Nah I'm not above anyone in fact, I learn just as much as everyone else does. I've been into intelligence as a hobby for about 15 years beginning with cypherpunks, cryptome, politechbot, globalsecurity, Orlin Grabbe (RIP) etc. and I ran my own "cryptome" like site for a while (*edited and fixed this link http://web.archive.org/web/*/http://politrix.org). Prior to that, I had a crypto only site for a whole (http://web.archive.org/web/*/http://venona.antioffline.com) so I read a lot into military/government strategies. I guess I have a little more experience with a lot more things than other people, but doesn't mean I'm smarter... Just more experienced.

There is a heavy shift into politics where this is concerned (Stuxnet) which is like a wetdream to many computer security companies and one has to remember, security is a multibillion dollar industry. The cost associated in marketing to "shut someone up" is akin to paying Forrester or Gartner to do research.

Let's take a quick look at the cost benefit of something like this....

Company X is a billion dollar security company. They develop products to "protect" the infrastructure. They have the capability to spend at MINIMUM 500,000.00 in marketing, write-ups, analysis', etc. which is peanuts. Creative accounting will allow them to write this off.

In their "preps" and "analysis'" of Stuxnet and similar threats (which they will googly-eyed now defend against for the right price), they market/saturate the public with "the world is coming to an end" writings. Total cost, let's be obnoxious and say they spend $5,000,000.00 in marketing, analysis, personnel, etc. What do you think the return would be if ONE large company forked out cash for their products?

Certain industries (AV, SSL Cert Cartels, etc.) have the FUD game down to a science. It doesn't make sense to post real world information because 1) no one wants to hear it. Besides it sounds more "Jason Bourne" and thrilling to spew fiction 2) Sex sells, well so does "rogue governments" ... How many contracts do you think sprouted up after Titan Rain and Advanced Persistent Threat?

What's amusing is that for all the "security" these products tout, they're extremely horrible at getting it down to a science so they tend to shift things. Where Intrusion Detection became Intrusion Prevention to now Intrusion TOLERANCE (sorry I don't want to tolerate intrusions). If one takes a moment away from the "hype" and looks at things on a most basic level, seriously ask yourself, if you were that rogue agency in government, would you waste your black budget dollars on a big "what if.." kind of exploit Stuxnet IS (not was).

Sure Stux was targeted and focused, but it wasn't anything uber-grandiose that made me want to "stop the press." I have friends on AIM which at the flick of an IM could whip up better more covert things before going to bed.


(FYI I edited my comment to add the politrix link if anyone is wondering)