4 ms·
> Chinese intelligence agents acquired National Security Agency hacking tools and repurposed them in 2016 to attack American allies and private companies in Eur
by elihu 8y ago
> Chinese intelligence agents acquired National Security Agency hacking tools and repurposed them in 2016 to attack American allies and private companies in Europe and Asia, a leading cybersecurity firm has discovered.
Does that open up the NSA to a lawsuit from those U.S. companies that were attacked by the same tools the NSA created and used against targets in China?
It seems like there ought to be some liability for any organization that gives this kind of technology to another organization who is likely to misuse it, even if "give" in this instance means "use it against them".
- lawnchair_larry 8y agoOf course not. The NSA didn’t put those vulnerabilities there. If we want to start pointing fingers, the first point of liability would be with whoever released the vulnerable software.
- lapinot 8y agoI do and you probably do too. Of course we can fantasize that these vulns have been planted, maybe even a couple have been. But most of them are probably just uncaught mistakes and subtle semantic errors. I believe in proving software (and other stuff) correct, but that doesn't mean we'll arrive at some point to the one true software. The problem is about defining formally what it is to be correct, having a model that encompasses all things you care about. You can't blame people for writing faulty software and shipping exploitable hardware, that's just what one does. I think it makes sense to blame people for discovering exploits and not disclosing them properly tho. That's what one is expected to do... Some wishful thinking: let's hope the US will see that the only move with positive outcome is to start a global disarmament initiative. We seem to have forgotten the days of fighting for de-weaponizing encryption, this should apply to cyber-security in general.