Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


08:16 PM
Thomas Claburn
Thomas Claburn
Connect Directly

NSA Surveillance: IT Pro Survey Says What?

To understand the relationship between security and privacy, we should pay more attention to IT professionals and spend less time asking loaded questions.

A majority of Americans who don't understand security find the National Security Agency's use of secret court orders to collect phone and email data acceptable. IT professionals, however, see things differently.

When the Washington Post published the results of a Pew Research poll on the subject last month, it concluded that most Americans (56%) accept NSA data collection, even at the expense of privacy, as a defense against terrorism. But it didn't characterize its 1,004 survey respondents as ignorant about computer security.

Stu Sjowerman, CEO of security training firm KnowBe4.com, did so indirectly. He posed the same survey questions, via SurveyMonkey, to more than 1,500 IT professionals — people who do understand computer security — and came to the opposite conclusion. In Sjowerman's survey, some 70% said the NSA's actions were unacceptable, compared to 41% in the Washington Post-Pew survey.

[ Learn more about the role major companies have in NSA surveillance. Read Microsoft Helped NSA Siphon Hotmail, Skype User Data. ]

Sjowerman, in a phone interview, said he decided to replicate the Post-Pew survey because he "didn't think that people really understand the implications [of the NSA's data gathering], especially long term."

There are two major issues. "One, if you do this kind of dragnet long-term," said Sjowerman, "you're creating a profile of everyone in the U.S. That is totally, as far as I'm concerned, violating the Fourth Amendment. Two, the U.S. government doesn't have a very good record of keeping everything secure. There will be data breaches."

Some 654 respondents offered a written explanation of their thoughts on the matter. Their answers for the most part echo Sjowerman's views.

"Too many law enforcement agencies have demonstrated they cannot be trusted and often put themselves above the law to achieve their goals," said respondent #4. "Those goals are not always in the best interests of citizens, but more often seem to favour large corporations or the rich and powerful."

Respondent #231 wrote, "Law enforcement officials do have a legitimate need to access some private information and communication, but such access must always be authorized beforehand by a properly executed warrant, limited to a very specific scope and duration, conducted under the oversight of the judge who issued that warrant, and cannot be done off record under a veil of secrecy. The rights of the people must not be trampled under a stampede towards security."

There are other viewpoints too, some who gladly surrender their privacy for what they perceive as security and others who see negligence in the intelligence community and its contractors for allowing Edward Snowden, the 29-year-old fugitive whistleblower responsible for exposing the scope of the NSA's activities, access to so much information.

But the takeaway here is that all surveys are not created equal. It's doubtful anyone would seek surgical advice from bar patrons, parachuting instruction from preschoolers or nautical knowledge from those who shun the sea. Asking average Americans their views on NSA data collection just isn't good enough. Some domain experience is necessary to reach an informed conclusion.

And not all questions are created equal. Consider this question, posed both by Pew and Sjowerman: "As you may know, it has been reported that the National Security Agency has been getting secret court orders to track telephone call records of MILLIONS of Americans in an effort to investigate terrorism. Would you consider this access to telephone call records an acceptable or unacceptable way for the federal government to investigate terrorism?"

The problem is that once you throw "terrorism" into the mix, the discussion ends. Only terrorists support terrorism, right? But as others have noted, the chance of being killed in a terrorist attack is extremely low. Reason in 2011 put it at one in 20 million, noting that in the past five years a person would be four to five times more likely to be killed by lightning than by a terrorist. (The recent Boston bombing may have shifted the odds a tiny bit.)

Would the average American be as accepting of the NSA's data gathering if the stated reason were to protect people from a bolt from above? Or imagine a much more hostile U.S. administration. Recall that President Nixon kept an enemies list. With the data squirreled away on NSA servers, imagine what one could do.

Then again, imagination is the real problem here. We imagine a fearful world. We might be better served if we imagined less and listened more to people with real-world privacy experience. To understand the relationship between security and privacy, we should pay more attention to IT professionals and spend less time asking loaded questions. We can find a balance without throwing away the Constitution.

Comment  | 
Print  | 
More Insights
Oldest First  |  Newest First  |  Threaded View
User Rank: Apprentice
7/16/2013 | 9:19:38 PM
re: NSA Surveillance: IT Pro Survey Says What?
User Rank: Apprentice
7/17/2013 | 12:50:27 AM
re: NSA Surveillance: IT Pro Survey Says What?
Very good point. Let knowledgeable people in on the operational detail of NSA systems and see what critique, what feedback they can give us. Law enforcement without public watchfulness tends to go outsde the law. With public watchfulness, it's much more accountable. I also agree the chances of being killed in a terrorist act are infinitesimal. On the other hand, note the difference in the second attack on the World Trade Center from the first, where the intent of setting off a van loaded with conventional explosives in the parking garage was to topple the building.The first try failed, What followed was plan B. Soon we'll be at plan C, I regret the circumstance, but at some point, we will want to know everything we can about the plan. Charlie Babcock
User Rank: Apprentice
7/17/2013 | 1:41:05 PM
re: NSA Surveillance: IT Pro Survey Says What?
Interesting. And this is very good point: "And not all questions are created equal."

Jim Donahue
Managing Editor
User Rank: Ninja
7/18/2013 | 11:12:59 AM
re: NSA Surveillance: IT Pro Survey Says What?
56% of the people agree? That is the same 56% that also are in favor of banning gay marriage, banning abortion (because it kills life), extending the death penalty to petty crimes, having a right-wing extremist Republican as president, and making gun ownership mandatory. Who did the Washington Post ask? The same 1,001 cleverly selected people to get a good headline? Or is the majority of people really that dumb and uninformed?
Thankfully, folks in IT see it differently and hopefully they have the guts to object when ordered to provide data to organizations outside of the company. If data doesn't even leave the premises in the first place we do not need heroes like Snowden.
Cara Latham
Cara Latham,
User Rank: Apprentice
7/18/2013 | 1:03:21 PM
re: NSA Surveillance: IT Pro Survey Says What?
Respondent #231 hit the nail on the head. There is a need for law enforcement to obtain some data as a matter of public security, but I would agree that there needs to be a legitimate reason for that access. Collecting a treasure trove of information about citizens -- even those who are not a threat -- does violate constitutional rights, and the laws must be adjusted so as to not allow the government to overstep its boundaries in the name of security. More oversight is definitely needed.
User Rank: Apprentice
7/18/2013 | 4:50:58 PM
re: NSA Surveillance: IT Pro Survey Says What?
Some cybersecurity tips government agencies can benefit from http://themodernnetwork.com/se...
User Rank: Apprentice
7/19/2013 | 9:50:49 PM
re: NSA Surveillance: IT Pro Survey Says What?
I think you will find the people that agree are more likey to be the ones that voted for the current administration. I haven't seen a lot of Democrats leading the charge to stop this abuse of power. Barring that, your salivating divisive rhetoric is shameful. Every American from all political leanings should unite to resist this attack of our constitutional rights. I will stand with any man or woman, without regard for their politics, to stop this totalitarian policy. That includes you.
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This gives a new meaning to blind leading the blind.
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-06-16
There is a XSS vulnerability in the ticket overview screens. It's possible to collect various information by having an e-mail shown in the overview screen. Attack can be performed by sending specially crafted e-mail to the system and it doesn't require any user intraction. This issue affects: OTRS A...
PUBLISHED: 2021-06-16
A deserialization flaw was found in Apache Chainsaw versions prior to 2.1.0 which could lead to malicious code execution.
PUBLISHED: 2021-06-16
Insecure storage of sensitive information has been reported to affect QNAP NAS running myQNAPcloud Link. If exploited, this vulnerability allows remote attackers to read sensitive information by accessing the unrestricted storage mechanism. This issue affects: QNAP Systems Inc. myQNAPcloud Link vers...
PUBLISHED: 2021-06-16
Rapid7 Nexpose is vulnerable to a non-persistent cross-site scripting vulnerability affecting the Security Console's Filtered Asset Search feature. A specific search criterion and operator combination in Filtered Asset Search could have allowed a user to pass code through the provided search field. ...
PUBLISHED: 2021-06-16
tEnvoy contains the PGP, NaCl, and PBKDF2 in node.js and the browser (hashing, random, encryption, decryption, signatures, conversions), used by TogaTech.org. In versions prior to 7.0.3, the `verifyWithMessage` method of `tEnvoyNaClSigningKey` always returns `true` for any signature that has a SHA-5...