from the it's-a-problem dept
However, the claim late last week that the NSA knew about and exploited Heartbleed, followed by the quick denial by the NSA, really puts an exclamation point on how untenable this dual role is for the NSA. It's difficult to take the NSA seriously given the competing interests within it. Add to this, President Obama basically giving his broad approval for the NSA to exploit security flaws it finds, and you have a very dangerous setup for your average internet user. The NSA, despite its job, will have little interest in actually protecting internet users.
Julian Sanchez summarizes the issue nicely by pointing out that the two roles are simply incompatible:
But the denial itself serves as a reminder that NSA's two fundamental missions – one defensive, one offensive – are fundamentally incompatible, and that they can't both be handled credibly by the same government agency.The NSA's history of being less than forthright in the past, as well as many of the Snowden revelations, combined with its dual role, simply means that most people won't believe the NSA's denial about Heartbleed, even if it was much more strongly worded than earlier denials. If the NSA's role, however, were made much clearer, such that it was only focused on protecting systems, without the offensive elements, then it would be both a lot more believable, and a lot more trustworthy. However, the very fact that the administration (and the NSA) appear to have little interest in moving in this direction says a lot about how much they really prioritize protecting our computer systems.