NSA warned Bush it needed to monitor networks

[dan at geer.org]

John Kelsey writes:
 | I think a bigger issue here is a sort of rational (to the bureaucrat) risk a
  | versity: if he declassifies something and it turns out he's leaked somethin
  | g valuable (in the eyes of his boss), he's in trouble.  As long as there's 
  | no cost to stamping "secret" or "FOUO" on every document his office produce
  | s, this is safer for him than any other course of action.   Along with this
  | , going through a document to make sure there's nothing secret in there is 
  | a lot more work than just classifying it.  The same logic works in the priv
  | ate world--how much of the stuff you've seen under NDA was genuinely going 
  | to cause a problem to the company that produced it, if someone just posted 
  | it to their website?


Exactly correct.  It is the same reason that
no corporate general counsel will allow data
on successful intrusions to be shared; the 
downside risk is well understood and the upside
benefit is vague, delayed, and does not accrue
to the releasing party.  

Cf. mandatory reporting of communicable diseases
where, presumably, few patients or private docs
would ever voluntarily report that there's a
case of Plague in the house were it not for
compelled disclosure.[1]


--dan


[1]
sample state list, to which you can add gunshot wounds
======================================================
Acquired Immunodeficiency Syndrome (AIDS)
Amebiasis
Anthrax
Botulism
Brucellosis
Campylobacteriosis
Cancer
Chancroid
Chickenpox
Chlamydial Infections
Cholera
Coccidioidomycosis
Colorado Tick Fever
Diphtheria
Echinococcosis
Encephalitis (post-infectious, arthropod-borne, and unspecified)
Food-borne Illness, including food poisoning
Giardiasis
Gonococcal Ophthalmia Neonatorum
Gonorrhea
Granuloma Inguinale
Hemophilus Influenza, Invasive Disease (all serotypes)
Hepatitis A
Hepatitis B, cases and carriers
Hepatitis, other Viral: Type C
Influenza
Legionellosis
Leprosy
Leptospirosis
Lymphogranuloma Venereum
Malaria
Meningitis, Aseptic and Bacterial
Meningococcemia
Mumps
Pelvic Inflammatory Disease
Pertussis
Plague
Poliomyelitis
Q-fever
Rabies (Human and Animal)
Relapsing Fever (tick-borne and louse borne)
Rheumatic Fever
Rocky Mountain Spotted Fever
Rubella
Rubella, Congenital Syndrome
Rubeola
Salmonellosis
Shigellosis
Staphylococcal Diseases
Syphilis
Tetanus
Toxic Shock Syndrome
Trichinosis
Tuberculosis
Tularemia
Typhoid
Typhus
Yellow Fever




---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at metzdowd.com