Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

4/6/2015
10:30 AM
50%
50%

Obama’s War On Hackers

Cybersecurity legislation, for the most part, is a good idea. But not without protections for bug bounty programs and other vital, proactive security research.

There has been a lot of discussion recently around President Obama’s plans to broaden the scope of legislation that would crack down on cybercrime in his proposed Modernizing Law Enforcement Authorities to Combat Cyber Crime plan. This proposal has raised a lot of questions for me and for many of my peers in the security research industry. Chief among them: will the research that I do, and that many in the community do, now become subject to investigation and possible prosecution?

Unfortunately, as currently proposed, the provisions are sufficiently vague so that solely consulting the law does little to clearly answer the question. That, for obvious reasons, leads to another set of questions:

  • Who would I ask to find out if the research I am conducting might violate the law? 
  • Would inquiring put the spotlight on me and put my research at risk? 
  • And, in general, what are the overall implications to the security research community?

Cybersecurity legislation is a complex topic. I think the intention of the law is largely a good one: government wants to crack down on criminals who have the potential to cripple infrastructure that is vital not only to business but to the lives of citizens in general. Defining laws that would only target the bad guys, however, is a very tricky thing.

Those of us in the trenches of information security are very much aware of the proactive industry research that takes place every day with the goal of preventing such crippling attacks from ever happening. However, concerns that security research could also be seen as illegal might curtail involvement by some of the brightest and most talented minds in our security community. Fear alone is a very credible deterrent, and unless there is a means for researchers to verify their research without fear, vital research will never see the light of day, or it will be taken overseas.

I had an opportunity to discuss this topic on a recent Dark Reading radio program. Joining the discussion was Harley Geiger from the Center for Democracy and Technology. The conversation touched on many interesting points, one being the scope of the Computer Fraud and Abuse Act (CFAA), which was enacted in 1986.

Just think about that for a moment: 1986. The overarching piece of legislation that is governing what may or may not be deemed illegal when it comes to cybersecurity research was written before the advent of the Internet itself!

[ICYMI: Hear the fascinating DR Radio broadcast on how New Cybercrime Crackdown Could Backfire And Criminalize Security Professionals]

What the current administration is essentially proposing is not a re-write of the current law, but instead, a broadening of it. Consider that, as the CFAA is written, things like bug bounty programs or any breach of a product/company’s terms of service (TOS) would be a violation of the law. How much broader can it get?

We have already seen negative examples of the current law being used against researchers, the most notable was the case against Aaron Swartz, who committed suicide in early 2013 while facing the potential of more than 30 years in prison and millions in fines for downloading academic journals from MIT’s JSTOR. If the laws are broadened and punishments increased, how many more cases like this will there be? It’s distressing to think about, and quite frustrating for researchers whose intentions are to help advance security and protections for businesses and consumers alike.

Ultimately, I think that some legislation is needed and that the majority of the cases that are enacted under it will be aimed at those with malicious intent. However, we need to reform the current law before extending it. Otherwise, there will be wide-reaching implications on the same security research that could ultimately play a strong hand in proactively derailing malicious behavior.

Jeremiah Grossman, Chief of Security Strategy, SentinelOne, Professional Hacker, Black Belt in Brazilian Jiu-Jitsu, & Founder of WhiteHat Security. Jeremiah Grossman's career spans nearly 20 years. He has lived a literal lifetime in computer security to become one of the ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
GonzSTL
50%
50%
GonzSTL,
User Rank: Ninja
4/8/2015 | 10:21:33 AM
Re: Great points, good article
When lawmakers surround themselves with their chosen advisors while crafting legislation, they feel that those advisors provide them with all the information they need to create the legislation. I would like to know who the advisors were when the proposal was crafted. Perhaps that would shed light on the apparent vagueness and potentially terrible side effects of the modified law.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
4/6/2015 | 1:23:28 PM
Great points, good article
Nice job on raising some important issues, Jeremiah. Curious to know if there is a process or federal agency where  for the public (and the cybersecurity community) can register its concerns about the proposed legislation? I couldn't see anything in the press release on the White House web site
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/2/2020
Ripple20 Threatens Increasingly Connected Medical Devices
Kelly Sheridan, Staff Editor, Dark Reading,  6/30/2020
DDoS Attacks Jump 542% from Q4 2019 to Q1 2020
Dark Reading Staff 6/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
The Threat from the Internet—and What Your Organization Can Do About It
The Threat from the Internet—and What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9498
PUBLISHED: 2020-07-02
Apache Guacamole 1.1.0 and older may mishandle pointers involved inprocessing data received via RDP static virtual channels. If a userconnects to a malicious or compromised RDP server, a series ofspecially-crafted PDUs could result in memory corruption, possiblyallowing arbitrary code to be executed...
CVE-2020-3282
PUBLISHED: 2020-07-02
A vulnerability in the web-based management interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications Manager IM & Presence Service, and Cisco Unity Connection could allow an unauthenticated, remote attack...
CVE-2020-5909
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, when users run the command displayed in NGINX Controller user interface (UI) to fetch the agent installer, the server TLS certificate is not verified.
CVE-2020-5910
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in use by the NGINX Controller do not require any form of authentication, so any successful connection would be authorized.
CVE-2020-5911
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller installer starts the download of Kubernetes packages from an HTTP URL On Debian/Ubuntu system.