5 ms·

If we’re as serious about cybersecurity as all the noise that gets made about it indicates, we really need legal immunity for unsolicited responsible disclosure

by teeray 2y ago

If we’re as serious about cybersecurity as all the noise that gets made about it indicates, we really need legal immunity for unsolicited responsible disclosure. You shouldn’t have any ability to beat someone with the CFAA who is trying to help you.

jagged-chisel 2y ago
Anyone has the “ability” and freedom to make threats under the CFAA. Because there are no consequences for doing so. This particular company wouldn’t get the feds to prosecute this case. Another annoying problem is that this company seems to think that their “policy” overrides first sale doctrine wrt their products: ‘we don’t know where or how you got that device, therefore CFAA violation threat.’
- teeray 2y ago
  > Anyone has the “ability” and freedom to make threats under the CFAA. Certainly. What I’m saying is that it should be cheap or free to neutralize their threat. There should be a lawyer-free portal where you can upload their threat letter and your responsible disclosure letter, and get some kind of legal order blessing your work that you can throw back at them.
  - krger 2y ago
    >There should be a lawyer-free portal where you can upload their threat letter and your responsible disclosure letter, and get some kind of legal order blessing your work that you can throw back at them. Who's going to check it to make sure that "your responsible disclosure letter" actually is a responsible disclosure letter and not just nonsense?
    - jasonjayr 2y ago
      The firm funded by fines for making unfounded threats with scary lawyer letters.
- pixl97 2y ago
  You may not get the feds to prosecute the case, but it's very possible for the feds to investigate you with varying levels of fervor. If you're a well lawyered security researcher this is probably fine. If you're some IT related person that does something else as your primary job this may or may not be fine if the FBI shows up and starts asking lots of questions about all kinds of things.
  - EvanAnderson 2y ago
    > If you're some IT related person that does something else as your primary job this may or may not be fine if the FBI shows up and starts asking lots of questions about all kinds of things. This is exactly what I tell my coworkers who are getting into security. Keep your mouth shut about anything you find unless you have a reporting channel that leads to a "well lawyered" security company. I've found vulnerabilities that I would have loved to disclose, but being a lowly IT generalist, I'm not going to stick my neck out. I can't imagine my employer would like the press. I use one-off email addresses at my personal domain and historically warned companies that I was seeing spam to one-off addresses as possible indications of a data breach. By and large I was ignored, but occasionally I received a word of thanks. Even more occasionally I received notes of thanks that, in fact, I had uncovered a data breach. Once, however, I received a nasty response insinuating that I'd breached their systems. The person I contacted didn't, apparently, understand what I was saying. They were confused that their company name was to the left of the "@" in my email address. That was enough for me. I decided I was done reporting those events. Too much risk.
    - slantedview 2y ago
      > I was seeing spam to one-off addresses as possible indications of a data breach For the uninformed, how does spam to an address on your domain indicate a breach of someone else's system?
      - EvanAnderson 2y ago
        I sign-up for a service using "123abc-theirdomain.com@mydomain.com" as the email address. Messages to that address come to my "Inbox". I don't use the address for anything else. I never send a message with that address. Years pass. I start receiving email solicitations for erectile dysfunction remedies and, oddly, woodworking plans (what is it with the spam for shed plans?) to that address. Either my address was sold or a data breach occurred. (It could have been my own data breached, but it seems unlikely, if that did happen, that the result would be me receiving spam only to that one specific address.)
- toss1 2y ago
  Yup. I submit that this sort of threat poisons the well and makes security worse for everyone, including those making the threat (but it's a bit of a commons problem because the worsening security is industry-wide, but for the threat-maker it seems to improve their situation). If I am a person interested in how these systems work, and maybe making some money off my work in the area, this sort of threat, both its severity (potentially years of costly litigation and or/jail) and how frequently it happens (seems we read of such incidents many times per year, which is only the tip of the iceberg) would make someone seriously question the straight white-hat path. Why not find the exploits and sell them on the dark web? One might even justify it with "they wouldn't listen anyway and it's their fault for releasing a system with such stupid vulns." and/or "they'll fix it only when they see real-world consequences and if they don't it doesn't matter". One's moral compass need not be very compromised to lean on such excuses. There REALLY needs to be a Safe Harbor law with basic requirements that the work is documented, first revealed to the company security dept (perhaps citing the Safe Harbor law?), no action taken by the researcher to allow it to be disclosed or released publicly for 90 days, and perhaps a few other reasonable safeguards. and how often it happens
upwardbound 2y ago
We do have that now, as of 2022! The new Justice Department policy now instructs prosecutors not to prosecute security researchers who acted in good faith for the public benefit and who avoided any harm to individuals or the public. https://www.justice.gov/opa/pr/department-justice-announces-new-policy-charging-cases-under-computer-fraud-and-abuse-act https://www.justice.gov/opa/pr/department-justice-announces-...
- qingcharles 2y ago
  That checks off federal cases, but there are still options for a corporation under what are normally much stricter state laws in the USA. For instance, in Illinois you can get up to 5 years in prison for violating the ToS of a web site.
  - TheCleric 2y ago
    As well I think that would still leave you exposed for a civil suit, which even if you win, can be financially devastating. What would be needed is an anti-SLAPP type legislation at the state and federal level to mitigate it.
- bagels 2y ago
  Policy can change, retrospectively even
  - DJBunnies 2y ago
    Yeah it was a kaizen ticket the group filed after the last sprint.

by teeray 2y ago

jagged-chisel 2y ago

Anyone has the “ability” and freedom to make threats under the CFAA. Because there are no consequences for doing so. This particular company wouldn’t get the feds to prosecute this case. Another annoying problem is that this company seems to think that their “policy” overrides first sale doctrine wrt their products: ‘we don’t know where or how you got that device, therefore CFAA violation threat.’

teeray 2y ago
> Anyone has the “ability” and freedom to make threats under the CFAA. Certainly. What I’m saying is that it should be cheap or free to neutralize their threat. There should be a lawyer-free portal where you can upload their threat letter and your responsible disclosure letter, and get some kind of legal order blessing your work that you can throw back at them.
- krger 2y ago
  >There should be a lawyer-free portal where you can upload their threat letter and your responsible disclosure letter, and get some kind of legal order blessing your work that you can throw back at them. Who's going to check it to make sure that "your responsible disclosure letter" actually is a responsible disclosure letter and not just nonsense?
  - jasonjayr 2y ago
    The firm funded by fines for making unfounded threats with scary lawyer letters.
pixl97 2y ago
You may not get the feds to prosecute the case, but it's very possible for the feds to investigate you with varying levels of fervor. If you're a well lawyered security researcher this is probably fine. If you're some IT related person that does something else as your primary job this may or may not be fine if the FBI shows up and starts asking lots of questions about all kinds of things.
- EvanAnderson 2y ago
  > If you're some IT related person that does something else as your primary job this may or may not be fine if the FBI shows up and starts asking lots of questions about all kinds of things. This is exactly what I tell my coworkers who are getting into security. Keep your mouth shut about anything you find unless you have a reporting channel that leads to a "well lawyered" security company. I've found vulnerabilities that I would have loved to disclose, but being a lowly IT generalist, I'm not going to stick my neck out. I can't imagine my employer would like the press. I use one-off email addresses at my personal domain and historically warned companies that I was seeing spam to one-off addresses as possible indications of a data breach. By and large I was ignored, but occasionally I received a word of thanks. Even more occasionally I received notes of thanks that, in fact, I had uncovered a data breach. Once, however, I received a nasty response insinuating that I'd breached their systems. The person I contacted didn't, apparently, understand what I was saying. They were confused that their company name was to the left of the "@" in my email address. That was enough for me. I decided I was done reporting those events. Too much risk.
  - slantedview 2y ago
    > I was seeing spam to one-off addresses as possible indications of a data breach For the uninformed, how does spam to an address on your domain indicate a breach of someone else's system?
    - EvanAnderson 2y ago
      I sign-up for a service using "123abc-theirdomain.com@mydomain.com" as the email address. Messages to that address come to my "Inbox". I don't use the address for anything else. I never send a message with that address. Years pass. I start receiving email solicitations for erectile dysfunction remedies and, oddly, woodworking plans (what is it with the spam for shed plans?) to that address. Either my address was sold or a data breach occurred. (It could have been my own data breached, but it seems unlikely, if that did happen, that the result would be me receiving spam only to that one specific address.)
toss1 2y ago
Yup. I submit that this sort of threat poisons the well and makes security worse for everyone, including those making the threat (but it's a bit of a commons problem because the worsening security is industry-wide, but for the threat-maker it seems to improve their situation). If I am a person interested in how these systems work, and maybe making some money off my work in the area, this sort of threat, both its severity (potentially years of costly litigation and or/jail) and how frequently it happens (seems we read of such incidents many times per year, which is only the tip of the iceberg) would make someone seriously question the straight white-hat path. Why not find the exploits and sell them on the dark web? One might even justify it with "they wouldn't listen anyway and it's their fault for releasing a system with such stupid vulns." and/or "they'll fix it only when they see real-world consequences and if they don't it doesn't matter". One's moral compass need not be very compromised to lean on such excuses. There REALLY needs to be a Safe Harbor law with basic requirements that the work is documented, first revealed to the company security dept (perhaps citing the Safe Harbor law?), no action taken by the researcher to allow it to be disclosed or released publicly for 90 days, and perhaps a few other reasonable safeguards. and how often it happens

upwardbound 2y ago

We do have that now, as of 2022! The new Justice Department policy now instructs prosecutors not to prosecute security researchers who acted in good faith for the public benefit and who avoided any harm to individuals or the public. https://www.justice.gov/opa/pr/department-justice-announces-new-policy-charging-cases-under-computer-fraud-and-abuse-act https://www.justice.gov/opa/pr/department-justice-announces-...

qingcharles 2y ago
That checks off federal cases, but there are still options for a corporation under what are normally much stricter state laws in the USA. For instance, in Illinois you can get up to 5 years in prison for violating the ToS of a web site.
- TheCleric 2y ago
  As well I think that would still leave you exposed for a civil suit, which even if you win, can be financially devastating. What would be needed is an anti-SLAPP type legislation at the state and federal level to mitigate it.
bagels 2y ago
Policy can change, retrospectively even
- DJBunnies 2y ago
  Yeah it was a kaizen ticket the group filed after the last sprint.