Perimeter
1/18/2012
05:45 PM
Robert Graham
Robert Graham
Commentary
50%
50%

A Firsthand Piracy Experience

Limited government support of intellectual property helps, but not the strong protections in SOPA/PIPA

Much has been written about SOPA/PIPA today, but I thought I’d give a personal perspective.

Thirteen years ago, I created the “BlackICE” products: “BlackICE Guard” was the first network IPS and “BlackICE Defender” was (one of) the first personal firewalls. My ability to sell these products depended on the government’s protection of intellectual property. I experienced exactly the problems targeted by those laws.

For example, foreign sites would crack the license key and sell pirated copies of the personal firewall, whose users would then come to us for software updates and support. This is the reason for Microsoft’s “Geniune Advantage” program targeting "victims of software piracy." It doesn’t target the casual user who pirates his own copy of Windows and puts it on multiple machines. Instead, it’s copying the foreign resellers of pirated CDs selling them on the streets of Shanghai.

However, while piracy was a problem, it was also an opportunity for BlackICE. Our target market was corporations, not home users.

Corporations might pirate software in order to try it out, but eventually they have to pay for it. In one memorable incident, the CSO of a Fortune 500 company admitted to pirating a few copies of our personal firewall to test it out in his lab -- as he signed the check for 10,000 legitimate copies for the company. Indeed, most security professionals in our industry who got their start in the late 1990s pirated my software at one point or another.

So why not simply make a free trial version available, or a shareware version? Mostly, it was perception. When you give something away for free, customers expect it to be free. It’s hard convincing customers to pay for something if you are already giving it away on the Internet. Conversely, when your software becomes the most pirated software on the Internet (as BlackICE was for a time), it creates a perception of value.

The moral of this story is that, yes, we need limited government support of intellectual property. Without such support, we could never have sold any product and never would have developed it. But on the other hand, we neither needed nor wanted the strong protections in the SOPA/PIPA bills. We didn't want these laws then, and since so much cybersecurity content is created by collaboration, such laws will be damaging to our future.

Robert Graham is CEO of Errata Security.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Mya
50%
50%
Mya,
User Rank: Apprentice
1/19/2012 | 5:34:17 AM
re: A Firsthand Piracy Experience
Sharing about your experience in the industry and your opinion about the government for intellectual property was interesting
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-7178
Published: 2014-11-28
Enalean Tuleap before 7.5.99.6 allows remote attackers to execute arbitrary commands via the User-Agent header, which is provided to the passthru PHP function.

CVE-2014-7850
Published: 2014-11-28
Cross-site scripting (XSS) vulnerability in the Web UI in FreeIPA 4.x before 4.1.2 allows remote attackers to inject arbitrary web script or HTML via vectors related to breadcrumb navigation.

CVE-2014-8423
Published: 2014-11-28
Unspecified vulnerability in the management portal in ARRIS VAP2500 before FW08.41 allows remote attackers to execute arbitrary commands via unknown vectors.

CVE-2014-8424
Published: 2014-11-28
ARRIS VAP2500 before FW08.41 does not properly validate passwords, which allows remote attackers to bypass authentication.

CVE-2014-8425
Published: 2014-11-28
The management portal in ARRIS VAP2500 before FW08.41 allows remote attackers to obtain credentials by reading the configuration files.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?