Here’s a bigger question, with 1,000 people who can do whatever they want and get their hands on almost any data they want it sounds like, how many of them have been bribed to work for foreign governments?

If they can access this information so easily like Snowden could, and they can cover up their tracks so easily like Snowden did, that makes ALL of them a very tempting target for a foreign government to bribe.

They don’t know what Snowden took and now they’re firing another 900 just like him. What are they leaving with?

OK, I’m not paranoid but…. I think everyone needs to make themselves as small a target as possible. Start encrypting phone calls, emails, text messages, browsing. Stop storing files on Dropbox, in Gmail, in iCloud, etc., and stash everything in a Cloudlocker (www.cloudlocker.it) which stays in your house where they still need a warrant to look inside.

What a shame it’s come to this, but we have to protect ourselves from the people who are supposed to protect us.

As tech-heavy as they are, the NSA is a very large and (in tech terms) relatively old organization, and a government one at that. From those characteristics, we can extrapolate from similar (but not secret) organizations to make certain guesses. For example, they’ve probably had an attempted upgrade turn into a major screwup with huge cost overruns and lots of management ass-covering. It happens in the military, it happens in government, it happens in private industry.

We can also guess that they have lots of legacy tech to maintain. Specialized old hardware and software that has to be kept in place for specific intelligence-collecting missions, but that doesn’t integrate well with more up-to-date systems. Keeping these systems working would require specialized employees with significant system privileges.

We can also guess that their bureaucratic structure and security requirements will sometimes delay new technology. If, for example, they were using a custom in-house linux fork, then any improvements and bugfixes have to jump through the obvious hoops.

That’s all straightforward, and can be streamlined. But it also means that those old systems — the ones that mostly work, don’t seem like a big risk, and would be a huge effort to replace, may be continued nearly indefinitely. It also suggests to me that remodeling old tech might sometimes be bureaucratically preferred over new construction. How many lines of Fortran 77 do you reckon the NSA still has deployed? Of Cobol? Ada?

My guess is the NSA has some really nasty system integration/ESB/API-genre problems. In addressing these, upper management lacks the technical expertise, but demands solutions, so middle management looks the other way when nerds cut corners on security stupidity (cf. sysadmin privs) to get results.

Yes, the intelligence agencies are very good at hacking – it’s their equivalent of the money-making part of their enterprises. As a result, data-collection is where they spend the bulk of their money and place the most brain-power/skills. However, like the vast majority of enterprises, IT administration is simply another cost-center. As such, those costs are controlled to as great a degree possible – moreso given current budgetary trends. This means that administration is happening at “lowest bid” rates.

The plus side of this is that, while there may be 1000+ individuals that have sufficient access to do something Snowden-esque, there’s a very small fraction that have the skills to even begin to try to take advantage of that access. Smaller still is the number that, even if they had the skill to take advantage of that access would not voluntarily nor could be induced to do so.

You can see this reflected in any IT services organization: the billable guys tend to be the most clueful folks while the back-office guys tend to be lower-tier skills. Think of the guy doing desktop support at a Fortune 500 and that’s what the vast majority of the 1000 SAs are like in government IT.