State Department Backs Off Criminalizing Security Research Tools
from the now,-if-it-can-just-get-40-countries-to-agree-with-it... dept
Some good news for security researchers: the US government’s adoption of the Wassenaar Arrangement will no longer treat the tools of security research like crates of machine guns. While exploits and penetration tools can be used by bad people for bad things, they’re also invaluable to security researchers who use these to make the computing world a safer place.
Vague wording in the US government’s proposed adoption of the 2013 version of the Wassenaar Arrangement threatened to criminalize the development of security research tools and make any researcher traveling out of the country with a laptop full of exploits an exporter of forbidden weapons.
To its credit, the State Department welcomed comments on its proposal. Even better, it seems to have listened.
It appears that the State Department has heard these concerns loud and clear. Not only has all talk of finalizing the proposed rule as drafted come to halt, but State has put “removal of the technology control” on the agenda for the December 2016 meeting at Wassenaar.
But, as the EFF’s Nate Cardozo and Eva Galperin note, the battle isn’t over yet. The State Department still has to pitch its amended adoption to the other parties involved in the Wassenaar Arrangement.
Of course, this isn’t the end of the road. There is no guarantee that the 40 other nations who participate in the Wassenaar Arrangement will agree, but for now, we are enjoying this important victory.
Stripping out the criminalizing of security research is a welcome step forward. In a country where researchers are routinely subjected to legal threats and law enforcement scrutiny for reporting security holes and the government always too willing to abuse the broadly-worded CFAA to punish “hackers,” the addition of export controls on research tools would only have made the problem worse. And it would have done next to nothing to make general computing/internet usage any safer.
As was noted here last September, updates to the Wassenaar Arrangement were already having a chilling effect. HP pulled its support from Pwn2Own’s hacking competition in Japan, citing the “legal uncertainty” surrounding the country’s version of the agreement. Had the US government forged ahead with the wording unchanged, this country would have been the next to see major sponsors pull support from security research conferences or other hacking-related events.
For now, US security researchers are as “safe” as they’ve ever been — which isn’t really all that safe. But the situation could be far worse. The future is now partially in the hands of 40 other countries that may not be as receptive to the State Department’s arguments as the agency was to the comments of those its proposal would affect.
Filed Under: research, security research, state department, wassenaar agreement
Comments on “State Department Backs Off Criminalizing Security Research Tools”
What I've learned about being a security researcher
Under no circumstances should I even attempt to quietly report an operational problem to a corporation, university, or government agency. A much safer course of action is to publish it anonymously, forgoing the credit in favor of a modicum of personal safety.
Congratulations, everyone, you’ve taught me to avoid — at all costs — doing you a favor.
Re: What I've learned about being a security researcher
There’s been way too many favors going around. It’s about time all this altruistic nonsense stopped. Have you all forgotten your predatory instinct?!? It’s your nature! Long in tooth and claw!
Oh, and ignorance is bliss.
aND
you may wonder why I use a Russian AV tool.
YES, a few have been incarcerated, JUST for notifing the companies that there was a HOLE in the protection..
EVEN our gov. has fired many, responsible for the internet, BECAUSE what they wanted. was UPDATES, changes, MORE SECURITY..
Re: aND
No, I’d wonder why you used any AV tool. Are you using MS Windows? Try Tails Linux.
As they say...
When security research tools are outlawed, only outlaws will have security research tools.