Forum Moderators: open
A senior U.S. lawmaker said on Wednesday that it may be time for the government to regulate companies that provide online file-sharing services after a number of people managed to access FBI files, medical records and Social Security numbers.
House Oversight and Government Reform Committee Chairman Edolphus Towns said during a hearing on the safety of peer-to-peer software that he was astonished at privacy breaches involving LimeWire, operated by the Lime Group.Using LimeWire, people have been able to access FBI files, medical records, Social Security numbers and even a file containing information about a safe house location for President Barack Obama and his family, Towns said.
The FBI is at fault as those documents shouldn't be available to be shared via p2p
If I put crack cocaine in your house and you let people walk in and pick it up, are you going to be held accountable? Yes. These rules need to apply to the internet as well.
Silly move as it will push p2p network more into the underground and illegality, but will not persuade people to be smart and not use it.
People *want* to do things they should not do. Making it more illegal only means it goes more underground and out of reach of the law, with far worse results, and far less public outcry if one of the networks starts to abuse their customers (who would dare speak up if it did ?).
One would hope the prohibition was a learning experience ... Only last year did I sit with a guy on his porch discussing the far past on his life and he brought up he was Al Capone's driver for a while, trying hard to keep it clean and legal, but being drawn in by both his customers and the gangsters anyway.
Any of the mentioned breaches is a long chain of things that all went wrong.
Tackling it closer to the original problem is far easier than tackling it at the end.
e.g. FBI docs on limewire
- was is a secret or not (if not: no problem but perception)
- if it was secret, why was it used ?
---> no casual use, less exposure
- if it was used, where the rules on handling secrets followed ?
---> enforce handing of secrets if need be with draconian measures
- If the rules were followed, how come it still "escaped" ?
- if it was secret why was it stored where it could leak
- if it was stored on a laptop, why are secrets stored on mobile equipment ?
---> review handling rules
- if it was a secret, and if it was needed, and if it was handled within the rules, and if it was stored on mobile equipment, why was it not properly encrypted ?
---> yes, all the others would make it *safer* than the media-hyped encryption
But some politician wanting to go after the very last one: "p2p: that's the culprit" is silly at best. Next time, It'll get pushed to a newspaper, to a foreign website, ...
But I guess some lobbying might have gone on as well, there's an industry out there that *hates* p2p like nothing else. Showing a politician that the stuff they hate carries "FBI documents" as well could be a tactic to try to outlaw p2p.
Attack the problems where the real root cause is, not the symptoms.
SSNs: aren't they all breached multiple times by now ? Those who use SSNs as a secret (like a password) are the problem: it's a identifier (not even unique), between you and the government. Moreover you need to give it to enough others to make it far to widely known to be of any use as a means of authentication.
The US government could easily give people real means of authenticating themselves (and for managing authorizations even), but that comes too close to "federal government-issued ID", which makes it politically impossible and hence those in the US are going to be stuck with a system that's the equivalent of an account with login and password being the same (and guessable as well).
Other governments in other parts of the world do not have a phobia against IDs and they have taken such steps. E.g. out here all of us are being issued with with a government issued PKI system using real 2 factor authentication. It's all a smartcard for now, but it has the potential to become far more once everybody has one (we're nearing the end of the roll-out).
Either way, file-sharing sites SHOULD be held accountable for the files they hold.
Except that they never held the files. They merely supplied the software used to transfer it. Is the Apache Foundation responsible for every file transfered with an Apache web server?
If I put crack cocaine in your house and you let people walk in and pick it up, are you going to be held accountable?
Not if I never knew it was there.
