US Proposes Tighter Export Rules For Computer Security Tools 126
itwbennett writes: The U.S. Commerce Department has proposed tighter export rules for computer security tools and could prohibit the export of penetration testing tools without a license. The proposal would modify rules added to the Wassenaar Arrangement in 2013 that limit the export of technologies related to intrusion and traffic inspection. The definition of intrusion software would also encompass 'proprietary research on the vulnerabilities and exploitation of computers and network-capable devices,' the proposal said.
better open source the tools (Score:3, Insightful)
and publish them well away from USoA soil.
Re:better open source the tools (Score:5, Informative)
and publish them well away from USoA soil.
This is what happened with the encryption ban in the 1990s. Companies did their development outside America, using non-Americans. The result was job losses for Americans, atrophy of American skills, and no increase in security. That was predictable, and continued long after the stupidity of the policy was blatantly obvious. But it really takes a special kind of idiocy to do it all over again.
Re:better open source the tools (Score:5, Insightful)
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
Re: (Score:1)
To be fair...idiocy isn't any more prevalent than it ever has been. It's just that it's broadcast to the world now instead of just the local bar.
I disagree. We've gone to great lengths to help idiots. We did away with the Duel, we've empowered lawyers to help them and we have all kinds of warning labels now. We have bumper crops of stupid out there. Not only are they around, they're bold. Get pissed off if things aren't as they think they should be. Even if that way is very stupid. Then there are those that act offended.
Help America - legislate that we remove all warning labels.
Re: (Score:1)
I totally agree. It seems the US government is out to drive any innovation in tech/IT to other countries, through their lack of understanding and fear of change.
Re: (Score:2)
Whoops! Here we go again (Score:4, Insightful)
Ah, but this time it's different!
Re: (Score:3)
Ah, but this time it's different!
Yes. The companies already know how to set up foreign subsidiaries that will officially develop the tools restricted by this so there is no export. They learned from last time.
Re: (Score:2)
Yeah, it's "on the interne"... erh... wait, can I start over?
Re: (Score:1)
Anti-freedom of speech (Score:1)
Sourcecode is speech.
Opensource people: Do NOT obey this.
WARNING BADTHINK MINDCRIME DETECTED! (Score:5, Insightful)
sourcecode is munitions.
Re: (Score:2)
Awesome sig/bumper sticker material here!
Stupid ... (Score:5, Insightful)
Once again lawmakers don't understand the issue.
Making the tools illegal doesn't mean people who plan on doing illegal things won't have them.
It also assumes that the best such tools come from America.
This is idiot lawmakers who don't understand technology passing laws trying to fix it. So, saying it's extra special illegal to break the law achieves absolutely NOTHING, and it prevents people from studying actual security holes because the tools are limited.
Can we make it illegal to be stupid? That would be awesome!
Re:Stupid ... (Score:5, Insightful)
I think there is a better than even chance that the lawmakers understand this perfectly well, but that the real purpose of the law is to harass people who hold and publish views the government doesn't like by putting together a persecution [intended typo] with a 100 year sentence based on extreme applications of criminal laws. Their hope is that the target either plea bargains to something less that will still remove that person from the general population, or better yet from the Fed's perspective, prompts that person to just kill him/herself out of hopelessness.
Re: (Score:3)
It's a law against export, not possession.
The only result of laws like this is the off-shoring of jobs related to the creation of computer security tools.
This is why I had to laugh at the slant of the summary for the Kaspersky article yesterday, claming that it was negative that the product came from Russia. In actual fact, the fact that the product is not made in the US protects it from crap like this.
Re: (Score:2, Insightful)
Once again lawmakers don't understand the issue.
I hate it when you people say that! They have their orders. They understand perfectly well what they are doing. It is the voters that are ignorant and stupid and thus blindly follow them. And in that ignorance it is the voters that give value to the campaign dollar. The politician is not the idiot here.
Re:Stupid ... (Score:4, Insightful)
Re: (Score:2)
Looks like you haven't figured out who the politicians serve. Greedy, lying, clever, conniving little rats with illusions of grandeur, absolutely, the only stupid ones are those that lose, or get caught. They don't need to 'know' anything. The lobbyists tell their aides (they all carry their own stories) who tell them who to speak with and how to vote.
Re: (Score:1)
Re: (Score:2)
My favorite security researcher, come on we're nerds I know you have one too, is not even a US citizen not sure his nationality but he lives in Malta.
I'm sure this won't slow him down as he's been at it over a decade.
Yes Luigi, I'm referring to you!
Re: (Score:3)
It also assumes that the best such tools come from America.
And doing crap like this makes sure that if it is still the case, it will not be for long. Development with either move, or get surpassed.
Re: (Score:2)
If any of the companies mails hit a US server, the USA can claim legal jurisdiction. This has happened before and people have been extradited over it. Post on facebook advertising your companies toolkits? Same thing. Use google maps for a map to your company HQ? Same thing. Use Dropbox? Onedrive? You're dead meat if they want to grab you. If you want to accept payment from VISA or Mastercard, well, they're US companies and they don't do business with criminals, you see...
Life can be pretty difficult for com
Re: (Score:2)
If we made it illegal to be stupid, where would we find politicians?
However, it is hard to believe that they are this stupid.
Perhaps next they will try to build a wall to prevent those rogue 1s and 0s from being smuggled out of the country.
I'm sure one of our defense contractors will be happy to tell them it will work and charge big bucks for building it.
Re: (Score:1)
If we made it illegal to be stupid, where would we find politicians?
If we made it illegal to be stupid, who would be left to vote for them?
Re: (Score:2)
If we made it illegal to be stupid, where would we find politicians?
If we made it illegal to be stupid, who would be left to vote for them?
One of the main things required for a functioning US style democracy is a crappy education system.
Re:Stupid ... (Score:5, Insightful)
It is dangerous to assume stupidity - especially when the people in question are making threatening gestures in your direction. What you describe is one possibility. Another is that these lawmakers (or the people they work for) DO understand these issues, and the inevitable problems that arise are the expected outcome.
Yes, Hanlon's razor is a good heuristic most of the time, but in this case we have a pattern. Technology that empowers people (e.g. real crypto/security, better communications technology like the internet) has been attacked fairly consistently. Tools and methods have been criminalized in the past with alarming frequency. For this specific issue, there are a lot of people invested in the status quo [projectbullrun.org] of where computers ("ii.e. "most products", eventually) are easily monitored/tracked, and easily attacked if the need arises. Dan Geer described our situation very accurately in his outstanding talk last year [youtube.com]: the current strategy of the US government (and others) with regards to network security is "all offense".
When proposals like this happen, people are tying to shape your future. Maybe they want to get an actual law passed. They just want to use a confusing topic in a show for the benefit of their constituency. Maybe the goal is propaganda or shifting the Overrton window [wikipedia.org]. Whatever the purpose, we would be lucky to have stupid lawmaker which we can at least attempt to fix with education. Unfortunately, what looks like stupidity is often agenda, and underestimate their threat at your own peril.
Re: (Score:2)
the inevitable problems that arise are the expected outcome.
Right. Keep this in mind the next time you get your laptop confiscated by Customs for having a copy of nmap on it.
Re: (Score:2)
Lawmakers have never understood the issue, no matter what the issue is.
Re: (Score:2)
Re: (Score:1)
Not just America. Bunch of countries, even Australia. You know, we don't have any military nationals in America or the other countries.
Ok, are your sides hurting yet from laughing?
US Proposes Tighter Export Rules ... (Score:1)
Hot air, nothing compared to the US self imposed brain drain caused by fucked up policy, gamed and broken system. If they don't want to see things that are better in the hands of other countries then they should rethink the way things have been going in the US for the last 60+ years. The policy of 'keeping the people stupid' is not going to produce a superior product in any sector anyway so where are these idiots coming from on this?
Re: (Score:2)
Hot air, nothing compared to the US self imposed brain drain caused by fucked up policy, gamed and broken system. If they don't want to see things that are better in the hands of other countries then they should rethink the way things have been going in the US for the last 60+ years. The policy of 'keeping the people stupid' is not going to produce a superior product in any sector anyway so where are these idiots coming from on this?
An economic/social collapse is what those in power need to roll out martial law and complete the final stages of the "fundamental transformation of America" to a police state.
Strat
Re: (Score:2)
An economic/social collapse is what those in power need to roll out martial law and complete the final stages of the "fundamental transformation of America" to a police state.
They are going to get it because it is the desire of those in power, CIA analysts have come forward now stating that the "3rd world depression is no longer avoidable". I think world depression is a bit on the dramatic side though, I think the rest of the world is likely to contain it to the US/UK. Rusky/China have been getting cozy f
Re: (Score:3)
Re: (Score:1)
Paranoid, much?
Head in the sand, much?
Re: (Score:1)
Paranoid, much?
Those that would mistake paranoia with basic observational skills referencing events over the last 60 years are likely be on some type of 'agenda'. What some call paranoid, others are calling it 'having a big mouth', but you don't see that part now do you?
Re: (Score:2)
Don't bother. Just check Dave420's post history. He's drank so much of Leftist/Social Justice kool-aid that California is considering sanctioning him for the amount of water he wastes.
Strat
Re: (Score:2)
Of course! (Score:1)
Why would they want software running around that could conceivably reveal what the US governments & friends are up to? No sir, we can't have that.
The funny thing is that this will just obliterate what little economy they still had in that area and send the whole thing overseas. So the net result will be, if anything, even less control over that software than before. Good jawb guys!
Re: (Score:2)
The funny thing is that this will just obliterate what little economy they still had in that area and send the whole thing overseas. So the net result will be, if anything, even less control over that software than before. Good jawb guys!
And piss off people that might otherwise be on their side. "To fight our enemies, we need to make more enemies!"
Facepalm (Score:2)
IANAL, does anyone know what effect this would have on things like Wireshark and Metasploit?
Take that China! (Score:5, Funny)
Haha! No more Norton AV for you!
Re: (Score:2)
Ah yes! (Score:1)
The US government still thinks that the US is still ahead of everyone when it comes to computer and software technology.
So, all that work that's offshored is done by programmers with memory issues? And the same with the H1-bs?
Requirements for job:
Security and penetrations programming and testing. Early onset Alzheimer's and/or severe drug and alcohol addiction, ....
Logjam (Score:5, Insightful)
Re: (Score:3)
will mean that certain critical vulnerabilities may not be discovered in time, or not reported.
Which, if you think about it, works in Big Brother's favor. Again.
Re: (Score:2)
...perhaps restricting such tools will mean that certain critical vulnerabilities may not be discovered in time, or not reported.
Well yes, that is the idea. Reporting these kind of things will become illegal [slate.com] (for an example how it's happening in meatspace)
Just proprietary? (Score:5, Interesting)
I'm interested in whether this is limited to ONLY proprietary research.
I could actually see an argument for banning export of such research. Do we really want companies finding flaws in widely-used software, keeping those flaws secret from the software vendors and the general public, but then selling details on those flaws to others who could potentially turn around and exploit them? In a sense, this does sound like a munition.
I don't see the same concern with public research. If you disclose a vulnerability publicly, then everybody can fix it, and that strengthens the ecosystem instead of weakening it.
If the ban were limited to proprietary research, I don't see it as a bad thing. Of course, it does nothing to keep companies from selling their findings to NSA contractors and such, but I don't expect the US to lift a finger to ban practices like these.
And Of Course... (Score:4, Informative)
...What they mean by "export" is posting downloads or links to downloads of source code or binaries on the 'net.
Just another restriction on the communication of knowledge & free speech in the "Land of the Free".
The US I grew up in during the 1960s/'70s is dead.
Strat
Re: (Score:1)
The US I grew up in during the 1960s/'70s is dead.
Oh, thank god! Who wants to relive Johnson/Nixon? And look what it gave us, the 80s, and he *who shall not be named*!
Re:And Of Course... (Score:4, Funny)
And look what it gave us, the 80s, and he *who shall not be named*!
That's a pretty rude way to make fun of Prince's trademark woes.
Re: (Score:1)
Agreed!
Individual liberty and rule of law is for old people!
Re: (Score:1)
Because this has worked so well in the past (Score:2)
let's repeat our folly.
Re: (Score:2)
Re: (Score:3)
Being online would qualify as exporting...
Not automatically. If its uploaded to a server from outside the USA and the server itself exists outside the USA, no export was involved.
This just pushes the remaining development of such tools out of the USA.
Re: (Score:2)
Sure... Quote only part of my post out of context, and state that you disagree with it as if it stood alone, all the while completely omitting the part where I said it would only matter if the site were located in the USA in the first place.
Obviously if the site is not hosted in the USA then there is no issue that the USA could have with the site... although the uploader of such content, *if located in the USA*, could still be held accountable for said export if they were able to identify them.
We're back to THIS again? (Score:2)
Yeah... Let's make "security through obscurity" the law of the land.
That'll help so much.
Effin' idiots.
Publish the source code in a book (Score:2, Interesting)
First [wikipedia.org] Amendment [wikipedia.org] says "Kiss my ass" to export restrictions.
Why make a law you can't enforce? (Score:3)
Great tool for bullying US security researchers (Score:5, Insightful)
Sure, this law won't stop these tools from leaving the USA, but may still be effective in bullying and retaliating against US based security researchers when they piss off the wrong people.
You presented your research at a conference outside the US? => That's export.
You put your software up on the web for everyone? => That's export.
You posted details to a mailing list which is hosted outside the US? => That's export.
Its official, I am now a criminal. (Score:2)
This brilliant because ... (Score:2)
... it will discourage hackers from just breaking in and getting the stuff.
Huh (Score:1)
Well you can't stop people from getting these tools, you may be able to keep people from selling them.
Dear US law makers (Score:3)
Your jurisdiction, unlike the traffic of the internet, is limited to your own country. And the countries you control. Which is a lot, I give you that, but by no stretch whatsoever it's all.
Also: Money trumps laws. Twice so if corporations are involved. If $evil_bastard_country wants to throw money at whoever sells them $supersecret_technology, corporations will not obey your law, they will race against each other to find the loophole. Which usually ends in the tech involved being developed abroad by those suspicious foreigners and then sold to the $evil_bastard_country.
The net effect for the US of such a ban is a loss of jobs, loss of knowledge and most of all valuable IT security information in the hands of whatever foreign country was smart enough not to be as stupid as you are, putting shackles on your own ITSEC industry.
Please Comment (Score:5, Interesting)
Script kiddies (Score:1)
The only way to stop a bad guy with a script kiddie tool is a good guy with a script kiddie tool.
You already left the barn door open ASSHOLES! (Score:2)
At this point, it's pretty much moot.
The tools are already out there.
Cutting off now accomplishes JACK SHIT. And all the tools will simply be mirrored outside the US.
The especially bad part? Look at the whole encryption export debacle.
Basically most of the meaningful security jobs and development will move outside the US.
Sure, we'll have in-country development, but it'll be happening in a vacuum, as nobody else will want to touch development of tools they can't legally use.
Meaning that security tools in g
Ban security products from the US (Score:1)
The idea that the US is some how in charge of how security researchers spend their energies will be its own undoing. Research will be done outside the US. Security researchers have long memories. Nothing stops them from doing all of their research outside the US. And nothing will stop them from denying US interests access to their tools, research, and discoveries.
Customers in the united states will still find out about the vulnerabilities. They'll find out after they are penetrated.
Thankfully stupidity is n
What else did you expect? (Score:1)
People who can defend themselves tend to make their own decisions. This has not escaped the notice of governments.
If you don't like it, send a comment! (Score:2)
Didn't we already try this? (Score:2)
Why? (Score:1)
OH! That'll work (Score:1)
NOT!
Considering most of the good ones come from Russia, China, and India.
Re:You can ban these so-called "tools" AFAIK. (Score:5, Interesting)
David Sternlight is that you? You know you can legally buy both ski masks and crow bars, right? In fact, I think REI sells ski masks, crow bars (cleverly disguised as climbing hardware), and backpacks all in the same store, and they haven't been shut down yet.
Re: (Score:2)
Many Western nations have fat, centralized, industrial-era governments facing a networked, post-industrial world. Obviously they're going to fight as long and hard as possible to limit technologies that will make them obsolete.
This is why the future is increasingly being made outside Luddite states like America and the EU; places that don't have an entrenched industrial-era political class who can stop it.