Re: [Cerowrt-devel] security guidelines for home routers

["David P. Reed" <dpreed@deepplum.com>]

[-- Attachment #1: Type: text/plain, Size: 2239 bytes --]


> I would like it very much if my country attempted to get to something> similar as a requirement for FCC certification or import. Stronger> yes, would be nice, but there was> nothing horrible in here that I could see.
 
Dave T. - You may remember from when I helped get you in contact with the FCC regarding their attempt to rule against software updates of routers. Subsequent to that, I and others were brought into an ex parte discussion with the top policy people in the FCC regarding their role in supporting security reviews of routers and development of secure routers for WiFi. The FCC lawyers have asserted that they have no legal authority whatsoever in regard to assuring security of routers.
 
They haven't been interested in communications security at all, in all of my work with them over the last 20 years. Personally, I don't see Congress passing laws on router security, or for that matter, "Internet of Things" security. There is some thought that the Federal Trade Commission might have authority under "consumer protection" and "product safety" laws. But FTC is generally weak and uninterested in regulating most technologies.
 
One of the US's problems (which may have parallels in Europe) is that ALL responsibility for communications security in the USG resides in the NSA, which is in the Department of Defense. Every other part of the USG depends on NSA support. (Even the Federal Information Processing Standards for commercial encryption are vetted officially by NSA, because they are the only agency that has security competencies)
 
Is it a good thing to bring NSA into regulating the security of home routers or IoT? Technically, they and their contractors are very sharp on this. I've worked with them since I began work in computer security in my research group at MIT in 1973. (we did no classified research, but NSA was part of our support, and the chief scientist of the NSA shared an office with me when he visited us).
 
Personally, I think it's time to move "security" out of the military sector of government..
 
But maybe not in the FCC, which is in a weird part of the USG, with no budget for technical expertise at all. (Congress doesn't want them to have technical resources)
 
 

[-- Attachment #2: Type: text/html, Size: 7017 bytes --]