6 ms·
any U.S company Your response begs the solution. Presumably, FOSS is not considered a "covered entity" under this bill. Arch or Gentoo linux, private mailserv
by vox_mollis 11y ago
any U.S company
Your response begs the solution.
Presumably, FOSS is not considered a "covered entity" under this bill. Arch or Gentoo linux, private mailserver, XMPP server with OTR, etc, is a simple circumvention.
- etjossem 11y agoA covered entity includes "any person who provides ... a method to facilitate a communication or the processing or storage of data." FOSS encryption libraries could be considered a method of processing data. If signed into law, this could compel maintainers to design libraries with gov't decryption in mind.
- retbull 11y agoJust decryption. It isn't government only just mandated by them ANYONE can use it.
- etjossem 11y agoAgreed. Those familiar with encryption understand that a single security incident resulting in the theft of such a backdoor key is all it would take. The attack would cascade to any company that implemented the library.
- vox_mollis 11y agoHow could this be enforced, assuming the library developers are scattered throughout the world? Worst case scenario, all US developers drop off the project, or contribute anonymously.
- DennisP 11y agoGiven that courts have ruled open-source crypto code to be constitutionally protected speech, it might be difficult to make that stick. https://en.wikipedia.org/wiki/Source_code#Legal_issues_in_the_United_States https://en.wikipedia.org/wiki/Source_code#Legal_issues_in_th...
- etjossem 11y agoThe case in question (Bernstein v. United States) is fascinating: https://epic.org/crypto/export_controls/bernstein_decision_9_cir.html https://epic.org/crypto/export_controls/bernstein_decision_9...
- maxerickson 11y agoWould protected speech mean you could use some non compliant code to provide services or just that you could publish it?
- DennisP 11y agoI don't know, but the bill doesn't appear to cover end users. Cloud-based services would probably have to deal with it, but not people running software on their own computers.
- rietta 11y agoIt would seem that no US person could package or distribute such open source crypto without becoming a covered entity.
- anonbanker 11y agoRed Hat would be. Consider the amount of funding RH and Sun Microsystems have put into the linux desktop. Imagine if they were now required to provide technical assistance to people attempting to surveil through the tools they've invented.