The NSA Wants To Help Design Safer Tech Products. Do You Trust Them?

The U.S. military’s codemaking agency says it wants to help the tech industry make its products more secure, and better able to use emerging technologies like 5G networking. But the National Security Agency is also the military’s codebreaking agency. Can it win over Silicon Valley types long suspicious of its help?

NSA aims to do this outreach with a new Standards and Futures group, part of the public-facing Cybersecurity Directorate that is set to reach full operational capability in January. 

On Thursday, NSA officials took the highly unusual step of inviting more than a dozen reporters to their new Integrated Cyber Center. It’s built around the Joint Operations Center, a giant room resembling the fictional NORAD command center in the movie War Games. Three 47-by-20-foot screens tower over the agency operators below, displaying real-time data about U.S. operations and threats. Some 200 NSA and U.S. Cyber Commander operators will handle cyberdefense and foreign-intelligence collection, and coordinate with representatives of the Department of Homeland Security and other U.S. agencies.

NSA officials said having a big space to collaborate would help coordinate U.S. operations and responses to cyber incidents.

But the new Futures and Standards group will be less focused on the tactical back and forth of cyber defense and offense and more on predicting and spotting bugs and vulnerabilities in commercial products — and even helping businesses and consumers use good products safely.

To do that, the agency will have to overcome the false perception that it would rather hold onto vulnerabilities for its own use than disclose them to manufacturers for fixing. Agency leaders say that they need to speak out more — a rather big culture change at the “No Such Agency” — to rebut that notion, get bugs fixed, and keep the public safe.

Anne Neuberger, the director of the new Directorate, said that the NSA now believes its mission includes spreading the word about small problems before they become huge ones. “Our role is taking the insights we have…whether it’s 5G, whether it’s quantum system crypto, whether it’s distributed ledger, and trying to work to ensure those products are built more secure. And we give advice to users who need different levels of security.”

Neal Ziring, the directorate’s technical director, said the new group aims to inoculate the public by reaching out to the tech industry before bad products gain wide adoption. “Futures and Standards is going to look out a little ahead of today’s threats...look what’s coming down the pike, what sort of risks [a new technology or architecture] might engender, what sort of security improvements might be made to it, and then work with entities that might help effect those changes, usually industry, but sometimes standards bodies, to try and make sure that some of those security improvements are in there before that technology becomes widespread.”

Ziring said the NSA would offer recommendations to help businesses use some products and emerging technologies as safely as possible. 

Chinese-produced 5G telecom equipment has become an issue of disagreement between the U.S. and some in Europe. But many institutions, businesses, some governments have quietly acquiesced to the fact that Chinese 5G equipment from makers like Huawei, will be in a lot of places in the future, despite the fact that Huawei’s products are highly vulnerable to attack from Chinese intelligence services (among other actors.)

Europe, which has declined to ban Huawei products, is moving toward a method of what might be called quarantined architectures. As senior vice president at the Center for Strategic and International Studies James Lewis explained in April, “They don’t let Huawei near their sensitive intelligence facilities, their sensitive military facilities.” 

Ziring said the new group would look at Huawei and other 5G equipment, asking, “How can it be used most safely? When can it be used for national security purposes and when might it not be so suitable? Understanding that stuff takes time. And experimentation...And collaboration with the folks who are developing or deploying the technologies, that’s where our Futures and Standards” group will come in. 

Of course, the NSA still has a longstanding mission of breaking into and spying on computers, phones, and networks. Should device makers, network administrators, and userstrust NSA to for advice on setting up a 5G network? The answer from Neuberger is: Yes. Really.

She says her directorate will speak out only “in the white-hat mission,” meaning to help friendly organizations stiffen their defenses.  “Those who break things know best how to secure them.”

She said the Cybersecurity Directorate will run entirely separately from, say, the Tailored Access Operations office.

“A big part of standing up a separate cybersecurity directorate was to convey the message that NSA has long had two missions: our cybersecurity mission and our foreign intelligence mission. I think that, in the past, when the Information Assurance Directorate came [into being], I don’t think that there was ever a question that that was a pure ‘white-hat mission,’” she said. 

What’s changed? The widespread adoption of IT and other new technologies have made the U.S. more vulnerable. “There are two lessons that our defensive mission needs to learn. One is they [adversaries] will take the easiest way in. And, if they are given national security intelligence leads, it’s their mission to achieve those,” she said. “We have some critical government networks, critical military networks, where a foreign adversary has been given direction to get and gain access and we want to ensure that the security advice that we’re giving is as sophisticated and as persistent as those kind of actors.” 

That says a lot about how the NSA has changed, at least in terms of public outreach, since the days of Edward Snowden. But it also says something about how cybersecurity has evolved.

The NSA has recently become more public in how it handles its foreign intelligence collection mission and the way it uses cyber effects to disrupt malicious behavior out of places like Russia. They’ve discussed how the NSA’s Russia Small Group intervened against Russian cyber efforts to disrupt the 2018 election and how the Cyber Command infiltrated ISIS communication networks to help bring about the terror group’s territorial loss. They’ve also been more public on their defensive mission and have shifted to offering more detail and context in the official NSA communications about threats.

In the future, there may well be some friction between the team that breaks things and the one that fixes. But right now, everyone is in the same room, watching the same threatening reality play out on the 47-foot screens.