Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

4/6/2015
10:30 AM
50%
50%

Obamas War On Hackers

Cybersecurity legislation, for the most part, is a good idea. But not without protections for bug bounty programs and other vital, proactive security research.

There has been a lot of discussion recently around President Obama’s plans to broaden the scope of legislation that would crack down on cybercrime in his proposed Modernizing Law Enforcement Authorities to Combat Cyber Crime plan. This proposal has raised a lot of questions for me and for many of my peers in the security research industry. Chief among them: will the research that I do, and that many in the community do, now become subject to investigation and possible prosecution?

Unfortunately, as currently proposed, the provisions are sufficiently vague so that solely consulting the law does little to clearly answer the question. That, for obvious reasons, leads to another set of questions:

  • Who would I ask to find out if the research I am conducting might violate the law? 
  • Would inquiring put the spotlight on me and put my research at risk? 
  • And, in general, what are the overall implications to the security research community?

Cybersecurity legislation is a complex topic. I think the intention of the law is largely a good one: government wants to crack down on criminals who have the potential to cripple infrastructure that is vital not only to business but to the lives of citizens in general. Defining laws that would only target the bad guys, however, is a very tricky thing.

Those of us in the trenches of information security are very much aware of the proactive industry research that takes place every day with the goal of preventing such crippling attacks from ever happening. However, concerns that security research could also be seen as illegal might curtail involvement by some of the brightest and most talented minds in our security community. Fear alone is a very credible deterrent, and unless there is a means for researchers to verify their research without fear, vital research will never see the light of day, or it will be taken overseas.

I had an opportunity to discuss this topic on a recent Dark Reading radio program. Joining the discussion was Harley Geiger from the Center for Democracy and Technology. The conversation touched on many interesting points, one being the scope of the Computer Fraud and Abuse Act (CFAA), which was enacted in 1986.

Just think about that for a moment: 1986. The overarching piece of legislation that is governing what may or may not be deemed illegal when it comes to cybersecurity research was written before the advent of the Internet itself!

[ICYMI: Hear the fascinating DR Radio broadcast on how New Cybercrime Crackdown Could Backfire And Criminalize Security Professionals]

What the current administration is essentially proposing is not a re-write of the current law, but instead, a broadening of it. Consider that, as the CFAA is written, things like bug bounty programs or any breach of a product/company’s terms of service (TOS) would be a violation of the law. How much broader can it get?

We have already seen negative examples of the current law being used against researchers, the most notable was the case against Aaron Swartz, who committed suicide in early 2013 while facing the potential of more than 30 years in prison and millions in fines for downloading academic journals from MIT’s JSTOR. If the laws are broadened and punishments increased, how many more cases like this will there be? It’s distressing to think about, and quite frustrating for researchers whose intentions are to help advance security and protections for businesses and consumers alike.

Ultimately, I think that some legislation is needed and that the majority of the cases that are enacted under it will be aimed at those with malicious intent. However, we need to reform the current law before extending it. Otherwise, there will be wide-reaching implications on the same security research that could ultimately play a strong hand in proactively derailing malicious behavior.

Jeremiah Grossman, Chief of Security Strategy, SentinelOne, Professional Hacker, Black Belt in Brazilian Jiu-Jitsu, & Founder of WhiteHat Security. Jeremiah Grossman's career spans nearly 20 years. He has lived a literal lifetime in computer security to become one of the ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
GonzSTL
50%
50%
GonzSTL,
User Rank: Ninja
4/8/2015 | 10:21:33 AM
Re: Great points, good article
When lawmakers surround themselves with their chosen advisors while crafting legislation, they feel that those advisors provide them with all the information they need to create the legislation. I would like to know who the advisors were when the proposal was crafted. Perhaps that would shed light on the apparent vagueness and potentially terrible side effects of the modified law.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
4/6/2015 | 1:23:28 PM
Great points, good article
Nice job on raising some important issues, Jeremiah. Curious to know if there is a process or federal agency where  for the public (and the cybersecurity community) can register its concerns about the proposed legislation? I couldn't see anything in the press release on the White House web site
97% of Americans Can't Ace a Basic Security Test
Steve Zurier, Contributing Writer,  5/20/2019
TeamViewer Admits Breach from 2016
Dark Reading Staff 5/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: I told you we should worry abit more about vendor lock-in.
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-7068
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-7069
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-7070
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-7071
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVE-2019-7072
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .