SoylentNews is people
SoylentNews
El Reg :
Analysis In the wake of the FBI's failed fight against Apple, Senators Richard Burr (R-NC) and Dianne Feinstein (D-CA) have introduced a draft bill that would effectively ban strong crypto.
The bill would require tech and communications companies to allow law enforcement with a court order to decrypt their customers' data. Last week a draft copy of the bill, dubbed the Compliance with Court Orders Act of 2016, was leaked, but the new version is even worse than the discussion draft.
In the draft version, court orders could only be issued for a crime resulting in death or serious bodily harm, terrorism and espionage, crimes against minors, serious violent felonies or Federal drug crimes. In the final version, those caveats are gone, so any court order will allow the police to access the data they want.
The bill would apply to "device manufacturers, software manufacturers, electronic communication services, remote communication services, providers of wire or electronic communication services, providers of remote communication services, or any person who provides a product or method to facilitate a communication or to process or store data." That's a pretty wide net.
"No entity or individual is above the law," said Feinstein. "The bill we have drafted would simply provide that, if a court of law issues an order to render technical assistance or provide decrypted data, the company or individual would be required to do so.
"Today, terrorists and criminals are increasingly using encryption to foil law enforcement efforts, even in the face of a court order. We need strong encryption to protect personal data, but we also need to know when terrorists are plotting to kill Americans."
Idiots, I tell you, they're a pair of idiots.
(Score: 3, Interesting) by Marand on Friday April 15 2016, @01:20AM
I was just reading this article [theregister.co.uk], also on The Register, which claims that Schneier told them that the wording could also affect things like lossy compression methods, because they couldn't be returned to their original state on demand. He had similar concerns about file deletion as well.
The more I see about this bill, the more ridiculous it sounds, and it started at insane.
(Score: 2) by Non Sequor on Friday April 15 2016, @03:41AM
Every law can be read in a way that makes compliance infeasible. The deal is that the courts are the ones that actually resolve what the terms in the law mean in context. Don't count on the courts to read "intelligible information or data" as "bit for bit copy". Also, pay attention to words like "appropriate" and "reasonable". These words delegate some latitude on the provisions of the law to the courts.
The much worse scenario here is not that the law is so broad that it shuts down all software. The nightmare scenario here is that they don't necessitate any engineering decisions, but they do require you to supply engineering effort to find a weakness in your own design. End-to-end encryption wouldn't be banned, but you would be forced to put some effort into finding an attack on your design. That's much, much worse than an outright ban, because an outright ban is much easier to fight. What's harder to fight, would be a law where designs where a company has control over the keys or clear data have a lower compliance cost than end-to-end encryption design. It's easier to turn over data that you're already sitting on than it is to write up and potentially implement an attack plan on a solid design.
Write your congressman. Tell him he sucks.
(Score: 5, Insightful) by mhajicek on Friday April 15 2016, @05:23AM
The original purpose of writing laws down, back in Hammurabi's day, was to eliminate discretion and make it perfectly clear what was permissible and what would be punished and how. The modern practice of leaving everything up to discretion, interpretation, and "reasonableness" I find abhorrent.
The spacelike surfaces of time foliations can have a cusp at the surface of discontinuity. - P. Hajicek
(Score: 2) by Pino P on Friday April 15 2016, @12:27PM
The legal systems of the Five Eyes (FVEY) countries have a concept called "case law", in which a lower court is bound by decisions made by a higher court. Case law restores some of the rule of law that "reasonable" removes, as courts of appeals will slowly build up what constitutes "reasonable" in common situations. But the practical problem with this is twofold. First, information technology has tended to outpace case law. Second, creating case law costs more money for attorney's fees and court costs than startups are likely to have, especially when one party in a case has the nigh-unlimited resources of the federal government.
(Score: 0) by Anonymous Coward on Friday April 15 2016, @06:01PM
Another problem with it is that judges tend to be authoritarians, so leaving them to make subjective decisions about what "reasonable" means is a recipe for disaster.
(Score: 2) by captain normal on Friday April 15 2016, @04:43PM
Do mean you'd prefer something like "that which is not expressively permitted, is prohibited"?
The Musk/Trump interview appears to have been hacked, but not a DDOS hack...more like A Distributed Denial of Reality.
(Score: 2) by mhajicek on Friday April 15 2016, @10:07PM
More like "that which is not expressly prohibited is permitted", unlike what we have where anything an officer doesn't like can fall under "disorderly conduct" or another vague catchall.
The spacelike surfaces of time foliations can have a cusp at the surface of discontinuity. - P. Hajicek
(Score: 2) by jcross on Friday April 15 2016, @01:44PM
On the other hand, those who, like Apple, do care about having strong encryption are presumable already expending resources in exactly that way. If you're not already devising attack plans against your own system, you can't claim much commitment to security. Now what it may do is cause only the large players to adopt serious security measures, but in some ways this is already the case.