'Black' budget purchases

[Michael Wilson <0005514706@mcimail.com>]

Cypherpunks:

	---	The following is posted by Tim May	---
I didn't comment before on Michael Wilson's revelations about the
Maryland Procurement Office (and how it revealed NSA purchases). But I
will now.

He writes:

> Michael Wilson
> Managing Director, The Nemesis Group
> 
> [I hope that the record of purchases made through the Maryland Procurement 
group
> are making their way from systems such as Mead Data and into private systems 
for
> analysis; warning, access of such data is expensive.]

Actually, there are much cheaper way to get even more accurate data.
Gunter Ahrendt has been the compiler of a list of supercomputer sites,
a list which he publishes weekly in comp.sys.super. (I haven't seen it
recently, so it may be dormant for the summer.)

Here's an excerpt for the NSA and CSS:

2) 83.73 - (02-JUN-1993) [NSA]
        National Security Agency,California,US
        1) 3 * Cray C916-512  83.73

3) 69.79 - (22-JUL-1993) [CSS]
        National Computing Security Center,Central Security
Service,National
        Security Agency Headquarters,Fort George G Meade,Maryland,US,
        postmaster@ftmeade-eas.army.mil
        1)     TMC CM-5/512     ~35.04  {linearly scaled from a 64CPU
unit}
        2) 5 * Cray Y-MP/8-256   34.75

etc.

I don't discount the possibility that NSA, CSS, NRO, etc. try to hide
some of their purchases--certainly in budgets, if not physically. But
in general they have little to gain by hiding the fact that they have,
for example, 8 Connection Machines. After all, Thinking Machines knows
(purchase, service), and word gets out.

Ahrendt has had good accuracy.

In any case, the number of supercomputers the NSA and its related
affiliate agencies have is not too worrisome to me.

--Tim May

---	end of inclusion	---

The data from the Maryland Procurement Office that is stored in certain 
databases (and removed from others, as I have just discovered when I checked) 
provides the complete 'black' budget purchases of the intelligence community, 
not just their purchases of supercomputers.  Such raw data goes a long way 
towards confirming other bits of intelligence, such as the establishment by NSA 
of its own chip manufacturing facility owing to a lack of trust in undocumented 
sections of commercial silicon.  This data is useful beyond knowing the numbers 
of supercomputers available (although it does help provide an upper boundary on 
raw processing power, useful for quantifying tolerances).

What we find interesting regarding the number of supercomputers at NSA is what 
they do to the keyspace; a supposition of ours from the early period of 
commercial public key was an attack on the domain of potential keys.  Given a 
known keylength, a powerful systematic search for primes that fit that range 
can, over time, begin to damage the strength of the system.  Careful analysis of
technical resource also allows one to speculate--are CM platforms (pardon the 
pun) used for exhaustive systematic search for keys, while Cray systems are used
for attacks on the keyspace?  Differentiation of parallel versus scalar 
processing towards attack domains is interesting.

Additionally, having such information is useful beyond its application towards 
analysis.  Operationally, it is useful for an adversary to know, for instance, 
that photo recon analysis is performed on NeXT workstations.  This knowledge 
provides specifications on just what can achieved in the way of image 
enhancements, etc.  It also opens up a realm of options in informational 
warfare; knowledge of the target platform is critical toward building a tailored
attack mechanism to cripple their capability, while knowledge of their providers
supplies an adversary with the introduction mechanism (there is no such thing as
an isolated system).

Michael Wilson
Managing Director, The Nemesis Group
The Adversary