Honest, maybe naive question, but what types of programmers actively help build and maintain systems like this? I turned down a job for a company that is less than a mile from my house because I viewed their business as immoral.
Hard for me to fathom anyone taking a job, helping to build systems like this. I get that many of the components of a system like this could be seen as harmless. However, a system of this complexity must have some talented engineers bringing it all together and making it work. How can they feel good about what they are doing?
One of my first jobs was at a company that sold and serviced surveillance equipment to school districts. It's a slippery slope where you can first focus on the good aspects -- murder cases solved -- but eventually encounter information that you have to make an ethical judgement on wether you are willing to play a role in implementing such technology. For instance, testing began on systems that could capture both audio and video and I became uncomfortable because kids say stupid things that can be taken out of context. I make no claims that audio surveillance was installed, but the casual nature of doing R&D on such systems without considering the implications became too uncomfortable for me to take part of.
The NSA sells the job to naive college students on patriotism and generic descriptions of working with cutting edge cool stuff. Once you're in, it's easy to rationalize that all this will be used only for good. Especially if the alternative is quitting your stable job that supports your family.
Many of the low-level analysts are very smart enlisted personnel with ranks of (E1 to E5) from among the various services. Many of them use the GI Bill to pay for college. Some stay in the IC, while others move one to different careers.
They're probably not thinking of it as immoral. Most likely they actually do believe they're improving national security by doing this.
Or they just like the paycheck, that's a big possibility. I imagine the NSA is probably happy to pay a lot with a large amount of bonuses to keep people in roles.
This sentiment was also echoed by Snowden in the original video interview. He supposedly had greater insight as to how civil rights at large were being violated, only because as a sysdmin he (and not others) had a broader picture of what was going on, and at what scale it was going on.
So, it's easy to imagine NSA recruiters coaxing potential hires with convincing lines like "we have internal courts, procedures, and checks and balances systems to prevent abuse of citizens' privacy".
In a profile on Palantir (which sells tools that help with this sort of thing), one employee was quoted as saying "this really is about saving the Shire". Had to laugh.
I remember that (I think it was in Wired), and it struck me as a basic naivety on their part as when they were building it they were thinking about catching bad guys without realising the line between who's a good guy and who's a bad guy is determined way above your head.
In the spirit of the 'Shire' quote they should have also realised 'with great power comes great responsibility'. No one has demonstrated that they are responsible enough to have that level of power over millions of people.
The opportunity to work on a cutting-edge technical problem at scale most would never get to touch. That's a very tempting proposal. The secrecy itself probably also appeals to some folks.
I'd also imagine that a lot of folks only work on one small part of this, that in and of itself, is not objectionable. Where it becomes scary is when you expand the scope to cover every US citizen regardless of wrongdoing.
I guess some people are in it for the money. Some probably like the technical challenge. But I'm sure there are also quite a few that believe this system really is preventing terrorism, following the law, and not doing anything wrong.
There's something more important than money and technical challenge.
It's called Power.
I can now look into any person's email and whatever legally. You and I may get a squishy feeling in the stomach about this but I can tell you that 1 out of 2 people will be OK with this if they aren't called out. (like watching porn, most people won't admit in front of kids and their parents but they will do it because they think they won't get caught)
I have asked this same question myself. It's stunning that only one sys admin has come forth with this information. Further, politicians and higher business officials in companies usually don't know what computers are capable of, which leads me to believe that it's actually programmers who are suggesting that such horrifying systems be built (for example, no politician is going to say "let's make a copy of every piece of internet traffic everywhere." The programmer says "We can copy everything," and the politician says "Ok, do it"). The only excuse I could imagine that a programmer would tell themselves is "This is just my job, and I'm just building the software, but it's the government that's going to be using it, not me, so I've done nothing wrong."
Seems to me that people aren't too concerned of nameless, faceless people looking through their stuff so long as people they know (parents, spouse, friends..) don't see it.
You know, probably one of the best things that could happen is for someone to pour out nsa data indiscriminately and en masse in order to just outright humiliate hundreds of millions of people.
THAT certainly wouldn't risk an apathetic response.
It would be good if people realized how snooping is connected to poverty. In my scenario, snooping is used to gain business secrets. These are used to undercut businesses, resulting in lower wages and poverty.
E.g. Chinese hackers steal plans for American-designed products. Instead of Americans working, building and selling the things we consume, inexpensive imported versions are available b/c those companies didn't pay for the overhead of design and didn't take any risk. We need to protect ourselves from this.
I have "friends" (read: we mostly argue about this) who fit your description.
They will tell you that there are rules in place to prevent spying on Americans (and if you take a look at the Foreignness Factor screenshots, there is a sense in which this is true)
They will also tell you that the benefits outweigh the cost. Here we have a system that has allegedly caught 300 terrorists, and they would tell you that spying on foreign people to catch 300 terrorists is a good trade.
I disagree with them on both counts, but you asked what they would say.
Okay, so if ~3,000 people died in the 9/11 attacks, and we prevented 300 of those, then that saves 900,000 people.
But in order to save 900,000 people, it required a bold attempt to eavesdrop on all ~1.3 billion people currently using the entire internet, leaving us with an efficiency of 0.1%.
Not only that, but the process needed to occur continuously, for a decade, ramping up, over time.
But wait! It took nearly 20 hijackers to accomplish one 9/11, so that means it only stopped 15 9/11's in a decade, or rather 1 and a half per year.
So that means we saved 4,500 people a year, by eavesdropping on over one billion each year.
But remember, when you tally up all those ten long years of life saving:
Those 45,000 people weren't just ordinary human beings...
They were Americans.They were Freedom.
And at the end of the day... well... ✼sniff!✼ I think you and I both know that you can't put a price... on FREEDOM.
Times are hard and if it's a choice between your personal morals and feeding your kids or ensuring that your home doesn't get repossessed then there are likely to be plenty of programmers willing to make the compromise.
Clearly a very smart guy, that went very far in the NSA -- and for a long time felt he was doing "the right thing" -- but eventually quit because of what the NSA were doing.
edit: He also touches on how compartmentalization leads to people not knowing what they're actually working on/how it will be used in some cases.
The internet is a public space. Unless you're using full client-side cryptography, one should not assume their activities are private, just as one doesn't assume their physical activities are private if they're done in the open in the public square. Using client-side crypto is the equivalent of entering a private residence; you can't just sit out in the open and expect privacy, you have to take special effort to keep your activities private.
Hard for me to fathom anyone taking a job, helping to build systems like this. I get that many of the components of a system like this could be seen as harmless. However, a system of this complexity must have some talented engineers bringing it all together and making it work. How can they feel good about what they are doing?