Hacker News Reader

Comment by jolmg | Hacker News Reader

> To make things worse, the Act proposes the creation of a hybrid bounty program, giving third-parties financial incentives to extract encrypted data following a request from U.S. agencies. In short, if the tech companies won’t build a backdoor, the U.S. government will pay hackers top dollar to use whatever means necessary to get the data for them.

Is that worse?

View on HN

I think it's a better solution. Far safer for the government to employ expert lock picks than to outlaw locks.

I thought that was the current status quo?

Only if the government tells us when they find a back door, which they obviously would not do.

Even if they don't, I think it's still better.

> the U.S. government will pay hackers top dollar to use whatever means necessary to get the data for them.

Probably the current state of affair anyway.

Probably for some operations. This would allow more of the intercepted and decrypted messages to become evidence in court. This would encourage more law enforcement agencies to use more backdoors.

IANAL

Except out in the open with plausible ... stuff.

Kind of like how woods hole "finds" a lot of stuff in the ocean.

I mean, if this means bounty hunters sell their exploits to the US Government instead of selling it to a financial fraud ring, that seems like a good thing.

Could you elaborate on the "stuff" that is found in the ocean for the purposes of this analogy?

I suspect other arms of the government that can put a man far underwater find things in the ocean and pass it on.

so if woods hole finds something, or a hacker finds something, who knows if they got a hint from elsewhere.

Second that, please - the analogy went over my head, but sounds interesting

Could you elaborate on that?

It will probably turn out that the most cost effective way of getting around encryption is bribing employees, whether through a contracting firm or directly. Great for trust...

Reminds me of Australia.

https://www.wired.com/story/australia-encryption-law-global-...

No, because if data that was encrypted is used in court, at least you know that the encryption scheme has been cracked. Even if they don't show how they cracked it, you can at least know it has likely been compromised (unless, of course, they somehow installed spyware on your device to intercept the data before encryption). I believe that people trying to break encryption leads to better encryption.

Of course it's worse, at least if it is successful. You already start out with two entities with access to your data instead of just the government. And one of them has already proven to be financially motivated and morally flexible, making it likely they will be willing to share their knowledge with any number of additional bidders.

If they were just paying hackers to build the backdoor, it might be better. Requiring a US agency request is basically a loyalty oath though, as their work violates the DMCA if that request is rescinded.

Yeah. Tax dollars at work.

Reply on news.ycombinator.com