3 ms·
All cyber security companies should be considered state actors. Even if they currently aren't it's too easy for a state to coopt them. If you build an antiviru
by wongarsu 2y ago
All cyber security companies should be considered state actors. Even if they currently aren't it's too easy for a state to coopt them.
If you build an antivirus software today, and tomorrow you get a secret court order to ignore certain malware for "national security" what are you going to do? What if it's a request to include a small binary payload in return for a lucrative government contract, with implied threats of what happens if you leak the request? You can decide not to do it and just shut down, but then the only ones left on the market are the ones that complied.
If you do cyber security for more than just compliance, evaluating the software providers against your threat model was always an important step. Whether that means avoiding American, Chinese or Russian software. In the threat model of a Western government agency, Russian software should have have been off limits since the 50s (even if Kaspersky tries to tell you they are not Russian at all).
That still doesn't mean their work is any less interesting or praiseworthy. Just like how you know NASA landed on the moon because Roscomos didn't dispute it, Kaspersky can do work and offer perspectives that might be more difficult for similarly sized western cyber security companies.
- yaomtc 2y agoI'd heard of gag orders, but I hadn't heard of secret court orders like that. I searched and found this: https://www.aclu.org/news/national-security/secret-court-opinion-reveals-mystery-tech-firm https://www.aclu.org/news/national-security/secret-court-opi... Do you know of other examples?
- flakeoil 2y agoMaybe don't put too much into the word "court order", but instead interpret it as an order from the government to force the company to use the tool for the governments/country's benefit. One could also assume that the owners and/or management of the company are in the same boat as the government/country so they do not mind using the tool for the country's benefit when needed.
- shakna 2y agoAustralia's Assistance and Access Orders (TAN, TCN, etc.) [0] basically allow the government to order mandatory backdoors into various software. They do have some oversight, but it isn't significant. They can order any employee, not just the company. The wording is also... Squirelly. You can't introduce a weakness, but the definition of weakness excludes the entire concept of backdoors. However, Technical Capability Notices can be ordered where: > reasonable, proportionate, practicable and technically feasible The employee/company can push back and argue one of those isn't met, but ultimately it is the office of the Governor General that decides. So far, it has basically only be used against journalists [1], as far as we know, which is nice and horrific. [0] https://www.homeaffairs.gov.au/about-us/our-portfolios/national-security/lawful-access-telecommunications/assistance-and-access-overview https://www.homeaffairs.gov.au/about-us/our-portfolios/natio... [1] https://www.abc.net.au/news/2019-07-15/abc-raids-australian-federal-police-press-freedom/11309810 https://www.abc.net.au/news/2019-07-15/abc-raids-australian-...
- jonathanstrange 2y agoThat's why I choose my anitivirus software based on the jurisdiction, not on technical comparisons.