8 ms·

Wyden Introduces Bill To Ban Government Backdoors Into Cellphones and Computers

417 points by sethbannon 12y ago

tptacek 12y ago
Can any agency demand a backdoor today, outside of CALEA, which this bill exempts? If they can't, then new backdoors would require new statutory authority --- which would simply override Wyden's bill. Congress can't pass laws preventing Congress from passing other laws, except by amending the Constitution.
- baddox 12y ago
  > Congress can't pass laws preventing Congress from passing other laws Is that the same as saying that Congress cannot pass two laws which contradict one another?
  - tptacek 12y ago
    No, it can definitely do that, but more importantly it can simply change its mind, and it can do that in subtler ways than by making direct references to Wyden's bill, "notwithstanding" &c &c.
    - Retric 12y ago
      The advantage is value language in new laws rarely trumps specific language in older laws. So, when or if the law is changed it becomes more obvious that agencies can add backdoors.
      - tptacek 12y ago
        I do not believe that it's the case that there's a "most specific wins" in statutory interpretation. A broad exemption in a later bill overrides all the previous statutes it implicates. In fact: if that's the case, and I think it is, then bills like this are deceptive: they make people like you believe you can grep the Congressional Record for references to Wyden's bill and tell if there's new statutory authority for backdoors. One of the HN legals (DannyBee! Rayiner! Tzs! Pdabbadabba!) can probably clear this up.
        mikecb 12y ago
        There is indeed a canon of interpretation which upholds a prior specific rule over a later in time general rule which does not specifically repeal the earlier one, and isn't directly conflicting. In that case, the general rule will be read if possible to avoid the earlier rule. Legislatures need to explicitly repeal something if it could be an issue. See the section in the following CRS report titled "Repeals by implication": http://www.fas.org/sgp/crs/misc/97-589.pdf http://www.fas.org/sgp/crs/misc/97-589.pdf Edit: Foiled again!
        Retric 12y ago
        Grep is clearly not enough, but sometimes cases are decided by extreme edge case interpretations as there is no clear intent. In which case a very specific law generally beats a vague interpretation if you squint really hard, but not clear if sweeping language. So, agency X can do anything wins. Agency X can make reasonable precautions does not because a prior law defines such behavior as unreasonable. Edit: My point being a law that says agency X can do anything raises plenty of red flags where 'make reasonable precautions' does not. PS: Though, that's just my understanding I would love to hear a better analysis.
        tptacek 12y ago
        People think I love threads like this because I'm pro-surveillance (no) but really it's just that I like having a reason to look stuff like this up. http://www.law.georgetown.edu/academics/academic-programs/legal-writing-scholarship/writing-center/upload/statutoryinterpretation.pdf http://www.law.georgetown.edu/academics/academic-programs/le... Search: "notwithstanding". We can probably find a bunch of examples in real statutes to get a sense of exactly how subtle the override could be. I don't think Wyden's bill is likely to be helpful in detecting new authority to demand backdoors. We'll have to be exactly as vigilant after it passes.
        Retric 12y ago
        Sure, but "notwithstanding" is exactly the type of language that should raise eyebrows. It's like seeing a goto in code. Sure it can be used to obscure things, and there are plenty of great examples of this, but it's also a big sign that saying "pay attention to me".
    - baddox 12y ago
      What further restriction were you talking about? Is it judicial precedent you're referring to, or legislative precedent? I believe there is at least one case where courts ruled that the government must fulfill the terms of a contract it made previously, but that's different than statutes.
  - walshemj 12y ago
    It can the older motion would normally get invalidated as a "consequential" of the second motion - its one of the trickier bits of drafting motion's in a parliamentary system you have to work out what consequentials there are and in which order it makes sense to take a set of motions. what congress or any parliamentary system cant do is bind it's self (the constitution might) - eg the uk parliament could decide to have an election tomorrow even though they passed a law 4 years back saying we have a fixed 5 year term
- deleted 12y ago
  [deleted]
- snowwrestler 12y ago
  The point is that a Senator is now on record opposing that type of new statutory authority. This bill is not intended to be a defensive wall; it's a stake in the ground in a debate that's just starting. It's a political move, not a serious legislative move. Most bills are.
- dminor 12y ago
  Often Wyden's actions signal that he knows something due to his position on the intelligence committee which he can't publicly reveal. So, you might take this to mean that there is a possibility that such backdoors are already being demanded.
- quesera 12y ago
  > Congress can't pass laws preventing Congress from passing other laws, except by amending the Constitution. Congress can't amend the Constitution, either. So we're left with, essentially, "Congress can undo what Congress can do.". Congress can of course propose amendments to the Constitution, and therefore also propose amendments which repeal previous amendments. In either case, ratification by by the state legislatures is required.
deleted 12y ago
[deleted]
pdknsk 12y ago
First, the bill has a major(?) exception. Second, they don't need to mandate it. They can just "ask" for it.
- tptacek 12y ago
  A law prohibiting executive branch agencies from asking for backdoors might actually have some utility. But unless there's a law (other than CALEA, which is indeed a major exception) that currently enables the USG to demand backdoors --- and I don't think there is --- this bill is a no-op. Anything that enabled the USG to make such a demand would have to come from Congress, which would simply override Wyden's bill.
deleted 12y ago
[deleted]
zallarak 12y ago
A lot of people will inevitably comment on the flimsiness of this bill - that it can be easily circumvented. This might be true, but its a step forward because it acknowledges that government backdoors are a bad thing. I wish I could remember where I read about this, but its similar to how activists changed the classification of LGBT literature to a non-stigmatizing category in libraries. This was the start of a lot of progress for LGBT rights. It was a minor victory among lots of major defeats at the time it happened. Instead of complaining about the weaknesses in the bill, we should view this as a facet of a multi-pronged effort to maintain privacy.
- waterlesscloud 12y ago
  Of course that's the point of it, and in that sense it is indeed useful. It's a bill intended to send a message and establish values, and it does that nicely. You can tell it's intended to send a message because, well, that's what the Senator says in the press release. “This bill sends a message to leaders of those agencies to stop recklessly pushing for new ways to vacuum up Americans’ private information, and instead put that effort into rebuilding public trust.”
  - tptacek 12y ago
    So, what you're saying is, it's cosmetic.
    - waterlesscloud 12y ago
      No, that's not what I'm saying.
      - tptacek 12y ago
        I didn't expect you to agree, but rather hoped you'd spell out why.
        graeme 12y ago
        You're being downvoted above because the second comment in the thread said "Of course that's the point of it,", referring to the comment above, which said: "it can be easily circumvented. This might be true, but its a step forward because it acknowledges that government backdoors are a bad thing. I wish I could remember where I read about this, but its similar to how activists changed the classification of LGBT literature to a non-stigmatizing category in libraries. This was the start of a lot of progress for LGBT rights. It was a minor victory among lots of major defeats at the time it happened. Instead of complaining about the weaknesses in the bill, we should view this as a facet of a multi-pronged effort to maintain privacy." That's the answer to your question of why they claim it's not merely cosmetic. They think it is cosmetic, but may also play a role in shifting language and expectations, which will have a more than cosmetic effect down the line. Edit: Rather than continue the thread – you might be right. I'll let waterlesscloud answer is I've misinterpreted their opinion.
gcb0 12y ago
what is the point of this? there are already laws that forbid it, and there are already laws that ignore those laws in case of national security or other bs. this new law would just add to the first lot. total waste of time. the only sane thing to do is to better regulate and try to add consequences to misuses of the second lot.
AdmiralAsshat 12y ago
If the bill even has a shot of passing, it will be quietly amended to include gaping exceptions, to the extent that nothing will actually change other than a brief pulling off the wool over the public eyes.
- tptacek 12y ago
  I don't think the bill needs to be changed at all to be deceptive to the public, because Congress doesn't work the way this bill suggests it does.
lsiebert 12y ago
Edit: There is the argument that this bill is a step in the right direction. The problem is that too often, steps in the right direction are the last step taken, and then people treat the problem as solved. I think there is something to be said for not letting the perfect be the enemy of the good, and this doesn't appear to explicitly OPEN any loopholes, so I guess I'm in favor. But we need something stronger to protect civil liberties, and to make people trust US companies can be secure. The Bill itself is weak as written, at least by my layman's reading. It's two pages, go look: http://www.wyden.senate.gov/download/?id=B8F74B59-0A6E-45C2-A259-109978D275EA&download=1 http://www.wyden.senate.gov/download/?id=B8F74B59-0A6E-45C2-... First, it only covers software, hardware and devices made available to the general public. So any internally developed hardware or software business logic could face such a mandate. Second, it only covers security functions of such items... It's not clear that specific information, such as a private key, would be a security function. Third, it has an explicit exemption for the CALEA, Which lets the government mandate how the telephone companies network architecture worked in order to make it easier to wiretap, which the FCC expanded to ISPs and VOIP providers. Now, the FBI and other government entities have been pushing for all internet companies to fall under the CALEA or similar laws, so we can presume that the CALEA is not everything it could be. Still we know that Verizon, which is a broadband ISP, was adding a unique key to HTTP communications. Fourth, it fails to define surveillance, and it's unclear if a broad capture of information which isn't looked, or of metadata, would be consider surveillance under the law. The law mentions physical search, but that still leaves electronic searches, as well as any form of seizures. Fifth, it does nothing to prevent attempts to weaken protocols, systems, APIs, encryption standards, etc. While it may prevent specific implementations of them from being forcibly weakened, it wouldn't prevent a forcible or other weakening of the underlying standard, including attempts to manipulate and weaken them.
- Taek 12y ago
  You are worried that this bill will be the last step in the right direction. An increasing number of people are unhappy with US surveilance aggression, and we are all aware that this bill is far from the magic bullet. I do not think there is a risk of this step being the last step in the right direction. We should support this bill (as it improves our state of affairs), but also call for stronger reform as well. It is a good first step, and hopefully one of many as there will be ongoing pressure for more action to be taken.
jdhendrickson 12y ago
I see comments on the veracity of this bill, but I decry the idea that passing more laws will fix this. It's mere theatre. There are laws already which ban the things our government is doing and they ignore those laws, what is it to ignore one more law? It grows worse with each passing year even the customary dog and pony show slap on the wrist has been dispensed with. The 24 hour news cycle moves on and the fourth estates co-option is more obvious daily. Arguing the details of bullshit doesn't strike me as a judicious use of our time. I strongly urge you to throw any effort you consider devoting to discussion or even thought in regard to legislative fixes to moving forward with the broad adoption of encryption and infrastructure changes within your own organizations that prevent them from monitoring our communications whether they like it or not. The United States government has proven itself untrustworthy, the best option is to simply remove the choice from their hands.
- Omniusaspirer 12y ago
  Don't forget to add decentralization to that list as well. A further addendum is that this isn't about just the US government- even in a magical world where the US stopped spying you'd still be the victim of other governments all over the world (and corporations as well!). This is a battle that started with technology and the only way to fight it is with better technology.
- rayiner 12y ago
  > There are laws already which ban the things our government is doing and they ignore those laws, what is it to ignore one more law? I can't think of any off the top of my head. Federal agencies have the authority to regulate what sort of air pollution control features your car has, so what law does it violate for them to regulate security features?
  - jdhendrickson 12y ago
    https://www.aclu.org/technology-and-liberty/nsa-spying-americans-illegal https://www.aclu.org/technology-and-liberty/nsa-spying-ameri... We can start with the 4th amendment and move on from there.
GauntletWizard 12y ago
The only true solution here will be to rule cellphones as inadmissible in court; Not under the Fourth, but under the Fifth. More and more, computers are becoming part of our brains; As inextricably linked to us as our limbs. Until we recognize that this is not fantasy, not the near future, but the now, we're all at danger from government overreach.
- Nanzikambe 12y ago
  That's hardly effective; most covertly collected evidence is already inadmissible in courts in most free countries and yet here we are. Governments spying isn't ubiquitous because it's an effective means to uphold the law: it's because like any government budget: you use it or you lose it. And after the "good old days" of the Cold War nobody is ready to relinquish that power. So instead here we are, decades after we stepped back from the nuclear brink, as terrified as ever with a media presenting us with a myriad of dubious villains to justify expansion and over reach. The true extent of the damage caused by rampant espionage will probably never be understood because secrets breed secrets, breed corruption -- and when a nation's intelligence services can legally spy on the full spectrum of industry: the potential for corruption is massive
Panino 12y ago
I don't mind if the bill is weak, because real solutions are happening outside of electoral politics. Curve25519 deployment is now massive, for example. LibreSSL is moving forward. RC4 has been ripped out of a lot of stuff and replaced with ChaCha. Salsa20 is in a ton of software and has many users. SafeCurves are getting discussion, especially ed448 and E-521. More people are deploying TLS. More people are conscientous. More people are protected by default without having to make an effort (TextSecure is a great example). My only sad point is that people are still talking about DNSSEC, which reduces security significantly if used for anything besides signing DNS records. I don't know why anyone not affiliated with Project Bullrun wants you to use RSA-1024 for security.
- tptacek 12y ago
  There is more wrong with DNSSEC than RSA-1024 (PKCS1v15 RSA, no less!). DNSSEC is a PKI run by world governments, most prominently that of the United States. It's hard to understand why anyone working in privacy would ever support it. Thankfully, it's dying on its own engineering (de)merits.
snowwrestler 12y ago
This bill won't pass. Some members would object, but mostly it's just not worth passing because it doesn't do anything. Also, it was introduced with just a few days left in this Congress. (All un-passed legislation is wiped out by the change in Congress.) BUT, it's not intended to pass. It is intended to communicate and memorialize a particular political opinion. In this case, it is intended to stand in opposition to the opinion expressed by some law enforcement leaders that the government, in the face of improving commercial encryption, should have new powers to mandate back doors. Most--in fact the vast majority of--bills that are introduced into Congress are not intended to pass, they are intended to make a point. This is one of those bills. That doesn't make it bad or good. That really depends on whether you agree with Senator Wyden. (I bet most people here do.)
finid 12y ago
But there are already backdoors in those things. And you can bet that this bill won't pass. You can bet your right thumb on that.
declan 12y ago
This bill is flawed but worth your support anyway. It's flawed for at least three reasons: * It doesn’t stop NSA from weakening security standards, bribing crypto vendors, or hacking into systems to insert backdoors. Even if a future law were to address that, a future president could instruct the NSA (part of the U.S. military, after all) to disregard it. We've all seen some recent examples of aggressive presidential action even in the non-military space where executive authority is weaker. * Wyden's bill doesn't seem to apply to FedGov spending. So if a company wants that fat .gov/.mil $10 billion-dollar contract, well, it might feel obliged to discontinue that full-device encryption product. It surely makes sense to focus on other unencrypted product lines to support that $10B contract, right? * A future Congress could overturn it, for instance by enacting FBI’s draft “Going Dark” surveillance legislation. I disclosed some details here about the FBI's proposal to target Internet companies (in retrospect, FBI was carrying water for NSA): http://www.cnet.com/news/fbi-we-need-wiretap-ready-web-sites-now/ http://www.cnet.com/news/fbi-we-need-wiretap-ready-web-sites... But despite those caveats, Wyden's bill is worth supporting anyway. It does no harm, it's highly symbolic -- and it would stop future agencies from creatively interpreting their statutory authority to screw over the Internet and companies represented here on HN. While no agency has clear legal authority in this area, that doesn't always stop them, with the FCC the most likely suspect. Remember this is the same agency that unilaterally extended CALEA backdoor requirements to broadband providers, despite Congress never giving it that authority, and despite the FBI director assuring politicians this would never happen. A federal appeals court judge called the FCC's argument for surveillance mandates "gobbledygook" and "nonsense," but unfortunately ended up dissenting in a 2-1 decision, as I wrote here in 2006: http://news.cnet.com/Appeals-court-upholds-Net-wiretapping-rules/2100-1028_3-6082085.html http://news.cnet.com/Appeals-court-upholds-Net-wiretapping-r... This is not a case of a bill doing some harm and some good, like the problematic USA Freedom Act, where different groups applied different weights and reached different recommendations. Wyden's bill does only good, even if doesn't go nearly far enough. Fixing a broken system is not a one-step process.
- abruzzi 12y ago
  > A future Congress could overturn it Short of a constitutional amendment, any congressional action could be overturned by a future congress.
blackaspen 12y ago
Makes me think of "These new laws will fundamentally change how we get around them".
deciplex 12y ago
It's great when politicians show a spine after being unelected. We should unelect them more often. The attention Wyden gets as being the anti-surveillance guy in Congress says more about Congress than it does about Wyden. This guy sat on the Intelligence Committee for years, and knew exactly what was going on, and although even he probably learned a thing or two from the Snowden leaks, it's a sure bet he learned a hell of a lot less than the rest of us. Yet, before that, he did precisely fuck-all about any of it. He's still done about fuck-all, besides sort of vaguely indicating that he might exploit some Constitutional provisions to reveal a few more secrets on the Senate floor before leaving office. I'm not holding my breath.
everettForth 12y ago
Too bad it looks like congress dropped this amendment that passed with an overwhelming majority in a backdoor deal over the past 48 hours: https://news.ycombinator.com/item?id=8703331 https://news.ycombinator.com/item?id=8703331
blueskin_ 12y ago
This will probably last about as long as the attempt at NSA reform; i.e. not very :(

417 points by sethbannon 12y ago

Can any agency demand a backdoor today, outside of CALEA, which this bill exempts? If they can't, then new backdoors would require new statutory authority --- which would simply override Wyden's bill. Congress can't pass laws preventing Congress from passing other laws, except by amending the Constitution.

baddox 12y ago
> Congress can't pass laws preventing Congress from passing other laws Is that the same as saying that Congress cannot pass two laws which contradict one another?
- tptacek 12y ago
  No, it can definitely do that, but more importantly it can simply change its mind, and it can do that in subtler ways than by making direct references to Wyden's bill, "notwithstanding" &c &c.
  - Retric 12y ago
    The advantage is value language in new laws rarely trumps specific language in older laws. So, when or if the law is changed it becomes more obvious that agencies can add backdoors.
    - tptacek 12y ago
      I do not believe that it's the case that there's a "most specific wins" in statutory interpretation. A broad exemption in a later bill overrides all the previous statutes it implicates. In fact: if that's the case, and I think it is, then bills like this are deceptive: they make people like you believe you can grep the Congressional Record for references to Wyden's bill and tell if there's new statutory authority for backdoors. One of the HN legals (DannyBee! Rayiner! Tzs! Pdabbadabba!) can probably clear this up.
      - mikecb 12y ago
        There is indeed a canon of interpretation which upholds a prior specific rule over a later in time general rule which does not specifically repeal the earlier one, and isn't directly conflicting. In that case, the general rule will be read if possible to avoid the earlier rule. Legislatures need to explicitly repeal something if it could be an issue. See the section in the following CRS report titled "Repeals by implication": http://www.fas.org/sgp/crs/misc/97-589.pdf http://www.fas.org/sgp/crs/misc/97-589.pdf Edit: Foiled again!
      - Retric 12y ago
        Grep is clearly not enough, but sometimes cases are decided by extreme edge case interpretations as there is no clear intent. In which case a very specific law generally beats a vague interpretation if you squint really hard, but not clear if sweeping language. So, agency X can do anything wins. Agency X can make reasonable precautions does not because a prior law defines such behavior as unreasonable. Edit: My point being a law that says agency X can do anything raises plenty of red flags where 'make reasonable precautions' does not. PS: Though, that's just my understanding I would love to hear a better analysis.
        tptacek 12y ago
        People think I love threads like this because I'm pro-surveillance (no) but really it's just that I like having a reason to look stuff like this up. http://www.law.georgetown.edu/academics/academic-programs/legal-writing-scholarship/writing-center/upload/statutoryinterpretation.pdf http://www.law.georgetown.edu/academics/academic-programs/le... Search: "notwithstanding". We can probably find a bunch of examples in real statutes to get a sense of exactly how subtle the override could be. I don't think Wyden's bill is likely to be helpful in detecting new authority to demand backdoors. We'll have to be exactly as vigilant after it passes.
        Retric 12y ago
        Sure, but "notwithstanding" is exactly the type of language that should raise eyebrows. It's like seeing a goto in code. Sure it can be used to obscure things, and there are plenty of great examples of this, but it's also a big sign that saying "pay attention to me".
  - baddox 12y ago
    What further restriction were you talking about? Is it judicial precedent you're referring to, or legislative precedent? I believe there is at least one case where courts ruled that the government must fulfill the terms of a contract it made previously, but that's different than statutes.
- walshemj 12y ago
  It can the older motion would normally get invalidated as a "consequential" of the second motion - its one of the trickier bits of drafting motion's in a parliamentary system you have to work out what consequentials there are and in which order it makes sense to take a set of motions. what congress or any parliamentary system cant do is bind it's self (the constitution might) - eg the uk parliament could decide to have an election tomorrow even though they passed a law 4 years back saying we have a fixed 5 year term
deleted 12y ago
[deleted]
snowwrestler 12y ago
The point is that a Senator is now on record opposing that type of new statutory authority. This bill is not intended to be a defensive wall; it's a stake in the ground in a debate that's just starting. It's a political move, not a serious legislative move. Most bills are.
dminor 12y ago
Often Wyden's actions signal that he knows something due to his position on the intelligence committee which he can't publicly reveal. So, you might take this to mean that there is a possibility that such backdoors are already being demanded.
quesera 12y ago
> Congress can't pass laws preventing Congress from passing other laws, except by amending the Constitution. Congress can't amend the Constitution, either. So we're left with, essentially, "Congress can undo what Congress can do.". Congress can of course propose amendments to the Constitution, and therefore also propose amendments which repeal previous amendments. In either case, ratification by by the state legislatures is required.

deleted 12y ago

[deleted]

pdknsk 12y ago

First, the bill has a major(?) exception. Second, they don't need to mandate it. They can just "ask" for it.

tptacek 12y ago
A law prohibiting executive branch agencies from asking for backdoors might actually have some utility. But unless there's a law (other than CALEA, which is indeed a major exception) that currently enables the USG to demand backdoors --- and I don't think there is --- this bill is a no-op. Anything that enabled the USG to make such a demand would have to come from Congress, which would simply override Wyden's bill.

deleted 12y ago

[deleted]

zallarak 12y ago

A lot of people will inevitably comment on the flimsiness of this bill - that it can be easily circumvented. This might be true, but its a step forward because it acknowledges that government backdoors are a bad thing. I wish I could remember where I read about this, but its similar to how activists changed the classification of LGBT literature to a non-stigmatizing category in libraries. This was the start of a lot of progress for LGBT rights. It was a minor victory among lots of major defeats at the time it happened. Instead of complaining about the weaknesses in the bill, we should view this as a facet of a multi-pronged effort to maintain privacy.

waterlesscloud 12y ago
Of course that's the point of it, and in that sense it is indeed useful. It's a bill intended to send a message and establish values, and it does that nicely. You can tell it's intended to send a message because, well, that's what the Senator says in the press release. “This bill sends a message to leaders of those agencies to stop recklessly pushing for new ways to vacuum up Americans’ private information, and instead put that effort into rebuilding public trust.”
- tptacek 12y ago
  So, what you're saying is, it's cosmetic.
  - waterlesscloud 12y ago
    No, that's not what I'm saying.
    - tptacek 12y ago
      I didn't expect you to agree, but rather hoped you'd spell out why.
      - graeme 12y ago
        You're being downvoted above because the second comment in the thread said "Of course that's the point of it,", referring to the comment above, which said: "it can be easily circumvented. This might be true, but its a step forward because it acknowledges that government backdoors are a bad thing. I wish I could remember where I read about this, but its similar to how activists changed the classification of LGBT literature to a non-stigmatizing category in libraries. This was the start of a lot of progress for LGBT rights. It was a minor victory among lots of major defeats at the time it happened. Instead of complaining about the weaknesses in the bill, we should view this as a facet of a multi-pronged effort to maintain privacy." That's the answer to your question of why they claim it's not merely cosmetic. They think it is cosmetic, but may also play a role in shifting language and expectations, which will have a more than cosmetic effect down the line. Edit: Rather than continue the thread – you might be right. I'll let waterlesscloud answer is I've misinterpreted their opinion.

gcb0 12y ago

what is the point of this? there are already laws that forbid it, and there are already laws that ignore those laws in case of national security or other bs. this new law would just add to the first lot. total waste of time. the only sane thing to do is to better regulate and try to add consequences to misuses of the second lot.

AdmiralAsshat 12y ago

If the bill even has a shot of passing, it will be quietly amended to include gaping exceptions, to the extent that nothing will actually change other than a brief pulling off the wool over the public eyes.

tptacek 12y ago
I don't think the bill needs to be changed at all to be deceptive to the public, because Congress doesn't work the way this bill suggests it does.

lsiebert 12y ago

Edit: There is the argument that this bill is a step in the right direction. The problem is that too often, steps in the right direction are the last step taken, and then people treat the problem as solved. I think there is something to be said for not letting the perfect be the enemy of the good, and this doesn't appear to explicitly OPEN any loopholes, so I guess I'm in favor. But we need something stronger to protect civil liberties, and to make people trust US companies can be secure. The Bill itself is weak as written, at least by my layman's reading. It's two pages, go look: http://www.wyden.senate.gov/download/?id=B8F74B59-0A6E-45C2-A259-109978D275EA&download=1 http://www.wyden.senate.gov/download/?id=B8F74B59-0A6E-45C2-... First, it only covers software, hardware and devices made available to the general public. So any internally developed hardware or software business logic could face such a mandate. Second, it only covers security functions of such items... It's not clear that specific information, such as a private key, would be a security function. Third, it has an explicit exemption for the CALEA, Which lets the government mandate how the telephone companies network architecture worked in order to make it easier to wiretap, which the FCC expanded to ISPs and VOIP providers. Now, the FBI and other government entities have been pushing for all internet companies to fall under the CALEA or similar laws, so we can presume that the CALEA is not everything it could be. Still we know that Verizon, which is a broadband ISP, was adding a unique key to HTTP communications. Fourth, it fails to define surveillance, and it's unclear if a broad capture of information which isn't looked, or of metadata, would be consider surveillance under the law. The law mentions physical search, but that still leaves electronic searches, as well as any form of seizures. Fifth, it does nothing to prevent attempts to weaken protocols, systems, APIs, encryption standards, etc. While it may prevent specific implementations of them from being forcibly weakened, it wouldn't prevent a forcible or other weakening of the underlying standard, including attempts to manipulate and weaken them.

Taek 12y ago
You are worried that this bill will be the last step in the right direction. An increasing number of people are unhappy with US surveilance aggression, and we are all aware that this bill is far from the magic bullet. I do not think there is a risk of this step being the last step in the right direction. We should support this bill (as it improves our state of affairs), but also call for stronger reform as well. It is a good first step, and hopefully one of many as there will be ongoing pressure for more action to be taken.

jdhendrickson 12y ago

I see comments on the veracity of this bill, but I decry the idea that passing more laws will fix this. It's mere theatre. There are laws already which ban the things our government is doing and they ignore those laws, what is it to ignore one more law? It grows worse with each passing year even the customary dog and pony show slap on the wrist has been dispensed with. The 24 hour news cycle moves on and the fourth estates co-option is more obvious daily. Arguing the details of bullshit doesn't strike me as a judicious use of our time. I strongly urge you to throw any effort you consider devoting to discussion or even thought in regard to legislative fixes to moving forward with the broad adoption of encryption and infrastructure changes within your own organizations that prevent them from monitoring our communications whether they like it or not. The United States government has proven itself untrustworthy, the best option is to simply remove the choice from their hands.

Omniusaspirer 12y ago
Don't forget to add decentralization to that list as well. A further addendum is that this isn't about just the US government- even in a magical world where the US stopped spying you'd still be the victim of other governments all over the world (and corporations as well!). This is a battle that started with technology and the only way to fight it is with better technology.
rayiner 12y ago
> There are laws already which ban the things our government is doing and they ignore those laws, what is it to ignore one more law? I can't think of any off the top of my head. Federal agencies have the authority to regulate what sort of air pollution control features your car has, so what law does it violate for them to regulate security features?
- jdhendrickson 12y ago
  https://www.aclu.org/technology-and-liberty/nsa-spying-americans-illegal https://www.aclu.org/technology-and-liberty/nsa-spying-ameri... We can start with the 4th amendment and move on from there.

GauntletWizard 12y ago

The only true solution here will be to rule cellphones as inadmissible in court; Not under the Fourth, but under the Fifth. More and more, computers are becoming part of our brains; As inextricably linked to us as our limbs. Until we recognize that this is not fantasy, not the near future, but the now, we're all at danger from government overreach.

Nanzikambe 12y ago
That's hardly effective; most covertly collected evidence is already inadmissible in courts in most free countries and yet here we are. Governments spying isn't ubiquitous because it's an effective means to uphold the law: it's because like any government budget: you use it or you lose it. And after the "good old days" of the Cold War nobody is ready to relinquish that power. So instead here we are, decades after we stepped back from the nuclear brink, as terrified as ever with a media presenting us with a myriad of dubious villains to justify expansion and over reach. The true extent of the damage caused by rampant espionage will probably never be understood because secrets breed secrets, breed corruption -- and when a nation's intelligence services can legally spy on the full spectrum of industry: the potential for corruption is massive

Panino 12y ago

I don't mind if the bill is weak, because real solutions are happening outside of electoral politics. Curve25519 deployment is now massive, for example. LibreSSL is moving forward. RC4 has been ripped out of a lot of stuff and replaced with ChaCha. Salsa20 is in a ton of software and has many users. SafeCurves are getting discussion, especially ed448 and E-521. More people are deploying TLS. More people are conscientous. More people are protected by default without having to make an effort (TextSecure is a great example). My only sad point is that people are still talking about DNSSEC, which reduces security significantly if used for anything besides signing DNS records. I don't know why anyone not affiliated with Project Bullrun wants you to use RSA-1024 for security.

tptacek 12y ago
There is more wrong with DNSSEC than RSA-1024 (PKCS1v15 RSA, no less!). DNSSEC is a PKI run by world governments, most prominently that of the United States. It's hard to understand why anyone working in privacy would ever support it. Thankfully, it's dying on its own engineering (de)merits.

snowwrestler 12y ago

This bill won't pass. Some members would object, but mostly it's just not worth passing because it doesn't do anything. Also, it was introduced with just a few days left in this Congress. (All un-passed legislation is wiped out by the change in Congress.) BUT, it's not intended to pass. It is intended to communicate and memorialize a particular political opinion. In this case, it is intended to stand in opposition to the opinion expressed by some law enforcement leaders that the government, in the face of improving commercial encryption, should have new powers to mandate back doors. Most--in fact the vast majority of--bills that are introduced into Congress are not intended to pass, they are intended to make a point. This is one of those bills. That doesn't make it bad or good. That really depends on whether you agree with Senator Wyden. (I bet most people here do.)

finid 12y ago

But there are already backdoors in those things. And you can bet that this bill won't pass. You can bet your right thumb on that.

declan 12y ago

This bill is flawed but worth your support anyway. It's flawed for at least three reasons: * It doesn’t stop NSA from weakening security standards, bribing crypto vendors, or hacking into systems to insert backdoors. Even if a future law were to address that, a future president could instruct the NSA (part of the U.S. military, after all) to disregard it. We've all seen some recent examples of aggressive presidential action even in the non-military space where executive authority is weaker. * Wyden's bill doesn't seem to apply to FedGov spending. So if a company wants that fat .gov/.mil $10 billion-dollar contract, well, it might feel obliged to discontinue that full-device encryption product. It surely makes sense to focus on other unencrypted product lines to support that $10B contract, right? * A future Congress could overturn it, for instance by enacting FBI’s draft “Going Dark” surveillance legislation. I disclosed some details here about the FBI's proposal to target Internet companies (in retrospect, FBI was carrying water for NSA): http://www.cnet.com/news/fbi-we-need-wiretap-ready-web-sites-now/ http://www.cnet.com/news/fbi-we-need-wiretap-ready-web-sites... But despite those caveats, Wyden's bill is worth supporting anyway. It does no harm, it's highly symbolic -- and it would stop future agencies from creatively interpreting their statutory authority to screw over the Internet and companies represented here on HN. While no agency has clear legal authority in this area, that doesn't always stop them, with the FCC the most likely suspect. Remember this is the same agency that unilaterally extended CALEA backdoor requirements to broadband providers, despite Congress never giving it that authority, and despite the FBI director assuring politicians this would never happen. A federal appeals court judge called the FCC's argument for surveillance mandates "gobbledygook" and "nonsense," but unfortunately ended up dissenting in a 2-1 decision, as I wrote here in 2006: http://news.cnet.com/Appeals-court-upholds-Net-wiretapping-rules/2100-1028_3-6082085.html http://news.cnet.com/Appeals-court-upholds-Net-wiretapping-r... This is not a case of a bill doing some harm and some good, like the problematic USA Freedom Act, where different groups applied different weights and reached different recommendations. Wyden's bill does only good, even if doesn't go nearly far enough. Fixing a broken system is not a one-step process.

abruzzi 12y ago
> A future Congress could overturn it Short of a constitutional amendment, any congressional action could be overturned by a future congress.

blackaspen 12y ago

Makes me think of "These new laws will fundamentally change how we get around them".

deciplex 12y ago

It's great when politicians show a spine after being unelected. We should unelect them more often. The attention Wyden gets as being the anti-surveillance guy in Congress says more about Congress than it does about Wyden. This guy sat on the Intelligence Committee for years, and knew exactly what was going on, and although even he probably learned a thing or two from the Snowden leaks, it's a sure bet he learned a hell of a lot less than the rest of us. Yet, before that, he did precisely fuck-all about any of it. He's still done about fuck-all, besides sort of vaguely indicating that he might exploit some Constitutional provisions to reveal a few more secrets on the Senate floor before leaving office. I'm not holding my breath.

everettForth 12y ago

Too bad it looks like congress dropped this amendment that passed with an overwhelming majority in a backdoor deal over the past 48 hours: https://news.ycombinator.com/item?id=8703331 https://news.ycombinator.com/item?id=8703331

blueskin_ 12y ago

This will probably last about as long as the attempt at NSA reform; i.e. not very :(