A bill proposed in US Congress would require the National Security Agency to inform representatives of other US government agencies about security holes it finds in software like the one that allowed the recent WannaCrypt ransomware attacks.
Under former President Barack Obama, the government created a similar inter-agency review, but it was not required by law and was administered by the NSA itself.
More World News Videos
- Video duration
- 01:22
Microsoft slams US government over ...
Microsoft slams US government over ransomware
Microsoft blames the US government for not disclosing software vulnerabilities after officials across the globe scrambled to catch the culprits behind a massive ransomware worm.
Up Next
Trump, Tillerson, Ross sword dance in Saudi Arabia
- Video duration
- 00:49
- Video duration
- 00:49
Trump, Tillerson, Ross sword dance in ...
Trump, Tillerson, Ross sword dance in Saudi Arabia
US President Donald Trump and White House officials take part in a ceremonial sword dance in Saudi Arabia.
Up Next
Disruptive passenger escorted off plane in Honolulu
- Video duration
- 00:22
- Video duration
- 00:22
Disruptive passenger escorted off plane ...
Disruptive passenger escorted off plane in Honolulu
A man is handcuffed and led off a plane in Honolulu on Friday after passengers helped duct-tape him to his seat and fighter jets escorted the flight to the airport.
Up Next
Qantas LA-Melbourne flight aborted
- Video duration
- 00:20
- Video duration
- 00:20
Qantas LA-Melbourne flight aborted
Qantas LA-Melbourne flight aborted
A Qantas jet flying from Los Angeles to Melbourne has been turned around two hours after take off when sparks were seen coming from an engine. Vision: Channel 7.
Up Next
Trump in Saudi Arabia, while isolated at home
- Video duration
- 01:19
- Video duration
- 01:19
Trump in Saudi Arabia, while isolated at ...
Trump in Saudi Arabia, while isolated at home
President Donald Trump's fellow Republicans in Congress are showing signs of going their own way, both on politics and policy, in the wake of one of the most difficult weeks of any American presidency.
Up Next
Newlyweds Pippa and James leave church
- Video duration
- 01:10
- Video duration
- 01:10
Newlyweds Pippa and James leave church
Newlyweds Pippa and James leave church
Pippa Middleton and her new husband James Matthews wave to the crowds as they leave their wedding ceremony on Saturday.
Up Next
Three victims critical in Times Square attack
- Video duration
- 01:11
- Video duration
- 01:11
Three victims critical in Times Square ...
Three victims critical in Times Square attack
A man accused of driving into a crowd of Times Square pedestrians with his car, killing one of them, has made his first appearance in court. Police say three of his victims remain in critical condition.
Up Next
If Trump 'took a dump on his desk'
- Video duration
- 01:10
- Video duration
- 01:10
If Trump 'took a dump on his desk'
If Trump 'took a dump on his desk'
CNN anchor Anderson Cooper has apologised after remarking that Jeffrey Lord, a Trump supporter, would defend Trump after he 'Took a dump on his desk'.
Microsoft slams US government over ransomware
Microsoft blames the US government for not disclosing software vulnerabilities after officials across the globe scrambled to catch the culprits behind a massive ransomware worm.
The new bill would mandate a review when a government agency discovers a security hole in a computer product and does not want to alert the manufacturer because it hopes to use the flaw to spy on rivals. It also calls for the review process to be chaired by the defense-oriented Department of Homeland Security rather than the NSA, which spends 90 per cent of its budget on offensive capabilities and spying.
Republican Senator Ron Johnson and Democratic Senator Brian Schatz introduced the legislation in the US Senate Homeland Security and Governmental Affairs Committee.
"Striking the balance between US national security and general cyber security is critical, but it's not easy," said Senator Schatz in a statement. "This bill strikes that balance."
Tech companies have long criticised the practice of withholding information about software flaws so they can be used by government intelligence agencies for attacks.
Hackers attacked 200,000 computers in more than 150 countries last week using a Microsoft Windows software vulnerability that had been developed by the NSA, was later stolen and eventually leaked online.
Microsoft President Brad Smith harshly criticised government practices on security flaws in the wake of the ransomware attacks. "Repeatedly, exploits in the hands of governments have leaked into the public domain and caused widespread damage," Smith wrote in a blog post.
Agencies like the NSA often have greater incentives to exploit any security holes they find for spying, instead of helping companies protect customers, cyber security experts say.
"Do you get to listen to the Chinese politburo chatting and get credit from the president?" said Richard Clayton, a cyber-security researcher at the University of Cambridge. "Or do you notify the public to help defend everyone else and get less kudos?"
Susan Landau, a cyber security policy expert at Worcester Polytechnic Institute, said that in putting DHS in charge of the process, the new bill was an effort to put the process "into civilian control."
The new committee's meetings would still be secret. But once a year it would issue a public version of a secret annual report.
The NSA did not immediately respond to a request for comment.
Reuters
0 comments
New User? Sign up