SoylentNews is people
SoylentNews
El Reg :
Analysis In the wake of the FBI's failed fight against Apple, Senators Richard Burr (R-NC) and Dianne Feinstein (D-CA) have introduced a draft bill that would effectively ban strong crypto.
The bill would require tech and communications companies to allow law enforcement with a court order to decrypt their customers' data. Last week a draft copy of the bill, dubbed the Compliance with Court Orders Act of 2016, was leaked, but the new version is even worse than the discussion draft.
In the draft version, court orders could only be issued for a crime resulting in death or serious bodily harm, terrorism and espionage, crimes against minors, serious violent felonies or Federal drug crimes. In the final version, those caveats are gone, so any court order will allow the police to access the data they want.
The bill would apply to "device manufacturers, software manufacturers, electronic communication services, remote communication services, providers of wire or electronic communication services, providers of remote communication services, or any person who provides a product or method to facilitate a communication or to process or store data." That's a pretty wide net.
"No entity or individual is above the law," said Feinstein. "The bill we have drafted would simply provide that, if a court of law issues an order to render technical assistance or provide decrypted data, the company or individual would be required to do so.
"Today, terrorists and criminals are increasingly using encryption to foil law enforcement efforts, even in the face of a court order. We need strong encryption to protect personal data, but we also need to know when terrorists are plotting to kill Americans."
Idiots, I tell you, they're a pair of idiots.
(Score: 2) by RamiK on Friday April 15 2016, @03:55AM
SCOPE OF REQUIREMENT
A covered entity that receives a court order referred to in paragraph (1)(A) shall be responsible only for providing data in an intelligible format if such data has been made unintelligible by a feature, product, or service owned, controlled, created, or provided, by the covered entity or by a third party on behalf of the covered entity.
This bill does not ban strong encryption. It simply limits entities to IaaS*. People could still buy a remote VM instance and VNC\RDP to it. They'll then install OSs with Public Domain encryption** that requires a password on boot, encrypts the storage, and only work with end-to-end public domain implementations of encryption protocols. The license will have to be lettered to make the running instance explicitly owned by the clients and not by the entity selling it or some third party.
Effectively, not only will this bill not ban strong encryption, it will force end-to-end strong encryption for storage purposes as well as remote compute. It will also likely force Intel, ARM and AMD to release their micro-controller encryptions to the public domain.
Overall, this is a great bill and we should all support it.
*Infrastructure as a service. As opposed to Platform as a service (Google App Engine and Microsoft Azure) and Software as a service (Web Hosting).
**Licensing retains ownership by the writer. EULAs in closed source software and free software licenses retain ownership by the developers making them responsible to provide decryption. The only way to overcome this is to use Public Domain encryption since the third party scope means you can't setup a shell outside the US to write the encryption part of your product for you.
compiling...
(Score: 0) by Anonymous Coward on Friday April 15 2016, @10:15AM
Licensing retains ownership by the writer. EULAs in closed source software and free software licenses retain ownership by the developers making them responsible to provide decryption. The only way to overcome this is to use Public Domain encryption since the third party scope means you can't setup a shell outside the US to write the encryption part of your product for you.
You forget the part where if you provide encryption as part of your service you're still required to be able to backdoor it.
Cool thing for me, since I'm a cryptographer and can make my own crypto algorithms just for me, and thus they can't stop me from using the ciphers without infringing 1st amendment rights (but they can ramp up the COINTELPRO harassment campaign against us cryptographers [that's why crypto conferences aren't in the USA anymore]).
(Score: 2) by RamiK on Saturday April 16 2016, @06:13PM
You forget the part where if you provide encryption as part of your service you're still required to be able to backdoor it.
Read this again:
feature, product, or service owned, controlled, created, or provided
Simply put, don't provide encryption.
As a software programmer, implement a general purpose script extension system.
As a hardware designer, replace your cryptography extensions with FPGA.
As a cryptographer, review anonymous scripts in an open academic journal wiki while releasing your reviews under public domain.
Is this a feature making data unintelligible? No more than any other general purpose interpreter, CPU or abacus.
Do you own this product, or service? Nope. Can't own what's under public domain.
Do you control this product, or service? Nope. Can't own what's under public domain.
Did you create this product, or service? Nope. anonymous wrote the script. You just reviewed it.
Did you provide this product, or service? Nope. You just reviewed it in a journal after it was posted anonymously \ fell off a truck.
Like I said, this bill is a blessing in disguise. It will force open computing like never before.
compiling...