Slashdot Mirror
Feds Expand Security Researchers' Ability To Hack Without Going To Jail (vice.com)
An anonymous reader quotes a report from Motherboard: Friday, the Librarian of Congress and U.S. Copyright Office renewed several key exemptions (and added a few new ones) to the Digital Millennium Copyright Act. This go round, they've extended some essential exemptions ensuring that computer security researchers won't be treated like nefarious criminals for their contributions to society. As part of an effort to keep the DMCA timely, Congress included a so-called "safety valve" dubbed the Section 1201 triennial review process that, every three years, mandates that activists and concerned citizens beg the Copyright Office and the Librarian of Congress to craft explicit exemptions from the law to ensure routine behavior won't be criminalized.
The exemptions still have some caveats. Specifically, the Copyright Office ruling only applies to "use exemptions," not "tools exemptions" -- meaning security researchers still can't release things like pen-testing tools that bypass DRM, or even publish technical papers exploring how to bypass bootloaders or other Trusted Platform Modules to test the security of the systems behind them. But other modest changes to the rules were incredibly helpful, notes Blake Reid, Associate Clinical Professor at Colorado Law. Specifically, the new exemption removes a "device limitation" from previous exemptions that potentially limited researchers to investigating software only on "consumer" devices; hindering their ability to investigate security vulnerabilities in things like the cryptographic hardware used in banking applications, networking equipment, and industrial control systems. The new exemption also modified the "controlled environment limitation" from the previous exemption, which was often read to imply that researchers had to conduct their work in a formal laboratory, potentially hindering research into things like integrated building systems like internet-connected HVAC systems.
The exemptions still have some caveats. Specifically, the Copyright Office ruling only applies to "use exemptions," not "tools exemptions" -- meaning security researchers still can't release things like pen-testing tools that bypass DRM, or even publish technical papers exploring how to bypass bootloaders or other Trusted Platform Modules to test the security of the systems behind them. But other modest changes to the rules were incredibly helpful, notes Blake Reid, Associate Clinical Professor at Colorado Law. Specifically, the new exemption removes a "device limitation" from previous exemptions that potentially limited researchers to investigating software only on "consumer" devices; hindering their ability to investigate security vulnerabilities in things like the cryptographic hardware used in banking applications, networking equipment, and industrial control systems. The new exemption also modified the "controlled environment limitation" from the previous exemption, which was often read to imply that researchers had to conduct their work in a formal laboratory, potentially hindering research into things like integrated building systems like internet-connected HVAC systems.
Jesus Fucking Christ! Is the 1st Amendment that toothless now?
We'll do the research for you. We might even sell you the results, provided your industry lets you have them. If not, well, it was nice to know you. Just don't expect us to come over to the US anymore for any security conferences, now that it's becoming more and more like trying to have a porn conference in Saudi Arabia.
signed, the rest of the world
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
this is "hacking"? what the fuck?
Free Software world hero Linus Torvalds was forced to resign from the Linux kernel project by blackmail. He fell for a honeytrap and was threatened with a #MeToo purge if he didn't resign. It's a corporate power grab, using "Social Just-Us" as a tool.
"Friday, the Librarian of Congress and U.S. Copyright Office"
I've protested every story about an action of any executive agency being referred to as the actions of the Trump administration as if Donald Trump personally makes every call so why is this one "Feds?"
For money, by money, always the money....
Oh and fuck blacks, mexicans, trannies, anyone who is not a Christian...Sieg Heil.
I swear to God, if we get 4 more years of the racist, money pope Clown in Chief, I am either going to move out of the country, or blow my fucking brains out.
I get on other countries because of some of the most bullshit, nanny state policies imaginable they implemented, but then I come across an article like this, and get reminded of just how fucked up,
micromanaged, and just down right dictatorial my own country is becoming.
I wonder which western country will 'win' this hellish, no fun race to the bottom, and become the first true 1984 society Orwell was warning about and then some.
God the way this summary is written is disgusting. I bet the researchers should be happy that the powers-to-be allow them to use the potty.
I'm very sure these researchers are now RESEARCHING which country they can move their operations to, so they can do their work without the corporate lackeys in government molesting them.
It's a fine, fine line between pleasure and pain, and, are you feelin' lucky, punk? That's why you do it using a sudo-name, like, oh, DJTrumpinmouthdisease. If you're in it for glory, you are in the wrong thing.
They can't move their research overseas if the bulk of the money they need is from the government, if they rely on a clearance in the U.S., or if they need access to GFE.
(The Feds are opposed to foreigners having secrets that were public knowledge after the next Defcon anyway.)
It's also seriously disruptive to families, and few countries want to be seen to be offering space to political refugees from America after the extraordinary rendition in Italy and the U.S. threatening to shoot down the Bolivian president as he flew over Europe. Tends to chill the atmosphere.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
I am a security professional with computer society professional membership that includes both professional and ethical obligations. I cannot do my job professionally with one hand tied and one eye poked out. I wonder where the discoverer of Spectre and Meltdown flaws, and buffer overruns in ME stand - despite their excellent contribution to society. Thankfully places like Norway do not place blinkers on academic freedom. There is no infringement on the device you own - end of story. Copyright means you can read the stuff, disassemble and trace - and if you find a bug, you ethically disclose it, and the other party ethically closes it within 30 days. Embarrassment is not a reason to gag the truth. USA will turn into a laughing stock., especially as the police purchase said hacking tools.
Law enforcement of tricky computer matters is best left to computer professionals - defined as anyone who can use or write the tools. Locked down hardware has made things tough for professionals. So said, do not stand in the way of progress.
Clickbait headline is clickbait. BeauHD still not k-rad.
It's about time that the US Feds, whoever they may be, permit security researchers to expose weaknesses in American cyber security without being penalized. In fact they should be rewarded. This is long overdue.
None of this has anything to with Trump, clown. It's the tyrannical left, screaming Russia and running around banning everything.
Latest victim: gab.com
Just die, clowns. You are a joke at this point. Please go to Venezuela, stay TFO of Brazil.
To hell with this! Rule that fans of MMORPG abandonware like City of Heroes can fire up private servers, including for-pay ones.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.