After WannaCry, a new bill would force the NSA to justify its hacking tools

[Kevo05s]

The reason behind the bill:

Quote

After last week’s massive ransomware attack shut down machines around the world, the NSA, which knew of the exploit before it was public, became a target for criticism.

According to this article, the law might help companies like Microsoft updating our computers with security patches due to the amount of vulnerabilities they are finding.

 

This is the bill they are trying to pass:

Quote

Protecting Our Ability to Counter Hacking Act of 2017, or PATCH Act, would establish a legal framework for the process, requiring federal agencies to establish policies on when to share vulnerabilities and, if unclassified, to make those policies widely available.

 

 

Even if there will probably be no-one to enforce this bill, I hope it does help M$ and other companies to secure their piece of software...

 

Edit: fixing the post to fit the community guidelines @Energycore

[Electronics Wizardy]

and this will be enforceable how?

[Kevo05s]

Just now, Electronics Wizardy said:

and this will be enforceable how?

I guess between the agencies, if they want to big bicks who's boss between each other... Or companies like Apple and M$ by legally suing them if they don't get their due report?

[Oshino Shinobu]

Ah yes, and we all know how good the NSA is at following the rules. 

[NrKj105]

yeah so they can make doors for themselves

[Electronics Wizardy]

Just now, Kevo05s said:

I guess between the agencies, if they want to big bicks who's boss between each other... Or companies like Apple and M$ by legally suing them if they don't get their due report?

you either need anouther gove agency to look over this that I don't trust. The government doens't have a reason to make our system more secure, they want access to them.

 

For suing if they don't report, how much are people liable for bugs they write. This might become a freedom of speech issue too. And the NSA doesn't want people talking about what there doing.

[Dylanc1500]

Could turn out to be an awful mistake.

[TheNorthBridge]

I feel like the NSA should have a responsibility to report known threats to developers immediately. That is also to say, their job isn't to find vulnerabilities that affect consumers, that should be left up to developers. If the NSA stumbles upon a threat they should release it to Microsoft or  whomever then step aside. They have no need withhold that information from people, and they have even less need to exploit those vulnerabilities for their own gain. 

[NrKj105]

especially when anyone can get these exploits on the "normal" github website
 

 

[BuckGup]

Won't do a thing

[Foxxer]

Can governments sue Microsoft? 

[WMGroomAK]

Fairly sure this won't fix anything and may in fact make things worse as vulnerabilities will be hoarded as un-notified pieces of code at lower levels or placed in a Classified status to avoid disclosure.  Adding in more people to these chains tend to either make federal agencies hide more information from their oversight or create more leaks of classified information.  Reading through this though, one of the biggest hurdles will be classifying and defining vulnerabilities based on all the 'Considerations' they have listed in (d)(3)(B) (Page for those reading at home).  

 

https://www.schatz.senate.gov/imo/media/doc/BAG17434_FINAL PATCH.pdf

Quote

• (i) Which technologies, products, systems, services, or applications are subject to the vulnerability, including whether the products or systems are used in core Internet infrastructure, in other critical infra-structure systems, in the United States economy, or in national security systems. 
• (ii) The potential risks of leaving the vulnerability unpatched or unmitigated.
• (iii) The harm that could occur if an actor, such as an adversary of the United States or a criminal organization, were to obtain information about the vulnerability. 
• (iv) How likely it is that the Federal Government would know if someone external to the Federal Government were exploiting the vulnerability. 
• (v) The need of the Federal Government to exploit the vulnerability
• (vi) Whether the vulnerability is needed for a specific ongoing intelligence or national security operation. 
• (vii) If a Federal entity would like to exploit the vulnerability to obtain information, whether there are other means available to the Federal entity to obtain such information. 
• (viii) The likelihood that a non-Federal entity will discover the vulnerability. 
• (ix) The risks to foreign countries and the people of foreign countries of not sharing or releasing information about the vulnerability. 
• (x) Whether the vulnerability can be patched or otherwise mitigated. 
• (xi) Whether the affected non-Federal entity has a publicly disclosed policy for reporting and disclosing vulnerabilities. 

Highlighted are where I think the Federal Agencies on the committee will point out as considerations for placing such vulnerabilities as Classified...  

 

[Prysin]

47 minutes ago, Electronics Wizardy said:

and this will be enforceable how?

by sacrificing infant hearts and virgin blood to the democrat "protestors" Senators.

[mr moose]

We all have ideals, but I dare say no one truly understands the process by which these organisations work (or don't work in some cases).  This could be awesome, this could be terrible.  But have faith that the NSA, being above the law, will not let it deter them from keeping you safe.

 

 

P.S message from the NSA don't turn off your computer tonight, the internet is a bit slow at your end. 

[Energycore]

Moved to GD.

 

Please edit the topic to meet our Tech News and Reviews guidelines which you can find pinned on the TNR forum. Once you have, mention me @Energycore and I'll move the thread back

[Ertman]

You know they would just say "National Security". Then when asked to elaborate, they will just say "We can disclose because of National Security".

[Energycore]

~Moved to Tech News and Reviews