Slashdot Mirror
Chilling Effect of the Wassenaar Arrangement On Exploit Research
Bismillah writes: Security researchers are confused as to how the export control and licensing controls covering exploits affect their work. The upcoming Wassenaar restrictions were expected to discourage publication of such research, and now it's already started to happen. Grant Wilcox, writing his dissertation for the University of Northumbria at Newcastle, was forced to take a better-safe-than-sorry approach when it came time to release the vulnerabilities he found in Microsoft's EMET 5.1. "No legal consultation on the matter took place, but Wilcox noted that exploit vendors such as Vupen had started to restrict sales of their products and services because of new export control and licensing provisions under the Wassenaar Arrangement. ... Wilcox investigated the export control regulations but was unable to clarify whether it applied to his academic work. The university did not take part. He said the provisions defining which type of exploits and software are and aren't controlled were written in ambiguous language and appeared to contradict each other."
These were, in all likelihood, written by industry and handed to government to implement.
Which means they've been carefully crafted to mean whatever is most advantageous to corporate interests and interpreted however they need it to be interpreted.
These are noting more than gag laws, designed to block and intimidate people.
You're not supposed to be able to know when they apply.
Lost at C:>. Found at C.
It now becomes 100% legal to report any exploit to them an any time. Once an exploit has been submitted, they independently confirm it works and report the exploit to the appropriate author. They also give the author a deadline to fix, based on severity of the exploit - somewhere between one week and one year.
After that one deadline is up the Council itself will publish the exploit giving the original submitter full credit.
Anyone that has successfully submits an exploit gets official 'submitter' rights, granting them the right to vote on who replacements for the Academics. Anyone that has an exploit on their code submitted becomes an official 'victim' rights, granting them the right to vote on replacements for the Business council members. President continues to appoint the government chair.
excitingthingstodo.blogspot.com
There's a mechanism in US law to deal with this kind of thing. It's called a "declaratory judgment," where a plaintiff who has reason to be afraid that the law will be enforced to land him in prison or bankruptcy sues for a judgment that either the law doesn't forbid his (in this case) publication of his research or that the Constitution forbids a law that would. Yeah, such suits ain't cheap. Fortunately there are several nonprofits that exist to fight exactly that kind of battle.
Lacking <sarcasm> tags,
Have gnu, will travel.
When will we start electing politicians that actually know about IT security? Or about IT? Or, if nothing else, about anything?
no, I don't have a sig