4 ms·

This claim seems like a big dilemma for US white-hat security researchers: 1. As a white-hat security researcher, you have an ethical responsibility to publicl

This claim seems like a big dilemma for US white-hat security researchers: 1. As a white-hat security researcher, you have an ethical responsibility to publicly disclose vulnerabilities after doing the necessary due diligence (informing the affected parties privately, and giving them the necessary time to respond, investigate, and come up with an acceptable solution). 2. As a US citizen, you can't report attacks carried out by US intelligence agencies. I can definitely see the responsibility that patriotic duty would entail, but a citizen with no links to their country's intelligence agency being held responsible for the said agency's failure in maintaining operational discretion doesn't seem sensible to me. Edit: update formatting.

wahern 8y ago
> As a US citizen, you can't report attacks carried out by US intelligence agencies. Who says? Unless you've received a National Security Letter, a gag order from a court, or have a pre-existing relationship with the government that governs disclosure (e.g. security clearance), there's nothing preventing a researcher from disclosing lawfully obtained information. Stumbling upon a secret investigation doesn't make the information unlawfully obtained, even if you suspect it might be a secret investigation.
- cyphar 8y ago
  Are you sure that the Espionage Act (1917) doesn't cover this? In Australia we have many recent laws that completely restrict our ability to whistleblow on any government issue (though it's not illegal if we ensure that non-Australian nationals know about it -- which is obviously an impossible and stupid standard).
  - wahern 8y ago
    It might (particularly subsections (d) and (e))[1], but only because the wording is so broad. Whether such an application would be legal is another matter. I suspect it would not absent specific intent (i.e. you're deliberately seeking out secrets to share) or a duty (security clearance). I suppose intent could be there if you share information about a device that says, "Warning: national defense injured if you disclose". But absent a duty I don't think a court would impute intent, especially considering the Free Speech issues (somewhat peculiar to the U.S.). Notice that nobody has seriously suggested (AFAIK) that the journalists who assisted Snowden should be charged under the Espionage Act, even though their acts would seem to fit multiple provisions. I think that's because unlike Snowden they had no duty, which means the bar for the requisite intent and knowledge (i.e. whether something is really going to harm national defense) is incredibly high. But who knows? It's a good point and it poses a ton of questions. Still, personally if I found a spying device on something I wouldn't hesitate to disclose it if it seemed noteworthy. I wouldn't feel chilled by the Espionage Act. The same law in some other country? Probably would think twice. [1] https://www.law.cornell.edu/uscode/text/18/793 https://www.law.cornell.edu/uscode/text/18/793
kabdib 8y ago
> As a US citizen, you can't report attacks carried out by US intelligence agencies. Sure you can. Short of a gag order (and maybe not even then) you can report intrusions all you like. In any event, how does one determine the nationality of hardware that shouldn't be there? It's not like there's going to be a snarky "Designed by the NSA in Fort Meade" logo on the chips in question.
- crankylinuxuser 8y ago
  If (IF!) you hold a civilian or military clearance, then you have a legal Duty to Report (DTR). That holds true whether its data in your clearance level or not. You also abide by a whole slew of laws regarding sensitive, secret, top secret, or SCIF information. If I knowingly, or even suspect, some information if classified, and I transmit it to anyone else than my federal assigned contact, I'm breaking major federal laws. A lot of security professionals in the US have such clearances. So finding a NSA implant or such proof makes it dangerous to talk about by default. So yeah, a gag order by profession.
  - flukus 8y ago
    Are you really a white-hat if you have to disclose vulnerabilities to an organisation known to exploit (or at least hoard) them?
    - crankylinuxuser 8y ago
      Please quote me where I claimed to be a white hat.
      - flukus 8y ago
        You didn't, but the context was: > This claim seems like a big dilemma for US white-hat security researchers It seems like the two are mutually exclusive.
      - igravious 8y ago
        “Are you really” => “Is one really” https://dictionary.cambridge.org/grammar/british-grammar/pronouns/pronouns-one-you-we-they https://dictionary.cambridge.org/grammar/british-grammar/pro... https://www.quickanddirtytips.com/education/grammar/one-versus-you https://www.quickanddirtytips.com/education/grammar/one-vers...

wahern 8y ago

> As a US citizen, you can't report attacks carried out by US intelligence agencies. Who says? Unless you've received a National Security Letter, a gag order from a court, or have a pre-existing relationship with the government that governs disclosure (e.g. security clearance), there's nothing preventing a researcher from disclosing lawfully obtained information. Stumbling upon a secret investigation doesn't make the information unlawfully obtained, even if you suspect it might be a secret investigation.

cyphar 8y ago
Are you sure that the Espionage Act (1917) doesn't cover this? In Australia we have many recent laws that completely restrict our ability to whistleblow on any government issue (though it's not illegal if we ensure that non-Australian nationals know about it -- which is obviously an impossible and stupid standard).
- wahern 8y ago
  It might (particularly subsections (d) and (e))[1], but only because the wording is so broad. Whether such an application would be legal is another matter. I suspect it would not absent specific intent (i.e. you're deliberately seeking out secrets to share) or a duty (security clearance). I suppose intent could be there if you share information about a device that says, "Warning: national defense injured if you disclose". But absent a duty I don't think a court would impute intent, especially considering the Free Speech issues (somewhat peculiar to the U.S.). Notice that nobody has seriously suggested (AFAIK) that the journalists who assisted Snowden should be charged under the Espionage Act, even though their acts would seem to fit multiple provisions. I think that's because unlike Snowden they had no duty, which means the bar for the requisite intent and knowledge (i.e. whether something is really going to harm national defense) is incredibly high. But who knows? It's a good point and it poses a ton of questions. Still, personally if I found a spying device on something I wouldn't hesitate to disclose it if it seemed noteworthy. I wouldn't feel chilled by the Espionage Act. The same law in some other country? Probably would think twice. [1] https://www.law.cornell.edu/uscode/text/18/793 https://www.law.cornell.edu/uscode/text/18/793

kabdib 8y ago

> As a US citizen, you can't report attacks carried out by US intelligence agencies. Sure you can. Short of a gag order (and maybe not even then) you can report intrusions all you like. In any event, how does one determine the nationality of hardware that shouldn't be there? It's not like there's going to be a snarky "Designed by the NSA in Fort Meade" logo on the chips in question.

crankylinuxuser 8y ago
If (IF!) you hold a civilian or military clearance, then you have a legal Duty to Report (DTR). That holds true whether its data in your clearance level or not. You also abide by a whole slew of laws regarding sensitive, secret, top secret, or SCIF information. If I knowingly, or even suspect, some information if classified, and I transmit it to anyone else than my federal assigned contact, I'm breaking major federal laws. A lot of security professionals in the US have such clearances. So finding a NSA implant or such proof makes it dangerous to talk about by default. So yeah, a gag order by profession.
- flukus 8y ago
  Are you really a white-hat if you have to disclose vulnerabilities to an organisation known to exploit (or at least hoard) them?
  - crankylinuxuser 8y ago
    Please quote me where I claimed to be a white hat.
    - flukus 8y ago
      You didn't, but the context was: > This claim seems like a big dilemma for US white-hat security researchers It seems like the two are mutually exclusive.
    - igravious 8y ago
      “Are you really” => “Is one really” https://dictionary.cambridge.org/grammar/british-grammar/pronouns/pronouns-one-you-we-they https://dictionary.cambridge.org/grammar/british-grammar/pro... https://www.quickanddirtytips.com/education/grammar/one-versus-you https://www.quickanddirtytips.com/education/grammar/one-vers...