TPP Threatens Security and Safety by Locking Down US Policy on Source Code Audit
eff.org
eff.org
> No Party shall require the transfer of, or access to, source code of software owned by a person of another Party, as a condition for the import, distribution, sale or use of such software, or of products containing such software, in its territory.
This means that requiring code audits is not allowed for any software, not just imported software, right? Because I've seen quite a few people misled into thinking that similarly worded provisions apply only to imported goods.
If TPP was a legit trade treaty I would expect it to have anti-protectionism provisions (i.e. treating imported and home-produced software the same), not legislation-preventing ones.
One provision like that is disturbing, 6000 pages of them is horrifying.
> No Party shall require the transfer of, or access to, source code of software owned by a person of another Party, as a condition for the import, distribution, sale or use of such software, or of products containing such software, in its territory.
The meaning of this sentence hinges on the definition of the word "Party". My guess is that a "Party" is a signatory of the treaty.
So, my read on this is that no government "shall require the transfer of & etc of source code..." "as a condition for the import, distribution & etc..." of software that is owned by someone (or something) that is not a citizen or is not based in that country.
I suspect that software made and sold within a given country would not be subject to this restriction.
I'm not clear on how this interacts with multinational corporations. I'm not entirely clear on how this affects state or local governments. (I expect that Federal treaties trump state and local law, but I'm not sure.)
I'm also not certain that my analysis is correct.
Edit: Ooh. I really super wonder how this interacts with code for which the original author(s) has relinquished all ownership and interest in. ;)
Unless it is "software owned by a person of another Party".
Which has the defacto effect of making it impossible to require such provisions domestically because all you'd need to do to circumvent it would be to transfer ownership to a suitable shell company and/or because domestic companies would justifiably be upset at being subject to harsher rules than foreign companies.
I guess I should have. :(
> ...domestic companies would justifiably be upset at being subject to harsher rules than foreign companies.
As I read it, nothing in the quoted TPP section precludes software purchasers from making access to source code a requirement of purchase. It prohibits governments from blocking the sale of "foreign-produced" software in their country if the software owner refuses to make the source code available.
It doesn't really make sense to do that with domestic software and to give imported software a free pass.
> which other country that is a party to this treaty is going to have standing to bring litigation
Why does it need to be a country? The domestic software maker whom the government forces to do something that is not allowed under the treaty should have standing.
For example, there's Russia-Canada income tax treaty. If one of those countries wants to hose me in a way that is contrary to that treaty, I should be able to use it to defend myself. I assume it would work the same way with TPP, but obviously IANAL.
Yes but what is applicable are domestic laws that can differ from country to country. What really would not make sense would be for an international treaty to restrict what a country can do with its own software in that country.
> Why does it need to be a country? The domestic software maker whom the government forces to do something that is not allowed under the treaty should have standing.
Because the parties in this agreement are countries - and the terms in the treaty provide remedies for businesses and individuals who are infringed by another country that is a party to the treaty. You are not a party to this treaty with your own government.
That's why people are concerned about the TPP, it appears to do exactly that. Not just in case of source code audits, but in general TPP seems to limit a country's ability to pass new legislation pretty significantly, including in areas that are not related to global trade (e.g. IP).
I sure hope the TPP isn't as bad as it seems.
"Misled" or willfully ignorant? The second, of course.
The text in question is just one sentence, but its meaning can be altered by any of the other 6000 pages. For example, this is how people who know more about this than me are reading it: http://www.ip-watch.org/2015/11/24/tpp-article-14-17-free-so...
Seriously, you can't blame ordinary people that they don't want to perform legal analysis of such a huge treaty as TPP, even if you somehow think they are able to.
Indeed. An actual free-trade agreement would be really simple to implement. Just stop intervening in trade in any way, and you'll have Free Trade.
But that would be against a lot of cronies' interests and very much in the people's interests, so it's never going to happen.
On a related note: Stop intervening in what people do with their property, and you'll have a free market.
That would preclude taxation though, and so, a lot of people who believe they somehow benefit from someone forcefully taking their money would object.
Well maybe, but you don't really want a Free Market. Be happy that thanks to not having it, you can still eat food that, while crappy, is not downright poison.
HN moves in a mysterious way
Its downvotes to perform...Not necessarily always in the "people's interests". Here's a bit of Wealth of Nations that you don't often see quoted:
Corporation laws, however, give less obstruction to the free circulation of stock from one place to another than to that of labour. It is everywhere much easier for a wealthy merchant to obtain the privilege of trading in a town corporate, than for a poor artificer to obtain that of working in it.
I'm sure you'll enjoy it when your neighbour decides to open a sewage processing plant.
And we have a name for contractual agreements with everyone in a society. We call them "laws".
Except that no one asked us if we agreed. Without mutual agreement, there is no contract. In reality, laws are commands that we're punished for disobeying.
Tell me, what's the practical difference between getting punished for disobeying a King's or Emperor's law, and getting punished for disobeying a law written by politicians or bureaucrats somewhere?
Then there's the problem that governments don't actually adhere to their own laws anyway. NSA's surveillance is unconstitutional. That's not a problem for them, but if you disobey laws, you will be punished one way or another.
Who do you think you're kidding?
And in your world, no one asks if we agree to property rights.
And calling them "rights" instead of "laws" doesn't make following them voluntary.
Punishing people for not adhering to a particular law is not necessarily morally legitimate. Smoking weed is a prime example.
You know those concepts are different, so you're intentionally conflating things, which means you're a troll/sophist.
It may be the case that a system of pure property would lead to the best outcomes, but if so you need to actually argue that.
Putting your preferred rules on a pedestal by calling them "rights" and refusing to engage with criticism is not an argument.
Is free trade even a good idea?
Suppose industry in your country has higher costs, because people care about say, waterways, and thus there has to be filtering and proper waste disposal.
If you allow free trade from a country where they simply dump waste everywhere, you are punishing industry for doing the right thing, and rewarding polluters.
First the most poignant issue with it is; "power begets more power" or "money begets more money". For the most part the rich get richer. Also the truth of the matter is the market can never be "free", there will always be someone clever or rich enough who will seek to exploit and control it. Thus you need regulations to keep these individuals and corporations in check. You then need a strong government that can stand up
Second the idea that the money you earn is the money you deserve is wrong. I come from a middle class and stable family. They have provided a world of support to help me succeed in this world. Do I deserve this? No I got lucky. The self made man myth, is utter bullshit. People that "succeed" in life have been helped along the way by the community. Do you really believe a poor person is poor because they don't work as hard as a wealthy person? What about people with mental disabilities, or physical ones? So people who acquire wealth don't really "deserve" it, I put that in quotes because they certainly deserve the money but so do a lot of other people that don't have it. Thus we impose taxation, to serve as a form of wealth redistribution and to create a safety net. This pays for public schools, public roads, transportations, military, etc. Basically the world is not fair and our governance should work to fix that.
Third, maintaining a "free market" is also equally important. You need good level of competition in society. Something for people to strive for and to power the whole system. Honestly this market would not be any freer than a libertarian's "free market", as stated previous the idea of a "free market" is a farce.
Fourth, think about the world you want to live in. Do you really want to live in a world where poor people are never given decent opportunities? Where they have to struggle and get by purely on corporation donation? What about if everything in your life goes bad, would you want to end up in the gutters or be able to rely on some form of assumed social aid.
-ps I don't know very much about TPP, I am just responding to what I perceive is your world view. -pps Clearly neither of our views are how any country operates, but I feel like we should be striving for something that works and not extremism -ppps Sorry if this seems a bit indirect, I'm not necessarily addressing you, but the numerous libertarians on the web in general and this has been partly cut and pasted from another convo.
In the sci-fi I read/watch, "free trade" is very popular and very well presented (and I'd say pretty accurately) - it all looks cool and pretty at a first glance, but then it turns out that big parts of the population are extremely poor miners slaving away their whole lives in some godforsaken hellholes, and on the free market you can easily buy anything from innocent people's organs to weapons of mass destruction.
As for libertarianism - it has some good ideas, but the more extreme forms burst into flames at the first mention of the word "externality".
Yes there is a certain aspect of libertarianism that both touches on something true and is attractive, but so does communism. Not that that means libertarianism is wrong it is just similar to communism that way, but I think it is wrong for the reasons I stated. Also Karl Marx offered many good critiques of capitalism.
I have studied each of the modern ideologies a bit, and Modern Liberalism is a good blend of both Libertarianism and Socialism. Rawls is a good source if you're interested in perusing, https://en.wikipedia.org/wiki/John_Rawls
I have to say tho, I see a pretty heavy trend towards libertarianism. Particularly among my peers in the Bay Area and their idols. I find it pretty annoying because they are the pinnacle of privilege and have embraced a ideology that alleviates their "guilt".
Also, there is another reason to keep a diversity of ideologies: they serve as a check on each other. For example, allowing either capital or labor to gain too much power tends to cause problems. It is the competition between them that keeps power from consolidating on one ideology.
(for a better description of that idea, see http://www.theguardian.com/world/2013/dec/08/david-simon-cap... )
By "instability" do you mean draconian legislation like SOPA / PIPA / CISPA / NDAA / TPP / TTIP and all the other nasty shit we're supposed to keep "pushing back" on, because otherwise they'll just inflict it all on us, and then it's too bad because we kind-of-sort-of asked for it by voting in the bums and not resisting.. ? :P
Let's hope we never experience whatever catastrophic failure would follow from pushing back too successfully!
We don't need to; we already know how it looks like. It went to the opposite extreme when the Industrial Revolution started; our great grandfathers and their great grandfathers paid in blood to restore the balance, so that we may enjoy relatively humane employment conditions the current generation of entrepreneurs wants to fight against so hard.
So you think we're now experiencing too little draconian legislation then?
That's a ridiculous idea in the reality we live in.
> IMO we need to trim regulations here and there
Who's "we"?
Now correct me if I'm wrong, but it seems you're suggesting that "externalities" are better handled by rulers ruling over their subjects than voluntary co-operation between individuals.
That's what we have now, you know. Rulers and subjects. There's a small elite imposing their will on everyone else, and it seems you think they're taking care of externalities better than we could without rulers.
Presumably, if you didn't think so, you'd support voluntary co-operation instead of our current societal arrangements.
But it's pretty damn difficult to believe you sincerely think so, considering we all know corporations around the world are somehow managing to pollute their hearts out despite our benevolent overlords being there to protect and serve us.
The people of Beijing can't be particularly happy with how their externalities are handled, for example.
It's like there's this thing called "bribery", and it's a really effective way of getting to do whatever the hell you want with the environment, as long as you keep handing money to the right politicians.
Oh, and by the way, this way of circumventing any negative consequences for destroying the environment wouldn't be available without political power, as you may be able to comperehend.
But nevermind, I wrote this message not so much to you, but to some innocent bystander who might happen to read this.
No, they're suggesting that externalities are not handled well by entities that, by definition, have no incentive to care about them.
But as it happens, yes I tend to think co-ordination problems are solved more effectively by a co-ordinator, rather than decentralised actors.
You can call them "rulers" if you like, but then you'd be ignoring the concept of democracy.
>you'd support voluntary co-operation
Except you don't support "voluntary" anything, because you're talking about property rights. You know, a system where people are forced to follow particular rules about resource allocation, regardless of whether they agreed to follow them.
As long as there is scarcity, there will inevitably be coercion in the distribution of resources. You can argue that a system of pure property rights minimises it, but please don't pretend that it magically avoids it.
Entities like rulers, perhaps? You know "campaign contributions" are an euphemism for bribes, don't you?
When the people who you think are preventing externalities get bribed, they actually have an incentive to not care about them.
> You can call them "rulers" if you like, but then you'd be ignoring the concept of democracy.
What exactly am I ignoring? The idea that you can affect something by dropping a piece of paper into a box? That belief is extremely convenient for the people who are in no way bound by that act, you know?
> Except you don't support "voluntary" anything, because you're talking about property rights.
Do you sincerely think the main reason why people don't steal from others is that they'd be punished for it?
> As long as there is scarcity, there will inevitably be coercion in the distribution of resources.
That's probably true in the sense that someone somewhere will rob someone regardless, but.. if you actually have a problem with "coercion in the distribution of resources", then you just can't sanely support the idea of an organization that coerces potentially hundreds of millions of people in how their resources are "distributed".
Sure, US democracy is badly implemented, but that doesn't mean the idea is inherently flawed. If you want to argue that it is, feel free. But until you do, please stop pretending there is no alternative to your false dichotomy.
>Do you sincerely think the main reason why people don't steal from others is that they'd be punished for it?
No, but most people following the rules of their own volition is not sufficient for the system to work. If you make it truly "voluntary", then anyone who doesn't agree can just take whatever they want.
> if you actually have a problem with "coercion in the distribution of resources"
I don't, as I said it's inevitable. I just object to libertarians pretending they can avoid it.
If you believe the act of dropping a piece of paper into a box actually affects what a politician can do, I've got a bridge to sell you. That's what it would take for voting to actually affect something, otherwise you're just engaging in a pointless ritual.
Of course it's only pointless on the voter's part. People believing in the idea that subjects have a say in how they're ruled sure as hell benefits the rulers!
> I just object to libertarians pretending they can avoid it
In fact, I've avoided all non-governmental forms of coercion all my life!
The power of democracy is that it becomes completely socially unacceptable to ignore what those pieces of paper say.
And indeed the people you're complaining about don't ignore them. They find ways to get what they want despite the system, but they never outright defy it. No one installs themself in office without winning an election (EDIT: In the US), and if anyone ever did there would be rioting in the streets.
>> I just object to libertarians pretending they can avoid it
>In fact, I've avoided all non-governmental forms of coercion all my life!
I mean that you're pretending your ideology can avoid all coercion, while ignoring the coercion involved in enforcing property rights.
[1] https://www.softwarefreedom.org/blog/2015/nov/23/TPP-Article...
Which make me wonder, how do you distinguish between legitimate use of source code audit and the one that try to blatantly copy the source code?
[0] http://spectrum.ieee.org/tech-talk/telecom/security/chinas-n...
Come on. Source code audit is pretty standard procedure in case of any government usage around the globe and there also plenty of people have access to proprietary software source directly or not. Even big companies getting hacked by enthusiast with nearly zero budget and country have almost unlimited resources.
What's more important so far China was doing great just replacing exist products using hardware available on market and without copying anyone source code.
First is that I'm very uncertain that it is a good idea to allow a gov't regulatory agency to require access to source code as a condition of access to a marketplace. Especially if it is anything more than simple access, like some form of auditing. Who's going to pay for whatever the regulatory agency is doing with the code (most likely the code's owner)? Also how long is it going to take the agency to issue an authorization? How would this impact code delivered to web browsers? Especially something packaged up as a webassembly or native plugin?
So... any new regulatory body that requires the ability to examine source code seems like it would need to navigate a minefield of problems. I doubt that a gov't agency could strike the right balance, and the side effect would be a significant barriers to trading in software.
On the other hand, the recent spat of problems with automobile software (Volkswagen, Toyota) do seem to make the case that some regulatory action might be necessary. Certainly requiring source code access is not that unusual in court cases, but do we want to wait until these companies are getting sued? Also with the expectation that driverless cars are coming... well.. there's going to be a lot of safety concerns there.
On the gripping hand, the FDA's medical device regulations seem to handle the issue of software without requiring access to source code (http://www.fda.gov/RegulatoryInformation/Guidances/ucm085281...). The TPP doesn't prevent any sort of validation regime requirement for products containing software... so maybe that's the right approach for specific product types (life critical, security critical... though what about browsers?). The TPP also doesn't prevent source code access via a suit or enforcement action, so if a problem does appear an appropriate regulatory body could demand source code (eg. NTSB could take an enforcement action of "validation audit" which requires the validation records and associated source code).
So... yet another part of the TPP that I'm conflicted on... sigh.
If you want to audit a closed-source program for bugs and backdoors, people have been able to do this successfully hundreds (of thousands?) of times with standard tools like debuggers, disassemblers, and automated program analysis tools. The fact that a program is closed source has not stopped anyone from researching how it works. Ask ANY security researcher if it suddenly becomes impossible.
EFF for the win, again! Who the heck is advising these people?
How could this possibly be reasonable?
Being able to look at the source code is a huge part of regulating code in life-and-death applications. Medical devices, cars, planes, train systems, etc. all need to be held to safety standards, and not allowing regulators access to the source code significantly inhibits their ability to do their job.
> If you want to audit a closed-source program for bugs and backdoors, people have been able to do this successfully hundreds (of thousands?) of times with standard tools like debuggers, disassemblers, and automated program analysis tools. The fact that a program is closed source has not stopped anyone from researching how it works. Ask ANY security researcher if it suddenly becomes impossible.
First of all, there are cases where you're just flat wrong. The Gauss virus contains an encrypted payload which is encrypted with a few system strings, meaning that when it runs in that system it will execute the encrypted code. It's impossible to audit the encrypted code without knowing the properties of the system it's intended to run on. Admittedly this is currently an unusual case, but given the incentives, it's unlikely that this will remain unusual. Hiding proof of code like the code in the Volkswagen emissions scandal[2] presents a large barrier to regulation, and it's not hard to imagine cases where it would make proving wrongdoing outright impossible.
Even in cases where an encrypted payload is not used, you cannot in good faith argue that the capability of auditing a binary is equivalent to the capability of auditing the source code. Yes, it's possible in most cases, but obviously it's significantly harder to audit computer generated, optimized, and decompiled assembly code than it is to audit code written in, say, C. The skill and time required to audit a binary is such that it's cost prohibitive in most cases: in the Volkswagen case, they discovered the fraudulent code with a $50,000 study that white-box tested the code by driving the car.[3] My guess is that an audit of the C code could have revealed something like:
if(car_is_being_emissions_tested()) {
...
}
In short, it's absolutely not reasonable to tie the hands of regulators by preventing them access to the source code. Doing so is equivalent giving up on regulating a large fraction of possible anti-regulation behaviors.
And this is only talking about regulation, when the binary being audited is produced by a company trying to skirt regulation. Even more concerns arise when the binary being audited might be partially created by a government. The NSA has well-known capabilities in this area, and we have no reason to believe that China (where many devices in the US are manufactured) has similar capabilities or will in the near future.
[1] https://securelist.com/blog/incidents/33561/the-mystery-of-t...
[2] https://en.wikipedia.org/wiki/Volkswagen_emissions_scandal
[3] https://en.wikipedia.org/wiki/Volkswagen_emissions_scandal#U...
Given that the arbitration procedure outlined by the TPP is operated by private lawyers who are already unreasonably biased towards their corporate clients...
The entire treaty strikes me as a brazen giveaway of national sovereignty to private interests. And as such should be stopped.
Sovereignty is more about where final power rests, not about where immediate control happens to take place, so I think withdrawal is a useful counterpoint to concerns about giving up sovereignty.