5 ms·

House Passes Amendments Blocking Funding for Undermining Encryption

73 points by randomname2 11y ago

greenyoda 11y ago
The posted URL gives a 404 error. It looks like the intent was to point to this press release: http://massie.house.gov/press-release/press-release-house-passes-massie-amendment-strengthen-privacy-and-security http://massie.house.gov/press-release/press-release-house-pa... Excerpt: The 383-43 vote represents a victory for electronic privacy advocates. Massie's amendment would prevent the National Institute of Standards and Technology (NIST) from cooperating with the NSA to weaken encryption standards for the purpose of facilitating electronic surveillance. “When our government weakens encryption software to spy on citizens, it puts everyone at risk. Hackers can exploit weak encryption to gain access to Americans' confidential health records and financial information," said Congressman Massie. "The NIST charter is to establish dependable standards, not to compromise standards for the purpose of spying."
- dang 11y ago
  Thanks. Url changed from http://massie.house.gov/press-release/press-release-house-passes-massie-amendment-strhttp://massie.house.gov/press-release/press-release-house-passes-massie-amendment-strengthen-privacy-and-securityengthen-privacy-and-security http://massie.house.gov/press-release/press-release-house-pa....
siliconc0w 11y ago
It was a fairly hair-brained scheme to begin with... NSA: Hey guys - you should totally use this suboptimal encryption standard with these constants we somehow created. Everyone: Uh... we're good. Thanks...
GunlogAlm 11y ago
You borked the URL a bit there. :) http://massie.house.gov/press-release/press-release-house-passes-massie-amendment-strengthen-privacy-and-security http://massie.house.gov/press-release/press-release-house-pa...
hellbanner 11y ago
Who are the 43 people who voted against and why? Are there any good sites for public discourse with house & senators about why they vote a certain way?
- mkempe 11y ago
  Close to 90% of the no-voters are Democrats. The only reason I can imagine is that they oppose even a tiny measure that would hinder the growth of Leviathan.
- dcre 11y ago
  Here are the votes: https://www.govtrack.us/congress/votes/114-2015/h290 https://www.govtrack.us/congress/votes/114-2015/h290
  - hellbanner 11y ago
    Wow, that's a great site. Wish there was an open community discussion where I could say.. send messages to my representative who then sends them to the Congress person after filtering messages from a voting group. I understand that's what representatives are supposed to do, but there's an awful lot of people with opinions..
dooglius 11y ago
The summary at https://www.congress.gov/amendment/114th-congress/house-amendment/342 https://www.congress.gov/amendment/114th-congress/house-amen..., and the bill it is attached to, imply that only funding from only NIST to consult with the NSA/CIA is blocked. Wouldn't this sort of thing be coming out of the NSA's budget anyway? Seems like an easy loophole. Edit: the loophole is even bigger than that! I listened to the discussion (http://www.c-span.org/video/?326244-2/us-house-debate-fy-2016-spending http://www.c-span.org/video/?326244-2/us-house-debate-fy-201... around 3:16) where Massie says that the bill doesn't prevent collaborating with the NSA to strengthen encryption, only to weaken it. But the NSA can just claim they are helping to strengthen encryption... in fact that's probably exactly what they did when they first introduced DUAL_EC_DRBG to NIST in the first place.
- higherpurpose 11y ago
  Right. Also isn't this bill like an annual one? Which means this amendment would have to be passed every year?
  - filoeleven 11y ago
    Yes, to the best of my knowledge the limitations placed on use of funds are only for the funds being appropriated by the current bill. In fact amendments that do otherwise may be removed under procedural rules, but it also seems that if no one raises a point of order then it is not enforced. I actually got curious and looked at a bunch of other amendments[0]. Another one that was agreed to was "An amendment to prohibit the use of funds by the Department of Justice in violation of the Fifth and Fourteenth Amendments to the United States Constitution; or to repeal the guidance provided in the memorandum issued by the Attorney General on March 31, 2015."[1] That makes me wonder what was in the referenced memorandum. This one was withdrawn by unanimous consent; make of that what you will: "An amendment to prohibit use of funds to transfer cell site simulators, or IMSI Catcher, or similar cell phone tower mimicking technology to state and local law enforcement that haven't adopted procedures for the use of such technology that protects the constitutional rights of citizens."[2] There were also a whole bunch of amendments that had this form: "An amendment to reduce and then increase funding for NOAA Operations, Research, and Facilities by $70 million."[3] That one passed but there were at least seven others failed or withdrawn (both before and after this one) which were identical in all but the cash amount, and a few more for agencies other than NOAA. Does anyone know what the point of these amendments are? [0]https://www.congress.gov/bill/114th-congress/house-bill/2578/amendments https://www.congress.gov/bill/114th-congress/house-bill/2578... [1]https://www.congress.gov/amendment/114th-congress/house-amendment/323 https://www.congress.gov/amendment/114th-congress/house-amen... [2]https://www.congress.gov/amendment/114th-congress/house-amendment/309 https://www.congress.gov/amendment/114th-congress/house-amen... [3]https://www.congress.gov/amendment/114th-congress/house-amendment/280 https://www.congress.gov/amendment/114th-congress/house-amen...
dcre 11y ago
Like I said in a reply to another comment, see the list of No votes here: https://www.govtrack.us/congress/votes/114-2015/h290 https://www.govtrack.us/congress/votes/114-2015/h290
- belovedeagle 11y ago
  Too bad this contradicts the favorite talking point of "it's Republicans who hate sound technology decisions"...
  - dmix 11y ago
    That's not as true anymore, plenty of news coverage in the past month of the last NSA limiting bill mentioned how the younger republicans are now more libertarian leaning and anti-surveillance. While the older republicans are still the hardcore national security hawks. There is some hope for the younger generations it seems, The people who have a better grasp of technology than the older crowd.
    - spacemanmatt 11y ago
      > There is some hope for the younger generations it seems, The people who have a better grasp of technology than the older crowd. While I agree there is reason for hope, the younger more Libertarian crowd concerns me more, even if I agree with them on surveillance.
deleted 11y ago
[deleted]
derefr 11y ago
This seems to imply that the following could be a plausible chain of events: 1. some of the NSA Suite A ciphers get reverse-engineered by foreign citizens; 2. isomorphic algorithms with equivalent guarantees to those Suite A ciphers are developed, again out-of-country; 3. those algorithms are put into a piece of open-source software and posted online, allowing anyone to use them; 4. industry across the world decides that these "new" ciphers are really good and widely adopts them (e.g. incorporating the code into OpenSSL et al), to the point that they become a de-facto standard; 5. flaws are found in other current ciphers, such that the isomorphic-to-Suite-A ciphers we now have access to become the only conscionably recommendable choices; Then, at that point, it seems like NIST could now choose to put these isomorphic-to-Suite-A ciphers into a standard, and the NSA couldn't say no. Is that right?
- Zigurd 11y ago
  That would be nice. But it seems like US diplomacy has been deployed against anyone claiming to be more secure than US tech companies. It's just crickets out there. Certainly all the Five Eyes's tech companies have been nailed down. It might happen, but it won't come from a major established tech company in the Americasphere.
mindslight 11y ago
And what is the penalty when NSA continues to do so, assuming they're even found out? Especially when they can just retroactively claim that the people doing so were on overhead for other projects. Or if they simply fund those type of projects through shell companies with reserves from drug running / insider trading? The only way to fix this mess is to defund and dismantle the whole damned agency.
fredleblanc 11y ago
Bah, one of the No votes was my house rep. Time to set aside an hour to write some letters of disappointment on Monday.

73 points by randomname2 11y ago

The posted URL gives a 404 error. It looks like the intent was to point to this press release: http://massie.house.gov/press-release/press-release-house-passes-massie-amendment-strengthen-privacy-and-security http://massie.house.gov/press-release/press-release-house-pa... Excerpt: The 383-43 vote represents a victory for electronic privacy advocates. Massie's amendment would prevent the National Institute of Standards and Technology (NIST) from cooperating with the NSA to weaken encryption standards for the purpose of facilitating electronic surveillance. “When our government weakens encryption software to spy on citizens, it puts everyone at risk. Hackers can exploit weak encryption to gain access to Americans' confidential health records and financial information," said Congressman Massie. "The NIST charter is to establish dependable standards, not to compromise standards for the purpose of spying."

dang 11y ago
Thanks. Url changed from http://massie.house.gov/press-release/press-release-house-passes-massie-amendment-strhttp://massie.house.gov/press-release/press-release-house-passes-massie-amendment-strengthen-privacy-and-securityengthen-privacy-and-security http://massie.house.gov/press-release/press-release-house-pa....

siliconc0w 11y ago

It was a fairly hair-brained scheme to begin with... NSA: Hey guys - you should totally use this suboptimal encryption standard with these constants we somehow created. Everyone: Uh... we're good. Thanks...

GunlogAlm 11y ago

You borked the URL a bit there. :) http://massie.house.gov/press-release/press-release-house-passes-massie-amendment-strengthen-privacy-and-security http://massie.house.gov/press-release/press-release-house-pa...

hellbanner 11y ago

Who are the 43 people who voted against and why? Are there any good sites for public discourse with house & senators about why they vote a certain way?

mkempe 11y ago
Close to 90% of the no-voters are Democrats. The only reason I can imagine is that they oppose even a tiny measure that would hinder the growth of Leviathan.
dcre 11y ago
Here are the votes: https://www.govtrack.us/congress/votes/114-2015/h290 https://www.govtrack.us/congress/votes/114-2015/h290
- hellbanner 11y ago
  Wow, that's a great site. Wish there was an open community discussion where I could say.. send messages to my representative who then sends them to the Congress person after filtering messages from a voting group. I understand that's what representatives are supposed to do, but there's an awful lot of people with opinions..

dooglius 11y ago

The summary at https://www.congress.gov/amendment/114th-congress/house-amendment/342 https://www.congress.gov/amendment/114th-congress/house-amen..., and the bill it is attached to, imply that only funding from only NIST to consult with the NSA/CIA is blocked. Wouldn't this sort of thing be coming out of the NSA's budget anyway? Seems like an easy loophole. Edit: the loophole is even bigger than that! I listened to the discussion (http://www.c-span.org/video/?326244-2/us-house-debate-fy-2016-spending http://www.c-span.org/video/?326244-2/us-house-debate-fy-201... around 3:16) where Massie says that the bill doesn't prevent collaborating with the NSA to strengthen encryption, only to weaken it. But the NSA can just claim they are helping to strengthen encryption... in fact that's probably exactly what they did when they first introduced DUAL_EC_DRBG to NIST in the first place.

higherpurpose 11y ago
Right. Also isn't this bill like an annual one? Which means this amendment would have to be passed every year?
- filoeleven 11y ago
  Yes, to the best of my knowledge the limitations placed on use of funds are only for the funds being appropriated by the current bill. In fact amendments that do otherwise may be removed under procedural rules, but it also seems that if no one raises a point of order then it is not enforced. I actually got curious and looked at a bunch of other amendments[0]. Another one that was agreed to was "An amendment to prohibit the use of funds by the Department of Justice in violation of the Fifth and Fourteenth Amendments to the United States Constitution; or to repeal the guidance provided in the memorandum issued by the Attorney General on March 31, 2015."[1] That makes me wonder what was in the referenced memorandum. This one was withdrawn by unanimous consent; make of that what you will: "An amendment to prohibit use of funds to transfer cell site simulators, or IMSI Catcher, or similar cell phone tower mimicking technology to state and local law enforcement that haven't adopted procedures for the use of such technology that protects the constitutional rights of citizens."[2] There were also a whole bunch of amendments that had this form: "An amendment to reduce and then increase funding for NOAA Operations, Research, and Facilities by $70 million."[3] That one passed but there were at least seven others failed or withdrawn (both before and after this one) which were identical in all but the cash amount, and a few more for agencies other than NOAA. Does anyone know what the point of these amendments are? [0]https://www.congress.gov/bill/114th-congress/house-bill/2578/amendments https://www.congress.gov/bill/114th-congress/house-bill/2578... [1]https://www.congress.gov/amendment/114th-congress/house-amendment/323 https://www.congress.gov/amendment/114th-congress/house-amen... [2]https://www.congress.gov/amendment/114th-congress/house-amendment/309 https://www.congress.gov/amendment/114th-congress/house-amen... [3]https://www.congress.gov/amendment/114th-congress/house-amendment/280 https://www.congress.gov/amendment/114th-congress/house-amen...

dcre 11y ago

Like I said in a reply to another comment, see the list of No votes here: https://www.govtrack.us/congress/votes/114-2015/h290 https://www.govtrack.us/congress/votes/114-2015/h290

belovedeagle 11y ago
Too bad this contradicts the favorite talking point of "it's Republicans who hate sound technology decisions"...
- dmix 11y ago
  That's not as true anymore, plenty of news coverage in the past month of the last NSA limiting bill mentioned how the younger republicans are now more libertarian leaning and anti-surveillance. While the older republicans are still the hardcore national security hawks. There is some hope for the younger generations it seems, The people who have a better grasp of technology than the older crowd.
  - spacemanmatt 11y ago
    > There is some hope for the younger generations it seems, The people who have a better grasp of technology than the older crowd. While I agree there is reason for hope, the younger more Libertarian crowd concerns me more, even if I agree with them on surveillance.

deleted 11y ago

[deleted]

derefr 11y ago

This seems to imply that the following could be a plausible chain of events: 1. some of the NSA Suite A ciphers get reverse-engineered by foreign citizens; 2. isomorphic algorithms with equivalent guarantees to those Suite A ciphers are developed, again out-of-country; 3. those algorithms are put into a piece of open-source software and posted online, allowing anyone to use them; 4. industry across the world decides that these "new" ciphers are really good and widely adopts them (e.g. incorporating the code into OpenSSL et al), to the point that they become a de-facto standard; 5. flaws are found in other current ciphers, such that the isomorphic-to-Suite-A ciphers we now have access to become the only conscionably recommendable choices; Then, at that point, it seems like NIST could now choose to put these isomorphic-to-Suite-A ciphers into a standard, and the NSA couldn't say no. Is that right?

Zigurd 11y ago
That would be nice. But it seems like US diplomacy has been deployed against anyone claiming to be more secure than US tech companies. It's just crickets out there. Certainly all the Five Eyes's tech companies have been nailed down. It might happen, but it won't come from a major established tech company in the Americasphere.

mindslight 11y ago

And what is the penalty when NSA continues to do so, assuming they're even found out? Especially when they can just retroactively claim that the people doing so were on overhead for other projects. Or if they simply fund those type of projects through shell companies with reserves from drug running / insider trading? The only way to fix this mess is to defund and dismantle the whole damned agency.

fredleblanc 11y ago

Bah, one of the No votes was my house rep. Time to set aside an hour to write some letters of disappointment on Monday.