51

The U.S. congress has a draft for a bill that would require companies to fetch information from a device when requested by a court. A consequence of this is that many types of security technology become illegal for any company subject to U.S. jurisdiction.

My question is, would this make open source software that uses encryption illegal?

  • In particular, could open source developers be sued?
  • Can a company that contributes to open source software be sued?
  • If a company distributes open source software, can they be sued (such as the owners of gnupg.org or github.com (note that difference between the two))?
  • If a phone maker puts open source encryption software in it, can they be sued?
  • If a user installs open source encryption software on a phone, can the phone maker be sued?
    • What if they downloaded it from a software center provided by the phone maker?

I am specifically talking about the types of encryption that could lead a company to be sued.

Note: I think I may be using the word "sue" incorrectly. Feel free to edit this question in order to make more sense legally.

  • Could you argue that once a piece of software is made open source it becomes 'of the world' and not subject to american jurisdiction? IANAL obviously, but a real world example is getting convicted because someone got stabbed by someone else using a knife you once threw away. – RichardAtHome Apr 9 '16 at 19:26
  • 1
    Seriously? No. If the law says "making X is illegal", publishing it or giving it away hardly changes the fact that you did make the illegal thing. – Andrew Medico Apr 9 '16 at 19:58
  • Though the question is well-received here, if you don't get the kinds of in-depth analysis you're looking for here, you can flag the question to request that a mod move it to Open Source.SE where there's a more specific community of experts on this specific topic. – WBT Apr 9 '16 at 21:27
  • You could argue it. You would lose. – PJB Apr 9 '16 at 21:32
  • 1
    @WBT The trick was to scare the living semicolons out of /r/Programming. – PyRulez Apr 10 '16 at 3:06
15

Section 4, Definition 4 Covered Entity, emphasis added:

The term "covered entity" means a device manufacturer, a software manufacturer, an electronic communication service, a remote computing service, a provider of wire or electronic communication service, a provider of a remote computing service, or any person who provides a product or method to facilitate a communication or the processing or storage of data.

This definition seems extremely broad, and could be stretched to cover an answerer on Stack Overflow whose answer provided a method facilitating data processing, storage, or communication (which covers most software methods). So let's then look at what can be required of a covered entity:

Section 3(a)(1), Requirement:

... a covered entity that receives a court order from a government for information or data shall provide such information or data to such government in an intelligible format or provide technical assistance as is necessary to obtain such information or data in an intelligible format or to achieve the purpose of the court order.

Subsection 2 limits the scope so that a covered entity only has to provide data if the data was "made unintelligible by a feature, product, or service owned, controlled, created, or provided by the covered entity or by a third party on behalf of the covered entity."

However, courts cannot effectively require people to do the impossible; if a programmer wrote a method that was used in an encrypted communication service that does not mean the programmer, lacking the encryption key, will be forced to break what they believe to be unbreakable encryption.

The key here is in section 3(c), emphasis added:

A provider of remote computing service or electronic communication service to the public that distributes licenses for products, services, applications, or software of or by a covered entity shall ensure that any such products, services, applications, or software distributed by such person be capable of complying with subsection (a).

So if this bill were to become law, it would be the service provider who's responsible for making sure the government can get the intelligible information. The government could require e.g. the author of the encryption function, even if that person's not part of the service provider, to help break the encryption, but the responsibility for ensuring data accessibility lies with the service provider.

The definition of service provider seems absent from at least what I can see of this bill, but it seems that a company selling a communications service to customers would very likely qualify, and a person/company who posted an answer on SO that was then picked up and integrated into something someone else distributed as part of a service, very likely would not.

  • 1
    However, courts cannot effectively require people to do the impossible but does this matter if the program is required to write a back door before hand? (essentially). See Sec 3(c). – IronManMark20 Apr 9 '16 at 18:27
  • 4
    We cannot prove that a message is unencrypted. A message may contain stenography or be opaque to the operators. This would also require them to identify and block stenographic data where possible. Suppose I were to provide a service which distributed random numbers (like random.org does) and stenographic payloads. The court might first issue a warrant to inspect my software to identify opaque messages being transmitted in this service. Then they might compel me under the act to either scrable (block) or reveal the stenography. – Karl the Pagan Apr 9 '16 at 18:40
  • 7
    @KarlthePagan: Picky correction, but I think you're looking for steganography, not stenography. – Soren Bjornstad Apr 9 '16 at 19:22
  • 2
    If the service provider is responsible, what happens if it's a really generic service like AWS? It's possible for users of that service to put crypto on their servers, with no back doors, right? If those users are not themselves service providers (i.e. they are individuals running private servers, or something like that), how does the law apply? – Kevin Apr 10 '16 at 6:35
  • 2
    @Bakuriu Apparently Apple chose to balance password complexity with usability on the side of a shorter, easier-to-input password to make normal use cases relatively easy, with a data-self-destruct feature as a primary defense mechanism against offline attacks. That's getting a bit off-topic for this answer though (from "in any case if you are encrypting..."); relevant questions/answers might be found/started at Information Security.SE. – WBT Apr 10 '16 at 18:13
2

There is good hope that this draft will never be turned into a law, if you read headlines like on theregister: "Read America's insane draft crypto- Understandable – it's more stupid than expected"

Creating the encryption is perfectly legal. You might be asked to help recover encrypted data. There is no mention of cost; I doubt that you could be asked to provide your services for free.

You are presumably on expert on creating encryption. You are presumably not at all an expert on cracking encryption. I would reasonably expect you to provide assistance by providing the complete source code for the encryption which you had to do anyway, because the GPL requires you to do so. (Except with the GPL, you have the choice between providing the source or committing copyright infringement, and here you have the choice between providing the source and infringing on this proposed law).

  • 1
    Hope you're right! Still, "insane" laws have passed by Congress before... – Baard Kopperud Apr 10 '16 at 10:49
  • 1
    There is mention of cost and that reimbursement would be provided. – WBT Apr 10 '16 at 14:08
  • 2
    "You are presumably on expert on creating encryption. You are presumably not at all an expert on cracking encryption." You can't be an expert on creating cryptographic systems without knowing how they can be broken. – Rhymoid Apr 10 '16 at 18:33
  • 6
    Of course you can. Actually, if you create a cryptographic system and you know how it can be broken, your cryptographic system is rubbish and should never, ever be let loose on the public. – gnasher729 Apr 10 '16 at 21:07
0

The argument can be made (and has already been made) that open source development is speech, and therefore protected by the first amendment.

Secondly, since encryption can be used for personal protection, the use of encryption software can be assimilated to the "bearing of arms", and is therefore protected by the second amendment. Any attempt at making encryption illegal would itself be unconstitutional.

  • So would you also be arguing that no law can place any restrictions whatsoever on gun ownership (even by terrorists, violent murderers, etc.) or speech (even defamatory, riot-inciting, etc.)? – WBT Apr 10 '16 at 2:02
  • 8
    @DavidGrinberg Strong cryptography does sometimes get formally classified as a munition and is covered by some arms control rules, especially for international movements. – WBT Apr 10 '16 at 4:31
  • 1
    @DavidGrinberg Also, the nuclear launch codes were 00000000 for many years during the Cold War. So there, I said it, even in bold, and I don't expect that'll be troublesome (mostly because the code isn't current). – WBT Apr 10 '16 at 4:38
  • 1
    @WBT I am not saying restrictions cannot be placed on the use of guns and encryption, I am saying outright outlawing them would be unconstitutional. – Flavien Apr 10 '16 at 10:35
  • 2
    The probability of the Supreme Court creating or recognizing a new category of unprotected speech is very, very low. In 2009, in United States v. Stevens, the Supreme Court explicitly rejected (8 to 1) the theory that new categories of speech could be excluded from First Amendment protection without a long history of restricting that type of speech. The test for whether a category of speech is outside 1A protection is whether it has been historically considered unprotected. Speech subject to First Amendment protection may not be restricted on the grounds that its social costs exceed its value. – David Schwartz Apr 10 '16 at 19:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.