Slashdot Mirror
Lawmakers Move To Block Government From Ordering Digital 'Back Doors' (thehill.com)
A bipartisan group of House lawmakers have introduced legislation that would block the federal government from requiring technology companies to design devices with so-called "back doors" to allow law enforcement to access them. From a report: The bill represents the latest effort by lawmakers in Congress to wade into the battle between federal law enforcement officials and tech companies over encryption, which reached a boiling point in 2015 as the FBI tussled with Apple over a locked iPhone linked to the San Bernardino terror attack case.
Top FBI and Justice Department officials have repeatedly complained that they have been unable to access devices for ongoing criminal investigations because of encryption. FBI Director Christopher Wray has suggested that devices could be designed to allow investigators to access them, though he insists the bureau is not looking for a "back door." The bipartisan bill introduced Thursday would prohibit federal agencies from requiring or requesting that firms "design or alter the security functions in its product or service to allow the surveillance of any user of such product or service, or to allow the physical search of such product" by the government.
Top FBI and Justice Department officials have repeatedly complained that they have been unable to access devices for ongoing criminal investigations because of encryption. FBI Director Christopher Wray has suggested that devices could be designed to allow investigators to access them, though he insists the bureau is not looking for a "back door." The bipartisan bill introduced Thursday would prohibit federal agencies from requiring or requesting that firms "design or alter the security functions in its product or service to allow the surveillance of any user of such product or service, or to allow the physical search of such product" by the government.
Finally some good is being done. This will put the kibosh on the issue for good and silence federal law enforcement. No good comes from weakening encryption or building in back doors; quite the opposite. It's not a matter of if but when the backdoors get discovered and become used for nefarious purposes. I am glad this has bipartisan support, and since it does, the likelihood of it getting passed is that much stronger. We don't need to live in any more of a surveillance state than we already do. It's one thing if the FBI or whatever other LEO agency discovers a vulnerability and exploits it. Hey this does happen. It's a whole other thing to have secret back doors built in. No! Just no!
Or push for immunity from prosecution when they DO illegally backdoor products, like they have been for 20+ years now (Go read up on the cisco and juniper backdoors, and I think a few of the smaller players too!)
"The security aspect of cyber is very, very tough. And maybe, it's hardly doable."
I know I personally feel great entrusting the security of the American people to a bunch of geriatrics who worry about "the cyber".
- Vincit qui patitur.
I'm a conservative. #NeverTrump
Virtually all congresscritters vote on all the bills without ever reading most of them, especially budgets. I only know of one representative in Congress who has ever read a federal budget. Paul Ryan WROTE, not just read, multiple federal budgets. For any and every congresscritter, I can find areas where we disagree as to the best policy. Ryan is no exception, I don't fully agree with anyone, on everything. He is also by far the best informed, smartest person we've had in Congress in many years. And squeaky clean on ethics. Whikle he doesn't always come to the same conclusions I do, his conclusions are based on *really* knowing his stuff, knowing wtf he's talking about. Frankly, me disagreeing with Paul Ryan about federal policy is like me disagreeing with Stephen Hawking about physics theories - we both have our own opinions; one of us knows wtf they are talking about it, and it isn't me.
Paul Ryan's departure will hurt the country when he's replaced with another "we have to pass the bill to find out what's in it" person.
I also want to see:
1. Mandatory Disclosure of KNOWN security bugs in a consumer product by any governmental entity, First to the manufacturer for a designated "Fix" period, after which, all vulnerability details shall be available to the public through FOIA request.
2. NO HORDING DEVICE OR SERVICE EXPLOITS: A security researcher, company, member of law enforcement, government, or any other party having accidentally, or intentionally: a successful defeat for a security measure on any common consumer product, OR public service must minimize the amount of proprietary or other users' data exposed during any proof of concept testing, and make minimal efforts to fully disclose their activities and all details of potential vulnerabilities to the operator of the service within 15 days of discovery, or they shall be deemed liable for holding means of fraudulent access with intent to commit a crime and fined the estimated value of the exploit not less than $10000 for a natural person, and not less than $100,000 for other persons.
3. Prohibition against selling for a profit, importing, trafficking in, or incorporating PAID security exploits, PAID software, or COMMERCIAL devices that are designed with a specific built-in function to defeat security measures or intercept data by falsifying network or over-the-air signals or "impersonating" another device into a commercial product, or conducting security exploits in the course of business, except if the course of business is pentesting and the exploit is used in the course of business against ONLY systems fully owned by the customer within the scope of a security testing engagement, OR If the complete source code for all software and design specifications for all hardware and details of all exploits are disclosed to the public 30 days prior to the sale or release of the commercial product.
4. Mandated Disclosures by MANUFACTURERS of the existence of ALL intentional security backdoors and remote means of access into any consumer or commercial smart phone, computer, appliance, or network device with criminal penalties for failing, AND public disclosure of any foreign governments or persons/organizations outside the manufacturer or outside the US that will have Access Credentials, Backdoor Access Procedures, Security Keys, or other Digital Signing or Decryption keys that are significant and could be used to exploit a device.
Yes, this is a continuation of an effort that began when some in Congress thought that the FBI was lying to them about their efforts to force Apple to crack a phone.
The reps who introduced this bill are:
Rep. Zoe Lofgren (D-Calif.) introduced the legislation along with Reps. Ted Lieu (D-Calif.), Jerrold Nadler (D-N.Y.), Matt Gaetz (R-Fla.), Thomas Massie (R-Ky.) and Ted Poe (R-Texas).
Reps involved starting in April were:
Zoe Lofgren (D-Calif.), Darrell Issa (R-Calif.), Jerrold Nadler (D-N.Y.), Jim Sensenbrenner (R-Wis.), Ted Lieu (D-Calif.), Ted Poe (R-Texas), Jared Polis (D-Col.), Matt Gaetz (R-Fla.), Suzan DelBene (D-Wash.) and Jim Jordan (R-Ohio).
Remember AT&T installed traffic monitoring equipment in their San Francisco switching office at the behest of the NSA?
Illegal under FISA.
In 2008 Bush signed the FISA Amendments Act which granted retroactive immunity to telecommunications companies for past violations of FISA.
Good point! We should just allow an authoritarian police state to be formed instead!
If it wasn't clear above, they just introduced this bill in House of Representatives. Rand Paul is a Senator. The bill has a long way to go before Paul would be looking at it.