Slashdot Mirror
Lawsuits Threaten Infosec Research -- Just When We Need it Most (zdnet.com)
This year, two security reporters and one researcher will fight for their professional lives in court. Steve Ragan, senior staff writer at tech news site CSO, and Dan Goodin, security editor at Ars Technica, were last year named defendants in two separate lawsuits. The cases are different, but they have a common theme: they are being sued by the companies covered in articles they wrote. From a report: Although lawsuits targeting reporters, particularly on the security beat, are rare, legal threats are an occupational hazard that reporters are all too aware of -- from companies threatening to call an editor to demand a correction -- or else -- to a full-blown lawsuit. But the inevitable aftermath is a "chilling effect." White-hat hackers and security researchers hesitate to report vulnerabilities and weaknesses to technology firms for fear of facing legal retribution. With nation state attackers targeting elections and critical national security infrastructure on a near-daily basis, security research is needed more than ever.
IANAL, but i would seem some of the threats border on using threats of a lawsuit to silence critics. Unfortunately, it takes money to defend yourself so it may be less painful simply to shut up.
I wonder if the threat of discovery and fighting to keep it public would stop some lawsuits as it would force companies to reveal potentially damaging information. You want to sue? I'll prove what I said is materially correct by demanding your code, internal memos, etc. related to bugs. I guess we'd need a high powered lawyer who is interested in security to decide to do one pro-bono.
The other option is to anonymously release bug data as soon as they are discovered to screw over companies that threaten lawsuits. If they don't want to play nice it's time to stand up to them in other ways.
I'm a consultant - I convert gibberish into cash-flow.
Although some CEOs believe any PR is good PR, this will not end well for them. The screwed up. The problem was reported. It was fixed. That was reported. But they go for the throat of the reporter anyway.
It's pretty ugly karma.
---- Teach Peace. It's Cheaper Than War.
How about wiki-sec? Anon white-hat dumping ground.
Regarding "If they can make up and fabricate events and have a jury believe them -- well that's going to have a far greater effect than chilling researchers and data breach reporting," I wonder if a blockchain might be useful to allow multiple people including journalistic outfits in different countries to confirm the facts at identifiable points in time. This might weaken the ability of rich, illegal operations to attempt to sue lone security researchers.
Security Stat Leaks - secsleaks.org should be the name.
don't most legal jurisdictions have a defence of truthfulness in defamation cases?
Civil cases are notoriously easy to win.
Not that I'm defending him, but a perfect example is O.J. Simpson. He was found not guilty of doing the crime, yet still had to pay tons of money in civil suits. Our legal system in the us is a real shitshow.
Yes, and a fat SLAPP counter-suit against Keeper Security and the other companies involved should go a long way towards stopping their bullshit.
BTW, Keeper Security's webpage isn't even properly secure and vulnerable to the most basic input fuzzing attacks.
Pa-fucking-thetic.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
Any company that sues researchers in this way should be assumed to be relinquishing any claim to responsible disclosure in the future.
This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
Don't they know that the best security is security through obscurity?
That if the bad guyz don't know about the h@x0rz that they can't hax teh big ironz n cloudz? /reallyBadSnarkOrSomething
Check your premises.
How bad of a failure was that, really?
He committed the murder. Then the government blew its credibility and trustworthiness by letting a racist cop try to frame an already-guilty guy, thereby undermining the credibility of all criminal prosecutions, everywhere. So OJ gets off on the criminal charge (i.e. We The People found that punishing the government is more important (much more important) to us than punishing any one particular criminal) but stills ends up being somewhat held accountable for the murder (by having to pay lots of money). It's not an ideal situation, but having racist cops isn't an ideal situation either, and you can't blame our legal system for racist cops, can you?
He didn't lose the civil case because civil cases are too easy to litigate; he lost because it got reasonably proven that he committed the murder. Not proven well enough that we should imprison him, but well enough that we knew for sure that he definitely committed the murder and we could justifiably take some kind of action against him. Nice middle-ground, considering the fuckups by the police. I'd call that a graceful performance degradation.
If Keeper wins this, they'll win because of misstatements/overstatements in Goodin's initial article that he significantly walked back multiple times, as laid out in Keeper's complaint. The research prompting Goodin's and other similar articles was not the issue.
Adjacent /. story