Wyden Introduces Bill To Ban Government Backdoors Into Cellphones and Computers

A lot of people will inevitably comment on the flimsiness of this bill - that it can be easily circumvented. This might be true, but its a step forward because it acknowledges that government backdoors are a bad thing.

I wish I could remember where I read about this, but its similar to how activists changed the classification of LGBT literature to a non-stigmatizing category in libraries. This was the start of a lot of progress for LGBT rights. It was a minor victory among lots of major defeats at the time it happened.

Instead of complaining about the weaknesses in the bill, we should view this as a facet of a multi-pronged effort to maintain privacy.

Edit: There is the argument that this bill is a step in the right direction. The problem is that too often, steps in the right direction are the last step taken, and then people treat the problem as solved. I think there is something to be said for not letting the perfect be the enemy of the good, and this doesn't appear to explicitly OPEN any loopholes, so I guess I'm in favor. But we need something stronger to protect civil liberties, and to make people trust US companies can be secure.

The Bill itself is weak as written, at least by my layman's reading. It's two pages, go look: http://www.wyden.senate.gov/download/?id=B8F74B59-0A6E-45C2-...

First, it only covers software, hardware and devices made available to the general public. So any internally developed hardware or software business logic could face such a mandate.

Second, it only covers security functions of such items... It's not clear that specific information, such as a private key, would be a security function.

Third, it has an explicit exemption for the CALEA, Which lets the government mandate how the telephone companies network architecture worked in order to make it easier to wiretap, which the FCC expanded to ISPs and VOIP providers. Now, the FBI and other government entities have been pushing for all internet companies to fall under the CALEA or similar laws, so we can presume that the CALEA is not everything it could be. Still we know that Verizon, which is a broadband ISP, was adding a unique key to HTTP communications.

Fourth, it fails to define surveillance, and it's unclear if a broad capture of information which isn't looked, or of metadata, would be consider surveillance under the law. The law mentions physical search, but that still leaves electronic searches, as well as any form of seizures.

Fifth, it does nothing to prevent attempts to weaken protocols, systems, APIs, encryption standards, etc. While it may prevent specific implementations of them from being forcibly weakened, it wouldn't prevent a forcible or other weakening of the underlying standard, including attempts to manipulate and weaken them.

This bill is flawed but worth your support anyway. It's flawed for at least three reasons:

* It doesn’t stop NSA from weakening security standards, bribing crypto vendors, or hacking into systems to insert backdoors. Even if a future law were to address that, a future president could instruct the NSA (part of the U.S. military, after all) to disregard it. We've all seen some recent examples of aggressive presidential action even in the non-military space where executive authority is weaker.

* Wyden's bill doesn't seem to apply to FedGov spending. So if a company wants that fat .gov/.mil $10 billion-dollar contract, well, it might feel obliged to discontinue that full-device encryption product. It surely makes sense to focus on other unencrypted product lines to support that $10B contract, right?

* A future Congress could overturn it, for instance by enacting FBI’s draft “Going Dark” surveillance legislation. I disclosed some details here about the FBI's proposal to target Internet companies (in retrospect, FBI was carrying water for NSA): http://www.cnet.com/news/fbi-we-need-wiretap-ready-web-sites...

But despite those caveats, Wyden's bill is worth supporting anyway. It does no harm, it's highly symbolic -- and it would stop future agencies from creatively interpreting their statutory authority to screw over the Internet and companies represented here on HN.

While no agency has clear legal authority in this area, that doesn't always stop them, with the FCC the most likely suspect. Remember this is the same agency that unilaterally extended CALEA backdoor requirements to broadband providers, despite Congress never giving it that authority, and despite the FBI director assuring politicians this would never happen. A federal appeals court judge called the FCC's argument for surveillance mandates "gobbledygook" and "nonsense," but unfortunately ended up dissenting in a 2-1 decision, as I wrote here in 2006: http://news.cnet.com/Appeals-court-upholds-Net-wiretapping-r...

This is not a case of a bill doing some harm and some good, like the problematic USA Freedom Act, where different groups applied different weights and reached different recommendations. Wyden's bill does only good, even if doesn't go nearly far enough. Fixing a broken system is not a one-step process.

Can any agency demand a backdoor today, outside of CALEA, which this bill exempts? If they can't, then new backdoors would require new statutory authority --- which would simply override Wyden's bill.

Congress can't pass laws preventing Congress from passing other laws, except by amending the Constitution.

I see comments on the veracity of this bill, but I decry the idea that passing more laws will fix this. It's mere theatre. There are laws already which ban the things our government is doing and they ignore those laws, what is it to ignore one more law? It grows worse with each passing year even the customary dog and pony show slap on the wrist has been dispensed with. The 24 hour news cycle moves on and the fourth estates co-option is more obvious daily. Arguing the details of bullshit doesn't strike me as a judicious use of our time. I strongly urge you to throw any effort you consider devoting to discussion or even thought in regard to legislative fixes to moving forward with the broad adoption of encryption and infrastructure changes within your own organizations that prevent them from monitoring our communications whether they like it or not. The United States government has proven itself untrustworthy, the best option is to simply remove the choice from their hands.

This bill won't pass. Some members would object, but mostly it's just not worth passing because it doesn't do anything. Also, it was introduced with just a few days left in this Congress. (All un-passed legislation is wiped out by the change in Congress.)

BUT, it's not intended to pass. It is intended to communicate and memorialize a particular political opinion. In this case, it is intended to stand in opposition to the opinion expressed by some law enforcement leaders that the government, in the face of improving commercial encryption, should have new powers to mandate back doors.

Most--in fact the vast majority of--bills that are introduced into Congress are not intended to pass, they are intended to make a point. This is one of those bills. That doesn't make it bad or good. That really depends on whether you agree with Senator Wyden. (I bet most people here do.)

I don't mind if the bill is weak, because real solutions are happening outside of electoral politics.

Curve25519 deployment is now massive, for example. LibreSSL is moving forward. RC4 has been ripped out of a lot of stuff and replaced with ChaCha. Salsa20 is in a ton of software and has many users. SafeCurves are getting discussion, especially ed448 and E-521. More people are deploying TLS. More people are conscientous. More people are protected by default without having to make an effort (TextSecure is a great example).

My only sad point is that people are still talking about DNSSEC, which reduces security significantly if used for anything besides signing DNS records. I don't know why anyone not affiliated with Project Bullrun wants you to use RSA-1024 for security.

The only true solution here will be to rule cellphones as inadmissible in court; Not under the Fourth, but under the Fifth. More and more, computers are becoming part of our brains; As inextricably linked to us as our limbs. Until we recognize that this is not fantasy, not the near future, but the now, we're all at danger from government overreach.

It's great when politicians show a spine after being unelected. We should unelect them more often.

The attention Wyden gets as being the anti-surveillance guy in Congress says more about Congress than it does about Wyden. This guy sat on the Intelligence Committee for years, and knew exactly what was going on, and although even he probably learned a thing or two from the Snowden leaks, it's a sure bet he learned a hell of a lot less than the rest of us. Yet, before that, he did precisely fuck-all about any of it. He's still done about fuck-all, besides sort of vaguely indicating that he might exploit some Constitutional provisions to reveal a few more secrets on the Senate floor before leaving office. I'm not holding my breath.

First, the bill has a major(?) exception. Second, they don't need to mandate it. They can just "ask" for it.

Makes me think of "These new laws will fundamentally change how we get around them".

Too bad it looks like congress dropped this amendment that passed with an overwhelming majority in a backdoor deal over the past 48 hours: https://news.ycombinator.com/item?id=8703331

what is the point of this? there are already laws that forbid it, and there are already laws that ignore those laws in case of national security or other bs.

this new law would just add to the first lot. total waste of time.

the only sane thing to do is to better regulate and try to add consequences to misuses of the second lot.

This will probably last about as long as the attempt at NSA reform; i.e. not very :(

If the bill even has a shot of passing, it will be quietly amended to include gaping exceptions, to the extent that nothing will actually change other than a brief pulling off the wool over the public eyes.

But there are already backdoors in those things. And you can bet that this bill won't pass. You can bet your right thumb on that.