Most Linux contributions are made by multi-billions companies like IBM/Redhat. They would not risk to contravene to law. For example that it conforms to the law, look at WiFi drivers. There are many requirement by local laws on which band to use, what kind of traffic is authorized, etc. The WiFi drivers (most of them opaque binaries) conform to each country law.
To make Linux not lawful, you would have to create your own kernel with your own altered drivers, except you can't modify binaries.
Even then how could you make you system unidentifiable? How would you have control over booting your modified Linux in a commercial computer that uses UEFI? How would you know that the commercial CPU is not phoning home through the Intel Management Engine?
You would have use a FPGA CPU, your own designed hardware and a trusted OS but at the end you will always rely on the work of thousands people and hundred companies.
Mainline WiFi drivers will easily let you break the law by just pretending to be in a place with different regulations. Assuming this ever gets implemented in Linux, there's no reason to believe you won't be able to just pretend to be in Uzbekistan or whatever where this EU law doesn't apply.
If literally every jurisdiction on Earth makes it a crime, then I guess this option would go away, but that seems unlikely to me.
Most Linux contributions are made by multi-billions companies like IBM/Redhat.
The source code is published on the internet under the GPL. Anyone who doesn't like any of their contributions can take that one out and keep any of the others. Do you expect the Kali Linux people to include a backdoor?
To make Linux not lawful, you would have to create your own kernel with your own altered drivers, except you can't modify binaries.
You can in fact modify binaries, it's just more work. For one person, once. Although that's fairly irrelevant because there exists hardware that doesn't require binary-only drivers.
How would you know that the commercial CPU is not phoning home through the Intel Management Engine?
You install a firewall in front of it to detect or prevent this. Also, because it can be so easily detected and would be a scandal, it's very likely to be public knowledge if any commercial hardware in widespread use actually did this.
Are you sure the hardware you are going to use for firewall purposes is not biased towards letting the traffic from/to Intel ME to be unnoticed? What filters are you going to set?
What if your computer is still accessible for Intel ME surveillance because the VPN server is also Intel ME and they would negotiate somehow to keep having your Intel ME instance an ability to phone home? Is in possible to have a VPN provider which guarantees not having any Intel machines on the network?
What if your computer is still accessible for Intel ME surveillance because the VPN server is also Intel ME and they would negotiate somehow to keep having your Intel ME instance an ability to phone home?
This would require the hardware backdoor to be aware of and integrate with the specific VPN that you used, which could be a version of the code published after the hardware shipped.
Is in possible to have a VPN provider which guarantees not having any Intel machines on the network?
Irrelevant unless the code on your side could hook the VPN, though of course you could.
The better attack would be to have the compromised firmware send its packets using the addresses and ports of some existing connection regardless of its contents, and then have a compromised ISP read them. But even that could be detected by logging the packets at the clean firewall. If it records any that aren't a part of the VPN connection then you've got yourself a rat and a scandal.
Comments
It's far more difficult than that.
Most Linux contributions are made by multi-billions companies like IBM/Redhat. They would not risk to contravene to law. For example that it conforms to the law, look at WiFi drivers. There are many requirement by local laws on which band to use, what kind of traffic is authorized, etc. The WiFi drivers (most of them opaque binaries) conform to each country law.
To make Linux not lawful, you would have to create your own kernel with your own altered drivers, except you can't modify binaries.
Even then how could you make you system unidentifiable? How would you have control over booting your modified Linux in a commercial computer that uses UEFI? How would you know that the commercial CPU is not phoning home through the Intel Management Engine?
You would have use a FPGA CPU, your own designed hardware and a trusted OS but at the end you will always rely on the work of thousands people and hundred companies.
Mainline WiFi drivers will easily let you break the law by just pretending to be in a place with different regulations. Assuming this ever gets implemented in Linux, there's no reason to believe you won't be able to just pretend to be in Uzbekistan or whatever where this EU law doesn't apply.
If literally every jurisdiction on Earth makes it a crime, then I guess this option would go away, but that seems unlikely to me.
The source code is published on the internet under the GPL. Anyone who doesn't like any of their contributions can take that one out and keep any of the others. Do you expect the Kali Linux people to include a backdoor?
You can in fact modify binaries, it's just more work. For one person, once. Although that's fairly irrelevant because there exists hardware that doesn't require binary-only drivers.
You install a firewall in front of it to detect or prevent this. Also, because it can be so easily detected and would be a scandal, it's very likely to be public knowledge if any commercial hardware in widespread use actually did this.
Are you sure the hardware you are going to use for firewall purposes is not biased towards letting the traffic from/to Intel ME to be unnoticed? What filters are you going to set?
You can install open source software on a PC from the early 2000s that predates the Intel Management Engine and use it as a firewall.
Then you use default deny and allow only e.g. a VPN connection.
What if your computer is still accessible for Intel ME surveillance because the VPN server is also Intel ME and they would negotiate somehow to keep having your Intel ME instance an ability to phone home? Is in possible to have a VPN provider which guarantees not having any Intel machines on the network?
This would require the hardware backdoor to be aware of and integrate with the specific VPN that you used, which could be a version of the code published after the hardware shipped.
Irrelevant unless the code on your side could hook the VPN, though of course you could.
The better attack would be to have the compromised firmware send its packets using the addresses and ports of some existing connection regardless of its contents, and then have a compromised ISP read them. But even that could be detected by logging the packets at the clean firewall. If it records any that aren't a part of the VPN connection then you've got yourself a rat and a scandal.