Snowden impersonated NSA officials, sources say

I don't disagree with anything you've said about holes in security. I just think it's silly to say the solution is to hire stupider people.

It is not really security theater if you consider all the other systems they have in place: the clearance process, auditing, etc.

What I see is a use of RBAC that is not all that stupid, and that I happen to use on my own systems. RBAC is being used not to guard against abuse but to guard against mistakes. I use the SELinux sandbox to run my web browser, because it is easy to make a mistake like this:

http://thejh.net/misc/website-terminal-copy-paste

Ah, not so fast, the sandbox keeps that mistake from spreading all over my home directory. Now, the NSA has people who deal with important national security matters (or whatever), but they might make mistakes too. So the NSA uses RBAC to ensure that an analyst cannot accidentally copy and paste some intelligence secrets into a document that will be sent to people without clearance. Remember that the NSA does not just hire random people off the street; there is some amount of filtering meant to reduce the number of insider threats, but that process alone does not necessarily protect against honest mistakes (hence RBAC).

It may also be the case that the NSA is not trying to guard against abuses by sysadmins, but by the tens of thousands of non-sysadmins they employ. In theory this is silly because it just means that your enemies will try to get their agents to work as sysadmins, but in practice it is likely to be a cost-effective solution that greatly reduces the number of people you need to worry about.

Finally there is the matter of auditing. It is OK to have a sysadmin who can transition to an unauthorized security level if the audit logs record it and if you frequently inspect those logs. Again, if sysadmins are the only employees who can make such transitions, you have far fewer people you need to watch -- a net win.

> Have any of the NSA leaks told us anything we don't know?

Yes. Due to the fourth amendment (I'd recommend reading it), I'm definitely surprised at the scope of what has come to light. These actions directly contradict it, both in letter and spirit.

> I have yet to see any serious abuse of the NSA's power.

Please make a modest effort before making such statements.

1. The fact that the blanket spying exists at all is an abuse. It is a DUI checkpoint on every single road, every day, instead of pulling over swerving drivers.

2. Secret laws, courts = abuse. In America?

3. No oversight, congress un/misinformed = abuse!

4. The sympathetic fisc court itself has ruled many actions have been unconstitutional. Abuse!

5. That the leak we're talking about exists is an abuse!

6. If there have been admitted abuses, the number of non-disclosed must be far larger. Due to #5 we know they are quite possible.

7. Harassment of journalists, families, abuse.

In short, it is abusive from macro to micro. Betterunix's reply points out your multiple-contradictory statements.

> Due to the fourth amendment (I'd recommend reading it), I'm definitely surprised at the scope of what has come to light. These actions directly contradict it, both in letter and spirit.

I'd bother replying to the rest of your ill-informed statements, but it's clear that you don't understand the systems involved. Read up on it before making such false statements. I really don't need to address your circular logic, that's just sad.

There is no "blanket spying" any more than a police watching traffic go by for speeders is "blanket spying". There's your car analogy.

I have yet to see evidence that he has lied. Keep in mind that the personal data being mined by these systems was already recorded, legally and gathered legally with the contracts you agreed to with these companies. I've read the EULA and every single one of them states they will cooperate with authorities for data requests. Without evidence of abuse, there is no lie here.

>How is that coherent with your first sentence?

you can't have it both ways. People who live in USA and are technical would know about these systems. People external and non-technical would not necessarily. Is that so hard to understand?

>What checks do you think are built in, exactly?

Read the article, please, before commenting.

>effective checks on the NSA's power are not in place.

There is still no evidence that your statement is true. The article shows that effective checks are there, but like all defenses, they can be flanked. Thus Snowden had to abuse his trust to get around them. This is just reality. There will never be a defense that can't be flanked.

You can say that this article is proof that there is ineffective checks, but then you have to admit that this article proves that Snowden had a ulterior motive when he accepted his contract with NSA. You must accept that if the goverment broke some rules to do their job (which so far I have not seen any evidence for) then you must also accept that Snowden broke some rules to steal these documents.