President Obama Wants You--In Jail
quora.com
quora.com
What decision-makers are not really thinking is that by threatening legitimate security researchers (or well-meaning insiders), they leave the field open to the malicious hackers. However, with government money in play, there could be an interest to leave backdoors open for other shenanigans (like rigged tendering).
Though, to be fair, malicious hackers are the people they're out to get, just that well-meaning people would get caught in the crossfire. Granted, matters are much too complex to be understood by politicians or even many corporate lawyers.
That anyone would ever say this in a non-ironic sense is flabbergasting.
> That anyone would ever say this in a non-ironic sense is flabbergasting.
Legislators write the laws and then courts figure out the ramifications. Laws get written because of some catalyst, but I wouldn't expect anybody to be able to understand the full ramifications until the law is in place for a while and people have started testing it in the legal system.
You can hardly expect politicians to understand the
ramifications of the legislation they're proposing.
If there is one thing I expect politicians to understand, it is exactly that: the laws they propose. Passing the laws that serve their country the best, that is the most important part of their job. Everything else can be delegated, but this is why they spend time together in a room, debating issues and voting on laws. They don't even need to read it: they need a trusted expert to tell them what decision they are taking for the future of their country.
This common attitude ensures that successful politicians are the ones who maintain the illusion of competence and decisiveness in all circumstances.
Slinging mud at specific politicians is not productive, since most of them don't know enough to understand why this language is unacceptably vague. I'd hazard that most of Congress is in favor of this language. We need to educate them as to why this language is dangerous, not start a partisan battle. The problems with this legislation are way bigger than Obama.
Is it about drugs? Is it about software piracy? Is it about fisheries law? I don't know, I haven't actually bothered to click on the article because I object to being baited with such a mysterious-sounding headline.
I just came into the thread to complain about the headline. Hi there!
That's because the claim is in fact wrong.
Imagine your bank decided to store your money in an unprotected vault, no security, and then it goes missing one day. Yes, a criminal stole it, but it was only possible because the bank deceived the customers into thinking their money was secure. As far as I'm concerned, there's two criminals in this equation.
Would you mind elaborating...?
Even if you deduce that there might be a flaw in some web site design, you actually need to illegally hack the site in order to prove such flaw exists. In the article, the author noticed he could associate himself with any company that works with the US government and change their info. To prove that, he broke the law. And is lucky he is not in jail for doing so.
I can see from the company's point of view, from the FBI, from the government, from senators and congressmen writing the laws - trying to find flaws in a system is by definition hacking, illegal entry, unauthorized use. You don't have to be stealing credit card numbers for it to be a crime. Logging in to a computer system you are not authorized to is a crime. Period.
So the moral of the story is, if you want to stay out of jail, don't try to find flaws in web sites. Just don't. Or if you do, have a theory and report it to the company, but don't test your theory.
But I do agree companies should have a way to be contacted about security flaws, and be held criminally liable if a flaw was reported and not fixed in a timely manner. But even white-hat hackers are breaking the law and only by their actions after (reporting it to the company) are they not getting arrested or sued for it.
The one thing new legislation should do is require companies, and especially banks, government agencies, and health care organizations, to have a defined channel for reporting security flaws anonymously and in detail. By reporting the GSA eOffer flaw to the agency's Inspector General, I followed proper procedure (and was punished), but most of the time, there is no proper procedure. I reported the PayMaxx flaw to the only people who would listen--my sales representative and customer service representatives--and unsurprisingly, the critical information went nowhere. I reported the Facebook flaw to Mark Zuckerberg, and unsurprisingly, he placed the blame on someone else, telling me that he hadn't written the code in question. Responses like these aren't good enough. On the FaceCash payment system web site, this is why we've put a link to our security response form on the bottom of every single page. (If you run a web site, you should do the same.)
This puzzles me. You correctly note how absolutely abysmal the political arena is for crafting well-defined rules regarding technical issues, and yet you immediately start agitating for more regulation. Do you really want to be compelled to conform to whatever (likely flawed) procedural policy the politicians and bureaucrats would come up with? A policy which would require further legislation to fix (much to the joy of lawyers and lobbyists)?
How about this instead: repeal some legislation. Repeal the laws that prosecute Good Samaritans who, after a reporting a security flaw to a firm, release it to the public who might be harmed by the flaw. If the firm has no procedures in place to deal with the reports, then too bad for them; they don't get to use the state as a club against others.
I'm fully aware that none of that will happen. The police power of the state confers no wisdom on those willing to wield it. Nor do they have any incentive to write good laws, but on the contrary are encouraged by interested parties to write bad laws (intentionally or not). So please, stop agitating for new laws in the vain hope that finally, this time, they won't create a plethora of unintended consequences and injured innocents.
There's no way to rule innocent men. The only power government has is the power to crack down on criminals. When there aren't enough criminals, one makes them. One declares so many things to be a crime that it becomes impossible for men to live without breaking laws.
How can anyone take an article seriously when the title is so intellectually dishonest, hyperbolic, and factually untrue? Please keep this stuff on Reddit.
Not every piece of literature ever written has a title that perfectly summarizes the contents. I like my title, but regardless, the issues discussed in the piece are what's important.