15 ms·

Senate encryption bill draft mandates 'technical assistance'

389 points by chlodwig 11y ago

etjossem 11y ago
"A covered entity that receives a court order for information or data shall provide such information or data in an intelligible format; or provide such technical assistance as is necessary to obtain such information or data in an intelligible format or achieve the purpose of the court order." Okay, so I get that the main section of the bill requires companies which provide encryption to decrypt data upon receiving a court order demanding access to it. If the company is capable of decrypting its customers' data, that's a scary thought. But it's followed by two very conflicting subsections: (b) nothing in this act may be construed to require or prohibit any specific design or operating system to be adopted by any covered entity, but (c) a provider of remote computing services to the public shall ensure such products are capable of complying with a court order to decrypt. It seems like this could be read as "you must build backdoors", but also as "we're not telling you how to architect your product." These two sections are completely at odds. By the way, Scribd sucks. Have a downloadable PDF: https://josephhall.org/f0eabaa89b8ee38577bf7d0fd50ddf0d58ecd27a/307378123-Burr-Encryption-Bill-Discussion-Draft.pdf https://josephhall.org/f0eabaa89b8ee38577bf7d0fd50ddf0d58ecd... (it's still just non-OCR'd images though :<)
- msandford 11y ago
  Roughly paraphrased: "We don't care what kind of lock you build, so long as you build one that you can always unlock for us. We're not mandating any particular design, but you have to unlock it on demand." That's not really a lock, then, is it?
  - gknoy 11y ago
    It worked for the TSA.
    - bovermyer 11y ago
      And as a result, the TSA destroyed a hot sauce boxed set I had in my luggage. I learned my lesson; now I just buy new clothes/toiletries/etc. at my destination rather than take anything at all with me.
      - korethr 11y ago
        Another option is to start flying with something that qualifies as a 'firearm' in your luggage. Such requires actual proper locks that only you can open. There was a talk on this at DEFCON 17 https://www.youtube.com/watch?v=KfqtYfaILHw https://www.youtube.com/watch?v=KfqtYfaILHw Obviously, this only works in the US. Other countries will have different laws on the ownership and transport of firearms.
        bovermyer 11y ago
        The other complications surrounding that would make this option more trouble than it's worth for me. I'll stick with the no-luggage route!
        EdHominem 11y ago
        Only in the USA does taking a gun with you make the airport easier. Pro tip: pack the gun at home.
  - nickpeterson 11y ago
    To be fair, it's exactly a lock, well understood and easy to circumvent (like the keys to your house).
    - msandford 11y ago
      And just like the keys to my house, it requires an actual live physical human being to transport itself through meatspace at a non-relativistic speed in order to perform said circumvention, right? Oh, it doesn't? Hmmm.
      - mortenjorck 11y ago
        This is why I'm hoping we can ultimately just let go of all these analogies for encryption. Analogies are training wheels, and if we leave them on for too long, we risk propagating the idea that all bikes have four wheels.
        dredmorbius 11y ago
        All models are wrong. Some models are useful. Analogies are models. Analogies are pretty much precisely how we convey novel ideas. The problem is finding one which doesn't melt when pushed too hard. I keep having to explain to my father that deleting data from storage doesn't speed up computers. Nor does leaking it. His response when I mentioned that the Panama Papers leaks were 2.6 terabytes of data was "well, that must have made their systems a lot faster" (because they were no longer bogged down by having 2.6 TB of data on them). That's wrong at least two ways: data-on-disk doesn't slow down computers, and leaking data (making a copy) doesn't remove it from the source. And this is a reasonably intelligent human being. Who's used computers for many decades.
        acbabis 11y ago
        What do you mean "deleting data from storage doesn't speed up computers?" Deleting old files certainly makes file searches faster.
  - seanp2k2 11y ago
    It's the crypto equivalent of the TSA-approved locks.
    - _asummers 11y ago
      And just like TSA locks, the bittings will leak, rendering the lock useless to all but the laziest adversaries.
      - Spivak 11y ago
        What do you mean 'will leak'? You can find pictures of the master keys online today. I think the TSA locks are a great example of why backdoors are completely idiotic.
        _asummers 11y ago
        That was exactly my point. The TSA lock bittings are available and the back door keys will be available shortly after instituted.
      - marcoperaza 11y ago
        Think about the threat model for a lock on a suitcase. The adversary must have your bag in their possession. It's the perfect example of something that's only to keep honest people honest. Also, they make sure that your bag stays closed.
        mcintyre1994 11y ago
        Does anyone actually use a suitcase that while locked with any padlock can't be opened with a pen? Unless the lock is secured to something other than the zipper you can resecure it invisibly too.
  - ascagnel_ 11y ago
    It's a TSA-approved lock for encryption instead of luggage. And just like with TSA locks, there will be leaks and compromised systems that only hurt the general public.
- bendykstra 11y ago
  It seems consistent with statements by Clinton and other government officials, "Maybe the back door isn't the right door, and I understand what Apple and others are saying about that. I just think there's got to be a way, and I would hope that our tech companies would work with government to figure that out." They create the requirement and tech companies have to find the least bad way to comply. I wonder what that means for software like Google Chrome. Chrome would need to send the parameters of every SSL session to Google on the chance that the FBI requires Google to decrypt it.
  - mioelnir 11y ago
    Think what it does for all the creditcard companies. The TLS stream contains also those nice back-of-the-card control numbers that card processors are not allowed to store.
- the8472 11y ago
  I almost want this to happen, simply because it only applies to "remote computing services". It would provide a major incentive to move anything security-relevant back to the endpoints where it should be in the first place.
  - extrapickles 11y ago
    This bill covers anyone who does things with data or makes something that touches data. If you make paper shredders, you are covered under this bill. If you handle data, you need to make sure things like your fire suppression system doesn't damage it. The bill does not care how the data is rendered unreadable to law enforcement. It only cares that you provide them with a readable copy if it was rendered unreadable by anything even remotely in your control.
- cfallin 11y ago
  > a provider of remote computing services to the public shall ensure such products are capable of complying with a court order to decrypt. I'm not well-versed in these things at all, but I wonder what implications this would have on VM providers like Amazon (EC2) or Google (GCE)? Does this mean they somehow have to magically ensure that you didn't install sshd on your Linux VM? Surely that can't be the intention (?), but the broad language is scary.
- rayiner 11y ago
  Subsection (c) says it must be possible to comply with subsection (a). That subsection requires companies either to decrypt or to help decrypt. Technically, you don't have to successfully decrypt so long as you can help try. That's almost certainly not what they me at to write, but that's what the draft says. It's a badly drafted bill for more than technical reasons.
  - JoshTriplett 11y ago
    > Technically, you don't have to successfully decrypt so long as you can help try. Which raises the question of whether a vendor could build a system they cannot themselves break into, and then "help" by providing the documentation showing how they've built the system (which they should post publicly anyway). Still a bad bill for numerous reasons, of course.
- l1n 11y ago
  And here's a Tesseract+corrected transcript: https://lin.noblejury.com/burr.txt https://lin.noblejury.com/burr.txt
  - etjossem 11y ago
    Cleaned up: http://pastebin.com/raw/PrXTrc2N http://pastebin.com/raw/PrXTrc2N
- comex 11y ago
  You slightly misquoted (b) - it says that nothing in this act may be construed to authorize any government officer to require or prohibit any specific design or operating system. I think it's meant to avoid a situation where regulators would have lists of specific software that is required or prohibited, as opposed to the government suing companies on a case by case basis if their software didn't comply with (c). It appears to be based on a clause from CALEA, which refers to "any law enforcement agency or officer" - see (b) (1) in: https://www.law.cornell.edu/uscode/text/47/1002 https://www.law.cornell.edu/uscode/text/47/1002
- deleted 11y ago
  [deleted]
isomorphic 11y ago
"We don't have the first notion how cryptography works," said the politician-senators in a joint statement, "but we're hoping the voters will see past the blatant trampling of civil liberties to think we're doing something to be tough on the trrrrists."
- vvanders 11y ago
  I know most of the tech community likes to joke about this but I think there's something serious to consider: How can we educate the wider public that breaking crypto makes everything less secure. Most of the arguments I've seen in the wider context seem to split down tech/non-tech lines with this being the key point that's not understood.
  - vdnkh 11y ago
    I'll take a stab: it's like sending mail in transparent envelopes.
    - ethbro 11y ago
      I think that might be too subtle. I'd go with "It's like mailing a check in a transparent envelope with the amount and pay-to fields erasable and written in with a dry erase marker."
      - capote 11y ago
        Even more so--"It's like forcing everything sent by mail to be sent in a transparent envelope and then publishing in the news every route that mailmen take and the easiest points where to intercept them." Laws dictating how to/not to encrypt things make news really quickly so it takes even takes out all the fun in security research.
    - TrevorJ 11y ago
      More like: The government wants a master key that will unlock all the doors on your home, but they super promise to be real careful not to let anyone else use it.
sdihehjnss 11y ago
The funniest part is feinstein is California senator. Know who San Francisco congress rep is?, pelosi another champion of freedom... Voting doesn't work, it's a waste of time, our corrupt illegitimate government will continue to violate every ethic and change every law which increases their power. Anyone who defends such monsters are no better than monsters themselves. Again, the US government kills with impunity, tortures with impunity, commits war crimes like the recent hospital bombi ng, has the highest incarceration rate in the world... The list of goes on and on and yet people plug their ears and bury their heads in the sand. We live in a police state, just accept the truth. EDIT The community can down vote but can't respond to the truth.
- api 11y ago
  Problem is that she's a Democrat and a liberal on social issues. Is SF going to vote for a right wing social conservative candidate just because Feinstein is bad on crypto? Same problem exists in "red" states, where conservative politicians can get away with all kinds of corruption and madness because who's going to vote for a baby eating liberal? Basically if your state is very Democrat or very Republican you have single party rule and your politicians are dictators. The culture war must die if we ever want any meaningful progress on any other kind of issue.
  - sdihehjnss 11y ago
    False dichotomy. The point is the tech scene can't even get their representatives to represent them in their core issues. Belief in elections mattering is akin to belief in the tooth fairy or Santa Claus.
    - etjossem 11y ago
      If Feinstein's the problem here, then it is irresponsible to throw up your hands and declare the failure of democracy. Instead, vote her out of office and replace her with someone who understands the implications of weakening encryption. Your vote alone doesn't matter, you say? Do what you can to educate those around you on the issues. Make them think twice before re-electing someone with such a bad record.
Esau 11y ago
As far as I am concerned, this bill is unconstitutional.
- kabdib 11y ago
  That's an uphill battle, and a long one, and one that you need to have deep pockets to win.
popctrl 11y ago
"We’re still in the process of soliciting input from stakeholders and hope to have final language ready soon." Who are stakeholders in this context?
- TillE 11y ago
  Presumably just law enforcement (FBI, DoJ, etc), since they're clearly not listening to either technical experts or software/hardware providers.
fooey 11y ago
Unless they backdoor in backdoors, it seems like this will just force companies to make sure there's no possible way for them to access the data. If your company ever has any way to view the data, the government will find a way to force you to give it to them.
- Manishearth 11y ago
  AIUI this bill doesn't allow for that possibility; it says that companies must always provide the data, which implies that companies can never put the data in a situation where they can't access it in the future.
Laaw 11y ago
I mean... you literally can't legislate crypto, can you? Could someone explain what this would look like, in a practical sense? Would self-signed keys become illegal, and all PKI would have to have a "government" parent key of some kind?
- mjevans 11y ago
  More to the point, how would this and the 5th amendment interact if it was the end user that created a pass-phrase protected key which no one else knew?
- Spivak 11y ago
  > If the company cannot meet this standard, it must offer “technical assistance as is necessary to obtain such information or data,” according to the draft. Based on this it appears not. Here's how I imagine it going. 1. There's something the government wants that you've stored on some SaaS website like Dropbox. 2. But you've encrypted all of your files with your GPG key so Dropbox gives the gov't access to the files and then tells them that's all they can do. 3. Now the government needs your key so they raid your house and take your say, Dell laptop. 4. Now you use FDE and Secure Boot with a custom key so your device is locked tight. 5. The gov't then goes to Dell and demands that they use any exploit they know to unlock your device. 6. So long as you've chosen a good strong passphrase Dell will do their best but ultimately tell the gov't that there's nothing they can do.
- peterwwillis 11y ago
  They used to legislate crypto, so there's no reason they couldn't now. Back in the day, creating (and "exporting") an SSL library without a license was illegal. If you're talking TLS, whomever holds the private key would have to use it to decrypt either stored or transmitted data and turn that data over to the feds. If you're talking PGP or something, then either the makers of PGP would have to put in a backdoor, or stop making it. To implement this all the government would need is to send an NSL to anyone who creates, owns or operates any tool with encryption technology, or anyone who operates a network or service that encryption is going over.
api 11y ago
So this hands the entire security software market to overseas companies...?
- tobltobs 11y ago
  To which country? The UK, France, Australia, NZ, Eastern Europe would love to just follow the US on this stupidity. German politicians are too stupid to understand security only remotely. The few countries which would not introduce a similar law would come onto some black list.
  - api 11y ago
    Maybe Iceland could capture the entire infosec industry.
koenigdavidmj 11y ago
If this passed, I would appreciate a determined stance to make the government's technology experience difficult. No more smartphones. Google and Bing refusing traffic to government IP blocks. No more Windows updates past whatever Microsoft has already agreed to by contract. Obviously there's no financial incentive for any of this.
- rspeer 11y ago
  Ever talked to someone who works with technology for the government? The government's technology experience is already difficult. The government already has e-mail inboxes with a nearly-unusable UX, messages that pass through so many unreliable contracted-out systems that they might not get delivered for several days, hideously obsolete "smart"phones... and yet this pain isn't felt by the people making the laws, just by their staff. We're talking about a place where the Blackberry is advanced technology. Your suggestions would involve companies dropping their government contracts out of spite, for an effect that the government would barely notice.
astockwell 11y ago
Crypto == Math. Full stop. All thoughts on civil liberties aside, it's sad that these officials don't even realize that what they're asking for is (or will hopefully shortly be) impossible for companies to do. Then the real fighting will start. I'm sure Congress sees this proposal as a middle-ground between DOJ desires and freedom/privacy, but once it dawns on them that things like "no knowledge" encryption are really what it says on the tin, they will feel backed into a corner, with the only visible choices being something asinine like, criminalize encryption or ... give up? Maybe that's something for this community to start thinking about, if we want to have a constructive say in this whole mess. Come up with a way to frame the "Give up" option in a better light, so Congress can point to it and tell the DOJ "look we did X for you", while still not outlawing encryption.
- wyldfire 11y ago
  It's very clear to me that civil liberties are at the core of this discussion. And while I think that crypto->math->speech is clear, others may not. Let's keep in mind that our legislators are responding to a genuine fear in the electorate. It's our job(s) as technophiles to educate the electorate and legislature as to why this isn't the right move. This is where SCOTUS really pays off as a check against Congress. They can be surprisingly practical (sometimes). This blog article by djb [1] really makes a good case for why encryption is speech (and the fact that it has utility is orthogonal). Recall that Bernstein v US was a driver for real progress in the government's understanding and treatment of encryption technology. [1] https://blog.cr.yp.to/20160315-jefferson.html https://blog.cr.yp.to/20160315-jefferson.html
  - curun1r 11y ago
    > And while I think that crypto->math->speech is clear While I agree with this, I don't think the most important part of crypto == math is the connection to speech. The most important part is that math doesn't compromise. You can't make math kinda work...it either does or it doesn't. You can't make math work for some people and not others. Math is absolute, so this debate is absolute. The result is either secure applications or fundamentally insecure applications. This is where the government's "we've got to find a compromise" rhetoric rings hollow, naive or disingenuous, depending on how much credit you're willing to give them when it comes to technical acumen. Compromise, when it comes to encryption, means compromised. When encryption is compromised, that encryption is fundamentally broken and dangerous. Crypto == math means there can be no compromise with the government's agenda. And it's not because we don't want to be reasonable, it's because math doesn't care about court orders, the law, the government's authority or good intentions.
deleted 11y ago
[deleted]
kabdib 11y ago
I just wrote my senators. I encourage you to do the same. Talk here is fine, but it's more useful to let folks on the hill know what's up. I think the bill is over-the-top bad; they are obviously going for a compromise of some kind. By appearing to reach a middle ground they can paint the pro-crypto camps as being uncooperative. Of course, there's no middle ground with math.
- DougN7 11y ago
  This! If the HN community won't take a few moments to write their representatives, then we have no excuse and can't complain. Writing mine now...
- AJ007 11y ago
  If the commercial market has to build insecure devices, these same senators, the FBI, CIA, NSA, will all eventually get to move their own work to these things or stick with 10, 20 year old devices. The US government may be able to spend billions on specialized devices but eventually they are going to be left behind. Sounds like Assange's goal behind Wikileaks. Eventually, they can keep no secrets. I think the CIA-NSA is smart enough to figure this out. It's not going to fly.
- AJ007 11y ago
  If the commercial market has to build insecure devices, these same senators, the FBI, CIA, NSA, will all eventually get to move their own work to these things or stick with 10, 20 year old devices. The US government may be able to spend billions on specialized devices but eventually they are going to be left behind. Sounds like Assange's goal behind Wikileaks. Eventually, they can keep no secrets. I think the CIA-NSA is smart enough to figure this out. It's not going to fly.
ultramancool 11y ago
Ah yes, the good old "let's ban math" bill. Not the first time: https://en.wikipedia.org/wiki/Indiana_Pi_Bill https://en.wikipedia.org/wiki/Indiana_Pi_Bill
gnoway 11y ago
Do bills like this one pass? This reads like childish foot-stamping. Anyway, if there's a product out there which doesn't provide this capability, no amount of bill passage is going to make that product work like some congressperson wants.
ted12 11y ago
There's a real, reasonable fear at the heart of this legislation. If encryption becomes widespread and providers/individuals start using it correctly, then it will greatly hinder law enforcement's ability to gather physical evidence for certain types of crimes. At the end of the day this is just another situation where we have to weigh the positive of greater freedom against the negative of the impunity this freedom may provide to those breaking laws that we all support. I don't know what the answer is, but acting like anyone who supports this legislation is just after more control is immature.
- beatpanda 11y ago
  Encryption does not create impunity for anyone. Crimes are still crimes, and plenty of criminals were caught, prosecuted and convicted before mass surveillance.
- mr_luc 11y ago
  I'm sorry -- "if encryption becomes widespread and providers/individuals start using it correctly" is what everyone technical agrees should happen. The spread should be as wide and as comprehensive as possible. To suggest otherwise is to say that security isn't important at all. Or could you concretely suggest some areas where communications shouldn't be encrypted? Offer up some sacrificial lambs.
- mikhailt 11y ago
  Encryption is already widespread, with WhatsApp alone just enabled p2p encryption to 1b users. Full disk encryption has been around for 20 years. There's nothing anyone can do about this, you cannot hinder encryption, it is just pure math. You can ban encryption all you want, it will never ever stop terrorism in any way. All that will do is harm the good people that have legitimate reasons to protect their secrets from everyone, not the bad people.
- raquo 11y ago
  Criminals will always have encryption, regardless of any laws, so your dichotomy isn't really correct.
- alanwatts 11y ago
tonmoy 11y ago
So the publisher that publishes text book on crypto have to provide a bank door to the government?
jfoutz 11y ago
Maybe the right answer isn't fighting. Maybe the right answer is just getting a few friends together, creating a town, appoint someone judge, someone else prosecutor and someone else sheriff. There was a report of someone speeding. Use the awesome government powers to subpoena cell phone connectivity, credit card transactions, or whatever to identify the speeder. Police have auctions for seized stuff, presumably you could just auction off that data off to recover the costs (and then some) Then repeat, over and over. If you're feeling really enthusiastic, start targeting aws's DOD stuff. [1] [1] https://aws.amazon.com/compliance/dod/ https://aws.amazon.com/compliance/dod/
rietta 11y ago
This is not just govt access. For a judge to be able to order your computer unlocked, means people at Microsoft, at Lenovo (or whoever you use), and at your ISP all have the keys to unlock your data even if you used an “encryption” feature. You have to trust every company, everywhere to never have a security incident involving the keys. I posted my full thoughts after the first reading through this at https://rietta.com/blog/2016/04/08/feinstein-burr-encryption-bill/ https://rietta.com/blog/2016/04/08/feinstein-burr-encryption.... Specifically, any U.S company would be required to maintain the ability, through unspecified means, to retrieve the plain-text from any data “made unintelligible by a feature, product, or service owned, controlled, created, or provided by the [company].” And the company would then be required to turn over such data in real-time “concurrently with its transmission” or “expeditiously, if stored by the [company] or on a device.” It's chilling.
- vox_mollis 11y ago
  any U.S company Your response begs the solution. Presumably, FOSS is not considered a "covered entity" under this bill. Arch or Gentoo linux, private mailserver, XMPP server with OTR, etc, is a simple circumvention.
  - etjossem 11y ago
    A covered entity includes "any person who provides ... a method to facilitate a communication or the processing or storage of data." FOSS encryption libraries could be considered a method of processing data. If signed into law, this could compel maintainers to design libraries with gov't decryption in mind.
    - retbull 11y ago
      Just decryption. It isn't government only just mandated by them ANYONE can use it.
      - etjossem 11y ago
        Agreed. Those familiar with encryption understand that a single security incident resulting in the theft of such a backdoor key is all it would take. The attack would cascade to any company that implemented the library.
donatj 11y ago
Doesn't the 13th amendment to the constitution outlaw slavery? > Neither slavery nor involuntary servitude, except as a punishment for crime whereof the party shall have been duly convicted, shall exist within the United States, or any place subject to their jurisdiction. If you've done anything illegal, they can't compel you to work? Seems to make this whole thing sound unconstitutional.
alkonaut 11y ago
The way I read the text (which is quickly and layman-y) I don't see anything that mandates back doors or encourages weak encryption. So to me it looks mostly fine or even just a formalization of the status quo? It seems to say that if a company can read their customers data in plain text, then that plaintext should also be provided to authorities upon request/warrant. So the bottom line is: use strong crypto and build products with strong crypto and ensure only the end users hold the keys to the data. Then all the aid you can give authorities is "no can do" - and that's still acceptable? I'm kind of fine with that.
- deleted 11y ago
  [deleted]
hellbanner 11y ago
YC staff: Since YC is a huge source of economy and technical innovation.. have you considered talking to the USG about security?
andrewdb 11y ago
If this manages to become law, how would this impact open source crypto? Which company would hold the responsibility of compliance? The project sponsors, code repo hosts, or other?
- brightball 11y ago
  That is the real question. My guess is that there will soon be a push to make open source crypto somehow illegal (if we're following the logic at this point) similar to the way that open source 3D printed firearms are treated. It will be handled that way until the process makes its way through the courts.
godgod 11y ago
Build me a unsinkable boat but make sure it has a giant hole in the bottom so LEA can get in. Congress...you just don't get it.
Bluestrike2 11y ago
Reading through the bill, it's apparent that this is actually a pretty poor attempt at circumventing the rise of encryption. I have my suspicions as to why. The bill mandates technical assistance, yes, but the obvious argument is that no amount of technical assistance can accomplish that which is impossible. If the data can't be accessed, it can't be accessed. Interpreting this as barring companies from implementing those implementing those features would require an unduly expansive reading of the text, to say nothing of issues with Sect. 3(b). Sect. 3(c) seems to contradict that, but 18 USC § 2711 defines a "remote computing service" as "the provision to the public of computer storage or processing services by means of an electronic communications system" [0]. That would seem to include iCloud services, for instance, but not the iPhone itself. For reference, 18 USC Chapter 121 covers the storage of electronic communications and access to transactional records. It's possible that this is part of a long-game. Breaking the encryption debate down into smaller pieces lets them control the narrative a bit more and defuse some of the strongest arguments against backdoors and weakening encryption. They can point to this bill a few months down the road and see "look, nothing bad happened. The evil hackers those San Francisco techies were complaining about never stole your identity." It would make the opposition appear more reactionary, and give them more time to muddy the water further. To the average person, the bill seems entirely reasonable. Who could object to companies giving assistance when they have to comply with a court order? In that sense, it's a perfect starting point. But most likely, this is a trial balloon meant to help them refine their arguments and position before they get around to a concerted push. That seems likely given that the Senate Intelligence Committee doesn't really have jurisdiction over this issue [1][2]. If they can pass it, great for them. If not, they'll come back around for another go in a bit. They've got the time, and for various reasons, they've chosen this hill to fight upon. If the want to stop these efforts before they eventually manage to stumble into a "success," the tech industry eventually has to gear up for a lobbying and PR war with a degree of cynicism that's unheard of in Silicon Valley. Eventually, simply reacting to the government's efforts isn't going to be enough. Groups like the RIAA and MPAA, even when they've failed to actually implement their policy proposals, have had remarkable successes in manipulating Congress to go along with their plans. At least until they backfire. Like the NRA with the second amendment, encryption will have to be the primary focus. Everything else has to be secondary. Supporting backdoors and the weakening of encryption has to be transformed into a toxic issue for politicians. Hammer home the potential consequences to every retiree and everyone else who doesn't like the idea of their identity being stolen and their assets being spread amongst the criminal element. With this debate, there's really no room for optimism or taking the "high road." There's no high road in sight, and success is the only metric that matters here. 0. https://www.law.cornell.edu/uscode/text/18/2711 https://www.law.cornell.edu/uscode/text/18/2711 1. https://www.eff.org/deeplinks/2016/04/burr-feinstein-proposal-simply-anti-security https://www.eff.org/deeplinks/2016/04/burr-feinstein-proposa... 2. http://www.intelligence.senate.gov/about http://www.intelligence.senate.gov/about
godgod 11y ago
Congress obviously either doesn't get it or can't seem to let the encryption issue go because they want access to all our private communications. You can't have it both ways. This is the last dying breathe of a criminal government overreaching.
tomohawk 11y ago
Now that the Supremes have ruled that the feds can force you to buy a product (health insurance), it's not such a large step to force people to perform work on their behalf. One of the major gripes of the American revolution was the forced quartering of soldiers in people's homes.
Cshelton 11y ago
No way this passes....it blatantly violates the First, fourth, and fifth Amendment. How can we stop this...Vote! Vote the people that support this out of office. ....also...If they want to make everything unsecure...hack the congress members bank accounts, private information, Ashley Madison account, every email and text they send, every phone call they make...every password they've used on any site ever. Make them wish they never made such a stupid law. Maybe then they will learn how important encryption is.
jakelarkin 11y ago
If you're in California, here is a form to email Dianne Feinstein your thoughts on this bill. https://www.feinstein.senate.gov/public/index.cfm/e-mail-me https://www.feinstein.senate.gov/public/index.cfm/e-mail-me
johngalt 11y ago
Politicians aren't idiots. Neither are they Machiavellian schemers. They are just in a situation where supporting bills like this are all upside and no downside. If this passes and five years later computer security is swiss cheese, politicians know that most people will blame the computer companies and vendors not the government. If this fails due to tech company opposition, they will get to avoid any criticism for not preventing the next terrorist attack. Instead they will simply find one encrypted iPhone and blame Apple.
lasermike026 11y ago
No, absolutely not. I'm tired of this stupid conversation. The answer is always no.
- lasermike026 11y ago
  We need a NRA for crypto to destroy any and all politicians and bureaucrats that would threaten crypto safety. So, as we set out this year to defeat the divisive forces that would take freedom away, I want to say those fighting words for everyone within the sound of my voice to hear and to heed, and especially for you, Mr. <insert politician here>: 'From my cold, dead hands!' — Crypto's Charlton Heston
cgearhart 11y ago
It is my sincerest hope that this bill goes into the filing cabinet with Dihydrogen Monoxide [0] and legislating the value of pi [1]. I appreciate the challenges that encryption creates for law enforcement, but it has nothing to do with placing people "above" the law; rather it is a simple truth that you cannot create a system that is both designed to be secure and circumvented by authorities (and no one else). It is asinine that we must continue to have this debate. [0] http://www.nbcnews.com/id/4534017/ns/technology_and_science-science/t/local-officials-nearly-fall-ho-hoax/ http://www.nbcnews.com/id/4534017/ns/technology_and_science-... [1] https://en.wikipedia.org/wiki/Indiana_Pi_Bill https://en.wikipedia.org/wiki/Indiana_Pi_Bill
makecheck 11y ago
Ah, demonstrating yet again how insane it is that we hand so much power to people who know so little about the domains they control (and worse, seem to do little to change their lack of understanding). Will bills like this spur people into action to change how the government operates? I suspect at the very least, this will pointlessly cost technology companies millions as they desperately try to counteract the bill. What would we do if this passed? I suppose I would winnow and chaff the hell out of my data, sending literally 42 gigabytes of garbage bytes for every one-kilobyte file. That way, if somebody wants to decrypt it, they will at least have to sift through tons and tons of garbage to do so.
jrapdx3 11y ago
Ignorance is everywhere, especially concerning computer security and especially among the representatives and senators in the US Congress. We must combat ignorance by educating the ignorant, and that includes elected officials. Many here at HN have knowledge and high level of awareness of the importance of privacy and security, and I'm sure there are more than a few genuine experts tuning in. In any case most of us probably have salient information and experience to share, and it certainly needs to be shared. If you are a US citizen by all means write to your Representative and Senators. Voters' opinions do matter, particularly in an election year. This afternoon, I sent messages to all 3 members of my congressional delegation exclaiming how bad an idea the Burr-Feinstein bill happens to be. I urge you do do the same.
intrasight 11y ago
I can see from reading the comments that I remain in the minority in thinking that such a law will actually bring benefits in terms of security since it will promote FOSS approaches which, being based upon free speech, will be beyond the reach of this law, and which being open will in any case be more secure.
etjossem 11y ago
The plaintext version of the draft bill (cleaned up): http://pastebin.com/raw/PrXTrc2N http://pastebin.com/raw/PrXTrc2N
mortdeus 11y ago
Well it was only a matter of time before we digressed back into a nation with legalized slavery.
sehugg 11y ago
The bill begins: It is the sense of Congress that-- no person or entity is above the law; economic growth, prosperity, security, stability, and liberty require adherence to the rule of law; Confused here, I thought that the process between Apple and the FBI was taking place in the courts and not on some kind of aquatic platform in international waters.
ipsin 11y ago
Could someone help decode this? "covered entities must provide responsive, intelligible information or data, or appropriate technical assistance to a goverment pursuant to a court order." I assume that this includes secret FISA orders, but what's with the language about "a government"? Could this be construed to include non-American governments? (i.e. Five Eyes?) Or is that a term of art?
dbcooper 11y ago
It's rather disheartening that Californians haven't managed to organise serious resistance to Feinstein.
deleted 11y ago
[deleted]
x0054 11y ago
If the goal is to stop terrorism and illegal drug trade, this is the epitome of idiocy. End to end encryption isn't trivial to implement, but at the same time there are many open source projects that implement it already. If this become the norm, than professional criminals will simply adopt open source tools and 3rd party programs, as well as products offered by companies outside US to ensure their privacy. So this will weaken the security of all honest people and do basically nothing to achieve any of the goals set forth in this legislature. Of course if the goal is to further control and subjugate the citizens of this country for the benefit of it's corrupt government, then by all means, it's a brilliant piece of legislature.
0x07c0 11y ago
"made unintelligible by a feature, product, or service owned, controlled, created, or provided by the [company]." So no more Hash functions I guess, better store those passwords in clear text. Also encryption is the key to any form of distributed system where you have misbehaving actors.., you know like the internet..
dschiptsov 11y ago
Encryption which can be decrypted by third party is not encryption but encoding.
anthony_james 11y ago
Does anyone know if foreign companies that operate within the United States would be subject to these laws? If not, then perhaps a lot of big US tech companies will move offshore? Thoughts?
anonbanker 11y ago
This is why none of my business, and none of my personal data (outside browing with PrivacyBadger enabled), goes to companies residing in the United States. (written on an rk3288-based ARM laptop from China, over a VPN from Iceland)
nathan_long 11y ago
How does this apply to open source? Eg, if two people used PGP, their email providers couldn't decrypt their communications. Would the PGP authors/maintainers get in trouble for being unable to help? Does this effectively make it illegal to create end-to-end encryption tools for users?

389 points by chlodwig 11y ago

"A covered entity that receives a court order for information or data shall provide such information or data in an intelligible format; or provide such technical assistance as is necessary to obtain such information or data in an intelligible format or achieve the purpose of the court order." Okay, so I get that the main section of the bill requires companies which provide encryption to decrypt data upon receiving a court order demanding access to it. If the company is capable of decrypting its customers' data, that's a scary thought. But it's followed by two very conflicting subsections: (b) nothing in this act may be construed to require or prohibit any specific design or operating system to be adopted by any covered entity, but (c) a provider of remote computing services to the public shall ensure such products are capable of complying with a court order to decrypt. It seems like this could be read as "you must build backdoors", but also as "we're not telling you how to architect your product." These two sections are completely at odds. By the way, Scribd sucks. Have a downloadable PDF: https://josephhall.org/f0eabaa89b8ee38577bf7d0fd50ddf0d58ecd27a/307378123-Burr-Encryption-Bill-Discussion-Draft.pdf https://josephhall.org/f0eabaa89b8ee38577bf7d0fd50ddf0d58ecd... (it's still just non-OCR'd images though :<)

msandford 11y ago
Roughly paraphrased: "We don't care what kind of lock you build, so long as you build one that you can always unlock for us. We're not mandating any particular design, but you have to unlock it on demand." That's not really a lock, then, is it?
- gknoy 11y ago
  It worked for the TSA.
  - bovermyer 11y ago
    And as a result, the TSA destroyed a hot sauce boxed set I had in my luggage. I learned my lesson; now I just buy new clothes/toiletries/etc. at my destination rather than take anything at all with me.
    - korethr 11y ago
      Another option is to start flying with something that qualifies as a 'firearm' in your luggage. Such requires actual proper locks that only you can open. There was a talk on this at DEFCON 17 https://www.youtube.com/watch?v=KfqtYfaILHw https://www.youtube.com/watch?v=KfqtYfaILHw Obviously, this only works in the US. Other countries will have different laws on the ownership and transport of firearms.
      - bovermyer 11y ago
        The other complications surrounding that would make this option more trouble than it's worth for me. I'll stick with the no-luggage route!
      - EdHominem 11y ago
        Only in the USA does taking a gun with you make the airport easier. Pro tip: pack the gun at home.
- nickpeterson 11y ago
  To be fair, it's exactly a lock, well understood and easy to circumvent (like the keys to your house).
  - msandford 11y ago
    And just like the keys to my house, it requires an actual live physical human being to transport itself through meatspace at a non-relativistic speed in order to perform said circumvention, right? Oh, it doesn't? Hmmm.
    - mortenjorck 11y ago
      This is why I'm hoping we can ultimately just let go of all these analogies for encryption. Analogies are training wheels, and if we leave them on for too long, we risk propagating the idea that all bikes have four wheels.
      - dredmorbius 11y ago
        All models are wrong. Some models are useful. Analogies are models. Analogies are pretty much precisely how we convey novel ideas. The problem is finding one which doesn't melt when pushed too hard. I keep having to explain to my father that deleting data from storage doesn't speed up computers. Nor does leaking it. His response when I mentioned that the Panama Papers leaks were 2.6 terabytes of data was "well, that must have made their systems a lot faster" (because they were no longer bogged down by having 2.6 TB of data on them). That's wrong at least two ways: data-on-disk doesn't slow down computers, and leaking data (making a copy) doesn't remove it from the source. And this is a reasonably intelligent human being. Who's used computers for many decades.
        acbabis 11y ago
        What do you mean "deleting data from storage doesn't speed up computers?" Deleting old files certainly makes file searches faster.
- seanp2k2 11y ago
  It's the crypto equivalent of the TSA-approved locks.
  - _asummers 11y ago
    And just like TSA locks, the bittings will leak, rendering the lock useless to all but the laziest adversaries.
    - Spivak 11y ago
      What do you mean 'will leak'? You can find pictures of the master keys online today. I think the TSA locks are a great example of why backdoors are completely idiotic.
      - _asummers 11y ago
        That was exactly my point. The TSA lock bittings are available and the back door keys will be available shortly after instituted.
    - marcoperaza 11y ago
      Think about the threat model for a lock on a suitcase. The adversary must have your bag in their possession. It's the perfect example of something that's only to keep honest people honest. Also, they make sure that your bag stays closed.
      - mcintyre1994 11y ago
        Does anyone actually use a suitcase that while locked with any padlock can't be opened with a pen? Unless the lock is secured to something other than the zipper you can resecure it invisibly too.
- ascagnel_ 11y ago
  It's a TSA-approved lock for encryption instead of luggage. And just like with TSA locks, there will be leaks and compromised systems that only hurt the general public.
bendykstra 11y ago
It seems consistent with statements by Clinton and other government officials, "Maybe the back door isn't the right door, and I understand what Apple and others are saying about that. I just think there's got to be a way, and I would hope that our tech companies would work with government to figure that out." They create the requirement and tech companies have to find the least bad way to comply. I wonder what that means for software like Google Chrome. Chrome would need to send the parameters of every SSL session to Google on the chance that the FBI requires Google to decrypt it.
- mioelnir 11y ago
  Think what it does for all the creditcard companies. The TLS stream contains also those nice back-of-the-card control numbers that card processors are not allowed to store.
the8472 11y ago
I almost want this to happen, simply because it only applies to "remote computing services". It would provide a major incentive to move anything security-relevant back to the endpoints where it should be in the first place.
- extrapickles 11y ago
  This bill covers anyone who does things with data or makes something that touches data. If you make paper shredders, you are covered under this bill. If you handle data, you need to make sure things like your fire suppression system doesn't damage it. The bill does not care how the data is rendered unreadable to law enforcement. It only cares that you provide them with a readable copy if it was rendered unreadable by anything even remotely in your control.
cfallin 11y ago
> a provider of remote computing services to the public shall ensure such products are capable of complying with a court order to decrypt. I'm not well-versed in these things at all, but I wonder what implications this would have on VM providers like Amazon (EC2) or Google (GCE)? Does this mean they somehow have to magically ensure that you didn't install sshd on your Linux VM? Surely that can't be the intention (?), but the broad language is scary.
rayiner 11y ago
Subsection (c) says it must be possible to comply with subsection (a). That subsection requires companies either to decrypt or to help decrypt. Technically, you don't have to successfully decrypt so long as you can help try. That's almost certainly not what they me at to write, but that's what the draft says. It's a badly drafted bill for more than technical reasons.
- JoshTriplett 11y ago
  > Technically, you don't have to successfully decrypt so long as you can help try. Which raises the question of whether a vendor could build a system they cannot themselves break into, and then "help" by providing the documentation showing how they've built the system (which they should post publicly anyway). Still a bad bill for numerous reasons, of course.
l1n 11y ago
And here's a Tesseract+corrected transcript: https://lin.noblejury.com/burr.txt https://lin.noblejury.com/burr.txt
- etjossem 11y ago
  Cleaned up: http://pastebin.com/raw/PrXTrc2N http://pastebin.com/raw/PrXTrc2N
comex 11y ago
You slightly misquoted (b) - it says that nothing in this act may be construed to authorize any government officer to require or prohibit any specific design or operating system. I think it's meant to avoid a situation where regulators would have lists of specific software that is required or prohibited, as opposed to the government suing companies on a case by case basis if their software didn't comply with (c). It appears to be based on a clause from CALEA, which refers to "any law enforcement agency or officer" - see (b) (1) in: https://www.law.cornell.edu/uscode/text/47/1002 https://www.law.cornell.edu/uscode/text/47/1002
deleted 11y ago
[deleted]

isomorphic 11y ago

"We don't have the first notion how cryptography works," said the politician-senators in a joint statement, "but we're hoping the voters will see past the blatant trampling of civil liberties to think we're doing something to be tough on the trrrrists."

vvanders 11y ago
I know most of the tech community likes to joke about this but I think there's something serious to consider: How can we educate the wider public that breaking crypto makes everything less secure. Most of the arguments I've seen in the wider context seem to split down tech/non-tech lines with this being the key point that's not understood.
- vdnkh 11y ago
  I'll take a stab: it's like sending mail in transparent envelopes.
  - ethbro 11y ago
    I think that might be too subtle. I'd go with "It's like mailing a check in a transparent envelope with the amount and pay-to fields erasable and written in with a dry erase marker."
    - capote 11y ago
      Even more so--"It's like forcing everything sent by mail to be sent in a transparent envelope and then publishing in the news every route that mailmen take and the easiest points where to intercept them." Laws dictating how to/not to encrypt things make news really quickly so it takes even takes out all the fun in security research.
  - TrevorJ 11y ago
    More like: The government wants a master key that will unlock all the doors on your home, but they super promise to be real careful not to let anyone else use it.

sdihehjnss 11y ago

The funniest part is feinstein is California senator. Know who San Francisco congress rep is?, pelosi another champion of freedom... Voting doesn't work, it's a waste of time, our corrupt illegitimate government will continue to violate every ethic and change every law which increases their power. Anyone who defends such monsters are no better than monsters themselves. Again, the US government kills with impunity, tortures with impunity, commits war crimes like the recent hospital bombi ng, has the highest incarceration rate in the world... The list of goes on and on and yet people plug their ears and bury their heads in the sand. We live in a police state, just accept the truth. EDIT The community can down vote but can't respond to the truth.

api 11y ago
Problem is that she's a Democrat and a liberal on social issues. Is SF going to vote for a right wing social conservative candidate just because Feinstein is bad on crypto? Same problem exists in "red" states, where conservative politicians can get away with all kinds of corruption and madness because who's going to vote for a baby eating liberal? Basically if your state is very Democrat or very Republican you have single party rule and your politicians are dictators. The culture war must die if we ever want any meaningful progress on any other kind of issue.
- sdihehjnss 11y ago
  False dichotomy. The point is the tech scene can't even get their representatives to represent them in their core issues. Belief in elections mattering is akin to belief in the tooth fairy or Santa Claus.
  - etjossem 11y ago
    If Feinstein's the problem here, then it is irresponsible to throw up your hands and declare the failure of democracy. Instead, vote her out of office and replace her with someone who understands the implications of weakening encryption. Your vote alone doesn't matter, you say? Do what you can to educate those around you on the issues. Make them think twice before re-electing someone with such a bad record.

Esau 11y ago

As far as I am concerned, this bill is unconstitutional.

kabdib 11y ago
That's an uphill battle, and a long one, and one that you need to have deep pockets to win.

popctrl 11y ago

"We’re still in the process of soliciting input from stakeholders and hope to have final language ready soon." Who are stakeholders in this context?

TillE 11y ago
Presumably just law enforcement (FBI, DoJ, etc), since they're clearly not listening to either technical experts or software/hardware providers.

fooey 11y ago

Unless they backdoor in backdoors, it seems like this will just force companies to make sure there's no possible way for them to access the data. If your company ever has any way to view the data, the government will find a way to force you to give it to them.

Manishearth 11y ago
AIUI this bill doesn't allow for that possibility; it says that companies must always provide the data, which implies that companies can never put the data in a situation where they can't access it in the future.

Laaw 11y ago

I mean... you literally can't legislate crypto, can you? Could someone explain what this would look like, in a practical sense? Would self-signed keys become illegal, and all PKI would have to have a "government" parent key of some kind?

mjevans 11y ago
More to the point, how would this and the 5th amendment interact if it was the end user that created a pass-phrase protected key which no one else knew?
Spivak 11y ago
> If the company cannot meet this standard, it must offer “technical assistance as is necessary to obtain such information or data,” according to the draft. Based on this it appears not. Here's how I imagine it going. 1. There's something the government wants that you've stored on some SaaS website like Dropbox. 2. But you've encrypted all of your files with your GPG key so Dropbox gives the gov't access to the files and then tells them that's all they can do. 3. Now the government needs your key so they raid your house and take your say, Dell laptop. 4. Now you use FDE and Secure Boot with a custom key so your device is locked tight. 5. The gov't then goes to Dell and demands that they use any exploit they know to unlock your device. 6. So long as you've chosen a good strong passphrase Dell will do their best but ultimately tell the gov't that there's nothing they can do.
peterwwillis 11y ago
They used to legislate crypto, so there's no reason they couldn't now. Back in the day, creating (and "exporting") an SSL library without a license was illegal. If you're talking TLS, whomever holds the private key would have to use it to decrypt either stored or transmitted data and turn that data over to the feds. If you're talking PGP or something, then either the makers of PGP would have to put in a backdoor, or stop making it. To implement this all the government would need is to send an NSL to anyone who creates, owns or operates any tool with encryption technology, or anyone who operates a network or service that encryption is going over.

api 11y ago

So this hands the entire security software market to overseas companies...?

tobltobs 11y ago
To which country? The UK, France, Australia, NZ, Eastern Europe would love to just follow the US on this stupidity. German politicians are too stupid to understand security only remotely. The few countries which would not introduce a similar law would come onto some black list.
- api 11y ago
  Maybe Iceland could capture the entire infosec industry.

koenigdavidmj 11y ago

If this passed, I would appreciate a determined stance to make the government's technology experience difficult. No more smartphones. Google and Bing refusing traffic to government IP blocks. No more Windows updates past whatever Microsoft has already agreed to by contract. Obviously there's no financial incentive for any of this.

rspeer 11y ago
Ever talked to someone who works with technology for the government? The government's technology experience is already difficult. The government already has e-mail inboxes with a nearly-unusable UX, messages that pass through so many unreliable contracted-out systems that they might not get delivered for several days, hideously obsolete "smart"phones... and yet this pain isn't felt by the people making the laws, just by their staff. We're talking about a place where the Blackberry is advanced technology. Your suggestions would involve companies dropping their government contracts out of spite, for an effect that the government would barely notice.

astockwell 11y ago

Crypto == Math. Full stop. All thoughts on civil liberties aside, it's sad that these officials don't even realize that what they're asking for is (or will hopefully shortly be) impossible for companies to do. Then the real fighting will start. I'm sure Congress sees this proposal as a middle-ground between DOJ desires and freedom/privacy, but once it dawns on them that things like "no knowledge" encryption are really what it says on the tin, they will feel backed into a corner, with the only visible choices being something asinine like, criminalize encryption or ... give up? Maybe that's something for this community to start thinking about, if we want to have a constructive say in this whole mess. Come up with a way to frame the "Give up" option in a better light, so Congress can point to it and tell the DOJ "look we did X for you", while still not outlawing encryption.

wyldfire 11y ago
It's very clear to me that civil liberties are at the core of this discussion. And while I think that crypto->math->speech is clear, others may not. Let's keep in mind that our legislators are responding to a genuine fear in the electorate. It's our job(s) as technophiles to educate the electorate and legislature as to why this isn't the right move. This is where SCOTUS really pays off as a check against Congress. They can be surprisingly practical (sometimes). This blog article by djb [1] really makes a good case for why encryption is speech (and the fact that it has utility is orthogonal). Recall that Bernstein v US was a driver for real progress in the government's understanding and treatment of encryption technology. [1] https://blog.cr.yp.to/20160315-jefferson.html https://blog.cr.yp.to/20160315-jefferson.html
- curun1r 11y ago
  > And while I think that crypto->math->speech is clear While I agree with this, I don't think the most important part of crypto == math is the connection to speech. The most important part is that math doesn't compromise. You can't make math kinda work...it either does or it doesn't. You can't make math work for some people and not others. Math is absolute, so this debate is absolute. The result is either secure applications or fundamentally insecure applications. This is where the government's "we've got to find a compromise" rhetoric rings hollow, naive or disingenuous, depending on how much credit you're willing to give them when it comes to technical acumen. Compromise, when it comes to encryption, means compromised. When encryption is compromised, that encryption is fundamentally broken and dangerous. Crypto == math means there can be no compromise with the government's agenda. And it's not because we don't want to be reasonable, it's because math doesn't care about court orders, the law, the government's authority or good intentions.

deleted 11y ago

[deleted]

kabdib 11y ago

I just wrote my senators. I encourage you to do the same. Talk here is fine, but it's more useful to let folks on the hill know what's up. I think the bill is over-the-top bad; they are obviously going for a compromise of some kind. By appearing to reach a middle ground they can paint the pro-crypto camps as being uncooperative. Of course, there's no middle ground with math.

DougN7 11y ago
This! If the HN community won't take a few moments to write their representatives, then we have no excuse and can't complain. Writing mine now...
AJ007 11y ago
If the commercial market has to build insecure devices, these same senators, the FBI, CIA, NSA, will all eventually get to move their own work to these things or stick with 10, 20 year old devices. The US government may be able to spend billions on specialized devices but eventually they are going to be left behind. Sounds like Assange's goal behind Wikileaks. Eventually, they can keep no secrets. I think the CIA-NSA is smart enough to figure this out. It's not going to fly.
AJ007 11y ago
If the commercial market has to build insecure devices, these same senators, the FBI, CIA, NSA, will all eventually get to move their own work to these things or stick with 10, 20 year old devices. The US government may be able to spend billions on specialized devices but eventually they are going to be left behind. Sounds like Assange's goal behind Wikileaks. Eventually, they can keep no secrets. I think the CIA-NSA is smart enough to figure this out. It's not going to fly.

ultramancool 11y ago

Ah yes, the good old "let's ban math" bill. Not the first time: https://en.wikipedia.org/wiki/Indiana_Pi_Bill https://en.wikipedia.org/wiki/Indiana_Pi_Bill

gnoway 11y ago

Do bills like this one pass? This reads like childish foot-stamping. Anyway, if there's a product out there which doesn't provide this capability, no amount of bill passage is going to make that product work like some congressperson wants.

ted12 11y ago

There's a real, reasonable fear at the heart of this legislation. If encryption becomes widespread and providers/individuals start using it correctly, then it will greatly hinder law enforcement's ability to gather physical evidence for certain types of crimes. At the end of the day this is just another situation where we have to weigh the positive of greater freedom against the negative of the impunity this freedom may provide to those breaking laws that we all support. I don't know what the answer is, but acting like anyone who supports this legislation is just after more control is immature.

beatpanda 11y ago
Encryption does not create impunity for anyone. Crimes are still crimes, and plenty of criminals were caught, prosecuted and convicted before mass surveillance.
mr_luc 11y ago
I'm sorry -- "if encryption becomes widespread and providers/individuals start using it correctly" is what everyone technical agrees should happen. The spread should be as wide and as comprehensive as possible. To suggest otherwise is to say that security isn't important at all. Or could you concretely suggest some areas where communications shouldn't be encrypted? Offer up some sacrificial lambs.
mikhailt 11y ago
Encryption is already widespread, with WhatsApp alone just enabled p2p encryption to 1b users. Full disk encryption has been around for 20 years. There's nothing anyone can do about this, you cannot hinder encryption, it is just pure math. You can ban encryption all you want, it will never ever stop terrorism in any way. All that will do is harm the good people that have legitimate reasons to protect their secrets from everyone, not the bad people.
raquo 11y ago
Criminals will always have encryption, regardless of any laws, so your dichotomy isn't really correct.
alanwatts 11y ago

tonmoy 11y ago

So the publisher that publishes text book on crypto have to provide a bank door to the government?

jfoutz 11y ago

Maybe the right answer isn't fighting. Maybe the right answer is just getting a few friends together, creating a town, appoint someone judge, someone else prosecutor and someone else sheriff. There was a report of someone speeding. Use the awesome government powers to subpoena cell phone connectivity, credit card transactions, or whatever to identify the speeder. Police have auctions for seized stuff, presumably you could just auction off that data off to recover the costs (and then some) Then repeat, over and over. If you're feeling really enthusiastic, start targeting aws's DOD stuff. [1] [1] https://aws.amazon.com/compliance/dod/ https://aws.amazon.com/compliance/dod/

rietta 11y ago

This is not just govt access. For a judge to be able to order your computer unlocked, means people at Microsoft, at Lenovo (or whoever you use), and at your ISP all have the keys to unlock your data even if you used an “encryption” feature. You have to trust every company, everywhere to never have a security incident involving the keys. I posted my full thoughts after the first reading through this at https://rietta.com/blog/2016/04/08/feinstein-burr-encryption-bill/ https://rietta.com/blog/2016/04/08/feinstein-burr-encryption.... Specifically, any U.S company would be required to maintain the ability, through unspecified means, to retrieve the plain-text from any data “made unintelligible by a feature, product, or service owned, controlled, created, or provided by the [company].” And the company would then be required to turn over such data in real-time “concurrently with its transmission” or “expeditiously, if stored by the [company] or on a device.” It's chilling.

vox_mollis 11y ago
any U.S company Your response begs the solution. Presumably, FOSS is not considered a "covered entity" under this bill. Arch or Gentoo linux, private mailserver, XMPP server with OTR, etc, is a simple circumvention.
- etjossem 11y ago
  A covered entity includes "any person who provides ... a method to facilitate a communication or the processing or storage of data." FOSS encryption libraries could be considered a method of processing data. If signed into law, this could compel maintainers to design libraries with gov't decryption in mind.
  - retbull 11y ago
    Just decryption. It isn't government only just mandated by them ANYONE can use it.
    - etjossem 11y ago
      Agreed. Those familiar with encryption understand that a single security incident resulting in the theft of such a backdoor key is all it would take. The attack would cascade to any company that implemented the library.

donatj 11y ago

Doesn't the 13th amendment to the constitution outlaw slavery? > Neither slavery nor involuntary servitude, except as a punishment for crime whereof the party shall have been duly convicted, shall exist within the United States, or any place subject to their jurisdiction. If you've done anything illegal, they can't compel you to work? Seems to make this whole thing sound unconstitutional.

alkonaut 11y ago

The way I read the text (which is quickly and layman-y) I don't see anything that mandates back doors or encourages weak encryption. So to me it looks mostly fine or even just a formalization of the status quo? It seems to say that if a company can read their customers data in plain text, then that plaintext should also be provided to authorities upon request/warrant. So the bottom line is: use strong crypto and build products with strong crypto and ensure only the end users hold the keys to the data. Then all the aid you can give authorities is "no can do" - and that's still acceptable? I'm kind of fine with that.

deleted 11y ago
[deleted]

hellbanner 11y ago

YC staff: Since YC is a huge source of economy and technical innovation.. have you considered talking to the USG about security?

andrewdb 11y ago

If this manages to become law, how would this impact open source crypto? Which company would hold the responsibility of compliance? The project sponsors, code repo hosts, or other?

brightball 11y ago
That is the real question. My guess is that there will soon be a push to make open source crypto somehow illegal (if we're following the logic at this point) similar to the way that open source 3D printed firearms are treated. It will be handled that way until the process makes its way through the courts.

godgod 11y ago

Build me a unsinkable boat but make sure it has a giant hole in the bottom so LEA can get in. Congress...you just don't get it.

Bluestrike2 11y ago

Reading through the bill, it's apparent that this is actually a pretty poor attempt at circumventing the rise of encryption. I have my suspicions as to why. The bill mandates technical assistance, yes, but the obvious argument is that no amount of technical assistance can accomplish that which is impossible. If the data can't be accessed, it can't be accessed. Interpreting this as barring companies from implementing those implementing those features would require an unduly expansive reading of the text, to say nothing of issues with Sect. 3(b). Sect. 3(c) seems to contradict that, but 18 USC § 2711 defines a "remote computing service" as "the provision to the public of computer storage or processing services by means of an electronic communications system" [0]. That would seem to include iCloud services, for instance, but not the iPhone itself. For reference, 18 USC Chapter 121 covers the storage of electronic communications and access to transactional records. It's possible that this is part of a long-game. Breaking the encryption debate down into smaller pieces lets them control the narrative a bit more and defuse some of the strongest arguments against backdoors and weakening encryption. They can point to this bill a few months down the road and see "look, nothing bad happened. The evil hackers those San Francisco techies were complaining about never stole your identity." It would make the opposition appear more reactionary, and give them more time to muddy the water further. To the average person, the bill seems entirely reasonable. Who could object to companies giving assistance when they have to comply with a court order? In that sense, it's a perfect starting point. But most likely, this is a trial balloon meant to help them refine their arguments and position before they get around to a concerted push. That seems likely given that the Senate Intelligence Committee doesn't really have jurisdiction over this issue [1][2]. If they can pass it, great for them. If not, they'll come back around for another go in a bit. They've got the time, and for various reasons, they've chosen this hill to fight upon. If the want to stop these efforts before they eventually manage to stumble into a "success," the tech industry eventually has to gear up for a lobbying and PR war with a degree of cynicism that's unheard of in Silicon Valley. Eventually, simply reacting to the government's efforts isn't going to be enough. Groups like the RIAA and MPAA, even when they've failed to actually implement their policy proposals, have had remarkable successes in manipulating Congress to go along with their plans. At least until they backfire. Like the NRA with the second amendment, encryption will have to be the primary focus. Everything else has to be secondary. Supporting backdoors and the weakening of encryption has to be transformed into a toxic issue for politicians. Hammer home the potential consequences to every retiree and everyone else who doesn't like the idea of their identity being stolen and their assets being spread amongst the criminal element. With this debate, there's really no room for optimism or taking the "high road." There's no high road in sight, and success is the only metric that matters here. 0. https://www.law.cornell.edu/uscode/text/18/2711 https://www.law.cornell.edu/uscode/text/18/2711 1. https://www.eff.org/deeplinks/2016/04/burr-feinstein-proposal-simply-anti-security https://www.eff.org/deeplinks/2016/04/burr-feinstein-proposa... 2. http://www.intelligence.senate.gov/about http://www.intelligence.senate.gov/about

godgod 11y ago

Congress obviously either doesn't get it or can't seem to let the encryption issue go because they want access to all our private communications. You can't have it both ways. This is the last dying breathe of a criminal government overreaching.

tomohawk 11y ago

Now that the Supremes have ruled that the feds can force you to buy a product (health insurance), it's not such a large step to force people to perform work on their behalf. One of the major gripes of the American revolution was the forced quartering of soldiers in people's homes.

Cshelton 11y ago

No way this passes....it blatantly violates the First, fourth, and fifth Amendment. How can we stop this...Vote! Vote the people that support this out of office. ....also...If they want to make everything unsecure...hack the congress members bank accounts, private information, Ashley Madison account, every email and text they send, every phone call they make...every password they've used on any site ever. Make them wish they never made such a stupid law. Maybe then they will learn how important encryption is.

jakelarkin 11y ago

If you're in California, here is a form to email Dianne Feinstein your thoughts on this bill. https://www.feinstein.senate.gov/public/index.cfm/e-mail-me https://www.feinstein.senate.gov/public/index.cfm/e-mail-me

johngalt 11y ago

Politicians aren't idiots. Neither are they Machiavellian schemers. They are just in a situation where supporting bills like this are all upside and no downside. If this passes and five years later computer security is swiss cheese, politicians know that most people will blame the computer companies and vendors not the government. If this fails due to tech company opposition, they will get to avoid any criticism for not preventing the next terrorist attack. Instead they will simply find one encrypted iPhone and blame Apple.

lasermike026 11y ago

No, absolutely not. I'm tired of this stupid conversation. The answer is always no.

lasermike026 11y ago
We need a NRA for crypto to destroy any and all politicians and bureaucrats that would threaten crypto safety. So, as we set out this year to defeat the divisive forces that would take freedom away, I want to say those fighting words for everyone within the sound of my voice to hear and to heed, and especially for you, Mr. <insert politician here>: 'From my cold, dead hands!' — Crypto's Charlton Heston

cgearhart 11y ago

It is my sincerest hope that this bill goes into the filing cabinet with Dihydrogen Monoxide [0] and legislating the value of pi [1]. I appreciate the challenges that encryption creates for law enforcement, but it has nothing to do with placing people "above" the law; rather it is a simple truth that you cannot create a system that is both designed to be secure and circumvented by authorities (and no one else). It is asinine that we must continue to have this debate. [0] http://www.nbcnews.com/id/4534017/ns/technology_and_science-science/t/local-officials-nearly-fall-ho-hoax/ http://www.nbcnews.com/id/4534017/ns/technology_and_science-... [1] https://en.wikipedia.org/wiki/Indiana_Pi_Bill https://en.wikipedia.org/wiki/Indiana_Pi_Bill

makecheck 11y ago

Ah, demonstrating yet again how insane it is that we hand so much power to people who know so little about the domains they control (and worse, seem to do little to change their lack of understanding). Will bills like this spur people into action to change how the government operates? I suspect at the very least, this will pointlessly cost technology companies millions as they desperately try to counteract the bill. What would we do if this passed? I suppose I would winnow and chaff the hell out of my data, sending literally 42 gigabytes of garbage bytes for every one-kilobyte file. That way, if somebody wants to decrypt it, they will at least have to sift through tons and tons of garbage to do so.

jrapdx3 11y ago

Ignorance is everywhere, especially concerning computer security and especially among the representatives and senators in the US Congress. We must combat ignorance by educating the ignorant, and that includes elected officials. Many here at HN have knowledge and high level of awareness of the importance of privacy and security, and I'm sure there are more than a few genuine experts tuning in. In any case most of us probably have salient information and experience to share, and it certainly needs to be shared. If you are a US citizen by all means write to your Representative and Senators. Voters' opinions do matter, particularly in an election year. This afternoon, I sent messages to all 3 members of my congressional delegation exclaiming how bad an idea the Burr-Feinstein bill happens to be. I urge you do do the same.

intrasight 11y ago

I can see from reading the comments that I remain in the minority in thinking that such a law will actually bring benefits in terms of security since it will promote FOSS approaches which, being based upon free speech, will be beyond the reach of this law, and which being open will in any case be more secure.

etjossem 11y ago

The plaintext version of the draft bill (cleaned up): http://pastebin.com/raw/PrXTrc2N http://pastebin.com/raw/PrXTrc2N

mortdeus 11y ago

Well it was only a matter of time before we digressed back into a nation with legalized slavery.

sehugg 11y ago

The bill begins: It is the sense of Congress that-- no person or entity is above the law; economic growth, prosperity, security, stability, and liberty require adherence to the rule of law; Confused here, I thought that the process between Apple and the FBI was taking place in the courts and not on some kind of aquatic platform in international waters.

ipsin 11y ago

Could someone help decode this? "covered entities must provide responsive, intelligible information or data, or appropriate technical assistance to a goverment pursuant to a court order." I assume that this includes secret FISA orders, but what's with the language about "a government"? Could this be construed to include non-American governments? (i.e. Five Eyes?) Or is that a term of art?

dbcooper 11y ago

It's rather disheartening that Californians haven't managed to organise serious resistance to Feinstein.

deleted 11y ago

[deleted]

x0054 11y ago

If the goal is to stop terrorism and illegal drug trade, this is the epitome of idiocy. End to end encryption isn't trivial to implement, but at the same time there are many open source projects that implement it already. If this become the norm, than professional criminals will simply adopt open source tools and 3rd party programs, as well as products offered by companies outside US to ensure their privacy. So this will weaken the security of all honest people and do basically nothing to achieve any of the goals set forth in this legislature. Of course if the goal is to further control and subjugate the citizens of this country for the benefit of it's corrupt government, then by all means, it's a brilliant piece of legislature.

0x07c0 11y ago

"made unintelligible by a feature, product, or service owned, controlled, created, or provided by the [company]." So no more Hash functions I guess, better store those passwords in clear text. Also encryption is the key to any form of distributed system where you have misbehaving actors.., you know like the internet..

dschiptsov 11y ago

Encryption which can be decrypted by third party is not encryption but encoding.

anthony_james 11y ago

Does anyone know if foreign companies that operate within the United States would be subject to these laws? If not, then perhaps a lot of big US tech companies will move offshore? Thoughts?

anonbanker 11y ago

This is why none of my business, and none of my personal data (outside browing with PrivacyBadger enabled), goes to companies residing in the United States. (written on an rk3288-based ARM laptop from China, over a VPN from Iceland)

nathan_long 11y ago

How does this apply to open source? Eg, if two people used PGP, their email providers couldn't decrypt their communications. Would the PGP authors/maintainers get in trouble for being unable to help? Does this effectively make it illegal to create end-to-end encryption tools for users?