The question(s) I have about the NSA aren't "Do they use Hadoop, Spark, S4, MPI, OpenMP, etc." but rather things like:
1. Do they already have a functional quantum computer, capable of rendering most modern encryption useless?
2. Do they have a mathematical breakthrough that allows them to factor products of large prime numbers multiplied together, far faster than anyone suspects - which would render most / all modern encryption useless?
3. Have they planted backdoors and vulnerabilities in popular, widely distributed hardware / software platforms?
Re: #3; can you seriously imagine that they can't take control of an MS-Windows PC, with or without MS's knowledge?
And you forgot a point: can they get an SSL root certificate signed for them, in order to perform MitM attacks on seemingly secured connections? Here again it's a foregone conclusion, several less technically-savvy countries have been caught doing that.
> Re: #3; can you seriously imagine that they can't take control of an MS-Windows PC, with or without MS's knowledge?
Can they take control of an MS-Windows PC without the cooperation of my router maker and my firewall maker? And what does it cost them to do so for the different makers?
You know? I'm fairly sure they can, after all if some kiddy off the internet can what are the chances they can't. But what's the cost to cover the different profiles? Is there a single point of failure?
Shouldn't be hard for the NSA to monitor your web browsing for a few days and then inject a 0-day for whatever browser you're using into an HTTP response from, say, HN, right?
If they've got to rely on the infrastructure provider to know what I've been looking at, then I assume that they don't have infrastructure in place themselves to arbitrarily do HTTP injection in a push button manner. May be wrong though.
What could we do about it if 1. were true? Not much.
For 2. I think it's safe to assume that they know a few tricks that we don't. Probably enough to hasten breaking encryption, but probably not enough to make encryption useless.
Well, there are some things we could do for 1. - switch to an algorithm not vulnerable to quantum computing, for example. I think NTRU would be an example of this.
I'm sure they can handle number 2 quite easily. The factors of any large prime number are the number itself and 1. What I think you meant, though, is can they factor the product of two large prime numbers (where the original primes are unknown to them). If that can be solved (without quantum computers), then I believe that actually opens up a whole range of solutions to other problems not related to cryptography.
Number 3 is the most likely, along with pushbutton tools that automate attacking and extracting information from endpoint devices. The market among state actors for zero-day exploits is documented, while the other possibilities are out there with other "secret weapon" theories that are predicated on fundamental scientific breakthroughs.
There are highly skilled and better financed tech companies with huge R&D teams. Why would the NSA be able to outperform them?
More to the point, they don't (presumably) have some secret pipeline of highly talented people. I mean, the pool of graduates in mathematics, statistics, computer science, etc., year in and year out, is available to everyone, NSA, other public sector, other private sector, etc. And while the NSA probably prioritizes hiring brilliant math wonks and what-not, so do wall street hedge fund companies, tech companies, etc. And given that at least some small percentage of "really smart people" would probably refuse to work for the NSA just on ideological grounds, I don't see any reason to believe that they have a monopoly on smart people who can do crypto research and what-not.
As for their financing, however... I don't know. I'm not real big on conspiracy theories, but I don't doubt the existence of secret budgets and "off the books" stuff to fund certain government programs. I mean, just go back to the Iran/Contra affair[1] and you can see that some sneaky stuff does go on, at least on occasion.
Absolutely. I'm not suggesting they don't have smart people, just pointing out that they don't have all of the smart people. Or at least that's my presumption.
To add another reference to your point, you must be a US citizen to work for the NSA. That alone limits their supply of the really smart people of the world.
What tech companies have an R&D budget of $125.6 billion[1] dollars a year? And that's just what's on the books. Who knows what is classified, "for our own good."
The NSA knew about differential cryptanalysis more than 10 years before academia and the general public. It's become cool to bash the NSA, but don't make the mistake of underestimating them. (Also, remember that the NSA is far, far larger than the CIA.) They have plenty of smart people working for them--in fact, a bunch of the most prominent researchers/personalities in the security community worked for the NSA in the past.
Unlikely. And given the secrecy surrounding their budgets, how could you know for sure? Even if you did, the dollars themselves are only part of the picture. The dynamic surrounding the money also has a big influence on how it can be used. A private company needing to post a profit operates under a set of constraints that are dramatically different from those that govern R&D in the military.
Also, unlike private R&D teams, the military can unilaterally classify and restrict entirely categories of hardware (e.g. GPS units that function over specific altitudes or above certain velocities). And they can seize (in secret) any instances that threaten national security.
That's a set of competitive advantages that the private sector, almost by definition, can never hope to match. Or at least not independently.
1. Do they already have a functional quantum computer, capable of rendering most modern encryption useless?
2. Do they have a mathematical breakthrough that allows them to factor products of large prime numbers multiplied together, far faster than anyone suspects - which would render most / all modern encryption useless?
3. Have they planted backdoors and vulnerabilities in popular, widely distributed hardware / software platforms?
etc.