3 ms·

Specifically which law do people believe selling exploits violates? Off the top of my head I've only got "conspiracy"-like laws and international embargoes (dep

Specifically which law do people believe selling exploits violates? Off the top of my head I've only got "conspiracy"-like laws and international embargoes (depending on buyer). Should it be illegal? Yeah, potentially. Is it? Unclear.

rtsil 6y ago
At least accessory to crime if the exploit is used in a criminal activity, I presume?
- MeinBlutIstBlau 6y ago
  If you traded it off tor with a burner computer at a cafe or something, there is absolutely no way anybody could trace it back to you. It took the FBI to catch the silk road guy several years and iirc they pinned him on buying a hitmans services, not drug trafficking.
ufmace 6y ago
I'm extremely wary of a law that would potentially criminalize that. It would almost certainly have to be very vague and prone to being abused by malicious prosecutors. How would you set it up such that it's illegal to sell an exploit to a supposedly malicious actor, but not illegal to sell or negotiate prices with the company maintaining the software or some other company that they deem to be their agent for managing security reports, per current White Hat practices? Conspiracy convictions usually require proof that the suspect had created a plan to commit a serious crime and has taken active steps towards the execution of that plan, even if they haven't committed the actual crime yet. We're already perilously close to US Federal Prosecutors being able to lock up anybody they don't like indefinitely. It's so exorbitantly expensive to fight Federal charges that hardly anybody really does, much less does successfully. The last thing we need is more vague Federal criminal laws with poorly thought out evidence and mens rea requirements.
- Arainach 6y ago
  There's no selling/negotiation in the current model. If you go to Google and say "I found this bug, I'll tell you what I did for $50K", that's extortion. If you disagree with their classification or payout, you can contest that classification in the system - but you are not arguing on the price of the exploit, you are arguing on what the exploit is.
teejmya 6y ago
While I agree with you, any competent lawyer could frame this under the Computer Fraud and Abuse Act
dbsmith83 6y ago
Why should it be illegal? From a US perspective, I don't think selling words/ideas should be illegal in most cases--especially just because it could be used for doing something illegal. For instance, there are books which describe chemical processes for synthesizing methamphetamine (https://www.amazon.com/Secrets-Methamphetamine-Manufacture-Uncle-Fester/dp/B01GEXT9VM https://www.amazon.com/Secrets-Methamphetamine-Manufacture-U...). But they are not illegal, because if they were it would infringe upon freedom of speech. Deciding what can and cannot be sold/published is a very authoritarian path to go down. It is better to just outlaw the criminal behavior.

rtsil 6y ago

At least accessory to crime if the exploit is used in a criminal activity, I presume?

MeinBlutIstBlau 6y ago
If you traded it off tor with a burner computer at a cafe or something, there is absolutely no way anybody could trace it back to you. It took the FBI to catch the silk road guy several years and iirc they pinned him on buying a hitmans services, not drug trafficking.

ufmace 6y ago

I'm extremely wary of a law that would potentially criminalize that. It would almost certainly have to be very vague and prone to being abused by malicious prosecutors. How would you set it up such that it's illegal to sell an exploit to a supposedly malicious actor, but not illegal to sell or negotiate prices with the company maintaining the software or some other company that they deem to be their agent for managing security reports, per current White Hat practices? Conspiracy convictions usually require proof that the suspect had created a plan to commit a serious crime and has taken active steps towards the execution of that plan, even if they haven't committed the actual crime yet. We're already perilously close to US Federal Prosecutors being able to lock up anybody they don't like indefinitely. It's so exorbitantly expensive to fight Federal charges that hardly anybody really does, much less does successfully. The last thing we need is more vague Federal criminal laws with poorly thought out evidence and mens rea requirements.

Arainach 6y ago
There's no selling/negotiation in the current model. If you go to Google and say "I found this bug, I'll tell you what I did for $50K", that's extortion. If you disagree with their classification or payout, you can contest that classification in the system - but you are not arguing on the price of the exploit, you are arguing on what the exploit is.

teejmya 6y ago

While I agree with you, any competent lawyer could frame this under the Computer Fraud and Abuse Act

dbsmith83 6y ago

Why should it be illegal? From a US perspective, I don't think selling words/ideas should be illegal in most cases--especially just because it could be used for doing something illegal. For instance, there are books which describe chemical processes for synthesizing methamphetamine (https://www.amazon.com/Secrets-Methamphetamine-Manufacture-Uncle-Fester/dp/B01GEXT9VM https://www.amazon.com/Secrets-Methamphetamine-Manufacture-U...). But they are not illegal, because if they were it would infringe upon freedom of speech. Deciding what can and cannot be sold/published is a very authoritarian path to go down. It is better to just outlaw the criminal behavior.