying is a pseudo-accepted peace time activity, military sabotage isn't.

To add to your point: computer espionage is the first and often second to last step before computer sabotage. You could build a program protected by cryptography that without the key would be indistinguishable from spyware, but with the key would be very destructive. You can't know the intention of a computer network operation until the attacker pulls the trigger and releases the key and by then it is too late.

In conventional espionage sabotage does not have the same footprint as intelligence collection. They are easier to tell apart. For this reason merely copying the rules and norms of HUMINT and SIGINT into computer network operations is very dangerous.

It's a big deal because of the resources being applied to this, and the lack of resources applied to keeping data private and secure.

Of course you can't prevent efforts to break into systems. But you can spend enough resources on making it difficult and fruitless that it is reasonably certain that our data can't be accessed by spooks of any nation.

We get what we pay for. Right now we spend vastly more on surveillance than on privacy and security. Guess which one we have more of?

The resources that sabotage unwanted nuclear programs ... are resources well spent. This part of NSA is caring the mandate. Highly targeted, highly efficient, no collateral damage, no dragnets, delivering results.

Yesterday's legit NSA operation and toolkit is tomorrow's cybercrime and hacking toolkits.

So this is yet another NASA-like example of military spending driving research that eventually gets repurposed for civilian use? Great!