Or the era in which the government does understand the Internet, and deliberately attacks actual threats…getting caught in the crossfire is never fun, no matter how legitimate the battle. How many people died in the Battle of Britain from shells, shrapnel and planes falling on them? But of course, many more would have died had the RAF not fought the Luftwaffe.

Likewise, how many will suffer today in the crossfire between criminal gangs, extremist organisations and legitimate governments? How many would suffer if legitimate governments didn't fight?

>Likewise, how many will suffer today in the crossfire between criminal gangs, extremist organisations and legitimate governments? How many would suffer if legitimate governments didn't fight?

About as many, or even less.

Governments not using mass surveillance, and other forms of spying on their own citizens, implies the following benefits:

The money spent on mass surveillance is either spent elsewhere (so you merely need to find a more productive use of those untold billions to decide that the surveillance is not worth it) or not collected as taxes or tariffs to begin with.

The man hours spent constructing, maintaining and operating the apparatus of surveillance is spent elsewhere (this coincides with the benefit above, where the government takes engineering talent and uses it for more productive projects or increases the supply of engineering talent in the private market alongside a tax rebate).

The money & man hours spent by innocent people (read: people caught in 'crossfire') defending themselves from mass surveillance is free to be spent on more productive projects (whereas now it merely serves to lower the impact of the 'crossfire').

The chilling effect caused by mass surveillance ceases to exist (or is at least less in the world where people are unsure whether mass surveillance occurs vs. the world where they know it occurs for sure).

As for the detriments, I'm not sure how effective mass surveillance has been at achieving its stated goal - while I cant reliably reason about a world where mass surveillance never existed, I can say that the impact of domestic and international terrorism on the quality of life in US and Europe was not high prior to mass surveillance and that I see no good reason to believe it should have increased dramatically enough to justify both the resources spent and the loss of privacy (or even either of those separately) - but this is an argument that you need to make, I can't provide it for you.

I'm also not aware of any notable achievements of the mass surveillance programs, and although these may be classified, I doubt they exist since the US gov't still refuses fair trials to the alleged terrorists it imprisons, and if the surveillance projects had generated a significant amount of useful, incriminating evidence this would not be necessary (under the, imo, fair assumption that the reason they avoid trial is that the govt is incapable of proving guilt in many relevant).

Intelligence collection is not about security but about * control*, though security is a small subset of control.

The problem is that, as Gall's Law states, systems and organization eventually become counter productive: the NSA and the security industry generally are threats to individual and national security.

     <comment class="devils_advocate">

This seems like a mighty conspiracist view on the topic. There haven't been any inklings, covert or overt, that the recent actions taken by governments are for anything other than their stated goals.

How can you confidently say that this is about control and not security?

Have you ever managed an organization? Then you would understand why it is a fundamental need for those in control to have the maximum amount of information possible. It's impossible to govern an organization of you know nothing about it.

That you call it a conspiracy betrays your ignorance of this matter.

You just did an excellent job of not answering the literally one question I asked you. Could you do that, please?

"Cyberwarfare" cannot be analogized to traditional war. There is no analog to mutually assured destruction. There are no open battlefields; every system attacked has a private or government owner. Every dollar spent on attacks instead of patching vulnerabilities leaves everyone else vulnerable to those attacks.

Instead of analogies and aphorisms, let's talk about actual consequences to actual tactics.

Software vulnerabilities are now the most important vector for signals intelligence, so really the argument here is whether there's a purpose to conducting signals intelligence, and whether it outweighs the harm done by postponing fixes for bugs that NSA could otherwise report.

Before I would ever change sides in that argument, I would need to see definitive proof that vulnerabilities in software I use are better for me than having those vulnerabilities fixed.

Unlike nuclear weapons, there aren't a lot of rare resources required for discovering vulnerabilities, so the approaches that help with nuclear nonproliferation will not help with digital security. All one needs is to find vulnerabilities is smart people (and maybe a lot of computing resources to brute force fuzz a lot of software). There are a lot of smart people and fast computers out there, and the ones not in the US almost certainly outnumber those that are inside the US. It seems it would be much better to defend against them and disarm entirely rather than hope to stay ahead of them.

I'll admit up front that I don't have a clearance of any sort, and I don't work in intelligence. But as a citizen of the USA, that particular argument is really quite irrelevant. I don't want my systems used by IDF Unit 8200, The Equation Group (or whatever the NSA calls themselves) or PLA Unit 61398. The "important vector" is a wide open hole I want patched. All the NSA arguments are pretty irrelevant, except for signs for the rest of us to regard the NSA as a rogue agency.

On some authority, you're asking me to put myself in the position of an NSA leader. I'm not an NSA leader. Postponing the bug fixes hurts me, and the rest of the people like me. Fix them.

That's not really the choices available. The options aren't NSA reports bugs/uses them for intelligence collection, its NSA uses bugs for intelligence collection or they don't find bugs at all.

Its possible that the right answer is we should have a US agency finding bugs and getting them patched, but it certainly shouldn't be any of the intelligence agencies. That feels a little too like putting the military in charge of the police force.

Even in WW2, there are plenty of reasonable arguments about methods and whether they were necessary, proportionate, and effective. Look not to fighter command but bomber command: to what extent was widespread strategic bombing necessary and effective? Firebombings of Dresden and Tokyo?