Congress Passes Bill Forcing Tech Companies To Disclose Foreign Software Probes (reuters.com) 61
An anonymous reader quotes a report from Reuters: The U.S. Congress is sending President Donald Trump legislation that would force technology companies to disclose if they allowed countries like China and Russia to examine the inner workings of software sold to the U.S. military. Companies would be required to address any security risks posed by the foreign source code reviews to the satisfaction of the Pentagon, or lose the contract. The legislation also creates a database, searchable by other government agencies, of which software was examined by foreign states that the Pentagon considers a cyber security risk. It makes the database available to public records requests, an unusual step for a system likely to include proprietary company secrets. The final version of the bill was approved by the Senate in a 87-10 vote on Wednesday after passing the House last week. The spending bill is expected to be signed into law by Trump.
Linux Distros (Score:3)
Re:Linux Distros (Score:4, Insightful)
Re: (Score:2)
so there would never be an approval for which paperwork would be necessary.
Remember: this is the government -- logic doesn't apply here.
Re: (Score:3)
Re: (Score:3)
Any computer work by a company with mil/gov contracts will have to be report what their staff do.
Work for a big company and that work on any "open source" project gets banned.
People are the "security risks" not just the distro.
Re: (Score:2)
Re: (Score:2, Informative)
So how might this affect the companies like RedHat, Debian and the other Linux distros that are open source based?
In all the DoD work I've been exposed to, open source was prohibited altogether. So no Redhat at all, but a 20 year old unpatched Solaris 7 OS was okay.
And now? (Score:2)
So what if there is a law that prohibits government source probes from being disclosed?
Re: (Score:2)
Simple than the US based software company can either not do business there or pay whatever fines etc might be levied if that is a choice. Or said company can leave the US and be prevented from doing business here... (yeah right like any sane org would give up this market).
If places like China want to make rules like that they simply risk cutting themselves off from the technology the rest of the world is using - to friggen bad.
Re: (Score:2)
Ok, so basically you think it's ok to make laws that allow you to do things that you don't allow for others.
Re: (Score:2)
Yes - that's called being a sovereign nation.
Re: (Score:2)
so just don't throw a fit if other sovereign countries do the same.
Comment removed (Score:5, Interesting)
Re: (Score:2)
I am a lot less concerned about the PRC being allowed to view the code for Oracle DB or Windows than I am about allowing Chinese citizens to be employed to work on them
Why stop here?
Why not throwing all Chinese out of USA?
That'll sure cure your anxiety.
He/she only identified the particular risk, did not hint at your proposed solution. Do you not agree that the fact that many Chinese citizens come to work for these companies, then return to China, is a risk? Or are you just jumping to some kind of divisive rant because that is what you do?
Re: (Score:2)
Probably one of the people that doesn't believe the USA should protect their interests. Also probably not American.
Re: (Score:1)
... the PRC is way worse than anything most liberals believe about Russia.
It took Trump only a few months to turn an entire fucking century of "progressive" love for the Soviet Union/Russia into something Ronald "Evil Empire" Reagan would approve of.
LOL.
Re: (Score:1)
Re: (Score:1)
You understand that all of what you wrote happened under Obama, not Trump, right?
https://www.politico.com/story... [politico.com]
https://wilsonquarterly.com/qu... [wilsonquarterly.com]
Re: (Score:3)
in terms of influencing public policy, the PRC is way worse than anything most liberals believe about Russia.
Worse how? More influential? Because they are both up to the same kinds of tactics.
Dumb as a Post (Score:3)
https://www.reuters.com/articl... [reuters.com]
"In order to sell in the Russian market, technology companies including Hewlett Packard Enterprise Co, SAP SE and McAfee have allowed a Russian defense agency to scour software source code for vulnerabilities, the Reuters investigation found last year."
Senator Jeanne Shaheen is dumb as a post. Foreign governments are purchasing American technology. It would be in their best interests to see if there are backdoors put in there by the NSA or CIA. This has happened before. Senator Biden talked about how the US put backdoors into pipeline controls sold to the Soivet Union. So this type of thing happens.
Re: (Score:2)
Just because there are benign reasons for inspection doesn't invalidate the reasons she states. In fact, counterintelligence has uncovered plenty of evidence of Chinese penetration teams, secrets 'sent home' by foreign nationals, etc.
It's a central concept for engineering: if a competitor is making a better product, reverse engineer it, look for papers/reports about it, or (best of all) get the design documents and source code.
Re: (Score:2)
No. The Defense Department just won't buy your stuff.
Re: (Score:2)
My company will not comply. It's our private network and we won't be reporting on anything about it unless we want to.
That's fine, your company is perfectly free to not comply. The DoD doesn't care (nor does anyone else, TBH),
The DoD just won't buy/use your company's shit. Nobody has a right to a DoD contract.
Strat