4 ms·

To me this raises a question about selling security vulnerabilities to state actors in general (in the context of the Facebook vulnerability thread where the st

by aidanhs 10y ago

To me this raises a question about selling security vulnerabilities to state actors in general (in the context of the Facebook vulnerability thread where the standard discussion about value is being hashed out). Specifically, I live in the UK and one of the complaints law enforcement has is that US companies can (and do) totally ignore valid court orders because they don't apply in the US (reddit being an arbitrary concrete example). So, what would be the impact of GCHQ setting up a scheme where you can sell vulnerabilities to them (assuming they do the legwork to make it legal)? Would it violate some kind of trade agreement? I assume at minimum it would harm diplomatic relations given the pressure the big companies would exert on the US to push back.

Zigurd 10y ago
Imagine if some eager beaver out there started weaponizing microbes and selling them to the highest bidder. They would rightly be droned to a greasy smear on their lab wall. "Security researchers" who sell vulns to governments are no better.
tantalor 10y ago
https://en.wikipedia.org/wiki/Treason https://en.wikipedia.org/wiki/Treason
fweespee_ch 10y ago
https://www.eff.org/deeplinks/2015/06/damn-equities-sell-your-zero-days-navy https://www.eff.org/deeplinks/2015/06/damn-equities-sell-you... > Noted eagle eye and EFF Investigative Researcher Dave Maass happened on an interesting item from earlier this week on FedBizOpps, the site for government agencies to post contracting opportunities. The Navy put up a solicitation explaining that the government wants “access to vulnerability intelligence, exploit reports and operational exploit binaries affecting widely used and relied upon commercial software,” including Microsoft, Adobe, Android, Apple, “and all others.” If that weren’t clear enough, the solicitation explains that “the vendor shall provide the government with a proposed list of available vulnerabilities, 0-day or N-day (no older than 6 months old). . . .The government will select from the supplied list and direct development of exploit binaries.” http://www.zdnet.com/article/nsa-purchased-zero-day-exploits-from-french-security-firm-vupen/ http://www.zdnet.com/article/nsa-purchased-zero-day-exploits... > The National Security Agency bought hacking tools from a security firm, based on documents unearthed by a FOI request. The US is doing it. The GCHQ likely does it too and I bet at least some of this list was built via information purchased from others: https://www.schneier.com/blog/archives/2014/07/gchq_catalog_of.html https://www.schneier.com/blog/archives/2014/07/gchq_catalog_...
JoshTriplett 10y ago
> Specifically, I live in the UK and one of the complaints law enforcement has is that US companies can (and do) totally ignore valid court orders because they don't apply in the US (reddit being an arbitrary concrete example). A US company (or individual) should absolutely ignore court orders from a non-US court; such courts have no jurisdiction. A "valid" court order necessarily must come from a court with jurisdiction. Similarly, I'd expect a UK company to ignore US court orders. (And in both cases, I'd ideally hope the court knows better than to take the case in the first place or to issue such an order.)
- ddebernardy 10y ago
  Actually, the court would issue such an order _because_ it knows better: without it, you basically have little leverage when you try to enforce the same in the foreign country in a court that actually _has_ jurisdiction. Here's an example where a French court issued a court order to a US firm: https://en.wikipedia.org/wiki/LICRA_v._Yahoo https://en.wikipedia.org/wiki/LICRA_v._Yahoo!
- wodenokoto 10y ago
  The thing is, companies like Google, Facebook and Apple are kinda companies of great britain or at least Ireland. They have bases in Ireland for tax purposes and to comply with certain data retention laws. That aside, it is not really too much to ask that a company that does business in England abide by English law.
  - JoshTriplett 10y ago
    I'd certainly agree that a company with a legal nexus in a given country must obey that country's laws (or leave). But "does business in England" and "has a legal nexus in England" are two different things, depending on your definition of "does business". For instance, if I sell a service online, and someone from England buys it, that might count as "does business in England" but it doesn't make either me or the service subject to English law or jurisdiction.
    - 10y ago
morgante 10y ago
Uh, state actors (including GCHQ) already are some of the primary buyers of vulnerabilities.

by aidanhs 10y ago

Zigurd 10y ago

Imagine if some eager beaver out there started weaponizing microbes and selling them to the highest bidder. They would rightly be droned to a greasy smear on their lab wall. "Security researchers" who sell vulns to governments are no better.

tantalor 10y ago

https://en.wikipedia.org/wiki/Treason https://en.wikipedia.org/wiki/Treason

fweespee_ch 10y ago

https://www.eff.org/deeplinks/2015/06/damn-equities-sell-your-zero-days-navy https://www.eff.org/deeplinks/2015/06/damn-equities-sell-you... > Noted eagle eye and EFF Investigative Researcher Dave Maass happened on an interesting item from earlier this week on FedBizOpps, the site for government agencies to post contracting opportunities. The Navy put up a solicitation explaining that the government wants “access to vulnerability intelligence, exploit reports and operational exploit binaries affecting widely used and relied upon commercial software,” including Microsoft, Adobe, Android, Apple, “and all others.” If that weren’t clear enough, the solicitation explains that “the vendor shall provide the government with a proposed list of available vulnerabilities, 0-day or N-day (no older than 6 months old). . . .The government will select from the supplied list and direct development of exploit binaries.” http://www.zdnet.com/article/nsa-purchased-zero-day-exploits-from-french-security-firm-vupen/ http://www.zdnet.com/article/nsa-purchased-zero-day-exploits... > The National Security Agency bought hacking tools from a security firm, based on documents unearthed by a FOI request. The US is doing it. The GCHQ likely does it too and I bet at least some of this list was built via information purchased from others: https://www.schneier.com/blog/archives/2014/07/gchq_catalog_of.html https://www.schneier.com/blog/archives/2014/07/gchq_catalog_...

JoshTriplett 10y ago

> Specifically, I live in the UK and one of the complaints law enforcement has is that US companies can (and do) totally ignore valid court orders because they don't apply in the US (reddit being an arbitrary concrete example). A US company (or individual) should absolutely ignore court orders from a non-US court; such courts have no jurisdiction. A "valid" court order necessarily must come from a court with jurisdiction. Similarly, I'd expect a UK company to ignore US court orders. (And in both cases, I'd ideally hope the court knows better than to take the case in the first place or to issue such an order.)

ddebernardy 10y ago
Actually, the court would issue such an order _because_ it knows better: without it, you basically have little leverage when you try to enforce the same in the foreign country in a court that actually _has_ jurisdiction. Here's an example where a French court issued a court order to a US firm: https://en.wikipedia.org/wiki/LICRA_v._Yahoo https://en.wikipedia.org/wiki/LICRA_v._Yahoo!
wodenokoto 10y ago
The thing is, companies like Google, Facebook and Apple are kinda companies of great britain or at least Ireland. They have bases in Ireland for tax purposes and to comply with certain data retention laws. That aside, it is not really too much to ask that a company that does business in England abide by English law.
- JoshTriplett 10y ago
  I'd certainly agree that a company with a legal nexus in a given country must obey that country's laws (or leave). But "does business in England" and "has a legal nexus in England" are two different things, depending on your definition of "does business". For instance, if I sell a service online, and someone from England buys it, that might count as "does business in England" but it doesn't make either me or the service subject to English law or jurisdiction.
  - 10y ago

morgante 10y ago

Uh, state actors (including GCHQ) already are some of the primary buyers of vulnerabilities.