Security quote of the week [LWN.net]

Moderator and TechCrunch Senior Editor Frederic Lardinois asked [Google’s Manager of Information Security Heather] Adkins if she thinks of the NSA as a state-sponsored threat in the same way as China and Russia. She confirmed, yes, she considers the US' National Security Agency in that way. Does she worry about the NSA? Yes, she does and it’s good to worry about them because if they can attack, other organizations can attack too.

She goes on to say that she thinks less about individual threats and rather focuses on the techniques and the surface available to be attacked.

"A technique the NSA can use can easily be used by a Mexican cartel against our users," she said. "All of these actors have these tools available to them."

— Matt Burns in TechCrunch

to post comments

untangling misleading characterizations

Posted Sep 28, 2017 3:44 UTC (Thu) by Garak (guest, #99377) [Link]

All of these actors have these tools available to them

This seems a misleading characterization to me. I suppose the whole quote is more about what gets read between the lines, but I'll pedantically point out that- based on what I perceive as mainstream security thinking, international drug Cartels are not in any way equatable tool-wise with the NSA. The Cartels have to forge fake driver's licenses for their infiltrator employees with the possibly faked backgrounds and resumes. While the NSA just pulls out their access to the same tools as the DMV. Sure, I'll grant the point that the Cartels presumably have access to a much more serious set of hacking tools than the imagined image of some literal script kiddie, but I'm guessing, based on Snowden et al, that the NSA have *quite a bit more tool-wise at their disposal than the Cartels*. So I think this quote is unfortunately misleading in that specific way. On the flip side, I'd like to believe the Cartels have alternate, though significant tools and abilities and more to the point willingness to engage in riskier more nastily illegal behavior on larger scales than the NSA. I.e. the cartels might be outright murdering and torturing far more people than the NSA feels the need to. Ultimately for both of these reasons, the two threat models are IMHO not in any way lumpable together as the quote suggests. But of course at the level of reading between the lines, yes, they are both much nastier bigger threat surfaces than anything that was taken seriously pre-Snowden in the public sphere. And of course it's not a bad idea to publicly speak about them as similary nasty clouds of threat surface, lest you speak too specifically about one or the other in some way that offends them specifically. Serious diplomatic wording going on in this quote. Probably some interesting gray area laws as far as admitting to the fact that you consider government agents as a group you are taking efforts seeable as obstructing their civic function. Even though Snowden and Trump...