Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I once took a call with an ex-NSA guy who was a CEO selling email security software- your MX would point to them, they'd scan your incoming email for exploits, then deliver it on to you. When I spoke to the guy, I expressed my concern, having working for a large multinational corporate whose fiber optic lines were tapped by UK intelligence to avoid NSA laws against spying on americans, that if I couldn't inspect his software, I couldn't feel confident of the security and integrity of the scanning system.

I said, in good faith, that I would consider his product if I could inspect the running system and the code.

He said several things: 1) the NSA never did anything illegal 2) the software was too large to audit 3) it was an insult to his employment in the NSA that I was even asking these questions.

Then he hung up.



Obviously he fired you as a customer.

This is how the misspellings in Nigerian Prince emails market to the "right" customers.


The NSA would never do anything illegal; if you have a problem with highly misleading and unethical actions being undertaken with flimsy pretenses established by classified memos citing dubious legal justification- then that’s obviously your problem, not theirs. Also, didn’t the director of the NSA perjure himself when he lied under oath during his sworn testimony before SSCI? No, sorry, he actually gave the “least untruthful answer” and then changed his answer when contradictory facts became public. I would have called that illegal but obviously the NSA has a legal theory and justification as to when they need to provide “untruthful” “facts” to the institutions exercising oversight.


> 1) the NSA never did anything illegal

Okay... but even if it was legal that doesn't mean what they did is "right". There's a big difference.


The difference is that I knew he wasn't on the level when he said it, because the NSA has been sued and it's come out they've done things that were illegal, as found by a court of law, in public. That's just one example that we know of.


Yeah, one is objective, the other is so subjective it depends not only who you ask but when and how you ask it.


Neither is objective. There's no pretense of objectivity in the legal system. This is why you see people say things like "we'll find out if this was legal when they rule on the case".


They never got an official, judicial, slap, which certainly means it must be legal, isn't it?


Found to be illegal at the judicial level: https://www.nytimes.com/2010/04/01/us/01nsa.html then overturned by the 9th court. Then Congress stepped in and changed laws to make the situation "clearer".


Please define "right"


the precursor to law


Or perhaps the precursor to “just” law. Unjust laws abound.


> whose fiber optic lines were tapped by UK intelligence to avoid NSA laws against spying on americans

Who did you work for? This appears to be a 180deg misunderstanding of the 5 Eyes agreement. GCHQ is not allowed to spy on Americans.


https://www.nytimes.com/2013/10/31/technology/nsa-is-mining-...

"In partnership with the British agency known as Government Communications Headquarters, or GCHQ, the N.S.A. has apparently taken advantage of the vast amounts of data stored in and traveling among global data centers, which run all modern online computing, according to a report Wednesday by The Washington Post. N.S.A. collection activities abroad face fewer legal restrictions and less oversight than its actions in the United States."

Note there's a fair amount of speculation on the specific details of how and what data is collected and shared.


This source doesn't remotely support what you said, in fact it explicitly contradicts it;

> "pushed back against the notion that it was collecting abroad to “get around” legal limits imposed by domestic surveillance laws"


There's been public claims about it, and honestly thinking that they wouldnt do it once they have the power to seems naive?

https://www.zdnet.com/article/thatcher-ordered-echelon-surve... > Ex-spy Mike Frost told the CBS 60 Minutes programme that Thatcher had ordered surveillance on two cabinet colleagues according to excerpts released on Thursday. The allegation comes in the same week that a European Parliament report said Echelon, a surveillance system run by the United States, Canada, Britain, Australia and New Zealand, was used for industrial espionage.


"pushed back"? Like how the director of the NSA "pushed back" on congressional questions of whether the NSA was broadly collecting any data from American citizens?


Don't forget that Snowden leaks revealed that there is a huge open sharing pipe directly with Israel.

I can't recall the details - Ill have to go look it up again, but apparently Israel gets more data than any of the others, IIRC.


Source?

When someone says something about mysterious unseen evil activities and Israel it raises my conspiracy theory detector to yellow alert



[flagged]


https://news.ycombinator.com/newsguidelines.html

"Please don't post insinuations about astroturfing, shilling, brigading, foreign agents and the like. It degrades discussion and is usually mistaken. If you're worried about abuse, email us and we'll look at the data."


[flagged]


Is asking for a link to the source shilling now?


No, the asking for. Link was fine, as i stated in my op, i was going to find a source...

It was the “when israel gets called out” bullshit - and then looking at their post history.

Thats a shill account 100%


Do you have a link that speaks to the original comment or not?


[flagged]


> Conspiracy denotes that something is hidden

No it doesn't (at least not to me or the dictionary). Conspiracy denotes two or more people planning with each other to commit illegal, wrongful, or subversive acts. Whether or not it's hidden doesn't enter into it.


A lot of people are talking about a state of apartheid in Israel, lets not throw every theory in the corner of anti-Semitism. And to be crystal clear I'm saying this from a POV coming from Jewish heritage.


Not "more data than any of the others" - just a specific kind of access that usually comes with much closer intelligence relationships (e.g. Five Eyes), rather than the more wary relationship the Israeli and US intelligence communities generally have with each other.


> GCHQ is not allowed to spy on Americans.

Since when do spy agencies avoid doing things just because they're "not allowed" to do them? An activity being disallowed only means that they'll avoid telling people that they're doing it.


All of your emails and text messages have been saved on NSA server harddisks, without a warrent. You are asking the right questions.


> the software was too large to audit

That part's probably true.

Try to audit something like OpenSSL.


That's up to the auditor to decide, not the auditee.


AUditing is a negotiation between the auditor and the auditee. The auditor rarely gets to dictate absolute terms (and in my experience, will often listen to well-reasoned and prepared arguments and plans from auditees).


Open ssl has be audited and fips validated for some versions


You might be interested in this evidence of the incompleteness of FIPS validation as a talisman of security.

Edit: more importantly, the FIPS version of OpenSSL was vulnerable to HeartBleed.

https://www.engadget.com/2019/06/13/yubico-recalls-governmen...


I am pretty sure that the fips validated versions could not even compile.


Is there no more subtle way of turning down a customer, as an ex-spook? He seemed to imply more than he needed to for someone trained.


> 1) the NSA never did anything illegal

This is simply not true.


I bet I can guess who this is


Why are we supposed to respect secrecy in this moment?

Who is it?


Sounds like Area_1


It is just plain rude to apply his previous employer's actions, who employ over 30k people, solely on him.


Since I was effectively the CTO for a startup that cared about the security of its messaging, I think I made a reasoned judgement about the nature of the security of their product, offered a way that he could help increase my confidence that he wasn't just sending a copy of my unecrypted email (the email has to be unencrypted for their scanner to work) off wherever.

I don't really find that rude. A cloud customer certainly can go to a cloud provider, say "you know, it's possible you have rogue internal actors, I've read articles that said you've fired SREs before who snooped on user data, can I see your audits that show you deal with insider risk properly?"


I encourage you to go to cloud providers and ask to see their code. They will laugh in your face.


He's the one asking for your data, trust, and money. A little scrutiny is warranted.


That applies to every B2B company pretty much. Did he also ask other companies for access to their code?


If the NSA guy is selling himself based on his past experience, then he himself is the one dragging those issues into the conversation.


Yes, he sells himself on that experience (I had already done due diligence on a previous company he founded, sqrrl, which was organized around open source software, but touted the NSA creds):

Oren Falkowitz CEO and Co-founder Oren Falkowitz co-founded Area 1 Security to discover and eliminate targeted phishing attacks before they cause damage to organizations. Previously, he held senior positions at the National Security Agency (NSA) and United States Cyber Command (USCYBERCOM), where he focused on Computer Network Operations & Big Data. That’s where he realized the immense need for preemptive cybersecurity.


> those issues

What issues?


I think it's acceptable to wonder if the ex-employee's attitudes and beliefs are similar to the organization he spent the bulk of his time working at.


Then perhaps ask him about his attitudes and beliefs- not for access to his code.


They told him about their attitudes and beliefs: "The NSA did nothing wrong".

Honestly, why are you defending someone who believes that??


Who said anything about “solely”? It’s entirely reasonable to have the concerns OP had.


Yeah you should be able to work for whatever unethical employer you like, and defend their actions without consequence.

/s


-5 insightful.

This post could turn into +5 informative if names and contact details were added for this unidentified "ex-NSA guy" and the "security software."

As-is, this is post is becoming popular because people are replying with random experiences and hate they have for NSA and insecure systems. But instead it could be helpful by damaging the reputation of a specific person that is peddling insecure systems.

This is why I browse with -5 insightful.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: