Schneier on Security's Journal
 
[Most Recent Entries] [Calendar View]

Monday, September 16th, 2013

    Time Event
    6:55a
    Reforming the NSA

    Leaks from the whistleblower Edward Snowden have catapulted the NSA into newspaper headlines and demonstrated that it has become one of the most powerful government agencies in the country. From the secret court rulings that allow it collect data on all Americans to its systematic subversion of the entire Internet as a surveillance platform, the NSA has amassed an enormous amount of power.

    There are two basic schools of thought about how this came to pass. The first focuses on the agency's power. Like J. Edgar Hoover, NSA Director Keith Alexander has become so powerful as to be above the law. He is able to get away with what he does because neither political party -- and nowhere near enough individual lawmakers -- dare cross him. Longtime NSA watcher James Bamford recently quoted a CIA official: "We jokingly referred to him as Emperor Alexander -- with good cause, because whatever Keith wants, Keith gets."

    Possibly the best evidence for this position is how well Alexander has weathered the Snowden leaks. The NSA's most intimate secrets are front-page headlines, week after week. Morale at the agency is in shambles. Revelation after revelation has demonstrated that Alexander has exceeded his authority, deceived Congress, and possibly broken the law. Tens of thousands of additional top-secret documents are still waiting to come. Alexander has admitted that he still doesn't know what Snowden took with him and wouldn't have known about the leak at all had Snowden not gone public. He has no idea who else might have stolen secrets before Snowden, or who such insiders might have provided them to. Alexander had no contingency plans in place to deal with this sort of security breach, and even now -- four months after Snowden fled the country -- still has no coherent response to all this.

    For an organization that prides itself on secrecy and security, this is what failure looks like. It is a testament to Alexander's power that he still has a job.

    The second school of thought is that it's the administration's fault -- not just the present one, but the most recent several. According to this theory, the NSA is simply doing its job. If there's a problem with the NSA's actions, it's because the rules it's operating under are bad. Like the military, the NSA is merely an instrument of national policy. Blaming the NSA for creating a surveillance state is comparable to blaming the US military for the conduct of the Iraq war. Alexander is performing the mission given to him as best he can, under the rules he has been given, with the sort of zeal you'd expect from someone promoted into that position. And the NSA's power predated his directorship.

    Former NSA Director Michael Hayden exemplifies this in a quote from late July: "Give me the box you will allow me to operate in. I'm going to play to the very edges of that box."

    This doesn't necessarily mean the administration is deliberately giving the NSA too big a box. More likely, it's simply that the laws aren't keeping pace with technology. Every year, technology gives us possibilities that our laws simply don't cover clearly. And whenever there's a gray area, the NSA interprets whatever law there is to give them the most expansive authority. They simply run rings around the secret court that rules on these things. My guess is that while they have clearly broken the spirit of the law, it'll be harder to demonstrate that they broke the letter of the law.

    In football terms, the first school of thought says the NSA is out of bounds. The second says the field is too big. I believe that both perspectives have some truth to them, and that the real problem comes from their combination.

    Regardless of how we got here, the NSA can't reform itself. Change cannot come from within; it has to come from above. It's the job of government: of Congress, of the courts, and of the president. These are the people who have the ability to investigate how things became so bad, rein in the rogue agency, and establish new systems of transparency, oversight, and accountability.

    Any solution we devise will make the NSA less efficient at its eavesdropping job. That's a trade-off we should be willing to make, just as we accept reduced police efficiency caused by requiring warrants for searches and warning suspects that they have the right to an attorney before answering police questions. We do this because we realize that a too-powerful police force is itself a danger, and we need to balance our need for public safety with our aversion of a police state.

    The same reasoning needs to apply to the NSA. We want it to eavesdrop on our enemies, but it needs to do so in a way that doesn't trample on the constitutional rights of Americans, or fundamentally jeopardize their privacy or security. This means that sometimes the NSA won't get to eavesdrop, just as the protections we put in place to restrain police sometimes result in a criminal getting away. This is a trade-off we need to make willingly and openly, because overall we are safer that way.

    Once we do this, there needs to be a cultural change within the NSA. Like at the FBI and CIA after past abuses, the NSA needs new leadership committed to changing its culture. And giving up power.

    Our society can handle the occasional terrorist act; we're resilient, and -- if we decided to act that way -- indomitable. But a government agency that is above the law... it's hard to see how America and its freedoms can survive that.

    This essay previously appeared on TheAtlantic.com, with the unfortunate title of "Zero Sum: Americans Must Sacrifice Some Security to Reform the NSA." After I complained, they changed the title to "The NSA-Reform Paradox: Stop Domestic Spying, Get More Security."

    12:59p
    Tom Tomorrow from 1994

    This was published during the battle about the Clipper Chip, and is remarkably prescient.

    1:25p
    Surreptitiously Tampering with Computer Chips

    This is really interesting research: "Stealthy Dopant-Level Hardware Trojans." Basically, you can tamper with a logic gate to be either stuck-on or stuck-off by changing the doping of one transistor. This sort of sabotage is undetectable by functional testing or optical inspection. And it can be done at mask generation -- very late in the design process -- since it does not require adding circuits, changing the circuit layout, or anything else. All this makes it really hard to detect.

    The paper talks about several uses for this type of sabotage, but the most interesting -- and devastating -- is to modify a chip's random number generator. This technique could, for example, reduce the amount of entropy in Intel's hardware random number generator from 128 bits to 32 bits. This could be done without triggering any of the built-in self-tests, without disabling any of the built-in self-tests, and without failing any randomness tests.

    I have no idea if the NSA convinced Intel to do this with the hardware random number generator it embedded into its CPU chips, but I do know that it could. And I was always leery of Intel strongly pushing for applications to use the output of its hardware RNG directly and not putting it through some strong software PRNG like Fortuna. And now Theodore Ts'o writes this about Linux: "I am so glad I resisted pressure from Intel engineers to let /dev/random rely only on the RDRAND instruction."

    Yes, this is a conspiracy theory. But I'm not willing to discount such things anymore. That's the worst thing about the NSA's actions. We have no idea whom we can trust.

    << Previous Day 2013/09/16
    [Calendar]
    Next Day >>

Schneier on Security   About LJ.Rossia.org