4 ms·

What was surprising to me was that they didn't immediately do pre-dawn raids on the pentesters' homes and hold them without a lawyer under some provision of an

What was surprising to me was that they didn't immediately do pre-dawn raids on the pentesters' homes and hold them without a lawyer under some provision of an anti-terror law.

deleted 2y ago
[deleted]
garyfirestorm 2y ago
that is apparently not a popular move anymore since people keep logs and have credentials, strong social media presence and readily available cloud enabled cameras. one email to any news org and whoever authorizes the raid will probably face some music. but knowing TSA, we can expect this any minute now...
- tracker1 2y ago
  They just add you to a secret watch list to annoy you when you travel when you're critical of them... or the current administration, so it would seem.
- smsm42 2y ago
  Why bother if they could just put everyone involved on the "dangerous terrorist" list which has zero controls and zero accountability because "national security"? That's what happened to Tulsi Gabbard: https://www.racket.news/p/the-worm-turns-house-senate-investigate https://www.racket.news/p/the-worm-turns-house-senate-invest...
woodruffw 2y ago
That's not really how this works. TSA is maliciously incompetent, but there is a reporting pipeline and procedure for these things that's formalized and designed to protect exactly this kind of good-faith reporting[1]. (It's very easy to believe the worst possible thing about every corner of our government, since every corner of our government has something bad about it. But it's a fundamental error to think that every bad thing is always present in every interaction.) [1]: https://www.cisa.gov/report https://www.cisa.gov/report
- macNchz 2y ago
  Is there any sort of assurance that this wouldn't turn into a prosecution, though? It's not obvious to me on that site. Perhaps the CISA doesn't want to deter researchers, but do they get to make the final call? The DoJ announced in 2022 that they would not prosecute "good faith" security researchers, but it's not binding, just internal policy: https://www.scmagazine.com/analysis/doj-wont-prosecute-good-faith-security-researchers https://www.scmagazine.com/analysis/doj-wont-prosecute-good-... The policy (https://www.justice.gov/jm/jm-9-48000-computer-fraud https://www.justice.gov/jm/jm-9-48000-computer-fraud) explicitly states at the end that it's for guidance only / does not establish rights, and it includes a provision for additional consultation on cases involving terrorism or national security–terms which have both been overloaded by the government to justify overreach in the past. Personally, given the history of the CFAA, I wouldn't want to be in a position to test out this relaxed guidance on prosecuting good-faith researchers, but perhaps I'm unnecessarily averse to the idea of federal prison.
  - woodruffw 2y ago
    > Is there any sort of assurance that this wouldn't turn into a prosecution, though? It's not obvious to me on that site. Perhaps the CISA doesn't want to deter researchers, but do they get to make the final call? I don't think any sort of absolute assurance is possible, and if it was given I wouldn't trust it to be permanently binding :-) This is my intuition from having interacted with CISA, and my impression from talking to policy people: it's not 1993 (or even 2013) anymore, and there's a much better basal understanding of security researchers vs. someone trying to secure a "get out of jail free" card for doing something they shouldn't have. That doesn't mean the government can't mess up here, but I can't remember a prominent example of them throwing the book at a good faith report like this in the past decade. (Swartz is who I think of as an example of an extreme miscarriage of justice under an overly broad interpretation of the CFAA. And, of course, there could be facts in this situation that I'm not aware of that would motivate a criminal or civil CFAA investigation here. But "pre-dawn raids" aren't really it in situations like this one.)
    - Breza 2y ago
noinsight 2y ago
Yeah, I don't know if I would go testing such systems and then reporting the results under my own name (presumably)... I didn't see any comment about them being contracted to do this at least.
sixothree 2y ago
There's still _plenty_ of time for that to happen. I wouldn't want to be this person right now. I like my dog alive.
- extraduder_ire 2y ago
  I was thinking. They seem much more likely to react that way to public disclosure, and losing face as a result than from a professional looking private disclosure that they (either the org, or someone further up the org chart) can pretend never happened.
deleted 2y ago
[deleted]

What was surprising to me was that they didn't immediately do pre-dawn raids on the pentesters' homes and hold them without a lawyer under some provision of an anti-terror law.

deleted 2y ago

[deleted]

garyfirestorm 2y ago

that is apparently not a popular move anymore since people keep logs and have credentials, strong social media presence and readily available cloud enabled cameras. one email to any news org and whoever authorizes the raid will probably face some music. but knowing TSA, we can expect this any minute now...

tracker1 2y ago
They just add you to a secret watch list to annoy you when you travel when you're critical of them... or the current administration, so it would seem.
smsm42 2y ago
Why bother if they could just put everyone involved on the "dangerous terrorist" list which has zero controls and zero accountability because "national security"? That's what happened to Tulsi Gabbard: https://www.racket.news/p/the-worm-turns-house-senate-investigate https://www.racket.news/p/the-worm-turns-house-senate-invest...

woodruffw 2y ago

That's not really how this works. TSA is maliciously incompetent, but there is a reporting pipeline and procedure for these things that's formalized and designed to protect exactly this kind of good-faith reporting[1]. (It's very easy to believe the worst possible thing about every corner of our government, since every corner of our government has something bad about it. But it's a fundamental error to think that every bad thing is always present in every interaction.) [1]: https://www.cisa.gov/report https://www.cisa.gov/report

macNchz 2y ago
Is there any sort of assurance that this wouldn't turn into a prosecution, though? It's not obvious to me on that site. Perhaps the CISA doesn't want to deter researchers, but do they get to make the final call? The DoJ announced in 2022 that they would not prosecute "good faith" security researchers, but it's not binding, just internal policy: https://www.scmagazine.com/analysis/doj-wont-prosecute-good-faith-security-researchers https://www.scmagazine.com/analysis/doj-wont-prosecute-good-... The policy (https://www.justice.gov/jm/jm-9-48000-computer-fraud https://www.justice.gov/jm/jm-9-48000-computer-fraud) explicitly states at the end that it's for guidance only / does not establish rights, and it includes a provision for additional consultation on cases involving terrorism or national security–terms which have both been overloaded by the government to justify overreach in the past. Personally, given the history of the CFAA, I wouldn't want to be in a position to test out this relaxed guidance on prosecuting good-faith researchers, but perhaps I'm unnecessarily averse to the idea of federal prison.
- woodruffw 2y ago
  > Is there any sort of assurance that this wouldn't turn into a prosecution, though? It's not obvious to me on that site. Perhaps the CISA doesn't want to deter researchers, but do they get to make the final call? I don't think any sort of absolute assurance is possible, and if it was given I wouldn't trust it to be permanently binding :-) This is my intuition from having interacted with CISA, and my impression from talking to policy people: it's not 1993 (or even 2013) anymore, and there's a much better basal understanding of security researchers vs. someone trying to secure a "get out of jail free" card for doing something they shouldn't have. That doesn't mean the government can't mess up here, but I can't remember a prominent example of them throwing the book at a good faith report like this in the past decade. (Swartz is who I think of as an example of an extreme miscarriage of justice under an overly broad interpretation of the CFAA. And, of course, there could be facts in this situation that I'm not aware of that would motivate a criminal or civil CFAA investigation here. But "pre-dawn raids" aren't really it in situations like this one.)
  - Breza 2y ago

noinsight 2y ago

Yeah, I don't know if I would go testing such systems and then reporting the results under my own name (presumably)... I didn't see any comment about them being contracted to do this at least.

sixothree 2y ago

There's still _plenty_ of time for that to happen. I wouldn't want to be this person right now. I like my dog alive.

extraduder_ire 2y ago
I was thinking. They seem much more likely to react that way to public disclosure, and losing face as a result than from a professional looking private disclosure that they (either the org, or someone further up the org chart) can pretend never happened.

deleted 2y ago

[deleted]