DHS and/or NIST cover commercial and non-DoD government. But even then it is a voluntary and/or advisory capacity too - there is no authority to make a company fix a software product (unlike say a car defect, which gets into liability issues nobody wants to open for software).
As for discovering and preventing bugs, I think that would be a waste of time/effort in the current towards NSA and software in general. Nobody is going to take a binary patch from them, nobody is going to submit their source code for review, any help given to a company would draw complaints from their competitors, and fundamentally as long as companies aren't actually liable for damages due to bugs or security issues, they aren't going to care much about spending money to improve the situation. A corporation would just rather add another clause to a EULA to disclaim more and more responsibility.
It's a free market failure since bottom line profits aren't affected so there is no incentive to improve. That leaves the question of whether the government should be subsidizing the business world's failure to meaningfully invest in bug fixes and security improvements.
> That leaves the question of whether the government should be subsidizing the business world's failure to meaningfully invest in bug fixes and security improvements.
One good way to sum up what government is good for is "things the market can't or won't do on its own." So I'd say yes.
This is one of those situations - be careful what you ask for, you might get it.
Apple and Microsoft between them make $35 billion in profit a quarter (not picking on them, just examples) - corporations don't need government handouts for this, they need proper motivation which is absent because security issues don't cost them anything except PR.
Actual monetary damages would alter that however. Fines, penalties, liability assumption, etc. You really want to see that?
Otherwise, how would it work exactly?
Existing models of the FDA (and its drug approval process) or the DoT (and its ability to force auto recalls) would introduce monetary damages, legal liability, government authority to pull products, and regulatory approval as ways to the free market ignoring costs related to security/defects - you really want to see that for the software market?
How would you REQUIRE corporations to have their code vetted by the "future software security agency" (FSSA)? Or say FSSA provides reference implementations or reviews open-source code only? That's only part of the software universe, is it enough?
If participation is voluntary/optional, corporations still aren't going to care; they will need to be compelled to participate.
The world isn't neatly divided into things that people care about (and do) and don't care about and therefore will never do). It's a continuum.
For example, many people in companies care about security but never have time to do enough. If you make it so that they can do more per unit of time, they'll do more.
In that fashion, ISIS could argue that their torture is ok and necessary because the USA is also doing it to obtain information.
Edit: I'm referring to spying, not torture.
The only justification for it is "they did it first," which is both childish and irresponsible. Just because everyone else does it, doesn't mean it is correct, necessary, or justified.
It's both an out of band communications channel but also provides a feedback loop. If your enemy or your competitor is engaging in something you all agreed to is out of bounds, you can respond to it with the information you have gained.
EDS and Boeing will know if the other is underselling, bribing, receiving subsidies, etc. and be able to respond accordingly, for example.
See how so many countries are rushing to resolve territorial disputes at the International Court of justice? Only the plaintiffs.
Which is the polar opposite of what some governments want[0].
It's almost as if governments are playing the terrorist card to push through laws which benefit them—the political class.
Oh, but that's OK: everyone does it!
---
[0] http://www.theguardian.com/commentisfree/2015/jan/13/cameron...
Maybe take it as an appeal to logic: if nations are to grapple with the issues raised by the NSA and her sister orgs in the five eye countries, the best approach to raising the issue and proposing solutions (in my opinion) is to appeal to the logic of each individual and demonstrate how they are best served by dismantling these espionage operations.
So what does he do? Opened a shop one block down and drove the fist guy out of business.
Business is ruthless.
I know. If we ever hoped to get to that point, I think we'd need some esoteric unicorn shit like "checks and balances" built into our government.
- Most people a few hundred years ago, probably.
It took revolts, revolutions and changes in mores for things to advance to where they are today. Yes, some day, we may all enter a new world order where everything is placid. We're not there yet and thinking we can wish ourselves there in the near future, let's say, extremely optimistic, to the point if being wishful thinking.
Perhaps most importantly is that servitude and slavery became economically untenable.
Up to now we have paid tens of billions to get surveillance, and tens of millions to preserve confidentiality.
It could be the other way around.