Vulnerabilities / Threats

4/6/2015
10:30 AM
50%
50%

Obamas War On Hackers

Cybersecurity legislation, for the most part, is a good idea. But not without protections for bug bounty programs and other vital, proactive security research.

There has been a lot of discussion recently around President Obama’s plans to broaden the scope of legislation that would crack down on cybercrime in his proposed Modernizing Law Enforcement Authorities to Combat Cyber Crime plan. This proposal has raised a lot of questions for me and for many of my peers in the security research industry. Chief among them: will the research that I do, and that many in the community do, now become subject to investigation and possible prosecution?

Unfortunately, as currently proposed, the provisions are sufficiently vague so that solely consulting the law does little to clearly answer the question. That, for obvious reasons, leads to another set of questions:

  • Who would I ask to find out if the research I am conducting might violate the law? 
  • Would inquiring put the spotlight on me and put my research at risk? 
  • And, in general, what are the overall implications to the security research community?

Cybersecurity legislation is a complex topic. I think the intention of the law is largely a good one: government wants to crack down on criminals who have the potential to cripple infrastructure that is vital not only to business but to the lives of citizens in general. Defining laws that would only target the bad guys, however, is a very tricky thing.

Those of us in the trenches of information security are very much aware of the proactive industry research that takes place every day with the goal of preventing such crippling attacks from ever happening. However, concerns that security research could also be seen as illegal might curtail involvement by some of the brightest and most talented minds in our security community. Fear alone is a very credible deterrent, and unless there is a means for researchers to verify their research without fear, vital research will never see the light of day, or it will be taken overseas.

I had an opportunity to discuss this topic on a recent Dark Reading radio program. Joining the discussion was Harley Geiger from the Center for Democracy and Technology. The conversation touched on many interesting points, one being the scope of the Computer Fraud and Abuse Act (CFAA), which was enacted in 1986.

Just think about that for a moment: 1986. The overarching piece of legislation that is governing what may or may not be deemed illegal when it comes to cybersecurity research was written before the advent of the Internet itself!

[ICYMI: Hear the fascinating DR Radio broadcast on how New Cybercrime Crackdown Could Backfire And Criminalize Security Professionals]

What the current administration is essentially proposing is not a re-write of the current law, but instead, a broadening of it. Consider that, as the CFAA is written, things like bug bounty programs or any breach of a product/company’s terms of service (TOS) would be a violation of the law. How much broader can it get?

We have already seen negative examples of the current law being used against researchers, the most notable was the case against Aaron Swartz, who committed suicide in early 2013 while facing the potential of more than 30 years in prison and millions in fines for downloading academic journals from MIT’s JSTOR. If the laws are broadened and punishments increased, how many more cases like this will there be? It’s distressing to think about, and quite frustrating for researchers whose intentions are to help advance security and protections for businesses and consumers alike.

Ultimately, I think that some legislation is needed and that the majority of the cases that are enacted under it will be aimed at those with malicious intent. However, we need to reform the current law before extending it. Otherwise, there will be wide-reaching implications on the same security research that could ultimately play a strong hand in proactively derailing malicious behavior.

Jeremiah Grossman, Chief of Security Strategy, SentinelOne, Professional Hacker, Black Belt in Brazilian Jiu-Jitsu, & Founder of WhiteHat Security. Jeremiah Grossman's career spans nearly 20 years. He has lived a literal lifetime in computer security to become one of the ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
GonzSTL
50%
50%
GonzSTL,
User Rank: Ninja
4/8/2015 | 10:21:33 AM
Re: Great points, good article
When lawmakers surround themselves with their chosen advisors while crafting legislation, they feel that those advisors provide them with all the information they need to create the legislation. I would like to know who the advisors were when the proposal was crafted. Perhaps that would shed light on the apparent vagueness and potentially terrible side effects of the modified law.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
4/6/2015 | 1:23:28 PM
Great points, good article
Nice job on raising some important issues, Jeremiah. Curious to know if there is a process or federal agency where  for the public (and the cybersecurity community) can register its concerns about the proposed legislation? I couldn't see anything in the press release on the White House web site
Is Threat Intelligence Garbage?
Chris McDaniels, Chief Information Security Officer of Mosaic451,  5/23/2018
New Mexico Man Sentenced on DDoS, Gun Charges
Dark Reading Staff 5/18/2018
What Israel's Elite Defense Force Unit 8200 Can Teach Security about Diversity
Lital Asher-Dotan, Senior Director, Security Research and Content, Cybereason,  5/21/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Shhh!  They're watching... And you have a laptop?  
Current Issue
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-3018
PUBLISHED: 2018-05-24
The AXIS webapp in deploy-tomcat/axis in IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.1.2 and 7.2.0 through 7.2.1.4 allows remote attackers to obtain sensitive configuration information via a direct request, as demonstrated by happyaxis.jsp. IBM X-Force ID: 84354.
CVE-2013-3023
PUBLISHED: 2018-05-24
IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.1.2 and 7.2.0 through 7.2.1.4 might allow remote attackers to obtain sensitive information about Tomcat credentials by sniffing the network for a session in which HTTP is used. IBM X-Force ID: 84361.
CVE-2013-3024
PUBLISHED: 2018-05-24
IBM WebSphere Application Server (WAS) 8.5 through 8.5.0.2 on UNIX allows local users to gain privileges by leveraging improper process initialization. IBM X-Force ID: 84362.
CVE-2018-5674
PUBLISHED: 2018-05-24
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader before 9.1 and PhantomPDF before 9.1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw...
CVE-2018-5675
PUBLISHED: 2018-05-24
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader before 9.1 and PhantomPDF before 9.1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw...