Vulnerabilities / Threats

4/6/2015
10:30 AM
50%
50%

Obamas War On Hackers

Cybersecurity legislation, for the most part, is a good idea. But not without protections for bug bounty programs and other vital, proactive security research.

There has been a lot of discussion recently around President Obama’s plans to broaden the scope of legislation that would crack down on cybercrime in his proposed Modernizing Law Enforcement Authorities to Combat Cyber Crime plan. This proposal has raised a lot of questions for me and for many of my peers in the security research industry. Chief among them: will the research that I do, and that many in the community do, now become subject to investigation and possible prosecution?

Unfortunately, as currently proposed, the provisions are sufficiently vague so that solely consulting the law does little to clearly answer the question. That, for obvious reasons, leads to another set of questions:

  • Who would I ask to find out if the research I am conducting might violate the law? 
  • Would inquiring put the spotlight on me and put my research at risk? 
  • And, in general, what are the overall implications to the security research community?

Cybersecurity legislation is a complex topic. I think the intention of the law is largely a good one: government wants to crack down on criminals who have the potential to cripple infrastructure that is vital not only to business but to the lives of citizens in general. Defining laws that would only target the bad guys, however, is a very tricky thing.

Those of us in the trenches of information security are very much aware of the proactive industry research that takes place every day with the goal of preventing such crippling attacks from ever happening. However, concerns that security research could also be seen as illegal might curtail involvement by some of the brightest and most talented minds in our security community. Fear alone is a very credible deterrent, and unless there is a means for researchers to verify their research without fear, vital research will never see the light of day, or it will be taken overseas.

I had an opportunity to discuss this topic on a recent Dark Reading radio program. Joining the discussion was Harley Geiger from the Center for Democracy and Technology. The conversation touched on many interesting points, one being the scope of the Computer Fraud and Abuse Act (CFAA), which was enacted in 1986.

Just think about that for a moment: 1986. The overarching piece of legislation that is governing what may or may not be deemed illegal when it comes to cybersecurity research was written before the advent of the Internet itself!

[ICYMI: Hear the fascinating DR Radio broadcast on how New Cybercrime Crackdown Could Backfire And Criminalize Security Professionals]

What the current administration is essentially proposing is not a re-write of the current law, but instead, a broadening of it. Consider that, as the CFAA is written, things like bug bounty programs or any breach of a product/company’s terms of service (TOS) would be a violation of the law. How much broader can it get?

We have already seen negative examples of the current law being used against researchers, the most notable was the case against Aaron Swartz, who committed suicide in early 2013 while facing the potential of more than 30 years in prison and millions in fines for downloading academic journals from MIT’s JSTOR. If the laws are broadened and punishments increased, how many more cases like this will there be? It’s distressing to think about, and quite frustrating for researchers whose intentions are to help advance security and protections for businesses and consumers alike.

Ultimately, I think that some legislation is needed and that the majority of the cases that are enacted under it will be aimed at those with malicious intent. However, we need to reform the current law before extending it. Otherwise, there will be wide-reaching implications on the same security research that could ultimately play a strong hand in proactively derailing malicious behavior.

Jeremiah Grossman, Chief of Security Strategy, SentinelOne, Professional Hacker, Black Belt in Brazilian Jiu-Jitsu, & Founder of WhiteHat Security. Jeremiah Grossman's career spans nearly 20 years. He has lived a literal lifetime in computer security to become one of the ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
4/6/2015 | 1:23:28 PM
Great points, good article
Nice job on raising some important issues, Jeremiah. Curious to know if there is a process or federal agency where  for the public (and the cybersecurity community) can register its concerns about the proposed legislation? I couldn't see anything in the press release on the White House web site
GonzSTL
50%
50%
GonzSTL,
User Rank: Ninja
4/8/2015 | 10:21:33 AM
Re: Great points, good article
When lawmakers surround themselves with their chosen advisors while crafting legislation, they feel that those advisors provide them with all the information they need to create the legislation. I would like to know who the advisors were when the proposal was crafted. Perhaps that would shed light on the apparent vagueness and potentially terrible side effects of the modified law.
Want Your Daughter to Succeed in Cyber? Call Her John
John De Santis, CEO, HyTrust,  5/16/2018
Don't Roll the Dice When Prioritizing Vulnerability Fixes
Ericka Chickowski, Contributing Writer, Dark Reading,  5/15/2018
Why Enterprises Can't Ignore Third-Party IoT-Related Risks
Charlie Miller, Senior Vice President, The Santa Fe Group,  5/14/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "Security through obscurity"
Current Issue
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-11311
PUBLISHED: 2018-05-20
A hardcoded FTP username of myscada and password of Vikuk63 in 'myscadagate.exe' in mySCADA myPRO 7 allows remote attackers to access the FTP server on port 2121, and upload files or list directories, by entering these credentials.
CVE-2018-11319
PUBLISHED: 2018-05-20
Syntastic (aka vim-syntastic) through 3.9.0 does not properly handle searches for configuration files (it searches the current directory up to potentially the root). This improper handling might be exploited for arbitrary code execution via a malicious gcc plugin, if an attacker has write access to ...
CVE-2018-11242
PUBLISHED: 2018-05-20
An issue was discovered in the MakeMyTrip application 7.2.4 for Android. The databases (locally stored) are not encrypted and have cleartext that might lead to sensitive information disclosure, as demonstrated by data/com.makemytrip/databases and data/com.makemytrip/Cache SQLite database files.
CVE-2018-11315
PUBLISHED: 2018-05-20
The Local HTTP API in Radio Thermostat CT50 and CT80 1.04.84 and below products allows unauthorized access via a DNS rebinding attack. This can result in remote device temperature control, as demonstrated by a tstat t_heat request that accesses a device purchased in the Spring of 2018, and sets a ho...
CVE-2018-11239
PUBLISHED: 2018-05-19
An integer overflow in the _transfer function of a smart contract implementation for Hexagon (HXG), an Ethereum ERC20 token, allows attackers to accomplish an unauthorized increase of digital assets by providing a _to argument in conjunction with a large _value argument, as exploited in the wild in ...