HN Reader

Why is the UK so authoritarian on cyber security? I feel like they're consistently on HN with this type of "rules for thee, not for me" attitude regarding computer law.

So there are legitimate reasons for doing this, such as avoiding having to write reports and request authorizations from oneself, not having to disclose certain sensitive information, etc.

The right way to do this is to draft a framework law and a few decrees along the lines of “administrations XXX and YYY will apply NIS2 with the following exceptions and adaptations ....”

This avoids creating overly broad exemptions, ensuring that there is a reference framework, and preventing each administration from developing its own system.

This is very common in the arms and nuclear sectors, where many civil norms and standards clearly state “not applicable to nuclear” and the nuclear standard states “apply civil standard XXX, with the following specific provisions, the competent authority is the ONR.”

Declaring an overly broad exemption from the outset is not the right way to go about it.

Do as we say not as we do, and the engineers of "change" sit back.

UK government agencies have opportunities to improve cyber security in a pragmatic way by phasing in coordinated vulnerability disclosure.

This matches the article's point that the UK CSR bill may be a first step that helps to phase in bespoke legislation to improve UK national security.

For me this is professional because my work involves UK software engineering for medical information.

Coordinated vulnerability disclosure: https://github.com/joelparkerhenderson/coordinated-vulnerabi...

It's similar to how in Texas (and many other places) state agencies don't have to follow local building codes.

src: worked construction in state data centers

¿What asbestos, qué?

Brit here. UK Government's position "we will hold ourselves to equivalent standards via the Cyber Action Plan, just without legal obligations" -is institutionally equivalent to "trust the PDF." Fast forward to the non-repudiable era, please.

I think this is an overly cynical read on the whole thing, at least after skimming the main points from the bill.

A lot of it is about designating critical suppliers + providers and their security obligations.

Central government would typically be a customer, that uses other suppliers and providers to achieve its goals, not a supplier or a provider itself.

So in that sense it doesn't seem so strange to see it omitted, or at least for first set of legislation etc.? Get the first party suppliers in shape first, then legislate the net result of government function using those suppliers etc.