LAS VEGAS \u2014 The resounding message out of BSides Las Vegas and Black Hat \u2014 two information security conferences that took place the week of Aug. 5 \u2014 is that government is falling far short in the technology space.<\/p>\n\n\n\n
The underlying problem, said Bruce Schneier, a security technologist and fellow at the Harvard Kennedy School of Government, is that policymakers don\u2019t understand the technology and don\u2019t have members on their staff with expertise.<\/p>\n\n\n\n
So what both Congress and federal agencies need more of, he said, is public interest technologists on staff, people he defined as those that \u201ccombine their technological expertise and a public policy focus.\u201d<\/p>\n\n\n\n
This could act as an important counterbalance because, Schneier says, lawmakers don\u2019t understand the way software works, with constant updates and patches of software in the tech space because they are used to a longer, slower process of creating a law.<\/p>\n\n\n\n
\u201cI think that makes legislators unsuitable for a lot of this, though I would love to figure out a way to make law more agile,\u201d Schneier said.<\/p>\n\n\n\n
Because of the shortcomings in the legislative process, he said, agencies must take the lead on tech issues.<\/p>\n\n\n\n
\u201cAnd that means the agencies are the place where you can have agile policy-making, where the FTC can update their rules every three months … where the FDA has an iterative process for approving software in medical devices,\u201d Schneier said.<\/p>\n\n\n\n
\u201cThere\u2019re roles for technologists in both, but that\u2019s going to be the difference today. I\u2019d like to fix that, but there\u2019s a broader conversation to be had about how to do policy in the 21st century,\u201d Schneier continued.<\/p>\n\n\n\n
Throughout the week in Las Vegas, speakers pointed to the notorious hearings last year when lawmakers on Capitol Hill hauled Facebook founder Mark Zuckerberg to the Capitol for several hours of testimony and then infamously showed a stunning lack of prowess in technology policy. The prime example of Congress\u2019 shortfalls was when then-Sen. Orrin Hatch, R-Utah, asked Zuckerberg how Facebook made money.<\/p>\n\n\n\n
\u201cHow is that even possible that that is an okay question? You got to blame that senator and you got to blame his staff,\u201d said Schneier. \u201cSo I like to think it\u2019s getting better but then you have stuff like that.\u201d<\/p>\n\n\n\n
Aside from the Facebook hearing, Schneier also pointed to the heated discussion between the FBI and Apple over backdoors into the iPhone that occurred a few years ago as an area where government needs to improve its knowledge on technology.<\/p>\n\n\n\n
More recently, Attorney General William Barr controversially said he wanted encryption back doors for law enforcement. Schneier said that although the policy may not be good, Barr\u2019s rhetoric represented a shift in how the policymakers talk about technology.<\/p>\n\n\n\n
\u201cI thought that his rhetoric was better than we\u2019ve seen before … he actually said, \u2018I recognize that adding this backdoor will make devices more insecure and I think it\u2019s worth it,\u2019\u201d Schneier said. \u201cThat\u2019s fine. That\u2019s the right debate to have: how much more insecure and is it worth it?\u201d<\/p>\n\n\n\n
Public interest technologists could help the governments shape the policy surrounding these debates, he said. He pointed to election security, blockchain, how 0-day vulnerabitilies should be used by the government and the internet of things (IoT) as immediate issues to address.<\/p>\n\n\n\n
\u201cThis is all about vulnerabilities and how they are used and how they are fixed and how they affect security,\u201d Schneier said.<\/p>\n\n\n\n