Wyden Releases Draft Legislation to End Federal Dependence on Insecure, Proprietary Software

PRESS RELEASE

Washington, D.C. – Following a new report about how shambolic cybersecurity practices by a federal technology contractor enabled a massive hack of the U.S. government systems, Senator Ron Wyden, D-Ore., released draft legislation today to set mandatory cybersecurity standards, save taxpayers money, and break the anti-competitive lock-in effect caused by proprietary, walled-garden software.

Multiple disastrous hacks of U.S. government systems have been enabled by poor cybersecurity practices by Big Tech companies providing services to the government. Most recently, the Department of Homeland Security Cyber Safety Review Board cited a “cascade” of errors by Microsoft, allowing Chinese hackers to breach federal email systems.

The Secure and Interoperable Government Collaboration Technology Act would require the government to set new secure, open standards for collaboration software, which would also promote competition and save taxpayer dollars.

“My bill will secure the U.S. government’s communications from foreign hackers, while protecting taxpayer wallets. Vendor lock-in, bundling, and other anticompetitive practices result in the government spending vast sums of money on insecure software,” said Wyden. “It’s time to break the chokehold of big tech companies like Microsoft on government software, set high cybersecurity standards and reap the many benefits of a competitive market.”

While phone calls and email messages allow users to communicate no matter which mobile network or email provider they use, collaboration software is frustratingly walled off. Although video conferencing software like Zoom, Webex, and Microsoft Teams offer similar functionality, users cannot communicate across platforms. Similar barriers exist for chat services like Slack and document editors like Google Docs and Microsoft Office. As a result, agencies often become locked into expensive, insecure walled gardens that result in wasted time and taxpayer dollars as government employees switch constantly between different collaboration software products.

The Secure and Interoperable Government Collaboration Technology Act would –

Require the National Institute of Standards and Technology (NIST) to identify a set of interoperable standards, requirements, and guidance for each of these collaboration technology features, based on a set of required collaboration technology features identified by the General Services Administration (GSA).

Require that, to the fullest extent possible, the standards use end-to-end encryption and other technologies to protect U.S. government communications from foreign surveillance.

Require that collaboration technologies used by federal agencies enable those agencies to comply with federal record-keeping requirements.

Four years after NIST identifies the standards, require that collaboration technology procured by the federal government be capable of communicating using the NIST standards.

Tasks the Department of Homeland Security with conducting cybersecurity reviews of collaboration technology products widely used by the federal government.

Create a GSA and Office of Management and Budget working group to produce biennial reviews of collaboration tech used by the federal government to suggest additions or improvements to the standards.

The draft legislation is endorsed by Accountable Tech, Demand Progress, Fight for the Future, Proton, Nym, the Matrix.org Foundation, and Cory Doctorow.

“Interoperability - the ability to plug something new into a technology, with or without permission from the manufacturer - is the key to defeating Big Tech,” said Doctorow. “This bill will require public funds to be spent on technology that anyone can fix, extend, or improve, preventing tech companies from locking in and ripping off the US government. The most amazing part is that this isn’t already the way it’s done.”

“Through this legislation, the federal government has the opportunity to set an example for workplaces, organizations, and institutions across the country on how to fundamentally improve online safety. Protecting digital communication with end-to-end encryption is essential to data privacy and security, and should be the standard across the board. Without it, messages can be intercepted and abused by hackers, repressive law enforcement agencies, foreign governments, or the company that owns the platform itself. Everyone from the former director of the NSA, to Big Tech companies, to human rights defenders working under authoritarian regimes have highlighted the life-saving importance of end-to-end encryption. The issue of data privacy has never been more urgent, and decisive lawmaker action is needed in this moment to bring about tech platform policies that truly center our privacy and needs as users—not corporate profits,” said Leila Nashashibi, campaigner at Fight for the Future.

Wyden is accepting feedback on the draft legislation at [email protected]

The text of the draft bill is available here.

A one-page summary of the bill is here.