Rob  ☃️ Graham (not at Shmoocon this year)

Whenever I work with government, I see the same paradox pretty much everywhere. Everyone agrees with a statement in principle, while disagreeing in practice.https://twitter.com/SquirrelBuddha/status/1215043178509635584 …

That government over-classifies things is a well-known problem (making things government secrets that don't need to be). Everyone criticizes it, convinced it's what other people do. But then when it's their turn, they over-classify things.

When they want to cover their own ass, they find reasons to justify it, even while they see through the transparent excuses their opponents have for covering their ass.

Or, they know it's being over-classified, but it's simply not worth the political capital and damage to stick their head out and oppose the classification.

The NSA does not spy on Americans. It's a principle that pervades the NSA. So when Snowden revealed the NSA was indeed spying on Americans, the response was "that's absurd, we would never do that, it's not the same thing".

To be fair, in many ways the NSA is right, it's not the same thing, and they very much WANT to not spy on Americans. But at the same time, it's a delusion, and they really are spying on Americans sometimes.

Also to be fair, it's not what you think, there's little chance they'll spy on Hunter Biden and give that info to Trump for political purposes. But at the same time, doing things like grabbing everyone's phone records for arbitrary searches is still "spying on Americans".

Back to the original thread, everyone agrees that our own hackers should attack us first to expose then fix our weaknesses. In practice, if you do so, you are at extreme risk to your career and safety.