4 ms·

Since the US government has historically been one of the largest customers in the zero-day market, my guess would be no.

krisoft 5y ago
The US government is also one of the largest customers of ICBM rockets too. And you would find that it is not an unregulated field at all. I don’t know about regulations in the field. All I know is that “US gov buys a lot of X, therefore it X is not regulated” is not a convincing argument.
- AmericanChopper 5y ago
  The government’s ability to prevent software distribution is limited significantly by the first amendment. Selling “a tool for hacking” is fine, selling “a tool for committing crime” would be illegal, but that distinction just comes down to picking the right marketing copy. The government can however restrict the import and export of software quite broadly. This is not legal advice, obviously.
  - lazide 5y ago
    Well, and the first amendment only matters if someone gets it to court, the court accepts it (not easy to get against the federal gov’t), the evidence or the plaintiff doesn’t ‘disappear’ in the mean time, etc.
    - AmericanChopper 5y ago
      Depends on what kind of court you’re talking about. If you’re talking about civil court, then any software (or anything at all really) can be used for committing a tort. If the government tried to ban certain types of software from being made/distributed, they would either make a law that’s never enforced (like the obviously unconstitutional DMCA anti-circumvention law), or a law that’s immediately struck down by the courts.
  - nobody9999 5y ago
    >The government’s ability to prevent software distribution is limited significantly by the first amendment. Selling “a tool for hacking” is fine, selling “a tool for committing crime” would be illegal, but that distinction just comes down to picking the right marketing copy. The government can however restrict the import and export of software quite broadly. An interesting point. Given the vendor and customers for NSO's products, Federal law (in the US) would apply, rather than state law. That said, an interesting parallel would be possession of burglary tools[0], which is a crime in many places in the US. However, given that "burglary tools" are generally just tools (e.g., bolt cutters), intent or mens rea[2] becomes important. Presumably, a similar argument could be made about tools like nmap, nc, ettercap, metasploit, etc., since they can be used for legitimate purposes, even though they're also used for site intrusions/compromises. NSO's tools, presumably, are mostly used for the latter rather than the former. I'm guessing (IANAL) that's one of the rationales used to restrict sales/exports. Is that a convincing argument to criminalize activity and saddle it with strict liability[1]? I'm not so sure, but I'm also not a DOJ lawyer. All that said, I don't think it's all just "marketing copy." As with most things, context and nuance matter. I make no judgement WRT the appropriateness of such restrictions, as I'm not in possession of all the facts. Even so, while I tend toward the free flow of information, there is something to the idea that if you're caught at the back door of a jewelry store late at night with bolt cutters, that implies mens rea much more than having bolt cutters in the toolbox in your garage. YMMV. [0] https://codes.findlaw.com/ny/penal-law/pen-sect-140-35.html https://codes.findlaw.com/ny/penal-law/pen-sect-140-35.html [1] https://www.law.cornell.edu/wex/strict_liability https://www.law.cornell.edu/wex/strict_liability [2] https://www.law.cornell.edu/wex/mens_rea https://www.law.cornell.edu/wex/mens_rea Edit: Fixed typo.
    - AmericanChopper 5y ago
      The sales pitch is basically the only thing that can make it illegal, because it’s illegal to knowingly do anything for the purpose of assisting somebody else commit a crime. That’s why it would be illegal to have a “burglary tools” section at a hardware store, even if they only difference between that and any other hardware store is words on a sign. Even with regards the restricting import, the government is largely limited to sanctioning particular actors involved in the transaction. I’m really a bit surprised that this isn’t more widely understood on HN. Anybody who operated a web server in the 90s is likely to know about Bernstein vs DoJ, and even if you operate one today you’re still likely to encounter the idea of an “export cipher”.
- thr0wawayf00 5y ago
  Fair play. I'm thinking more from the perspective that the lack of regulation in the space makes it much easier to acquire and hoard zero-days at a government scale, as we saw with the Vault 7 leaks. Since the government is incentivized to hoard vulnerabilities for intelligence gathering, it's hard to see them being so willing to give it up.
- lostlogin 5y ago
  I’m not sure that regulation really applies much when you operate at that level. How many countries has the US waged war on with the combatants in both sides using US made weapons? The scene has been set again in Afghanistan. It isn’t ICBMs but it’s not a virtuous circle when you are dealing with weaponry.
  - lukeschlather 5y ago
    Has an ICBM ever been used offensively? I would say ICBMs are among the most well-regulated weapons in existence.
    - lostlogin 5y ago
      I don’t think it’s regulation that has stopped them being used.

krisoft 5y ago

The US government is also one of the largest customers of ICBM rockets too. And you would find that it is not an unregulated field at all. I don’t know about regulations in the field. All I know is that “US gov buys a lot of X, therefore it X is not regulated” is not a convincing argument.

AmericanChopper 5y ago
The government’s ability to prevent software distribution is limited significantly by the first amendment. Selling “a tool for hacking” is fine, selling “a tool for committing crime” would be illegal, but that distinction just comes down to picking the right marketing copy. The government can however restrict the import and export of software quite broadly. This is not legal advice, obviously.
- lazide 5y ago
  Well, and the first amendment only matters if someone gets it to court, the court accepts it (not easy to get against the federal gov’t), the evidence or the plaintiff doesn’t ‘disappear’ in the mean time, etc.
  - AmericanChopper 5y ago
    Depends on what kind of court you’re talking about. If you’re talking about civil court, then any software (or anything at all really) can be used for committing a tort. If the government tried to ban certain types of software from being made/distributed, they would either make a law that’s never enforced (like the obviously unconstitutional DMCA anti-circumvention law), or a law that’s immediately struck down by the courts.
- nobody9999 5y ago
  >The government’s ability to prevent software distribution is limited significantly by the first amendment. Selling “a tool for hacking” is fine, selling “a tool for committing crime” would be illegal, but that distinction just comes down to picking the right marketing copy. The government can however restrict the import and export of software quite broadly. An interesting point. Given the vendor and customers for NSO's products, Federal law (in the US) would apply, rather than state law. That said, an interesting parallel would be possession of burglary tools[0], which is a crime in many places in the US. However, given that "burglary tools" are generally just tools (e.g., bolt cutters), intent or mens rea[2] becomes important. Presumably, a similar argument could be made about tools like nmap, nc, ettercap, metasploit, etc., since they can be used for legitimate purposes, even though they're also used for site intrusions/compromises. NSO's tools, presumably, are mostly used for the latter rather than the former. I'm guessing (IANAL) that's one of the rationales used to restrict sales/exports. Is that a convincing argument to criminalize activity and saddle it with strict liability[1]? I'm not so sure, but I'm also not a DOJ lawyer. All that said, I don't think it's all just "marketing copy." As with most things, context and nuance matter. I make no judgement WRT the appropriateness of such restrictions, as I'm not in possession of all the facts. Even so, while I tend toward the free flow of information, there is something to the idea that if you're caught at the back door of a jewelry store late at night with bolt cutters, that implies mens rea much more than having bolt cutters in the toolbox in your garage. YMMV. [0] https://codes.findlaw.com/ny/penal-law/pen-sect-140-35.html https://codes.findlaw.com/ny/penal-law/pen-sect-140-35.html [1] https://www.law.cornell.edu/wex/strict_liability https://www.law.cornell.edu/wex/strict_liability [2] https://www.law.cornell.edu/wex/mens_rea https://www.law.cornell.edu/wex/mens_rea Edit: Fixed typo.
  - AmericanChopper 5y ago
    The sales pitch is basically the only thing that can make it illegal, because it’s illegal to knowingly do anything for the purpose of assisting somebody else commit a crime. That’s why it would be illegal to have a “burglary tools” section at a hardware store, even if they only difference between that and any other hardware store is words on a sign. Even with regards the restricting import, the government is largely limited to sanctioning particular actors involved in the transaction. I’m really a bit surprised that this isn’t more widely understood on HN. Anybody who operated a web server in the 90s is likely to know about Bernstein vs DoJ, and even if you operate one today you’re still likely to encounter the idea of an “export cipher”.
thr0wawayf00 5y ago
Fair play. I'm thinking more from the perspective that the lack of regulation in the space makes it much easier to acquire and hoard zero-days at a government scale, as we saw with the Vault 7 leaks. Since the government is incentivized to hoard vulnerabilities for intelligence gathering, it's hard to see them being so willing to give it up.
lostlogin 5y ago
I’m not sure that regulation really applies much when you operate at that level. How many countries has the US waged war on with the combatants in both sides using US made weapons? The scene has been set again in Afghanistan. It isn’t ICBMs but it’s not a virtuous circle when you are dealing with weaponry.
- lukeschlather 5y ago
  Has an ICBM ever been used offensively? I would say ICBMs are among the most well-regulated weapons in existence.
  - lostlogin 5y ago
    I don’t think it’s regulation that has stopped them being used.