Slashdot Mirror
Feds Expand Security Researchers' Ability To Hack Without Going To Jail (vice.com)
An anonymous reader quotes a report from Motherboard: Friday, the Librarian of Congress and U.S. Copyright Office renewed several key exemptions (and added a few new ones) to the Digital Millennium Copyright Act. This go round, they've extended some essential exemptions ensuring that computer security researchers won't be treated like nefarious criminals for their contributions to society. As part of an effort to keep the DMCA timely, Congress included a so-called "safety valve" dubbed the Section 1201 triennial review process that, every three years, mandates that activists and concerned citizens beg the Copyright Office and the Librarian of Congress to craft explicit exemptions from the law to ensure routine behavior won't be criminalized.
The exemptions still have some caveats. Specifically, the Copyright Office ruling only applies to "use exemptions," not "tools exemptions" -- meaning security researchers still can't release things like pen-testing tools that bypass DRM, or even publish technical papers exploring how to bypass bootloaders or other Trusted Platform Modules to test the security of the systems behind them. But other modest changes to the rules were incredibly helpful, notes Blake Reid, Associate Clinical Professor at Colorado Law. Specifically, the new exemption removes a "device limitation" from previous exemptions that potentially limited researchers to investigating software only on "consumer" devices; hindering their ability to investigate security vulnerabilities in things like the cryptographic hardware used in banking applications, networking equipment, and industrial control systems. The new exemption also modified the "controlled environment limitation" from the previous exemption, which was often read to imply that researchers had to conduct their work in a formal laboratory, potentially hindering research into things like integrated building systems like internet-connected HVAC systems.
The exemptions still have some caveats. Specifically, the Copyright Office ruling only applies to "use exemptions," not "tools exemptions" -- meaning security researchers still can't release things like pen-testing tools that bypass DRM, or even publish technical papers exploring how to bypass bootloaders or other Trusted Platform Modules to test the security of the systems behind them. But other modest changes to the rules were incredibly helpful, notes Blake Reid, Associate Clinical Professor at Colorado Law. Specifically, the new exemption removes a "device limitation" from previous exemptions that potentially limited researchers to investigating software only on "consumer" devices; hindering their ability to investigate security vulnerabilities in things like the cryptographic hardware used in banking applications, networking equipment, and industrial control systems. The new exemption also modified the "controlled environment limitation" from the previous exemption, which was often read to imply that researchers had to conduct their work in a formal laboratory, potentially hindering research into things like integrated building systems like internet-connected HVAC systems.
We'll do the research for you. We might even sell you the results, provided your industry lets you have them. If not, well, it was nice to know you. Just don't expect us to come over to the US anymore for any security conferences, now that it's becoming more and more like trying to have a porn conference in Saudi Arabia.
signed, the rest of the world
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
It's so terrible that Trump's administration is censoring the research that Obama's administration flat out criminalized.
"Friday, the Librarian of Congress and U.S. Copyright Office"
I've protested every story about an action of any executive agency being referred to as the actions of the Trump administration as if Donald Trump personally makes every call so why is this one "Feds?"
They can't move their research overseas if the bulk of the money they need is from the government, if they rely on a clearance in the U.S., or if they need access to GFE.
(The Feds are opposed to foreigners having secrets that were public knowledge after the next Defcon anyway.)
It's also seriously disruptive to families, and few countries want to be seen to be offering space to political refugees from America after the extraordinary rendition in Italy and the U.S. threatening to shoot down the Bolivian president as he flew over Europe. Tends to chill the atmosphere.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
To hell with this! Rule that fans of MMORPG abandonware like City of Heroes can fire up private servers, including for-pay ones.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
Wait, what? When did that happen?
To quote Chief Justice Marshall from Foster v. Neilson in 1829: “In the United States, a different principle is established. Our constitution declares a treaty to be the law of the land. It is, consequently, to be regarded in courts of justice as equivalent to an act of the legislature, whenever it operates of itself, without the aid of any legislative provision. But when the terms of the stipulation import a contract—when either of the parties engages to perform a particular act, the treaty addresses itself to the political, not the judicial department; and the legislature must execute the contract, before it can become a rule for the court.”
If a treaty is "equivalent to an act of the legislature" (or even requires legislature to execute!), and acts of legislature are subject to the Constitution, how can a treaty supersede the Constitution? I would be curious if you have more modern case law which overturns this (I know the Court evolved a lot during the first 50 years or so).
"Nothing shocks me. I'm a scientist." -Indiana Jones