10 ms·

Google, the Wassenaar arrangement, and vulnerability research

137 points by _jomo 11y ago

tankenmate 11y ago
The UK and Australia have already implemented part or all of these agreements. Does Google already hold licenses in these jurisdictions? If we report a security bug to a Googler in these (or other similarly restricted jurisdictions) will they be able to share security bug details with their overseas Googler colleagues?
- gpvos 11y ago
  If I understand correctly, the UK and Australian implementations are much narrower, and much less problematic than the proposed US implementation. So presumably licenses will not be necessary in those other countries.
raythrop 11y ago
> Global companies should be able to share information globally. If we have information about intrusion software, we should be able to share that with our engineers, no matter where they physically sit. This statement goes through just as well when applied to missiles, nuclear engineering knowledge, bio-weapons knowledge, etc. Governments have decided that they wish to use commercial entities as a proxy method for protecting the status quo. If Google wish to challenge that policy then, well, OK. But there is no reasonable argument for making a special exception for "cyber security" over other forms of security-related engineering.
- airza 11y ago
  The key difference between those technologies and this is that industrial production hardware (centrifuges or specialized biological equipment, etc) are needed in addition to specialized knowledge of the topic at hand. These additional requirements make export controls a lot more enforceable, and why you can, say, send regulators to the site of a nuclear engineering facility and get a reasonable answer about if they have sent nuclear materials to another country. With infosec this would be basically impossible, since the specialized knowledge and the equipment are both non-physical and intimately entwined.
  - oracuk 11y ago
    This is not a practical distinction with regard to the legislation. A word document describing the specification for an export controlled technology is as prohibited from export as the implementation. Having the word document on a laptop you take to another country is as much a breach of the law as shipping a centrifuge.
- pjc50 11y ago
  No, exploits have the unique property that the "attack" and "defence" information are mirror images of one another. Also, deployment of nuclear and bio weapons against civilians is against international law, whereas western governments seem to have chosen to deploy offensive hacking themselves rather than attempt to get it banned internationally.
- tripzilch 11y ago
  Well, if people all over the world were under a constant daily threat getting seriously ill from bio-weapons used by criminals and governments world wide (even against their own people), as is the current global situation in software security, then yes, I would very much make that same statement. I would even argue that, especially in the case of bio-weapons, it would be a moral imperative to spread knowledge that could cure people. Remember that (going back to the cybersecurity analogy) the criminals already have the weapons, as well as the knowledge and capability to develop completely novel weapons from scratch (they might even be better at it than the US). For missiles the argument doesn't really hold, because knowledge of how to detect and protect oneself from missile attacks neither requires, nor strictly includes knowledge of how to actually build and use said missile. So the two big reasonable arguments are: - cyber attacks are already widespread, including global criminal organisations targeting civilians - both cyber offence and cyber defence enabled by the same knowledge of cyber security
mmaunder 11y ago
A couple of items I'd like to add: (I'm Founder/CEO of a busy infosec biz) While infosec is currently a smaller sector in startups than say social, casual gaming, apps, etc, it's growing furiously and Wassenaar and individual country regs will be top-of-mind for much of the YC community in the years to follow because many of you will be in this space. I'd like to emphasize one of Google's points: "Global companies should be able to share information globally." With existing laws we are already running into limits on where we can hire and what our own internal staff can send us. So it really is critical for any small or large global org that internal comms are not squashed by this. BIS's comment period ends today, so if you want to take action, now is the time. As in, before COB today. One last thing: The Hacking Team compromise and stolen data (including the zero-days they were hoarding) couldn't come at a worse time. It is fuel for the argument that zero-days, vulnerabilities, vectors etc should be tightly regulated and it's really thrown some weight behind the argument to close borders (WRT info exchange) rather than open them. So your help is really needed on this if you think you should be able to have open conversations about technical infosec issues with your colleagues in other countries. ~mark
- Zigurd 11y ago
  Hacking Team was in the business of selling zero-days to government for the purpose of enabling surveillance. That's what people find objectionable. It's the difference between culturing a microbe to make a vaccine or make a bioweapon. The latter should get your ass droned.
  - deciplex 11y ago
    > It's the difference between culturing a microbe to make a vaccine or make a bioweapon. The latter should get your ass droned. As a last resort. Ideally, it would get your ass arrested, your lab destroyed, and a speedy trial.
    - ommunist 11y ago
      Welcome to the real world, Neo. If you dig deeper, you will probably find shady Bahamas funds backing companies like that, and one may get an enlightenment, that government of one unspecified country feeds the company in question with zero-days to make a careful provocation to become able to receive public mandate on building tighter regulations for some future markets. Uhh...
4d004anonymous 11y ago
I have quite an interest in this area too. Here are a few things that may help: 1) Commercial Penetration Testing Software is already controlled. Here's a self-post to reddit on how these controls work and apply today: https://www.reddit.com/r/netsec/comments/36obxt/what_i_know_about_us_export_controls_and_hacking/ https://www.reddit.com/r/netsec/comments/36obxt/what_i_know_... If you choose to comment; it's helpful to understand the current law and how it works. This way it's easier to know what to ask for. 2) If you use software that may be controlled (for example: pen testing software); this issue affects you. Here are a few suggestions of things you could put in your comment: https://www.reddit.com/r/netsec/comments/3dusae/the_public_comments_on_the_proposed_wassenaar/ct9rjqu https://www.reddit.com/r/netsec/comments/3dusae/the_public_c... 3) As of last night, there were 101 public comments posted. Most were far below the quality you would hope for a good discussion on HN, let alone a note to a policy maker to request a change. If you have an interest in this area and have something constructive to suggest--the public comment process is your opportunity to do it. http://www.regulations.gov/#!docketBrowser;rpp=25;so=DESC;sb=postedDate;po=0;dct=PS;D=BIS-2015-0011 http://www.regulations.gov/#!docketBrowser;rpp=25;so=DESC;sb...
coldcode 11y ago
Are these governments completely insane? Not allowing security research or even reporting bugs without getting a license is the stupidest thing I've heard in my lifetime. The internet cannot be regulated in this fashion without destroying it completely. The world is not a collection of islands we are all in this together and letting any government stand in the way of safety and security is insane.
- Zigurd 11y ago
  On top of all that it seems very likely that such licenses will be used to excuse what should be crimes against humanity, in the form of creating exploits and related software to enable hunting down dissidents.
- caf 11y ago
  I don't believe this was intentional. Wassenaar is an arms control agreement - the intention was probably to regulate the sales of weaponised exploits, not basic research. It's an overreach.
  - benmmurphy 11y ago
    A lot of research will be very close to weaponised. Just browse googles bug tracker and you will find PoCs for a lot of their vulnerabilities.
MichaelGG 11y ago
>You should never need a license when you report a bug to get it fixed That hampers people that wish to publicly disclose or sell vulnerability information. This is massively biased in favour of software companies (to some extent, like Google). You should never need a license to disclose vulnerability information, full stop. >Global companies should be able to share information globally Why should this be limited to the employees of a company?
- comex 11y ago
  Public disclosure apparently won't require a license anyway: > Third, export controls do not apply to any technology or software that is "published" or otherwise made publicly available. http://bis.doc.gov/index.php/policy-guidance/faqs#subcat200 http://bis.doc.gov/index.php/policy-guidance/faqs#subcat200 (The FAQ also states that information about vulnerabilities, as opposed to how to exploit them, would not be controlled, but I believe Google if they say the legalese is insufficient to establish this.) I agree that defining boundaries rigidly in terms of companies would be limiting in today's world and especially in infosec. In general, though, I personally really despise the practice of selling vulnerabilities for the purpose of enabling people to attack others with them - which in practice means selling them to anyone but the vendor, or intermediary organizations like ZDI. True, there are so many ways for this to go wrong... but I cannot join with some of the infosec people who blast any regulations on the industry as inherently harmful, infringements of freedom of speech, useless against the real bad guys, etc. Even as I hesitate to even think in terms of things like 'increased threats' or 'acceptable infringement', or oppose 'absolutist thinking', considering how harmful such ideology has been in other, quite different but analogous realms (surveillance, airport security), and while I have little faith in the ability of a government so hyped up about "cyber" threats to avoid serious blunders, I simply cannot bring myself to find the current almost total lack of regulation in infosec, which you hint at in saying a license should never be required to share information, acceptable.
  - AnthonyMouse 11y ago
    There is a very simple reason why "regulation" in this space will never do anything useful. The cost of entry is very low (an individual can find vulnerabilities without any specialized infrastructure or organizational backing), and the value of vulnerabilities is high. It's basically the war on drugs if drugs could be transferred over the internet. Worse, the majority of the offenders are not in your jurisdiction to begin with, and they never have been or will be. It doesn't matter what law you pass, you will not stop this from happening. But just because passing laws can't do any good doesn't mean it can't do any bad. Bad laws can still do plenty of harm to the good guys. The best thing the government could do in this context is to be the highest bidder and then immediately disclose the vulnerabilities to the vendors.
thephyber 11y ago
Wired had a "call to arms" a few days ago over this comment period: http://www.wired.com/2015/07/moussouris-wassenaar-open-comment-period/ http://www.wired.com/2015/07/moussouris-wassenaar-open-comme...
Natsu 11y ago
The problem I have with this sort of arrangement is that the more rules they put in place on lawful disclosure, the more they hamper the good guys who follow the laws and the more of a comparative advantage that gives to the bad guys who can simply ignore the laws. We really don't want to hand the bad guys any more advantages than they already have, no matter how good our intentions are.
themeekforgotpw 11y ago
Aren't cyberarms arms? Isn't the right to bear arms an 'inalienable right'? I don't get it. And I don't get why this is a 'privacy' or 'free speech' issue or why corporations, as Google argues, should be exceptions to the law.
- tptacek 11y ago
  You should read the whole story before commenting; this is about foreign trade in exploits.
  - themeekforgotpw 11y ago
    Inalienable rights. Not civil rights. Inalienable rights are human rights - which extend (at least in theory) to foreigners. I read the story. But anyway if the Supreme Court ruling holds from Zimmerman it would apply equally well to everything in the article. Of course the Zimmerman case was about foreign exports as well. Try to be charitable.
    - themeekforgotpw 11y ago
      If the downvoter needs help understanding the historical analogy that makes this above comment make sense: https://en.wikipedia.org/wiki/Pretty_Good_Privacy#Criminal_investigation https://en.wikipedia.org/wiki/Pretty_Good_Privacy#Criminal_i...
- SamReidHughes 11y ago
  > Isn't the right to bear arms an 'inalienable right'? Not in any American sense of the term. The "unalienable" rights were to life, liberty, and the pursuit of happiness as outlined in the Declaration of Independence. Selling guns to redcoats isn't on that list.
- hga 11y ago
  For better or worse, right now the right to bear arms only holds in your house, outside of the 7th Circuit (Illinois, Indiana and Wisconsin), with litigation in the 9th Circuit (the west, specifically California and Hawaii) and D.C. Circuit in progress, and if there are adverse results in those Circuits we're almost positive the Supremes will continue to deny cert. We in the US pro-gun camp consider self-defense to be an unalienable right (see e.g. the U.K. for a notorious counterexample), but how that applies to exploits is not to my eye simple.
fancrazen 11y ago
Isn't the right to bear arms an 'inalienable right'?
ufydtdtdtfu 11y ago
The solution is to ignore the law. Governments have no moral legitimacy and therefore no legal legitimacy.
- JoshTriplett 11y ago
  They tend to react poorly to being ignored, though. And as a rule, they're not the ones that fare badly in such a conflict.
tdullien 11y ago
Hey there, if anyone wants some more background on all the negative side-effects of the current regulation, I wrote a lengthy blog post on the problems with the current phrasing of the Wassenaar amendments here: http://addxorrol.blogspot.ch/2015/05/why-changes-to-wassenaar-make.html http://addxorrol.blogspot.ch/2015/05/why-changes-to-wassenaa... (Background: I am a security researcher who designed industry-standard patch analysis algorithms / software, built algorithms & a startup for malware reverse engineering that was acquired by Google, pioneered several exploitation techniques, and worked heavily on the recent Rowhammer vulnerability)
richardw 11y ago
Previous export restrictions on crypto and certificates gave non-US participants (Mark Shuttleworth) the opportunity to take up the slack and build a business where there were no such restrictions. He simply had to fulfill the demand that existed outside of the US in large part due to export restrictions. The Wassenaar Arrangement is likely to result in similar unintended effects combined with a similar lack of intended effects.
oracuk 11y ago
It's probably worth remembering that there is an open source exemption. If a piece of 'intrusion software' has been published the export controls no longer apply. Publish your exploits to github before you send them overseas or travel to the conference to announce them.
gioele 11y ago
I find the "Summary of international crypto controls" at http://www.cryptolaw.org/cls-sum.htm http://www.cryptolaw.org/cls-sum.htm very informative. It shows that the _export_ controls have been in places for years and that is something that should worry us.
keso_77 11y ago
Global companies can go screw themselves, Google in particular. "People should be able to share information globally." is the motto everyone including global companies should rally behind. The crypto export ban is an apt analogy and it did hinder American companies and benefited everyone else. A good thing too when the NSA started monkeying around with crypto primitives and national security letters. Anything that slows down american tech behemoths and gives room for other european alternatives is a good thing.

137 points by _jomo 11y ago

The UK and Australia have already implemented part or all of these agreements. Does Google already hold licenses in these jurisdictions? If we report a security bug to a Googler in these (or other similarly restricted jurisdictions) will they be able to share security bug details with their overseas Googler colleagues?

gpvos 11y ago
If I understand correctly, the UK and Australian implementations are much narrower, and much less problematic than the proposed US implementation. So presumably licenses will not be necessary in those other countries.

raythrop 11y ago

> Global companies should be able to share information globally. If we have information about intrusion software, we should be able to share that with our engineers, no matter where they physically sit. This statement goes through just as well when applied to missiles, nuclear engineering knowledge, bio-weapons knowledge, etc. Governments have decided that they wish to use commercial entities as a proxy method for protecting the status quo. If Google wish to challenge that policy then, well, OK. But there is no reasonable argument for making a special exception for "cyber security" over other forms of security-related engineering.

airza 11y ago
The key difference between those technologies and this is that industrial production hardware (centrifuges or specialized biological equipment, etc) are needed in addition to specialized knowledge of the topic at hand. These additional requirements make export controls a lot more enforceable, and why you can, say, send regulators to the site of a nuclear engineering facility and get a reasonable answer about if they have sent nuclear materials to another country. With infosec this would be basically impossible, since the specialized knowledge and the equipment are both non-physical and intimately entwined.
- oracuk 11y ago
  This is not a practical distinction with regard to the legislation. A word document describing the specification for an export controlled technology is as prohibited from export as the implementation. Having the word document on a laptop you take to another country is as much a breach of the law as shipping a centrifuge.
pjc50 11y ago
No, exploits have the unique property that the "attack" and "defence" information are mirror images of one another. Also, deployment of nuclear and bio weapons against civilians is against international law, whereas western governments seem to have chosen to deploy offensive hacking themselves rather than attempt to get it banned internationally.
tripzilch 11y ago
Well, if people all over the world were under a constant daily threat getting seriously ill from bio-weapons used by criminals and governments world wide (even against their own people), as is the current global situation in software security, then yes, I would very much make that same statement. I would even argue that, especially in the case of bio-weapons, it would be a moral imperative to spread knowledge that could cure people. Remember that (going back to the cybersecurity analogy) the criminals already have the weapons, as well as the knowledge and capability to develop completely novel weapons from scratch (they might even be better at it than the US). For missiles the argument doesn't really hold, because knowledge of how to detect and protect oneself from missile attacks neither requires, nor strictly includes knowledge of how to actually build and use said missile. So the two big reasonable arguments are: - cyber attacks are already widespread, including global criminal organisations targeting civilians - both cyber offence and cyber defence enabled by the same knowledge of cyber security

mmaunder 11y ago

A couple of items I'd like to add: (I'm Founder/CEO of a busy infosec biz) While infosec is currently a smaller sector in startups than say social, casual gaming, apps, etc, it's growing furiously and Wassenaar and individual country regs will be top-of-mind for much of the YC community in the years to follow because many of you will be in this space. I'd like to emphasize one of Google's points: "Global companies should be able to share information globally." With existing laws we are already running into limits on where we can hire and what our own internal staff can send us. So it really is critical for any small or large global org that internal comms are not squashed by this. BIS's comment period ends today, so if you want to take action, now is the time. As in, before COB today. One last thing: The Hacking Team compromise and stolen data (including the zero-days they were hoarding) couldn't come at a worse time. It is fuel for the argument that zero-days, vulnerabilities, vectors etc should be tightly regulated and it's really thrown some weight behind the argument to close borders (WRT info exchange) rather than open them. So your help is really needed on this if you think you should be able to have open conversations about technical infosec issues with your colleagues in other countries. ~mark

Zigurd 11y ago
Hacking Team was in the business of selling zero-days to government for the purpose of enabling surveillance. That's what people find objectionable. It's the difference between culturing a microbe to make a vaccine or make a bioweapon. The latter should get your ass droned.
- deciplex 11y ago
  > It's the difference between culturing a microbe to make a vaccine or make a bioweapon. The latter should get your ass droned. As a last resort. Ideally, it would get your ass arrested, your lab destroyed, and a speedy trial.
  - ommunist 11y ago
    Welcome to the real world, Neo. If you dig deeper, you will probably find shady Bahamas funds backing companies like that, and one may get an enlightenment, that government of one unspecified country feeds the company in question with zero-days to make a careful provocation to become able to receive public mandate on building tighter regulations for some future markets. Uhh...

4d004anonymous 11y ago

I have quite an interest in this area too. Here are a few things that may help: 1) Commercial Penetration Testing Software is already controlled. Here's a self-post to reddit on how these controls work and apply today: https://www.reddit.com/r/netsec/comments/36obxt/what_i_know_about_us_export_controls_and_hacking/ https://www.reddit.com/r/netsec/comments/36obxt/what_i_know_... If you choose to comment; it's helpful to understand the current law and how it works. This way it's easier to know what to ask for. 2) If you use software that may be controlled (for example: pen testing software); this issue affects you. Here are a few suggestions of things you could put in your comment: https://www.reddit.com/r/netsec/comments/3dusae/the_public_comments_on_the_proposed_wassenaar/ct9rjqu https://www.reddit.com/r/netsec/comments/3dusae/the_public_c... 3) As of last night, there were 101 public comments posted. Most were far below the quality you would hope for a good discussion on HN, let alone a note to a policy maker to request a change. If you have an interest in this area and have something constructive to suggest--the public comment process is your opportunity to do it. http://www.regulations.gov/#!docketBrowser;rpp=25;so=DESC;sb=postedDate;po=0;dct=PS;D=BIS-2015-0011 http://www.regulations.gov/#!docketBrowser;rpp=25;so=DESC;sb...

coldcode 11y ago

Are these governments completely insane? Not allowing security research or even reporting bugs without getting a license is the stupidest thing I've heard in my lifetime. The internet cannot be regulated in this fashion without destroying it completely. The world is not a collection of islands we are all in this together and letting any government stand in the way of safety and security is insane.

Zigurd 11y ago
On top of all that it seems very likely that such licenses will be used to excuse what should be crimes against humanity, in the form of creating exploits and related software to enable hunting down dissidents.
caf 11y ago
I don't believe this was intentional. Wassenaar is an arms control agreement - the intention was probably to regulate the sales of weaponised exploits, not basic research. It's an overreach.
- benmmurphy 11y ago
  A lot of research will be very close to weaponised. Just browse googles bug tracker and you will find PoCs for a lot of their vulnerabilities.

MichaelGG 11y ago

>You should never need a license when you report a bug to get it fixed That hampers people that wish to publicly disclose or sell vulnerability information. This is massively biased in favour of software companies (to some extent, like Google). You should never need a license to disclose vulnerability information, full stop. >Global companies should be able to share information globally Why should this be limited to the employees of a company?

comex 11y ago
Public disclosure apparently won't require a license anyway: > Third, export controls do not apply to any technology or software that is "published" or otherwise made publicly available. http://bis.doc.gov/index.php/policy-guidance/faqs#subcat200 http://bis.doc.gov/index.php/policy-guidance/faqs#subcat200 (The FAQ also states that information about vulnerabilities, as opposed to how to exploit them, would not be controlled, but I believe Google if they say the legalese is insufficient to establish this.) I agree that defining boundaries rigidly in terms of companies would be limiting in today's world and especially in infosec. In general, though, I personally really despise the practice of selling vulnerabilities for the purpose of enabling people to attack others with them - which in practice means selling them to anyone but the vendor, or intermediary organizations like ZDI. True, there are so many ways for this to go wrong... but I cannot join with some of the infosec people who blast any regulations on the industry as inherently harmful, infringements of freedom of speech, useless against the real bad guys, etc. Even as I hesitate to even think in terms of things like 'increased threats' or 'acceptable infringement', or oppose 'absolutist thinking', considering how harmful such ideology has been in other, quite different but analogous realms (surveillance, airport security), and while I have little faith in the ability of a government so hyped up about "cyber" threats to avoid serious blunders, I simply cannot bring myself to find the current almost total lack of regulation in infosec, which you hint at in saying a license should never be required to share information, acceptable.
- AnthonyMouse 11y ago
  There is a very simple reason why "regulation" in this space will never do anything useful. The cost of entry is very low (an individual can find vulnerabilities without any specialized infrastructure or organizational backing), and the value of vulnerabilities is high. It's basically the war on drugs if drugs could be transferred over the internet. Worse, the majority of the offenders are not in your jurisdiction to begin with, and they never have been or will be. It doesn't matter what law you pass, you will not stop this from happening. But just because passing laws can't do any good doesn't mean it can't do any bad. Bad laws can still do plenty of harm to the good guys. The best thing the government could do in this context is to be the highest bidder and then immediately disclose the vulnerabilities to the vendors.

thephyber 11y ago

Wired had a "call to arms" a few days ago over this comment period: http://www.wired.com/2015/07/moussouris-wassenaar-open-comment-period/ http://www.wired.com/2015/07/moussouris-wassenaar-open-comme...

Natsu 11y ago

The problem I have with this sort of arrangement is that the more rules they put in place on lawful disclosure, the more they hamper the good guys who follow the laws and the more of a comparative advantage that gives to the bad guys who can simply ignore the laws. We really don't want to hand the bad guys any more advantages than they already have, no matter how good our intentions are.

themeekforgotpw 11y ago

Aren't cyberarms arms? Isn't the right to bear arms an 'inalienable right'? I don't get it. And I don't get why this is a 'privacy' or 'free speech' issue or why corporations, as Google argues, should be exceptions to the law.

tptacek 11y ago
You should read the whole story before commenting; this is about foreign trade in exploits.
- themeekforgotpw 11y ago
  Inalienable rights. Not civil rights. Inalienable rights are human rights - which extend (at least in theory) to foreigners. I read the story. But anyway if the Supreme Court ruling holds from Zimmerman it would apply equally well to everything in the article. Of course the Zimmerman case was about foreign exports as well. Try to be charitable.
  - themeekforgotpw 11y ago
    If the downvoter needs help understanding the historical analogy that makes this above comment make sense: https://en.wikipedia.org/wiki/Pretty_Good_Privacy#Criminal_investigation https://en.wikipedia.org/wiki/Pretty_Good_Privacy#Criminal_i...
SamReidHughes 11y ago
> Isn't the right to bear arms an 'inalienable right'? Not in any American sense of the term. The "unalienable" rights were to life, liberty, and the pursuit of happiness as outlined in the Declaration of Independence. Selling guns to redcoats isn't on that list.
hga 11y ago
For better or worse, right now the right to bear arms only holds in your house, outside of the 7th Circuit (Illinois, Indiana and Wisconsin), with litigation in the 9th Circuit (the west, specifically California and Hawaii) and D.C. Circuit in progress, and if there are adverse results in those Circuits we're almost positive the Supremes will continue to deny cert. We in the US pro-gun camp consider self-defense to be an unalienable right (see e.g. the U.K. for a notorious counterexample), but how that applies to exploits is not to my eye simple.

fancrazen 11y ago

Isn't the right to bear arms an 'inalienable right'?

ufydtdtdtfu 11y ago

The solution is to ignore the law. Governments have no moral legitimacy and therefore no legal legitimacy.

JoshTriplett 11y ago
They tend to react poorly to being ignored, though. And as a rule, they're not the ones that fare badly in such a conflict.

tdullien 11y ago

Hey there, if anyone wants some more background on all the negative side-effects of the current regulation, I wrote a lengthy blog post on the problems with the current phrasing of the Wassenaar amendments here: http://addxorrol.blogspot.ch/2015/05/why-changes-to-wassenaar-make.html http://addxorrol.blogspot.ch/2015/05/why-changes-to-wassenaa... (Background: I am a security researcher who designed industry-standard patch analysis algorithms / software, built algorithms & a startup for malware reverse engineering that was acquired by Google, pioneered several exploitation techniques, and worked heavily on the recent Rowhammer vulnerability)

richardw 11y ago

Previous export restrictions on crypto and certificates gave non-US participants (Mark Shuttleworth) the opportunity to take up the slack and build a business where there were no such restrictions. He simply had to fulfill the demand that existed outside of the US in large part due to export restrictions. The Wassenaar Arrangement is likely to result in similar unintended effects combined with a similar lack of intended effects.

oracuk 11y ago

It's probably worth remembering that there is an open source exemption. If a piece of 'intrusion software' has been published the export controls no longer apply. Publish your exploits to github before you send them overseas or travel to the conference to announce them.

gioele 11y ago

I find the "Summary of international crypto controls" at http://www.cryptolaw.org/cls-sum.htm http://www.cryptolaw.org/cls-sum.htm very informative. It shows that the _export_ controls have been in places for years and that is something that should worry us.

keso_77 11y ago

Global companies can go screw themselves, Google in particular. "People should be able to share information globally." is the motto everyone including global companies should rally behind. The crypto export ban is an apt analogy and it did hinder American companies and benefited everyone else. A good thing too when the NSA started monkeying around with crypto primitives and national security letters. Anything that slows down american tech behemoths and gives room for other european alternatives is a good thing.