Why doesn't simply being disconnected from the internet and located in the middle of nowhere Utah locked in a super-secure fortress with the best network engineers, computer experts, and cryptologists suffice?
Because nobody can use it there. You might as well put it at the bottom of the ocean -- or not collect it in the first place. At some point you have to give agents in the outside world a way to use the data or it's totally worthless, and then you have an exploitation vector.
Am I giving the NSA too much undeserved credit?
There is always a difference between best-in-class and infallible. And the problem is that you only have to be wrong once.
Cryptographers have a saying. Encryption is like a single fence post which is a thousand miles high. You're not likely to break the encryption, but it doesn't do you any good if the attacker can just go around it. Find a weaker link in the chain: Poor passwords, social engineering, bribery, good ol' fashion espionage, etc.
Comments
Because nobody can use it there. You might as well put it at the bottom of the ocean -- or not collect it in the first place. At some point you have to give agents in the outside world a way to use the data or it's totally worthless, and then you have an exploitation vector.
There is always a difference between best-in-class and infallible. And the problem is that you only have to be wrong once.
Also, this: https://news.ycombinator.com/item?id=5848148
Not to mention they have to get the data to the top secret offline location and it can be intercepted before it gets there.
Encryption? They're pretty good at it.
Cryptographers have a saying. Encryption is like a single fence post which is a thousand miles high. You're not likely to break the encryption, but it doesn't do you any good if the attacker can just go around it. Find a weaker link in the chain: Poor passwords, social engineering, bribery, good ol' fashion espionage, etc.