5 ms·

Classifying such technology as military weapons would begin to address a number of international and national concerns with for-sale-malware (aka spyware). The

by xbar 5y ago

Classifying such technology as military weapons would begin to address a number of international and national concerns with for-sale-malware (aka spyware). The use of such military weapons by civilians (or civilian police) against civilians become more obviously ban-able.

Goety 5y ago
Enforcement here would probably be centered on adding additional sentencing time or punishment for misuse. That said we have near zero ability to enforce this at the moment.
milderworkacc 5y ago
While I agree that the trade in these tools is reprehensible, I worry about creating a new class of software that is prohibited to possess or trade in. It wasn't so long ago that strong encryption was labelled a 'dual use technology', and moving it across national borders was non-trivial. How long will it take for pentesting tools and end-to-end encryption to be labelled 'military weapons' under such a scheme?
- xbar 5y ago
  I worry, too. Regulators do hatchet jobs when it comes to software law. But slippery slopes aside, it's pretty clear that selling tools to take over phones en masse is a bad deal for free societies. Here's what we will find next: military and political leaders' phones have also already been compromised by NSO Group tools. I feel confident it has happened at a higher rate than among journalists. Imagine both your favorite and your most hated political firebrands: how will their rhetoric sound when they realize they've been pwned by the opposition for the past year using COTS tools?
rapind 5y ago
> The use of such military weapons by civilians (or civilian police) against civilians become more obviously ban-able. Not sure it would stop the police part. https://en.wikipedia.org/wiki/Militarization_of_police https://en.wikipedia.org/wiki/Militarization_of_police
throwawayboise 5y ago
Calling it a weapon means it falls under 2nd Amendment. Pretty hard sell that it's a "military" weapon when you can carry it around on a thumb drive.
- kube-system 5y ago
  Calling something a weapon does not satisfy the applicability standards outlined in SCOTUS case law. SCOTUS says that the 2nd applies to weapons which are “bearable”, i.e: > "“[w]eapo[n] of offence” or “thing that a man wears for his defence, or takes into his hands,” that is “carr[ied] . . . for the purpose of offensive or defensive action.”
  - artificial 5y ago
    One can own a cannon. https://www.atf.gov/explosives/qa/black-powder-subject-regulation-under-federal-explosives-laws https://www.atf.gov/explosives/qa/black-powder-subject-regul...
    - kube-system 5y ago
      Which meets the above definition a 1000x better than software. Not that it matters, the 2nd amendment does not restrict congressional ability to legalize anything. It only prohibits restrictions.
- curryst 5y ago
  I don't think it's that hard of a sell. The size of the weapon doesn't really matter; there are firearms that aren't much larger than a thumbdrive (i.e. pen guns). On the other hand, there's a longstanding tradition of military technology that is designed to destroy the enemy's infrastructure rather than to directly kill enemy combatants. The closest parallel is probably an EMP strike. They're designed to inflict 0 casualties, but they cripple the enemy. That mirrors the usage of offensive software; they don't inflict any casualties directly, but they can ruin supply chains, remove communication capabilities from the enemy, etc. They probably deserve to be classified as weapons, and banned by a subsequent law. I think the government has a compelling case that would almost certainly pass strict scrutiny. It seems a logical place to put them, because they are dangerous, and the strict scrutiny puts an onus on the government to use the least restrictive means possible to legislate them. I fear the alternative is that they aren't classed as weapons, and we get some overly broad CFAA type legislature that threatens to penalize security researchers.

by xbar 5y ago

Goety 5y ago

Enforcement here would probably be centered on adding additional sentencing time or punishment for misuse. That said we have near zero ability to enforce this at the moment.

milderworkacc 5y ago

While I agree that the trade in these tools is reprehensible, I worry about creating a new class of software that is prohibited to possess or trade in. It wasn't so long ago that strong encryption was labelled a 'dual use technology', and moving it across national borders was non-trivial. How long will it take for pentesting tools and end-to-end encryption to be labelled 'military weapons' under such a scheme?

xbar 5y ago
I worry, too. Regulators do hatchet jobs when it comes to software law. But slippery slopes aside, it's pretty clear that selling tools to take over phones en masse is a bad deal for free societies. Here's what we will find next: military and political leaders' phones have also already been compromised by NSO Group tools. I feel confident it has happened at a higher rate than among journalists. Imagine both your favorite and your most hated political firebrands: how will their rhetoric sound when they realize they've been pwned by the opposition for the past year using COTS tools?

rapind 5y ago

> The use of such military weapons by civilians (or civilian police) against civilians become more obviously ban-able. Not sure it would stop the police part. https://en.wikipedia.org/wiki/Militarization_of_police https://en.wikipedia.org/wiki/Militarization_of_police

throwawayboise 5y ago

Calling it a weapon means it falls under 2nd Amendment. Pretty hard sell that it's a "military" weapon when you can carry it around on a thumb drive.

kube-system 5y ago
Calling something a weapon does not satisfy the applicability standards outlined in SCOTUS case law. SCOTUS says that the 2nd applies to weapons which are “bearable”, i.e: > "“[w]eapo[n] of offence” or “thing that a man wears for his defence, or takes into his hands,” that is “carr[ied] . . . for the purpose of offensive or defensive action.”
- artificial 5y ago
  One can own a cannon. https://www.atf.gov/explosives/qa/black-powder-subject-regulation-under-federal-explosives-laws https://www.atf.gov/explosives/qa/black-powder-subject-regul...
  - kube-system 5y ago
    Which meets the above definition a 1000x better than software. Not that it matters, the 2nd amendment does not restrict congressional ability to legalize anything. It only prohibits restrictions.
curryst 5y ago
I don't think it's that hard of a sell. The size of the weapon doesn't really matter; there are firearms that aren't much larger than a thumbdrive (i.e. pen guns). On the other hand, there's a longstanding tradition of military technology that is designed to destroy the enemy's infrastructure rather than to directly kill enemy combatants. The closest parallel is probably an EMP strike. They're designed to inflict 0 casualties, but they cripple the enemy. That mirrors the usage of offensive software; they don't inflict any casualties directly, but they can ruin supply chains, remove communication capabilities from the enemy, etc. They probably deserve to be classified as weapons, and banned by a subsequent law. I think the government has a compelling case that would almost certainly pass strict scrutiny. It seems a logical place to put them, because they are dangerous, and the strict scrutiny puts an onus on the government to use the least restrictive means possible to legislate them. I fear the alternative is that they aren't classed as weapons, and we get some overly broad CFAA type legislature that threatens to penalize security researchers.