5 ms·
Finfisher Spyware Let Bahrain Government Hack Political Activist
- secfirstmd 12y agoOne day, these people will be held accountable for what they sell. "We didn't know what they would so with it" is not good enough.
- tptacek 12y agoWorthwhile exercise: write a model statute that would stop the practice, then work through it's implications. (Not for nothing, but the sentiment you're expressing here is how I got my start in security; I continue to agree wholeheartedly with it).
- dmix 12y agoRemote exploitation of computers by law enforcement is not even very well defined in law or policy yet. Even in Western countries. What type of statute do you mean? Guidelines for legal warrant based surveillance or something to counter foreign authoritarian countries from using them? Export controls on exploits/intrusion software will not effectively stop that IMO - but this is the approach Europe is taking at the moment.
- tptacek 12y agoIf your response is "it's probably not possible to derive a workable statute", that is in itself an interesting result.
- dmix 12y agoThe only practical response I can think of is increasing the bar for it to be effective. For ex: investing in hardening, detection, and attribution. And in the near term it doesn't seem governments are well incentivized to help in this area.
- secfirstmd 12y agoInteresting point but I'm sure if I had a smarter legal brain it isn't impossible. Though enforcement of current export controls would be a good start...
- tptacek 12y agoNot to be snarky but I thought we all hated export controls here --- going back to Crypto Wars 1.
- secfirstmd 12y agoIn general I completely agree...but I don't have a problem with monitoring software (as opposed to open source crypto) like Finfisher being blocked from sale to repressive regimes.
- tedunangst 12y agoImplication: a16z won't be able to fight fire with fire.