1
00:00:00,330 --> 00:00:02,700
- We have an hour and 35 minutes.

2
00:00:02,700 --> 00:00:03,990
We're not gonna talk all that time.

3
00:00:03,990 --> 00:00:05,640
This is gonna be a round table discussion.

4
00:00:05,640 --> 00:00:08,280
So, we are going to
open it up to the group

5
00:00:08,280 --> 00:00:09,360
after a presentation

6
00:00:09,360 --> 00:00:11,160
where we kind of go
through some of the basics.

7
00:00:11,160 --> 00:00:11,993
I'm sorry.

8
00:00:11,993 --> 00:00:13,770
Yeah, Nadik, (chuckles)

9
00:00:13,770 --> 00:00:15,660
your head is giving a shadow.

10
00:00:15,660 --> 00:00:16,837
Sorry about that.

11
00:00:16,837 --> 00:00:19,110
I'm sorry also, that we are
not able to dim the lights

12
00:00:19,110 --> 00:00:21,303
just for this individual room.

13
00:00:21,303 --> 00:00:23,815
But we're gonna make it work.

14
00:00:23,815 --> 00:00:27,240
So, this is hacker law for hackers.

15
00:00:27,240 --> 00:00:28,230
I wanted to let you all know

16
00:00:28,230 --> 00:00:30,300
this is an on the record room.

17
00:00:30,300 --> 00:00:32,220
So, there's Chatham House
Rules in the other room.

18
00:00:32,220 --> 00:00:35,207
This one is on the record
and being streamed,

19
00:00:35,207 --> 00:00:37,530
just so, you all know,

20
00:00:37,530 --> 00:00:39,810
leave now if that's a problem, please.

21
00:00:39,810 --> 00:00:42,150
And let's do it.

22
00:00:42,150 --> 00:00:43,770
So, like the description says,

23
00:00:43,770 --> 00:00:46,590
we're going to go over some
of the changes to hacking law

24
00:00:46,590 --> 00:00:48,360
that have occurred particularly

25
00:00:48,360 --> 00:00:52,080
in the past year or so, 2021 to 2022.

26
00:00:52,080 --> 00:00:54,960
And look at some of the
areas that are rife now

27
00:00:54,960 --> 00:00:58,530
for community advocacy
in changing hacking law

28
00:00:58,530 --> 00:00:59,850
to help hackers.

29
00:00:59,850 --> 00:01:01,230
So, I'm Harley Geiger,

30
00:01:01,230 --> 00:01:04,920
and I am senior director
for public policy at Rapid7.

31
00:01:04,920 --> 00:01:06,480
I'm an attorney, and I've been working

32
00:01:06,480 --> 00:01:09,840
in cybersecurity and technology
policy for many years.

33
00:01:09,840 --> 00:01:12,960
And we are really blessed
to have this man right here

34
00:01:12,960 --> 00:01:15,660
from the Department of
Justice co-presenting.

35
00:01:15,660 --> 00:01:16,890
- Yeah, I'm, Leonard Bailey.

36
00:01:16,890 --> 00:01:19,298
I'm serving as Harley's wingman today.

37
00:01:19,298 --> 00:01:21,870
I am from the computer crime

38
00:01:21,870 --> 00:01:22,980
in intellectual property section

39
00:01:22,980 --> 00:01:24,914
in the criminal division of
the US Department of Justice.

40
00:01:24,914 --> 00:01:27,360
I am a Special Counsel
for National Security

41
00:01:27,360 --> 00:01:29,346
and head of our cybersecurity unit.

42
00:01:29,346 --> 00:01:31,110
- Doesn't that sound very impressive?

43
00:01:31,110 --> 00:01:31,943
It is.

44
00:01:31,943 --> 00:01:33,329
- In fact, my mom is very proud of it.

45
00:01:33,329 --> 00:01:35,063
- It is in fact very, very impressive.

46
00:01:37,500 --> 00:01:40,620
So, believe it or not,
there are no speakers.

47
00:01:40,620 --> 00:01:42,330
- So, these, the microphones,

48
00:01:42,330 --> 00:01:44,010
are actually just for streaming.

49
00:01:44,010 --> 00:01:46,680
So, when we open up to the group,

50
00:01:46,680 --> 00:01:48,030
we're gonna have to
pass around these mics,

51
00:01:48,030 --> 00:01:49,860
but there is no amplification.

52
00:01:49,860 --> 00:01:51,060
Are you having,

53
00:01:51,060 --> 00:01:52,620
can you raise your hand if
you're having trouble hearing me?

54
00:01:52,620 --> 00:01:53,762
- [Leonard] So, we need to be louder?

55
00:01:53,762 --> 00:01:54,595
Okay, got it.

56
00:01:54,595 --> 00:01:55,590
- [Harley] Yeah, okay, really sorry.

57
00:01:55,590 --> 00:01:57,340
I thought I was already projecting.

58
00:01:58,530 --> 00:02:01,517
Feel free to crowd in a little
bit closer, if that helps.

59
00:02:01,517 --> 00:02:03,513
I know the acoustics are not super.

60
00:02:05,040 --> 00:02:08,553
All right, first, this
is not legal advice.

61
00:02:09,540 --> 00:02:11,310
It's very important that
we get that out of the way.

62
00:02:11,310 --> 00:02:13,320
I really don't want anybody watching this

63
00:02:13,320 --> 00:02:16,050
to go and do a research project

64
00:02:16,050 --> 00:02:18,660
and think that this covers
all the nuances in the law.

65
00:02:18,660 --> 00:02:20,550
The law is just riddled

66
00:02:20,550 --> 00:02:22,740
with little exceptions
and important things.

67
00:02:22,740 --> 00:02:24,240
We're not gonna be able
to cover all of that

68
00:02:24,240 --> 00:02:25,170
in this presentation.

69
00:02:25,170 --> 00:02:27,060
So, if you have questions,

70
00:02:27,060 --> 00:02:29,220
particularly about a
specific research project,

71
00:02:29,220 --> 00:02:31,170
if you're worried about legal risks,

72
00:02:31,170 --> 00:02:33,330
then you should talk to a lawyer.

73
00:02:33,330 --> 00:02:34,500
Just not these lawyers.

74
00:02:34,500 --> 00:02:36,573
Do not rely on this presentation.

75
00:02:37,963 --> 00:02:40,920
Okay, So, let's start from the beginning.

76
00:02:40,920 --> 00:02:42,750
Why do we care about hackers?

77
00:02:42,750 --> 00:02:46,043
Why do we care about the
way that hackers are treat-

78
00:03:15,240 --> 00:03:16,073
A lot in our lives.

79
00:03:16,073 --> 00:03:16,950
We need the talent.

80
00:03:16,950 --> 00:03:18,900
We need the insight from people like you.

81
00:03:18,900 --> 00:03:21,270
It's not gonna be a
small cadre of experts.

82
00:03:21,270 --> 00:03:23,130
It's gonna be the community.

83
00:03:23,130 --> 00:03:24,780
- And from the company's perspective,

84
00:03:24,780 --> 00:03:26,910
it's exactly the same thing.

85
00:03:26,910 --> 00:03:28,726
We know this is a complicated problem.

86
00:03:28,726 --> 00:03:30,330
We're not gonna solve it ourself.

87
00:03:30,330 --> 00:03:32,640
And there are people in this
community who have skills

88
00:03:32,640 --> 00:03:34,440
that we simply need.

89
00:03:34,440 --> 00:03:38,100
So, from the government
perspective, that's why.

90
00:03:38,100 --> 00:03:42,073
- AKA, the government also,
wants to hire you. (laughs)

91
00:03:42,960 --> 00:03:47,960
So, federal law has evolved
in favor of hackers.

92
00:03:48,292 --> 00:03:50,370
I think that's a little bit provocative.

93
00:03:50,370 --> 00:03:51,297
I think that for a long time,

94
00:03:51,297 --> 00:03:54,360
the security community had this impression

95
00:03:54,360 --> 00:03:56,340
that federal law was stacked against them.

96
00:03:56,340 --> 00:03:58,620
And that, you know, you'll
be nailed to the wall

97
00:03:58,620 --> 00:04:00,360
if you violate terms of service,

98
00:04:00,360 --> 00:04:01,710
just, you know, you'll
be nailed to the wall

99
00:04:01,710 --> 00:04:05,160
if you are doing IoT research
in your own basements,

100
00:04:05,160 --> 00:04:06,734
under a 40 watt bulb.

101
00:04:06,734 --> 00:04:10,530
And I think that it's time to
challenge that perspective.

102
00:04:10,530 --> 00:04:12,000
And I think that one of the reasons

103
00:04:12,000 --> 00:04:12,873
why we should challenge it

104
00:04:12,873 --> 00:04:14,790
have been the changes that have occurred

105
00:04:14,790 --> 00:04:16,200
just in the past year.

106
00:04:16,200 --> 00:04:19,200
So, 2021 and 2022 had a lot of changes

107
00:04:19,200 --> 00:04:21,330
and they were almost always,
at least in the United States,

108
00:04:21,330 --> 00:04:22,590
at least at the federal level,

109
00:04:22,590 --> 00:04:26,250
sort of universally in favor
of the hacking community.

110
00:04:26,250 --> 00:04:27,083
Are the acoustics better?

111
00:04:27,083 --> 00:04:28,410
Am I projecting enough now?

112
00:04:29,280 --> 00:04:30,113
Sort of?

113
00:04:31,530 --> 00:04:33,730
Doing the best I can
without yelling, sorry.

114
00:04:34,920 --> 00:04:37,710
We're gonna cover the
Computer Fraud and Abuse Act.

115
00:04:37,710 --> 00:04:39,450
The Digital Millennium Copyright Acts.

116
00:04:39,450 --> 00:04:41,490
These are the sort of
two traditional medium

117
00:04:41,490 --> 00:04:42,720
of the security community.

118
00:04:42,720 --> 00:04:44,520
We're also, gonna talk a bit of about it,

119
00:04:44,520 --> 00:04:45,870
the international perspective.

120
00:04:45,870 --> 00:04:49,200
So, China's Coordinated
Vulnerability Disclosure Law,

121
00:04:49,200 --> 00:04:52,440
and then some about
the states, state laws.

122
00:04:52,440 --> 00:04:53,273
And then, like I said,

123
00:04:53,273 --> 00:04:56,790
we are gonna open it up
to hear your perspective.

124
00:04:56,790 --> 00:04:58,200
I think we have a lot of talents

125
00:04:58,200 --> 00:05:00,120
and experience in this room.

126
00:05:00,120 --> 00:05:01,800
So, it's gonna get interactive.

127
00:05:01,800 --> 00:05:02,787
We're definitely not gonna talk

128
00:05:02,787 --> 00:05:04,923
for the entire hour and a half.

129
00:05:06,690 --> 00:05:09,330
So, first up, the Computer
Fraud and Abuse Act.

130
00:05:09,330 --> 00:05:10,563
So, the CFAA.

131
00:05:11,640 --> 00:05:15,420
This is maybe the most feared
law and sort of the Pantheon

132
00:05:15,420 --> 00:05:17,430
for the security research community.

133
00:05:17,430 --> 00:05:19,680
And we're gonna talk, start basics.

134
00:05:19,680 --> 00:05:22,020
We're gonna talk about,
you know, what it does.

135
00:05:22,020 --> 00:05:25,757
And it has a long list of restrictions.

136
00:05:25,757 --> 00:05:28,020
I categorize 'em like this.

137
00:05:28,020 --> 00:05:31,680
So, first, it's a criminal
and civil statute,

138
00:05:31,680 --> 00:05:34,470
meaning that you can be
prosecuted criminally

139
00:05:34,470 --> 00:05:38,880
by federal prosecutors, but
you can also be sued privately.

140
00:05:38,880 --> 00:05:41,370
So, you can be sued by a
company or by an individual

141
00:05:41,370 --> 00:05:44,070
if you have violated the
Computer Fraud and Abuse Act.

142
00:05:44,910 --> 00:05:47,850
Here, with the CFAA, we
are talking almost entirely

143
00:05:47,850 --> 00:05:49,770
about other people's computers.

144
00:05:49,770 --> 00:05:51,930
So, it is about whether you are authorized

145
00:05:51,930 --> 00:05:54,540
to access or use the
computer in certain ways.

146
00:05:54,540 --> 00:05:56,040
And since you're doing
it on your own computer,

147
00:05:56,040 --> 00:05:58,230
you're presumably authorizing yourself.

148
00:05:58,230 --> 00:06:00,480
Now it gets to be a CFAA issue

149
00:06:00,480 --> 00:06:02,490
if you are interacting somehow

150
00:06:02,490 --> 00:06:03,900
with somebody else's computer.

151
00:06:03,900 --> 00:06:06,060
And it's not just the
laptop that's sitting here,

152
00:06:06,060 --> 00:06:08,310
it can be things like
internet servers, you know,

153
00:06:08,310 --> 00:06:10,920
or somebody else's computer
over the internet, all right?

154
00:06:10,920 --> 00:06:14,014
Now, the CFAA restricts
among other things,

155
00:06:14,014 --> 00:06:17,610
accessing a computer without
authorization, right?

156
00:06:17,610 --> 00:06:20,512
So, if you're authorized to
touch my computer or not.

157
00:06:20,512 --> 00:06:24,030
Causing damage without authorization.

158
00:06:24,030 --> 00:06:27,900
Damage can include, for
example, service disruptions,

159
00:06:27,900 --> 00:06:31,980
DDoS, dropping malware, it
can even be altering code

160
00:06:31,980 --> 00:06:33,240
on somebody else's computer.

161
00:06:33,240 --> 00:06:35,911
That's considered damage
without authorization.

162
00:06:35,911 --> 00:06:37,740
And then intent to defraud.

163
00:06:37,740 --> 00:06:40,380
If you have intent to defraud

164
00:06:40,380 --> 00:06:43,800
and you are trafficking in
passwords or access codes,

165
00:06:43,800 --> 00:06:45,180
that's also, a CFAA violation.

166
00:06:45,180 --> 00:06:46,830
And then extortion is another one.

167
00:06:46,830 --> 00:06:49,170
So, if you are saying, I
will damage your computer,

168
00:06:49,170 --> 00:06:51,420
or I will access your computer
without authorization,

169
00:06:51,420 --> 00:06:52,800
unless you pay me cash money.

170
00:06:52,800 --> 00:06:55,113
That is a CFAA violation.

171
00:06:57,090 --> 00:06:59,190
Oh, we have a new projector.

172
00:06:59,190 --> 00:07:01,020
So, most of that stuff though

173
00:07:01,020 --> 00:07:04,440
is avoidable by good-faith
security researchers.

174
00:07:04,440 --> 00:07:07,530
If you are truly conducting,
you know, good-faith hacking,

175
00:07:07,530 --> 00:07:10,760
you are not going to be
demanding money for, you know,

176
00:07:10,760 --> 00:07:12,840
or you're gonna threaten
damage to a computer.

177
00:07:12,840 --> 00:07:15,600
You're not going around
causing DDoS attacks

178
00:07:15,600 --> 00:07:18,390
or disruptions to service.

179
00:07:18,390 --> 00:07:22,080
And so, you also, don't
have intent to defraud.

180
00:07:22,080 --> 00:07:24,543
Your intent is to patch the vulnerability,

181
00:07:24,543 --> 00:07:26,550
it's to improve security.

182
00:07:26,550 --> 00:07:29,820
But there is another
provision of the CFAA,

183
00:07:29,820 --> 00:07:32,280
and this one is arguably the most broad

184
00:07:32,280 --> 00:07:34,560
and most problematic for
the security community.

185
00:07:34,560 --> 00:07:37,290
And that is exceeds authorized access.

186
00:07:37,290 --> 00:07:39,240
That is where most of the action

187
00:07:39,240 --> 00:07:41,310
in the past year has occurred.

188
00:07:41,310 --> 00:07:43,471
Do you wanna add anything
before we launch into that?

189
00:07:43,471 --> 00:07:46,440
- [Leonard] No, I think
you hit all the buttons.

190
00:07:46,440 --> 00:07:49,860
- So, exceeding authorized access.

191
00:07:49,860 --> 00:07:54,150
What that means is you
have access to a computer,

192
00:07:54,150 --> 00:07:55,736
you're authorized to access it,

193
00:07:55,736 --> 00:07:59,310
but you may only be authorized
to use it for certain things.

194
00:07:59,310 --> 00:08:02,700
So, I'm allowed to access
this computer for work,

195
00:08:02,700 --> 00:08:05,400
but I'm not allowed to
go bug hunting on it.

196
00:08:05,400 --> 00:08:07,347
'Cause I'm not a hacker, personally.

197
00:08:07,347 --> 00:08:11,220
Or I may be able to
access a social network,

198
00:08:11,220 --> 00:08:14,190
but not use my profile
on the social network

199
00:08:14,190 --> 00:08:15,990
to go bug hunting

200
00:08:15,990 --> 00:08:19,163
or to conduct security
research from there.

201
00:08:19,163 --> 00:08:21,990
So, that would be
exceeding the authorization

202
00:08:21,990 --> 00:08:24,783
that I had been given to
access those computers.

203
00:08:26,130 --> 00:08:29,190
Now, that gave a lot
of power traditionally

204
00:08:29,190 --> 00:08:31,770
to things like terms of service

205
00:08:31,770 --> 00:08:34,590
or acceptable use policies
or employment agreements,

206
00:08:34,590 --> 00:08:36,390
because those were the documents.

207
00:08:36,390 --> 00:08:40,320
Those were the ways that
your access was defined.

208
00:08:40,320 --> 00:08:43,140
So, if you, you know, join
a social networking service,

209
00:08:43,140 --> 00:08:45,420
they will have an acceptable
use policy or terms of service

210
00:08:45,420 --> 00:08:47,922
that says, "Here are the things
you're authorized to do."

211
00:08:47,922 --> 00:08:50,730
Usually, security research
is not in that list.

212
00:08:50,730 --> 00:08:52,140
Same thing with employers,

213
00:08:52,140 --> 00:08:54,300
they do not usually
authorize their employees

214
00:08:54,300 --> 00:08:56,520
to also go bug hunting on their computers,

215
00:08:56,520 --> 00:08:59,100
unless that's what you do professionally.

216
00:08:59,100 --> 00:09:02,400
So, it gave a lot of control to that.

217
00:09:02,400 --> 00:09:05,820
So, that's some of the basics about CFAA.

218
00:09:05,820 --> 00:09:08,250
Now, what has changed recently?

219
00:09:08,250 --> 00:09:11,130
And one of the big whoppers
that has changed recently

220
00:09:11,130 --> 00:09:14,040
is Van Buren versus the United States.

221
00:09:14,040 --> 00:09:16,440
So, that is a Supreme Court case.

222
00:09:16,440 --> 00:09:18,870
It was decided in 2021,

223
00:09:18,870 --> 00:09:23,870
and that kind of declawed
exceeds authorized access.

224
00:09:23,970 --> 00:09:26,820
The facts of the case are pretty colorful.

225
00:09:26,820 --> 00:09:28,800
Van Buren was a police officer

226
00:09:28,800 --> 00:09:31,020
and Van Buren was authorized

227
00:09:31,020 --> 00:09:36,020
to access a license plate
database as part of his work.

228
00:09:36,210 --> 00:09:38,400
But Van Buren was not authorized

229
00:09:38,400 --> 00:09:40,800
to use that same license plate database

230
00:09:40,800 --> 00:09:43,440
for personal criminal purposes.

231
00:09:43,440 --> 00:09:46,304
And that is what Officer
Van Buren did, for money.

232
00:09:46,304 --> 00:09:49,650
He was brought up under charges under CFAA

233
00:09:49,650 --> 00:09:53,220
and the Supreme court in
a five to three decision.

234
00:09:53,220 --> 00:09:55,437
Was it five to three or six to three?

235
00:09:55,437 --> 00:09:57,482
- Six to three.

236
00:09:57,482 --> 00:09:58,440
- Anyway, it was not a five-four decision.

237
00:09:58,440 --> 00:10:02,670
It was a pretty clear cut

238
00:10:02,670 --> 00:10:06,630
towards finding a narrow
interpretation of CFAA.

239
00:10:06,630 --> 00:10:10,440
What they said was,
essentially, the question is not

240
00:10:10,440 --> 00:10:12,420
if you've been authorized
to use it for one purpose

241
00:10:12,420 --> 00:10:13,560
and then are using it for another,

242
00:10:13,560 --> 00:10:18,510
instead it is, are the gates
up or down, was their analogy.

243
00:10:18,510 --> 00:10:20,580
Are you authorized to access the computer

244
00:10:20,580 --> 00:10:24,450
or are you not authorized
access to use the computer?

245
00:10:24,450 --> 00:10:26,430
And so, for Van Buren, what that meant

246
00:10:26,430 --> 00:10:30,720
was since he was authorized
to use that computer for work,

247
00:10:30,720 --> 00:10:32,970
then it is not exceeding
authorized access.

248
00:10:32,970 --> 00:10:34,410
It is not by itself,

249
00:10:34,410 --> 00:10:38,133
a CFAA violation to use it
for other purposes as well.

250
00:10:39,150 --> 00:10:42,930
And, now, it may be illegal
under other statutes,

251
00:10:42,930 --> 00:10:46,050
just not under this really
broad provision of the CFAA.

252
00:10:46,050 --> 00:10:48,300
This helps not only security researchers,

253
00:10:48,300 --> 00:10:52,050
but also, a lot of ordinary
consumers who use the internet

254
00:10:52,050 --> 00:10:54,990
and should not be under threat
of a federal hacking crime,

255
00:10:54,990 --> 00:10:57,720
simply for doing things like
violating terms of service,

256
00:10:57,720 --> 00:11:00,840
lying about your age on
Facebook, for example.

257
00:11:00,840 --> 00:11:03,123
So, that was a big deal.

258
00:11:04,110 --> 00:11:05,910
It also applies in part

259
00:11:05,910 --> 00:11:08,580
to publicly-available computers, right?

260
00:11:08,580 --> 00:11:11,460
So, if a computer or an
asset is on the internet

261
00:11:11,460 --> 00:11:13,590
and it is publicly accessible,

262
00:11:13,590 --> 00:11:16,230
then you arguably have authorization

263
00:11:16,230 --> 00:11:19,200
to access that
publicly-accessible computer.

264
00:11:19,200 --> 00:11:21,480
And if you have access for it

265
00:11:21,480 --> 00:11:24,870
for one authorized
purpose, under Van Buren,

266
00:11:24,870 --> 00:11:27,120
then it is not an exceeds
authorized access crime

267
00:11:27,120 --> 00:11:28,500
any longer under the CFAA

268
00:11:28,500 --> 00:11:31,140
to also use it for another purpose.

269
00:11:31,140 --> 00:11:36,140
And that was, that theory about
publicly-available computers

270
00:11:36,210 --> 00:11:40,440
was put to the test in
another case in 2022,

271
00:11:40,440 --> 00:11:43,018
this is HiQ versus LinkedIn.

272
00:11:43,018 --> 00:11:45,606
So, HiQ versus LinkedIn.

273
00:11:45,606 --> 00:11:48,390
So, HiQ was scraping
publicly-accessible content

274
00:11:48,390 --> 00:11:49,650
from LinkedIn.

275
00:11:49,650 --> 00:11:53,040
LinkedIn went so far as to
send a cease and desist order

276
00:11:53,040 --> 00:11:56,026
to HiQ saying, "Don't do this any longer."

277
00:11:56,026 --> 00:11:58,230
And the Ninth Circuit,

278
00:11:58,230 --> 00:12:01,873
which has traditionally
looked at CFAA in narrow ways,

279
00:12:01,873 --> 00:12:06,449
said that LinkedIn could not
bring HiQ up on CFAA charges,

280
00:12:06,449 --> 00:12:08,640
or in this case it'd be a lawsuit,

281
00:12:08,640 --> 00:12:11,730
for scraping its
publicly-accessible content.

282
00:12:11,730 --> 00:12:13,620
It was publicly-accessible.

283
00:12:13,620 --> 00:12:15,746
So, it put Van Buren to
the test on this issue

284
00:12:15,746 --> 00:12:18,300
of publicly-accessible computers.

285
00:12:18,300 --> 00:12:20,070
So, I wanna give an example

286
00:12:20,070 --> 00:12:21,900
of sort of where this may hit the road

287
00:12:21,900 --> 00:12:25,050
with an actual case, actual hacking.

288
00:12:25,050 --> 00:12:26,722
Did you want to add to that?

289
00:12:26,722 --> 00:12:27,555
Did I describe them correctly?

290
00:12:27,555 --> 00:12:28,388
- You certainly did.

291
00:12:28,388 --> 00:12:30,900
I guess there are a couple
things I'd just, I'd toss out.

292
00:12:30,900 --> 00:12:33,630
Which is, one of the things
I think we've learned

293
00:12:33,630 --> 00:12:36,630
from watching courts attempt
to interpret technology

294
00:12:36,630 --> 00:12:41,630
in generally, is they're not great at it.

295
00:12:41,670 --> 00:12:45,870
And what occurs, is
something that in my office,

296
00:12:45,870 --> 00:12:47,400
we have these big discussions

297
00:12:47,400 --> 00:12:51,030
about whether something
is like in the cyber world

298
00:12:51,030 --> 00:12:52,380
is something like something else

299
00:12:52,380 --> 00:12:54,000
in the physical world, right?

300
00:12:54,000 --> 00:12:55,980
And that's what happens in these cases.

301
00:12:55,980 --> 00:12:58,608
And so, the Supreme Court,
for example, in Van Buren,

302
00:12:58,608 --> 00:13:03,600
spoke in language of
gates up or gates down.

303
00:13:03,600 --> 00:13:06,510
If the gates are down,
the restrictions apply,

304
00:13:06,510 --> 00:13:09,570
if the gates are up, there
wasn't a lack of authorization.

305
00:13:09,570 --> 00:13:13,830
Exactly what a gate is,
may not be entirely clear,

306
00:13:13,830 --> 00:13:17,553
as we say here, right now, right?

307
00:13:19,050 --> 00:13:21,750
- And there were other
parts of the opinion

308
00:13:21,750 --> 00:13:24,180
where they make it clear
that if, for example,

309
00:13:24,180 --> 00:13:27,720
there are files directories of things

310
00:13:27,720 --> 00:13:32,720
that are, quote, "off-limits"
to you, then the CFAA applies.

311
00:13:33,864 --> 00:13:36,600
But what exactly off-limits means, also,

312
00:13:36,600 --> 00:13:38,274
is something that's going

313
00:13:38,274 --> 00:13:41,490
to take some interpretive work in courts.

314
00:13:41,490 --> 00:13:44,280
And so, absolutely right,

315
00:13:44,280 --> 00:13:47,340
Harley said that this
clearly has reigned back

316
00:13:47,340 --> 00:13:49,500
the reach of the CFAA.

317
00:13:49,500 --> 00:13:51,510
There will be more work to be done though,

318
00:13:51,510 --> 00:13:53,730
to figure out exactly what it means.

319
00:13:53,730 --> 00:13:55,320
There are things it didn't address,

320
00:13:55,320 --> 00:13:58,860
or just outside the ambit of the decision.

321
00:13:58,860 --> 00:14:02,340
For example, what is accessing a computer,

322
00:14:02,340 --> 00:14:04,230
under the CFAA right?

323
00:14:04,230 --> 00:14:05,940
Which I think is an important question

324
00:14:05,940 --> 00:14:07,260
for people in this community,

325
00:14:07,260 --> 00:14:09,120
when you were interacting with a computer,

326
00:14:09,120 --> 00:14:11,100
when does that cross the
threshold of being accessed,

327
00:14:11,100 --> 00:14:12,660
it might be actual under the statute,

328
00:14:12,660 --> 00:14:14,610
this case wasn't intended to address that.

329
00:14:14,610 --> 00:14:17,700
And so, that's still out
there to be resolved.

330
00:14:17,700 --> 00:14:20,100
All that said, everything Harley covered

331
00:14:20,100 --> 00:14:21,946
was exactly spot on.

332
00:14:21,946 --> 00:14:22,779
- Okay.

333
00:14:25,110 --> 00:14:27,960
Does anybody remember what
this horrible human being did?

334
00:14:29,423 --> 00:14:30,850
Yes, go ahead.

335
00:14:30,850 --> 00:14:35,517
- [Audience Member] Yeah,
used AT&T iPads to, you know,

336
00:14:37,088 --> 00:14:40,921
get email passwords for
a lot of, like, people

337
00:14:42,518 --> 00:14:44,935
who were high-ranking people.

338
00:14:46,440 --> 00:14:47,273
- That's right.

339
00:14:47,273 --> 00:14:51,950
So, this horrible human
being did find the addresses,

340
00:14:53,070 --> 00:14:55,463
email addresses, of AT&T iPad users

341
00:14:55,463 --> 00:14:57,570
exposed on the public internet,

342
00:14:57,570 --> 00:15:00,633
and managed to scrape
a great deal of this.

343
00:15:01,729 --> 00:15:05,640
And then disclosed it to Gawker, I think,

344
00:15:05,640 --> 00:15:08,940
and was brought up on CFAA charges.

345
00:15:08,940 --> 00:15:13,110
And I raised this to,
just as an illustration,

346
00:15:13,110 --> 00:15:17,040
that this type of prosecution,
it was already difficult

347
00:15:17,040 --> 00:15:18,690
because there was a
court split at the time.

348
00:15:18,690 --> 00:15:20,760
Van Buren resolved that court split

349
00:15:20,760 --> 00:15:22,320
and this kind of prosecution

350
00:15:22,320 --> 00:15:24,420
will be a lot harder going forward.

351
00:15:24,420 --> 00:15:26,769
It was publicly-available information.

352
00:15:26,769 --> 00:15:30,090
And now there is not a court split.

353
00:15:30,090 --> 00:15:31,260
So, not to say that there

354
00:15:31,260 --> 00:15:33,420
would not be any potential liability,

355
00:15:33,420 --> 00:15:35,700
but it would be a lot harder
to bring a case like this,

356
00:15:35,700 --> 00:15:36,900
now than it was previously.

357
00:15:36,900 --> 00:15:39,180
- I just want you to say one
more thing about this case.

358
00:15:39,180 --> 00:15:40,650
I think it was US versus Spitler,

359
00:15:40,650 --> 00:15:45,000
but, so, Harley hit on this earlier.

360
00:15:45,000 --> 00:15:47,880
There was a perception
that security researchers

361
00:15:47,880 --> 00:15:51,540
were being prosecuted far and wide.

362
00:15:51,540 --> 00:15:55,200
And when we first began
engaging with this community

363
00:15:55,200 --> 00:15:57,957
in 2014 or so, we took that back,

364
00:15:57,957 --> 00:16:00,636
and we actually thought about that,

365
00:16:00,636 --> 00:16:01,469
'cause we were concerned.

366
00:16:01,469 --> 00:16:03,270
We wanted to make sure we
weren't chilling research.

367
00:16:03,270 --> 00:16:05,610
And what we found in the last decade

368
00:16:05,610 --> 00:16:09,960
was this is the only case
the federal government

369
00:16:09,960 --> 00:16:13,773
has brought against a
security researcher, okay?

370
00:16:15,155 --> 00:16:16,170
- For security research.

371
00:16:16,170 --> 00:16:17,910
- For security research.

372
00:16:17,910 --> 00:16:18,870
There may have been other cases

373
00:16:18,870 --> 00:16:20,373
brought by state authorities,

374
00:16:21,210 --> 00:16:24,960
but this is the sole
case in the last decade

375
00:16:24,960 --> 00:16:26,540
against a security researcher.

376
00:16:26,540 --> 00:16:27,900
That may surprise some of you.

377
00:16:27,900 --> 00:16:29,190
And, just so you know,

378
00:16:29,190 --> 00:16:30,930
you don't have to accept our word for it.

379
00:16:30,930 --> 00:16:33,120
The Center for Democracy and Technology

380
00:16:33,120 --> 00:16:34,247
also took a look at this,

381
00:16:34,247 --> 00:16:37,533
and in 2017 they found
the exact same thing.

382
00:16:38,940 --> 00:16:40,650
That said, and we'll
talk about this later,

383
00:16:40,650 --> 00:16:44,970
there are reasons why this
community associates the CFAA

384
00:16:44,970 --> 00:16:48,870
with, let's say, aggressive restrictions,

385
00:16:48,870 --> 00:16:50,160
And we will get to that later,

386
00:16:50,160 --> 00:16:52,350
but I'll give you, spoiler alert,

387
00:16:52,350 --> 00:16:54,900
it has to do with the civil
portion of the statute.

388
00:16:56,683 --> 00:16:59,400
- So, that is one change,

389
00:16:59,400 --> 00:17:02,643
is those series of
cases, Van Buren and HiQ.

390
00:17:03,540 --> 00:17:04,373
It's a big deal.

391
00:17:04,373 --> 00:17:05,850
It solves a split that
was in circuit courts

392
00:17:05,850 --> 00:17:07,893
for, like, at least 10 years, I think.

393
00:17:09,432 --> 00:17:14,432
Now limitations, that change does not,

394
00:17:15,180 --> 00:17:16,560
that's a different part of the statute

395
00:17:16,560 --> 00:17:18,000
than if you're causing damage

396
00:17:18,000 --> 00:17:19,890
or if you have intent to defraud, right?

397
00:17:19,890 --> 00:17:21,510
So, if you cause damage, you know,

398
00:17:21,510 --> 00:17:23,490
or if you are out there
trying to defraud people,

399
00:17:23,490 --> 00:17:26,550
that is, this change is not
actually gonna help you.

400
00:17:26,550 --> 00:17:28,530
This is about exceeding
your authorized access.

401
00:17:28,530 --> 00:17:29,820
And it's federal,

402
00:17:29,820 --> 00:17:32,970
so, it applies just to, to
the federal law, just to CFAA.

403
00:17:32,970 --> 00:17:34,020
It's different from the states.

404
00:17:34,020 --> 00:17:35,730
And we're gonna cover the states in a bit.

405
00:17:35,730 --> 00:17:37,290
Now, but it's still a big deal.

406
00:17:37,290 --> 00:17:41,640
And on top of that news, in 2022, in fact,

407
00:17:41,640 --> 00:17:44,070
in the past, what, four months or so,

408
00:17:44,070 --> 00:17:45,480
the Department of Justice

409
00:17:45,480 --> 00:17:49,890
changed its charging policy for CFAA.

410
00:17:49,890 --> 00:17:52,290
And here is a look at that.

411
00:17:52,290 --> 00:17:54,420
Don't worry about reading
through the block of text

412
00:17:54,420 --> 00:17:56,160
too carefully.

413
00:17:56,160 --> 00:17:58,413
We can parse this language
a little bit later.

414
00:17:58,413 --> 00:18:02,370
But, this is also, this is public,

415
00:18:02,370 --> 00:18:06,478
and who better to talk
about it? (chuckles)

416
00:18:06,478 --> 00:18:10,440
- So, in May of this year,
we announced this policy.

417
00:18:10,440 --> 00:18:13,800
And it's sort of, maybe the capstone

418
00:18:13,800 --> 00:18:15,390
of a number of years of work

419
00:18:15,390 --> 00:18:17,820
with folks like Harley and
others in this community,

420
00:18:17,820 --> 00:18:21,060
who in a very openhanded way,

421
00:18:21,060 --> 00:18:23,100
allowed us to kind of understand better

422
00:18:23,100 --> 00:18:25,260
how the community works

423
00:18:25,260 --> 00:18:26,670
and to get more comfortable with the idea

424
00:18:26,670 --> 00:18:30,600
that there may be some
allowances for actors

425
00:18:30,600 --> 00:18:32,870
in this community, again,

426
00:18:32,870 --> 00:18:34,920
in the interest of
improving cyber security.

427
00:18:34,920 --> 00:18:36,930
So, in May of this year,

428
00:18:36,930 --> 00:18:38,455
we announced this policy

429
00:18:38,455 --> 00:18:42,810
that essentially says that
an Assistant US Attorney,

430
00:18:42,810 --> 00:18:46,110
we have 94 districts across the country

431
00:18:46,110 --> 00:18:48,150
that have federal prosecutors in them

432
00:18:48,150 --> 00:18:50,489
who are responsible for
these types of cases.

433
00:18:50,489 --> 00:18:53,820
We are the office at Main Justice

434
00:18:53,820 --> 00:18:56,010
that oversees this statute.

435
00:18:56,010 --> 00:18:57,720
Every indictment across the country

436
00:18:57,720 --> 00:18:59,463
has to come through our office.

437
00:18:59,463 --> 00:19:02,400
And so, we promulgated the policy

438
00:19:02,400 --> 00:19:04,440
to the US Attorney's offices saying

439
00:19:04,440 --> 00:19:08,670
that they should decline a
prosecution if the activity

440
00:19:08,670 --> 00:19:13,670
involved good faith computer
security research, meaning,

441
00:19:14,490 --> 00:19:15,720
and I won't delve too far into this,

442
00:19:15,720 --> 00:19:17,220
'cause we'll talk about
this later on the DMCA,

443
00:19:17,220 --> 00:19:22,220
but essentially, activity that
involves testing, examining,

444
00:19:24,180 --> 00:19:27,150
correcting, accessing
security, to do those things,

445
00:19:27,150 --> 00:19:30,870
to identify a security
flaw or vulnerability.

446
00:19:30,870 --> 00:19:32,370
And it's done in a way

447
00:19:32,370 --> 00:19:35,711
that avoids harm to the
public or individuals,

448
00:19:35,711 --> 00:19:38,760
and is primarily for the
purpose of producing information

449
00:19:38,760 --> 00:19:41,460
to protect the class of devices, machines,

450
00:19:41,460 --> 00:19:42,573
or online services.

451
00:19:43,410 --> 00:19:45,466
And so, you know, that's a lengthy way

452
00:19:45,466 --> 00:19:49,290
of attempting to capture
what it is people,

453
00:19:49,290 --> 00:19:52,320
we understand, attempt
to do in this community.

454
00:19:52,320 --> 00:19:54,510
And let me tell you, that
wasn't easy to try to capture

455
00:19:54,510 --> 00:19:56,820
in words, it took a lot
of tooling and throwing.

456
00:19:56,820 --> 00:19:58,800
But we'll talk about this more.

457
00:19:58,800 --> 00:20:00,270
- But here we are, the
Department of Justice

458
00:20:00,270 --> 00:20:01,830
has changed its charging policy

459
00:20:01,830 --> 00:20:05,400
for charging crimes under the CFAA to say,

460
00:20:05,400 --> 00:20:08,010
you should decline it if the defendant

461
00:20:08,010 --> 00:20:10,500
is a good faith security researcher.

462
00:20:10,500 --> 00:20:12,750
The language that is up there, again,

463
00:20:12,750 --> 00:20:14,040
we'll parse through it a bit more,

464
00:20:14,040 --> 00:20:16,380
but that is borrowed from
another part of the law

465
00:20:16,380 --> 00:20:18,090
where a lot of these
conversations were happening

466
00:20:18,090 --> 00:20:21,360
and is sort of becoming now
a lot of standard language

467
00:20:21,360 --> 00:20:23,280
around defining good
faith security research,

468
00:20:23,280 --> 00:20:25,410
for better or worse,
and nothing is perfect.

469
00:20:25,410 --> 00:20:28,680
But that again, May, so,
this is in the past year,

470
00:20:28,680 --> 00:20:31,683
a big change on the heels
of those court cases.

471
00:20:33,030 --> 00:20:36,870
Now, the limitation there is
that that is for criminal law.

472
00:20:36,870 --> 00:20:39,150
So, it does not apply to civil suits.

473
00:20:39,150 --> 00:20:41,490
Remember, you can still
be sued under the CFAA

474
00:20:41,490 --> 00:20:42,750
by private companies.

475
00:20:42,750 --> 00:20:44,850
And I will say that, anecdotally,

476
00:20:44,850 --> 00:20:47,520
in speaking with researchers at Rapid7,

477
00:20:47,520 --> 00:20:50,070
and speaking with like,
at, while at Rapid7,

478
00:20:50,070 --> 00:20:52,260
speaking with researchers
external to Rapid7

479
00:20:52,260 --> 00:20:53,253
and within Rapid7,

480
00:20:54,510 --> 00:20:57,150
we are seeing that much more,

481
00:20:57,150 --> 00:21:01,083
private lawsuits than over
things like criminal prosecution,

482
00:21:02,869 --> 00:21:04,440
and it is kind of a hard thing to measure

483
00:21:04,440 --> 00:21:05,730
because a lot of the private lawsuits

484
00:21:05,730 --> 00:21:07,860
come in the form of a threat,

485
00:21:07,860 --> 00:21:09,270
like a cease and desist letter.

486
00:21:09,270 --> 00:21:10,710
It hasn't ever reached the stage

487
00:21:10,710 --> 00:21:12,330
where it actually becomes a lawsuit.

488
00:21:12,330 --> 00:21:14,340
A lot of times the
researcher will back down

489
00:21:14,340 --> 00:21:15,900
or they'll work it out with the company,

490
00:21:15,900 --> 00:21:19,740
but it is still a major
problem for researchers.

491
00:21:19,740 --> 00:21:22,497
So, just that civil suit aspect of it

492
00:21:22,497 --> 00:21:24,447
and the charging policy does not apply.

493
00:21:26,370 --> 00:21:29,333
Do we wanna say anything else about CFAA?

494
00:21:29,333 --> 00:21:30,420
- I guess there's only one
other thing I should say,

495
00:21:30,420 --> 00:21:32,943
just in the interest of candor.

496
00:21:34,050 --> 00:21:35,490
Well, I said there have
been no prosecutions

497
00:21:35,490 --> 00:21:37,230
of security researchers.

498
00:21:37,230 --> 00:21:38,670
There may be a question about, well,

499
00:21:38,670 --> 00:21:40,650
have they been investigated?

500
00:21:40,650 --> 00:21:41,640
And there I'd have to concede

501
00:21:41,640 --> 00:21:43,648
there have been investigations,

502
00:21:43,648 --> 00:21:46,167
but you kind of have to cut
us a little slack there.

503
00:21:46,167 --> 00:21:48,300
And that is because, if you're,

504
00:21:48,300 --> 00:21:50,580
let's say penetration
desk testing a system

505
00:21:50,580 --> 00:21:52,480
that you don't have an agreement with,

506
00:21:53,460 --> 00:21:55,020
what you are necessarily doing

507
00:21:55,020 --> 00:21:57,930
is something that looks
identical to someone

508
00:21:57,930 --> 00:22:01,860
who is actually trying to,
let's say, break into a system.

509
00:22:01,860 --> 00:22:04,440
And so, there's no way of
telling what's going on,

510
00:22:04,440 --> 00:22:05,820
until and unless there's a little bit

511
00:22:05,820 --> 00:22:07,200
of investigative activity.

512
00:22:07,200 --> 00:22:10,443
And so, there still could be
a knock on the door asking,

513
00:22:11,497 --> 00:22:12,547
"What are you doing?"

514
00:22:14,520 --> 00:22:16,230
The point is that has not progressed

515
00:22:16,230 --> 00:22:18,600
and is not progressing to a prosecution.

516
00:22:18,600 --> 00:22:22,800
And so, we also, are better at
understanding the difference

517
00:22:22,800 --> 00:22:24,720
between certain types of activity

518
00:22:24,720 --> 00:22:28,860
that is actually a precursor
to actual intrusions

519
00:22:28,860 --> 00:22:30,420
versus others.

520
00:22:30,420 --> 00:22:32,520
Like for example,

521
00:22:32,520 --> 00:22:36,360
mere scanning, mere port scanning

522
00:22:36,360 --> 00:22:39,628
is not going to end up with
someone knocking on your door,

523
00:22:39,628 --> 00:22:43,833
asking for your, from the
government, I should say.

524
00:22:44,670 --> 00:22:46,470
But that wasn't necessarily the case

525
00:22:46,470 --> 00:22:48,393
going back a decade ago.

526
00:22:48,393 --> 00:22:51,222
But I think that that is
something that has changed.

527
00:22:51,222 --> 00:22:53,843
So, I just wanna clear that one point.

528
00:22:53,843 --> 00:22:56,370
- And so, just to recap the changes,

529
00:22:56,370 --> 00:23:00,360
those major court cases that
are curbing in a big way,

530
00:23:00,360 --> 00:23:02,880
the most problematic part of the CFAA.

531
00:23:02,880 --> 00:23:05,370
And then the DOJ's charging policy change,

532
00:23:05,370 --> 00:23:06,813
you know, all since 2021.

533
00:23:08,190 --> 00:23:10,500
This is the next big important one.

534
00:23:10,500 --> 00:23:13,380
So, this is section 1201 of the DMCA.

535
00:23:13,380 --> 00:23:16,229
So, the DMCA, the Digital
Millennium Copyright Act.

536
00:23:16,229 --> 00:23:20,460
Here is a law, that if
it were proposed today,

537
00:23:20,460 --> 00:23:23,100
would not even get a hearing in Congress.

538
00:23:23,100 --> 00:23:27,450
It is archaic and clunky and
it wastes everybody's time.

539
00:23:27,450 --> 00:23:29,070
And arguably it is broader

540
00:23:29,070 --> 00:23:30,900
than the Computer Fraud and Abuse Act.

541
00:23:30,900 --> 00:23:32,070
Because, remember I mentioned,

542
00:23:32,070 --> 00:23:33,720
that the Computer Fraud and Abuse Act

543
00:23:33,720 --> 00:23:36,390
largely applied to other
people's computers,

544
00:23:36,390 --> 00:23:38,280
section 1201 of the DMCA applies

545
00:23:38,280 --> 00:23:41,160
to other people's computers
and your computer.

546
00:23:41,160 --> 00:23:42,930
So, it can apply to you

547
00:23:42,930 --> 00:23:45,230
where you're you doing IoT research

548
00:23:45,230 --> 00:23:48,270
in your basement under a
20 watt bulb, like that.

549
00:23:48,270 --> 00:23:49,830
It does apply to you.

550
00:23:49,830 --> 00:23:54,060
What it does, is there we go.

551
00:23:54,060 --> 00:23:58,230
What it does is it restricts,
here comes the lawyer speak,

552
00:23:58,230 --> 00:24:01,380
circumventing a technological
protection measure

553
00:24:01,380 --> 00:24:03,870
to a protected work, a copyrighted work.

554
00:24:03,870 --> 00:24:05,550
So, what does that mean for hackers?

555
00:24:05,550 --> 00:24:07,500
Circumventing a technological
protection measure

556
00:24:07,500 --> 00:24:08,370
to a copyrighted work is

557
00:24:08,370 --> 00:24:10,200
what you do all the time, the software.

558
00:24:10,200 --> 00:24:11,850
So, a technological protection measure

559
00:24:11,850 --> 00:24:15,720
can be something like
encryption or a login.

560
00:24:15,720 --> 00:24:19,170
So, anything that is
protecting access to software.

561
00:24:19,170 --> 00:24:23,100
And so, that, because
you license software,

562
00:24:23,100 --> 00:24:24,960
does not mean that you have authorization

563
00:24:24,960 --> 00:24:27,810
from the copyright holder
to conduct that research.

564
00:24:27,810 --> 00:24:30,720
And that can be software
that is on your own device.

565
00:24:30,720 --> 00:24:33,120
Now it doesn't have to be just
on somebody else's device.

566
00:24:33,120 --> 00:24:34,830
So, arguably this has been broader.

567
00:24:34,830 --> 00:24:37,290
And a lot of times when I've
seen cease and desist letters

568
00:24:37,290 --> 00:24:40,530
that are sent out to
researchers, it's both,

569
00:24:40,530 --> 00:24:42,450
there's a citation for CFAA,

570
00:24:42,450 --> 00:24:44,853
as well as DMCA thrown in there.

571
00:24:45,960 --> 00:24:48,990
So, I think the best thing
about this law, you know,

572
00:24:48,990 --> 00:24:51,244
the best you could say for it,

573
00:24:51,244 --> 00:24:52,980
is that it gives the copyright office

574
00:24:52,980 --> 00:24:54,840
or technically the Librarian of Congress,

575
00:24:54,840 --> 00:24:57,000
but we'll just say the copyright office,

576
00:24:57,000 --> 00:24:59,400
the ability to, every three years,

577
00:24:59,400 --> 00:25:02,040
make an exception to this rule,

578
00:25:02,040 --> 00:25:06,210
this prohibition on restricting
or circumventing TPMs.

579
00:25:06,210 --> 00:25:09,930
And so, 2015 was actually the first time

580
00:25:09,930 --> 00:25:14,930
that there was a security
research exception to section 1201

581
00:25:15,060 --> 00:25:18,660
that did not rely on the authorization

582
00:25:18,660 --> 00:25:20,280
of the copyright holder.

583
00:25:20,280 --> 00:25:22,860
And there was a lot of folks
that were doing unsung work

584
00:25:22,860 --> 00:25:26,700
in the community to try
to make that happen.

585
00:25:26,700 --> 00:25:27,540
Andrew Metwichen,

586
00:25:27,540 --> 00:25:29,790
the Center for Democracy
and Technology, EFF.

587
00:25:30,780 --> 00:25:32,070
Like you don't hear their names

588
00:25:32,070 --> 00:25:33,120
proclaimed from the rooftops,

589
00:25:33,120 --> 00:25:35,670
but this process was where a lot

590
00:25:35,670 --> 00:25:38,220
of the cutting edge
conversations were happening

591
00:25:38,220 --> 00:25:41,700
for cyber security researcher protections.

592
00:25:41,700 --> 00:25:44,400
And it evolved every three years.

593
00:25:44,400 --> 00:25:46,853
So, 20 to 2015, 2018,

594
00:25:46,853 --> 00:25:49,500
in 2021 I think that what we finally have

595
00:25:49,500 --> 00:25:52,320
is decent protection that
you can hang your hat on

596
00:25:52,320 --> 00:25:54,180
for the vast majority of research.

597
00:25:54,180 --> 00:25:56,760
And we're gonna look at the language.

598
00:25:56,760 --> 00:25:59,190
So, good faith research, sorry,

599
00:25:59,190 --> 00:26:01,390
if this is not a sharper
image here for you,

600
00:26:02,520 --> 00:26:06,600
accessing a computer program
solely for the purposes

601
00:26:06,600 --> 00:26:08,880
of good faith testing, investigation,

602
00:26:08,880 --> 00:26:11,010
or correction of a security
flaw or vulnerability.

603
00:26:11,010 --> 00:26:12,720
All right, so, that's the research part.

604
00:26:12,720 --> 00:26:14,400
And then the rest are sort of caveats

605
00:26:14,400 --> 00:26:15,930
on doing it responsibly.

606
00:26:15,930 --> 00:26:18,930
So, where the research is
carried out in an environment

607
00:26:18,930 --> 00:26:21,540
designed to avoid harm to the public,

608
00:26:21,540 --> 00:26:23,460
where the information
that you're taking from it

609
00:26:23,460 --> 00:26:25,170
are used for security.

610
00:26:25,170 --> 00:26:26,190
All right, so, you're using it

611
00:26:26,190 --> 00:26:27,840
to promote the security of the devices

612
00:26:27,840 --> 00:26:29,700
that you are researching.

613
00:26:29,700 --> 00:26:32,728
And you're not, they had to
throw this in, 'cause remember,

614
00:26:32,728 --> 00:26:33,561
this is a copyright-based statute,

615
00:26:33,561 --> 00:26:35,880
and you're not using this
information in a manner

616
00:26:35,880 --> 00:26:38,730
that it facilitates
copyright infringement.

617
00:26:38,730 --> 00:26:41,640
Now, I don't know if you
caught a lot of the language

618
00:26:41,640 --> 00:26:44,190
in the Department of
Justice's charging policy,

619
00:26:44,190 --> 00:26:45,480
it's identical.

620
00:26:45,480 --> 00:26:49,170
The Department of Justice
borrowed from this exception

621
00:26:49,170 --> 00:26:50,700
that came out of the copyright office.

622
00:26:50,700 --> 00:26:53,850
This is in fact
government's best attempts,

623
00:26:53,850 --> 00:26:56,970
best stab at articulating what y'all do

624
00:26:56,970 --> 00:26:58,827
when you're doing security research.

625
00:26:58,827 --> 00:27:00,810
And I know that there is
a lot of different terms,

626
00:27:00,810 --> 00:27:03,720
like white hat hacker, ethical hacker.

627
00:27:03,720 --> 00:27:06,270
They went with good faith,
good faith security research,

628
00:27:06,270 --> 00:27:09,720
I think because good faith
carries a lot of legal precedent.

629
00:27:09,720 --> 00:27:12,480
And now we are actually seeing that term

630
00:27:12,480 --> 00:27:13,710
come up in a lot of other places

631
00:27:13,710 --> 00:27:14,940
that we're not even gonna cover here.

632
00:27:14,940 --> 00:27:17,010
So, for whatever it's worth,

633
00:27:17,010 --> 00:27:19,803
the description, white hat
hacker, ethical hacker,

634
00:27:21,420 --> 00:27:23,622
good faith security research is the one

635
00:27:23,622 --> 00:27:25,313
that has a momentum in
a lot of policy circles.

636
00:27:27,660 --> 00:27:28,493
- Oh please.

637
00:27:28,493 --> 00:27:30,480
- I'm just curious, how
many of you are lawyers?

638
00:27:31,860 --> 00:27:33,855
Okay, a good number of those.

639
00:27:33,855 --> 00:27:35,540
(Harley laughs)

640
00:27:35,540 --> 00:27:36,782
So, okay. (chuckles)

641
00:27:36,782 --> 00:27:40,140
This one statute amuses me in part,

642
00:27:40,140 --> 00:27:44,015
because, so, there's this
triennial process, right,

643
00:27:44,015 --> 00:27:47,610
whereby the Librarian of Congress

644
00:27:47,610 --> 00:27:49,020
looks at the copyright laws

645
00:27:49,020 --> 00:27:50,490
and decides whether there's an exception,

646
00:27:50,490 --> 00:27:52,200
and it's again, every three years,

647
00:27:52,200 --> 00:27:54,510
like, they sat around and said, "Two?

648
00:27:54,510 --> 00:27:56,070
No, that's not.

649
00:27:56,070 --> 00:27:57,300
Four?

650
00:27:57,300 --> 00:27:59,340
No, we're gonna go
three," for some reason.

651
00:27:59,340 --> 00:28:00,240
So, every three years,

652
00:28:00,240 --> 00:28:02,970
there's a chance to alter the law.

653
00:28:02,970 --> 00:28:06,990
Back in, I believe it was 2018,

654
00:28:06,990 --> 00:28:11,040
we became aware that this
was up for consideration

655
00:28:11,040 --> 00:28:14,880
and we decided we were gonna weigh in.

656
00:28:14,880 --> 00:28:17,100
And so, we did something we
haven't done before, which was,

657
00:28:17,100 --> 00:28:21,250
we issued a formal letter
to the Library of Congress

658
00:28:22,410 --> 00:28:26,250
in support of the security
research exception,

659
00:28:26,250 --> 00:28:29,400
'cause looking at it,
we felt it made sense.

660
00:28:29,400 --> 00:28:31,830
And then in 2021, it was up again,

661
00:28:31,830 --> 00:28:35,250
because some of the restrictions
on security research

662
00:28:35,250 --> 00:28:38,100
that were in the exemption in 2015

663
00:28:38,100 --> 00:28:40,350
were considered maybe too narrow.

664
00:28:40,350 --> 00:28:42,780
And we looked at that again

665
00:28:42,780 --> 00:28:45,180
and found that we could actually agree

666
00:28:45,180 --> 00:28:47,370
with expanding it in various ways.

667
00:28:47,370 --> 00:28:49,020
And because part of my office,

668
00:28:49,020 --> 00:28:50,010
I'm from the computer crime

669
00:28:50,010 --> 00:28:51,870
and intellectual property section,

670
00:28:51,870 --> 00:28:55,533
we actually enforce the
criminal DMCA provisions,

671
00:28:57,300 --> 00:28:58,800
the Library of Congress, actually,

672
00:28:58,800 --> 00:29:01,803
was pretty amenable to our position.

673
00:29:02,850 --> 00:29:05,370
So, just to kind of give
you a little more history

674
00:29:05,370 --> 00:29:08,220
on how this came to be.

675
00:29:08,220 --> 00:29:11,250
- I think I want to put
it a little more bluntly.

676
00:29:11,250 --> 00:29:13,890
The Department of Justice
stood up for researchers

677
00:29:13,890 --> 00:29:15,870
on two separate occasions in this process.

678
00:29:15,870 --> 00:29:17,460
Over a period of years,

679
00:29:17,460 --> 00:29:18,630
they put their money where their mouth is

680
00:29:18,630 --> 00:29:20,647
and got involved with
another agency saying,

681
00:29:20,647 --> 00:29:22,950
"Do better to protect researchers."

682
00:29:22,950 --> 00:29:24,480
That is really substantive.

683
00:29:24,480 --> 00:29:26,250
You know, from a law enforcement agency,

684
00:29:26,250 --> 00:29:27,810
when they say that they
wanna protect researchers,

685
00:29:27,810 --> 00:29:30,180
they, it's behind the scenes,
it's kind of inside baseball,

686
00:29:30,180 --> 00:29:31,590
but it actually, I was there.

687
00:29:31,590 --> 00:29:33,090
I was, you know, one of the people

688
00:29:33,090 --> 00:29:34,500
that was pushing the copyright office

689
00:29:34,500 --> 00:29:36,000
to have better protections.

690
00:29:36,000 --> 00:29:38,409
And the Department of Justice's
letters had a big effect

691
00:29:38,409 --> 00:29:40,500
on the copyright office

692
00:29:40,500 --> 00:29:42,060
actually approving these protections.

693
00:29:42,060 --> 00:29:42,893
And I'll-

694
00:29:42,893 --> 00:29:43,920
- I'm sorry, I had to jump in here,

695
00:29:43,920 --> 00:29:46,263
just so this is entirely a kumbaya moment.

696
00:29:47,310 --> 00:29:48,870
I mean, one of the things
that did happen though,

697
00:29:48,870 --> 00:29:52,980
over these years, is that
people in this community

698
00:29:52,980 --> 00:29:55,050
were willing to sit down with us

699
00:29:55,050 --> 00:29:57,960
and have good candid conversations

700
00:29:57,960 --> 00:30:00,954
about the way in which
research is conducted.

701
00:30:00,954 --> 00:30:04,740
And so, I think this is
really a good example

702
00:30:04,740 --> 00:30:08,970
of collaboration between, you
know, what, and many times,

703
00:30:08,970 --> 00:30:11,042
is viewed as antagonistic parties,

704
00:30:11,042 --> 00:30:12,690
but actually are two parties

705
00:30:12,690 --> 00:30:14,280
that are working towards a common goal,

706
00:30:14,280 --> 00:30:17,670
which is better security and protection

707
00:30:17,670 --> 00:30:20,193
of people's information and assets.

708
00:30:21,210 --> 00:30:23,910
- So, this was 2021
when this was released.

709
00:30:23,910 --> 00:30:26,250
I think this was late 2021,

710
00:30:26,250 --> 00:30:28,770
but consider the timeline
also, right, 2015,

711
00:30:28,770 --> 00:30:30,330
it started before 2015.

712
00:30:30,330 --> 00:30:33,870
So, this was a period of
like seven, eight years

713
00:30:33,870 --> 00:30:36,480
just working with the
copyright office alone on this.

714
00:30:36,480 --> 00:30:39,043
I think EFF had started even
several years before that.

715
00:30:39,043 --> 00:30:41,615
I mean it, like, talk about the way

716
00:30:41,615 --> 00:30:42,750
that policy moves slowly.

717
00:30:42,750 --> 00:30:44,973
One of the reasons for
that is because you,

718
00:30:46,080 --> 00:30:47,853
oh, we managed to do it.

719
00:30:49,230 --> 00:30:50,400
That's terrific.

720
00:30:50,400 --> 00:30:51,930
I'm assuming is that better for everybody?

721
00:30:51,930 --> 00:30:54,273
Yeah, awesome, thank you.

722
00:30:57,510 --> 00:31:00,330
Yeah, so, I I'll tell
you just a war story.

723
00:31:00,330 --> 00:31:05,330
So, in 2018 we heard from
other trade associations

724
00:31:06,780 --> 00:31:09,270
and well other sort of interests

725
00:31:09,270 --> 00:31:13,560
who wanted a copyright
to be better protected

726
00:31:13,560 --> 00:31:15,300
and thought that was more prioritized

727
00:31:15,300 --> 00:31:16,560
than security research.

728
00:31:16,560 --> 00:31:17,393
And they said things like,

729
00:31:17,393 --> 00:31:19,890
if we don't have restrictions
on security research,

730
00:31:19,890 --> 00:31:22,890
we're going to have unfettered
hacking of elections.

731
00:31:22,890 --> 00:31:24,510
We're gonna have people hacking planes.

732
00:31:24,510 --> 00:31:26,880
We're gonna have people
hacking cars on highways.

733
00:31:26,880 --> 00:31:29,460
It'll be, you know,
they'll be hacking cars

734
00:31:29,460 --> 00:31:32,190
in such a way that they're
violating pollution laws.

735
00:31:32,190 --> 00:31:34,434
To which our response
had always been, well,

736
00:31:34,434 --> 00:31:35,460
there are other laws
that take care of that.

737
00:31:35,460 --> 00:31:37,413
We don't have to rely
on this one to do it,

738
00:31:37,413 --> 00:31:40,530
but that took, you know,
like at least four years

739
00:31:40,530 --> 00:31:42,120
to overcome that argument.

740
00:31:42,120 --> 00:31:44,651
And now, and now we have.

741
00:31:44,651 --> 00:31:45,484
The language that you see here

742
00:31:46,604 --> 00:31:48,840
does not have that same caveat in it.

743
00:31:48,840 --> 00:31:50,850
This is an example of research.

744
00:31:50,850 --> 00:31:54,963
Why would this not fit the
language that we just saw?

745
00:31:56,670 --> 00:31:57,864
Yes?

746
00:31:57,864 --> 00:31:59,760
- [Audience Member] It was not
in a controlled safe manner.

747
00:31:59,760 --> 00:32:02,430
- That's right, that's right.

748
00:32:02,430 --> 00:32:04,800
So, this was on a highway.

749
00:32:04,800 --> 00:32:08,280
But this particular example

750
00:32:08,280 --> 00:32:11,400
was brought up in the
section 1201 proceedings

751
00:32:11,400 --> 00:32:13,380
as both a for and against, all right?

752
00:32:13,380 --> 00:32:15,930
We were saying, "Well,
look, the research actually

753
00:32:15,930 --> 00:32:19,260
did result in Jeep
recalling these vehicles

754
00:32:19,260 --> 00:32:20,160
for safety purposes."

755
00:32:20,160 --> 00:32:21,870
This was valuable to society.

756
00:32:21,870 --> 00:32:24,097
On the other side, we heard people saying,

757
00:32:24,097 --> 00:32:26,340
"No, this is terrible, look
at what these folks can do.

758
00:32:26,340 --> 00:32:29,400
They can stop it on a highway
and put everybody at risk."

759
00:32:29,400 --> 00:32:31,740
So, yes, this is one of those caveats.

760
00:32:31,740 --> 00:32:33,870
This is why this specific example

761
00:32:33,870 --> 00:32:36,390
made a lot of waves in policy land.

762
00:32:36,390 --> 00:32:40,443
And is one of the reasons
why that language there.

763
00:32:41,601 --> 00:32:42,434
Yes?

764
00:32:42,434 --> 00:32:43,933
- [Audience Member] Was that
authorized access though?

765
00:32:43,933 --> 00:32:48,933
Because it sounded like
the (faintly speaking).

766
00:32:51,420 --> 00:32:54,360
- So, it'd be authorized
access to the machinery,

767
00:32:54,360 --> 00:32:56,280
right, to the computer maybe.

768
00:32:56,280 --> 00:32:58,800
But not to the software on the computer,

769
00:32:58,800 --> 00:33:00,510
because the software is copyrightable

770
00:33:00,510 --> 00:33:03,515
and that's the way 1201,
section 1201 works,

771
00:33:03,515 --> 00:33:04,348
is that you have to get the authorization

772
00:33:04,348 --> 00:33:05,820
of the copyright holder.

773
00:33:05,820 --> 00:33:08,570
And in this case they did
not have authorization

774
00:33:08,570 --> 00:33:09,630
of the copyright holder,

775
00:33:09,630 --> 00:33:11,220
even if they had the authorization

776
00:33:11,220 --> 00:33:13,290
of the person who owned the Jeep.

777
00:33:13,290 --> 00:33:14,123
Art?

778
00:33:14,123 --> 00:33:15,554
- [Art] Would there have been also

779
00:33:15,554 --> 00:33:20,221
(indistinct) getting into the software?

780
00:33:21,625 --> 00:33:22,458
- Yes.

781
00:33:22,458 --> 00:33:23,291
- So it would have been
a technical measure.

782
00:33:23,291 --> 00:33:24,895
Yeah, that's a requirement of the statute.

783
00:33:24,895 --> 00:33:27,600
- [Art] (faintly speaking)

784
00:33:27,600 --> 00:33:30,351
- I think it probably
depends on the specifics.

785
00:33:30,351 --> 00:33:34,518
- [Art] Okay, (faintly speaking).

786
00:33:52,590 --> 00:33:54,990
- So, a big limitation on that, right?

787
00:33:54,990 --> 00:33:57,870
So, now you have, again,
just in the past year,

788
00:33:57,870 --> 00:33:59,310
you've got better,

789
00:33:59,310 --> 00:34:02,070
much better protections under
section 1201 of the DMCA

790
00:34:02,070 --> 00:34:03,848
for good faith security research.

791
00:34:03,848 --> 00:34:08,848
There is a limitation to it,
which is that protection,

792
00:34:08,850 --> 00:34:11,340
it does not apply, and
actually the copyright office

793
00:34:11,340 --> 00:34:14,250
cannot make it apply, they're
not authorized by law,

794
00:34:14,250 --> 00:34:17,280
to trafficking in the tools.

795
00:34:17,280 --> 00:34:20,550
So, if you are making the
tools available publicly,

796
00:34:20,550 --> 00:34:23,310
even just not-for-profit,
put it out on Twitter,

797
00:34:23,310 --> 00:34:27,600
then that may violate
section 1201 of the DMCA,

798
00:34:27,600 --> 00:34:28,500
but a different part of it.

799
00:34:28,500 --> 00:34:30,570
One that does not fall
under the protections

800
00:34:30,570 --> 00:34:31,740
that we just discussed.

801
00:34:31,740 --> 00:34:35,065
So, the act of research is
protected, but the disclosure

802
00:34:35,065 --> 00:34:37,650
of the tools and the
techniques may not be.

803
00:34:37,650 --> 00:34:38,520
Yes?

804
00:34:38,520 --> 00:34:40,122
- [Audience Member] Will there be any time

805
00:34:40,122 --> 00:34:41,334
for questions on that?

806
00:34:41,334 --> 00:34:42,540
I don't want to interrupt
what you have on the schedule.

807
00:34:42,540 --> 00:34:44,520
- Yes, there will be time for questions,

808
00:34:44,520 --> 00:34:47,923
but if you want, you know,
we're gonna be loose with it.

809
00:34:47,923 --> 00:34:50,923
- [Audience Member] Okay, let's say,

810
00:34:52,360 --> 00:34:55,943
if there's a civil
suit, and you know that-

811
00:34:58,271 --> 00:35:00,028
- I can't hear you very well, sorry.

812
00:35:00,028 --> 00:35:01,797
- [Audience Member] If
there's a civil suit,

813
00:35:01,797 --> 00:35:05,329
will the judge for the
case rule the same way

814
00:35:05,329 --> 00:35:08,912
that a prosecutor would
under the same law?

815
00:35:09,921 --> 00:35:13,758
Like, say, so let's say
somebody commits something,

816
00:35:13,758 --> 00:35:17,027
and the DOJ says, "We're
not gonna prosecute this."

817
00:35:17,027 --> 00:35:21,304
And then the the organization
files a suit civilly,

818
00:35:21,304 --> 00:35:26,018
will they (indistinct) that was a loss,

819
00:35:26,018 --> 00:35:28,878
let's say there's a loss, a monetary loss,

820
00:35:28,878 --> 00:35:33,249
would an organization be
entitled to the same thing,

821
00:35:33,249 --> 00:35:35,495
or does it just go away?

822
00:35:35,495 --> 00:35:37,290
- So, for CFAA, if you're talking about

823
00:35:37,290 --> 00:35:38,730
will a civil lawsuit,

824
00:35:38,730 --> 00:35:41,340
look at the DOJs charging policy change,

825
00:35:41,340 --> 00:35:44,013
it may be persuasive, but
it's not going to control.

826
00:35:46,235 --> 00:35:48,660
- And it's a different
standard of proof, right?

827
00:35:48,660 --> 00:35:51,000
So, in a civil proceeding,

828
00:35:51,000 --> 00:35:52,500
it'll be a preponderance of the evidence

829
00:35:52,500 --> 00:35:55,440
versus beyond a reasonable
doubt in a criminal case.

830
00:35:55,440 --> 00:35:58,863
So, there would be a
different standard also used.

831
00:36:00,162 --> 00:36:03,611
- [Audience Member] The
other question I had was,

832
00:36:03,611 --> 00:36:08,340
if the information is,
let's say, so (indistinct)

833
00:36:08,340 --> 00:36:11,760
finds a vulnerability in
the service application

834
00:36:11,760 --> 00:36:14,280
or something that an organization creates,

835
00:36:14,280 --> 00:36:16,080
but then makes them aware,

836
00:36:16,080 --> 00:36:20,256
but holds the information
for a bounty, so to speak,

837
00:36:20,256 --> 00:36:21,690
but not to say, attack them,

838
00:36:21,690 --> 00:36:24,394
just to say I found something
you should know about,

839
00:36:24,394 --> 00:36:26,801
but unless you pay me, I'm
not going to give it to you,

840
00:36:26,801 --> 00:36:28,889
but then doesn't sell it to anyone else.

841
00:36:28,889 --> 00:36:31,830
Is it legal, or then
he could be prosecuted?

842
00:36:31,830 --> 00:36:33,062
- Be careful.

843
00:36:33,062 --> 00:36:34,320
(audience laughs)

844
00:36:34,320 --> 00:36:37,293
That's what I would say, it
starts to look like extortion.

845
00:36:38,760 --> 00:36:41,520
And I think that's not best practices

846
00:36:41,520 --> 00:36:43,713
for research under any circumstances.

847
00:36:44,610 --> 00:36:47,220
And I think that I would
just say depending,

848
00:36:47,220 --> 00:36:49,337
it probably depends on the specifics,

849
00:36:49,337 --> 00:36:50,170
but you definitely don't
wanna give the impression

850
00:36:50,170 --> 00:36:52,440
that you are, you have, you know, exploits

851
00:36:52,440 --> 00:36:55,140
that you might use if they do not pay you.

852
00:36:55,140 --> 00:36:57,480
That is something that comes up

853
00:36:57,480 --> 00:37:00,780
both under section 1201 and
also, comes up under CFAA.

854
00:37:04,485 --> 00:37:05,901
- [Audience Member]
Yes, I just wanna, like,

855
00:37:05,901 --> 00:37:08,154
piggyback some questions about CFAA.

856
00:37:08,154 --> 00:37:13,154
I've heard, so for our purpose
of operating on the dark web

857
00:37:13,744 --> 00:37:18,744
or like the deep web,
collecting (indistinct),

858
00:37:19,594 --> 00:37:22,511
we come across screenshots of PIIs,

859
00:37:23,758 --> 00:37:27,496
or sometimes professional documents.

860
00:37:27,496 --> 00:37:31,161
Are we correct, that the CFAA for purposes

861
00:37:31,161 --> 00:37:33,177
of circumstances of hackers

862
00:37:33,177 --> 00:37:37,749
who access computers, because
it's not really access,

863
00:37:37,749 --> 00:37:41,161
but we do have kind of this ability

864
00:37:41,161 --> 00:37:44,054
to collect information that is,

865
00:37:44,054 --> 00:37:45,408
we're not supposed to see,

866
00:37:45,408 --> 00:37:48,398
but it's under certain authorization,

867
00:37:48,398 --> 00:37:50,491
that's for work purposes.

868
00:37:50,491 --> 00:37:52,999
Because, if we like paid
a researcher for that,

869
00:37:52,999 --> 00:37:55,832
(faintly speaking)

870
00:37:57,082 --> 00:37:58,298
that would be protected.

871
00:37:58,298 --> 00:38:00,998
- So, let me restate the
question for the streaming,

872
00:38:00,998 --> 00:38:02,850
and correct me if I'm wrong,

873
00:38:02,850 --> 00:38:03,683
if I mischaracterize.

874
00:38:03,683 --> 00:38:04,710
So, for example,

875
00:38:04,710 --> 00:38:06,090
if you're doing research on the dark web,

876
00:38:06,090 --> 00:38:09,732
you come across what is
apparently stolen data

877
00:38:09,732 --> 00:38:14,732
and you access it, are
you violating the CFAA?

878
00:38:15,330 --> 00:38:18,963
And the simple answer to
that, under those facts is no.

879
00:38:20,100 --> 00:38:22,050
I'm glad to say, that one
thing I can recommend to you

880
00:38:22,050 --> 00:38:24,900
is one of the things that
the cyber security unit

881
00:38:24,900 --> 00:38:28,740
that I had has done is we've
produced various white papers

882
00:38:28,740 --> 00:38:32,430
on issues that people in the
community and in industry

883
00:38:32,430 --> 00:38:34,020
have flagged for us as legal issues

884
00:38:34,020 --> 00:38:35,370
that they're interested in seeing

885
00:38:35,370 --> 00:38:37,050
if we could provide some guidance on.

886
00:38:37,050 --> 00:38:39,700
The one we released in February of 2020

887
00:38:41,670 --> 00:38:44,340
is intelligence gathering on the dark web

888
00:38:44,340 --> 00:38:48,457
or purchasing your information
back on the dark web.

889
00:38:48,457 --> 00:38:53,457
If you did a web search
for cybersecurity unit DOJ,

890
00:38:53,700 --> 00:38:55,590
you'll land on, there'll be landing page.

891
00:38:55,590 --> 00:38:58,590
And on there are links
to various white papers.

892
00:38:58,590 --> 00:39:00,477
One of them actually covers

893
00:39:00,477 --> 00:39:03,184
and I think is rather
instructive on this issue.

894
00:39:03,184 --> 00:39:07,767
- [Audience Member] (faintly speaking)

895
00:39:09,870 --> 00:39:14,430
- Yeah, no, I guess in lawyers speak,

896
00:39:14,430 --> 00:39:18,057
you wouldn't be actually
accessing a computer

897
00:39:18,057 --> 00:39:18,890
without authorization, right?

898
00:39:18,890 --> 00:39:21,237
The data is out somewhere else.

899
00:39:21,237 --> 00:39:22,560
- [Audience Member] (faintly speaking)

900
00:39:22,560 --> 00:39:24,210
- Right, but it's not that,

901
00:39:24,210 --> 00:39:28,423
you have not accessed the
computer from which it was stolen.

902
00:39:28,423 --> 00:39:31,350
It is just data that
someone has posted somewhere

903
00:39:31,350 --> 00:39:34,254
and you're accessing their
computer with authorization,

904
00:39:34,254 --> 00:39:36,333
you know, as it's posted on the web.

905
00:39:37,230 --> 00:39:41,640
But that would not be a
CFAA violation by itself.

906
00:39:41,640 --> 00:39:43,560
- But that's CFAA, I mean,

907
00:39:43,560 --> 00:39:45,210
there are other laws that can apply

908
00:39:45,210 --> 00:39:48,930
like receipt of stolen
property, some privacy laws.

909
00:39:48,930 --> 00:39:50,850
So, it depends on the situation.

910
00:39:50,850 --> 00:39:53,760
And just, I think be aware
that there are more laws

911
00:39:53,760 --> 00:39:55,830
than the CFAA that may
apply to that situation.

912
00:39:55,830 --> 00:39:56,663
- And on that square,

913
00:39:56,663 --> 00:39:58,680
I would recommend the
paper that I flagged,

914
00:39:58,680 --> 00:40:01,353
'cause we get into some
of the other issues.

915
00:40:05,143 --> 00:40:09,226
- [Audience Member] (indistinct)

916
00:40:20,130 --> 00:40:23,640
- So, here I'm going to be
very lawyerly and weaselly.

917
00:40:23,640 --> 00:40:26,673
The simple answer is the
facts will matter, right?

918
00:40:27,928 --> 00:40:31,560
So, if you, for example, will take Weev,

919
00:40:31,560 --> 00:40:33,410
the case that we talked about before.

920
00:40:35,370 --> 00:40:39,060
He had accessed through this AT&T server,

921
00:40:39,060 --> 00:40:42,580
which was configured to
essentially populate certain fields

922
00:40:43,590 --> 00:40:47,893
when you access it, if
you had an AT&T iPad,

923
00:40:47,893 --> 00:40:50,760
he identified what some would argue

924
00:40:50,760 --> 00:40:54,870
as a security vulnerability
that shouldn't have existed.

925
00:40:54,870 --> 00:40:56,310
He wrote then a Perl script

926
00:40:56,310 --> 00:40:59,970
that allowed him to do
that 116,000 times, right?

927
00:40:59,970 --> 00:41:03,360
Which did then kind of
move it out of what today

928
00:41:03,360 --> 00:41:06,510
we would consider good
faith security research.

929
00:41:06,510 --> 00:41:10,740
Now, if you're saying you
access this, you saw this,

930
00:41:10,740 --> 00:41:14,340
and then perhaps you reported it.

931
00:41:14,340 --> 00:41:17,463
That would help, right, in
terms of what we're thinking.

932
00:41:18,300 --> 00:41:21,270
You should be in the
mindset though, of thinking,

933
00:41:21,270 --> 00:41:23,820
how will someone perceive my actions,

934
00:41:23,820 --> 00:41:25,620
not my intent, but my actions,

935
00:41:25,620 --> 00:41:29,400
'cause it's very difficult to
discern what your motives are.

936
00:41:29,400 --> 00:41:31,320
So, if someone, for example,

937
00:41:31,320 --> 00:41:34,500
identifies your IP address
coming from wherever you are

938
00:41:34,500 --> 00:41:37,507
as accessing this particular server

939
00:41:37,507 --> 00:41:40,350
and there's nothing else going on,

940
00:41:40,350 --> 00:41:41,850
again, you may get a knock on the door.

941
00:41:41,850 --> 00:41:43,250
There may be some questions.

942
00:41:44,100 --> 00:41:46,230
You should do everything you can though

943
00:41:46,230 --> 00:41:48,690
to make it clear what it is you're doing.

944
00:41:48,690 --> 00:41:51,210
Again, the same paper
I talked about before,

945
00:41:51,210 --> 00:41:52,680
it goes into this a bit.

946
00:41:52,680 --> 00:41:54,870
That is to the extent, that for example,

947
00:41:54,870 --> 00:41:58,110
you work for a company
and there is a work plan

948
00:41:58,110 --> 00:41:59,880
that demonstrates that this is a manner

949
00:41:59,880 --> 00:42:03,390
in which you collect cyber
threat intelligence information.

950
00:42:03,390 --> 00:42:04,593
That would be helpful,

951
00:42:05,700 --> 00:42:07,950
not dispositive necessarily, but helpful.

952
00:42:07,950 --> 00:42:10,260
But that's the advice
I could give you here,

953
00:42:10,260 --> 00:42:14,520
put yourself in the mindset of,
without knowing your intent,

954
00:42:14,520 --> 00:42:16,110
what do my actions look like?

955
00:42:16,110 --> 00:42:18,060
And how can I demonstrate that my actions

956
00:42:18,060 --> 00:42:19,890
are not those actually of someone

957
00:42:19,890 --> 00:42:21,900
who would do this for malicious purposes.

958
00:42:21,900 --> 00:42:23,340
- All right, thank you.

959
00:42:23,340 --> 00:42:25,260
I'm gonna try to get us back on track.

960
00:42:25,260 --> 00:42:26,730
If we have questions that are not,

961
00:42:26,730 --> 00:42:28,530
like sort of directly related
to what we're talking about,

962
00:42:28,530 --> 00:42:29,430
we should hold those to the end.

963
00:42:29,430 --> 00:42:31,140
We do have time for a round table,

964
00:42:31,140 --> 00:42:32,850
So, we will have time
to get to the questions,

965
00:42:32,850 --> 00:42:35,400
but let's try to keep it to
what we're talking about now,

966
00:42:35,400 --> 00:42:36,233
just for the folk,

967
00:42:36,233 --> 00:42:39,123
the flow of conversations that
folks get the information.

968
00:42:40,650 --> 00:42:44,460
We were talking about section
1201 of the DMCA, and we said

969
00:42:44,460 --> 00:42:48,780
that this good faith
security research exception,

970
00:42:48,780 --> 00:42:52,920
which came out in 2021,
provides good protection,

971
00:42:52,920 --> 00:42:55,530
but does not cover trafficking.

972
00:42:55,530 --> 00:42:58,140
So, trafficking in the tools,
the exploits, the techniques.

973
00:42:58,140 --> 00:43:00,510
So, and trafficking sounds like

974
00:43:00,510 --> 00:43:02,340
it might be more complicated than it is,

975
00:43:02,340 --> 00:43:05,651
but it could just be public
disclosure of those things.

976
00:43:05,651 --> 00:43:10,020
And this is the basis of the
Apple versus Corellium lawsuit.

977
00:43:10,020 --> 00:43:12,277
This was partially settled in 2021.

978
00:43:12,277 --> 00:43:14,250
We don't have the details
of the settlement,

979
00:43:14,250 --> 00:43:17,190
but originally was that Corellium

980
00:43:17,190 --> 00:43:21,180
was violating that trafficking
portion of the statute.

981
00:43:21,180 --> 00:43:24,300
And one of the reasons that
it was settled, in fact,

982
00:43:24,300 --> 00:43:27,959
was from pressure from the
cybersecurity community

983
00:43:27,959 --> 00:43:30,810
that put out a statement
saying we should not be

984
00:43:30,810 --> 00:43:33,330
suppressing the use of
cybersecurity tools.

985
00:43:33,330 --> 00:43:35,520
We don't want there to be the case that,

986
00:43:35,520 --> 00:43:37,950
like a public disclosure
of techniques and tools

987
00:43:37,950 --> 00:43:40,623
is outlawed under section 1201.

988
00:43:40,623 --> 00:43:42,630
It is a bad cybersecurity
situation to say,

989
00:43:42,630 --> 00:43:44,400
everybody must develop their own

990
00:43:44,400 --> 00:43:47,100
because those tools will not be as good

991
00:43:47,100 --> 00:43:51,060
and able to actually
improve cybersecurity.

992
00:43:51,060 --> 00:43:51,893
Yes.

993
00:43:51,893 --> 00:43:52,750
- [Audience Member]
So, (faintly speaking).

994
00:44:02,496 --> 00:44:04,200
- I think that, that is one of the things

995
00:44:04,200 --> 00:44:06,360
that was kind of eye
opening about the lawsuit

996
00:44:06,360 --> 00:44:08,490
was that there did not
seem to be an exception

997
00:44:08,490 --> 00:44:09,660
for open source.

998
00:44:09,660 --> 00:44:12,150
And if the techniques and tools

999
00:44:12,150 --> 00:44:15,330
can circumvent a technological
protection measure

1000
00:44:15,330 --> 00:44:16,163
to a copyrighted work,

1001
00:44:16,163 --> 00:44:19,050
which, you know, a lot
of open source tools do,

1002
00:44:19,050 --> 00:44:21,180
then yes, it could violate that.

1003
00:44:21,180 --> 00:44:23,010
This is not a part of the statute

1004
00:44:23,010 --> 00:44:25,050
that we see come up very often.

1005
00:44:25,050 --> 00:44:27,360
And I think that it was
under the radar quite a bit.

1006
00:44:27,360 --> 00:44:30,450
And it is one that we don't
have that opportunity,

1007
00:44:30,450 --> 00:44:31,770
you know, to come to the copyright office

1008
00:44:31,770 --> 00:44:33,360
every three years for an exception.

1009
00:44:33,360 --> 00:44:35,397
That has to be something
that is done by Congress.

1010
00:44:35,397 --> 00:44:38,580
And Congress does what Congress does.

1011
00:44:38,580 --> 00:44:43,083
So, we talked about CFAA
and we talked about DMCA.

1012
00:44:44,940 --> 00:44:47,220
I wanna look at the states as well.

1013
00:44:47,220 --> 00:44:51,300
So, if you are, you know,
wherever you are reside,

1014
00:44:51,300 --> 00:44:54,750
and if you look up your state
and then computer crime law,

1015
00:44:54,750 --> 00:44:57,930
it will be worthwhile to take
a look at those statutes.

1016
00:44:57,930 --> 00:44:59,970
Many of them are very similar

1017
00:44:59,970 --> 00:45:01,320
to the Computer Fraud and Abuse Act.

1018
00:45:01,320 --> 00:45:04,080
They use similar language,
access without authorization.

1019
00:45:04,080 --> 00:45:06,330
Some of them say exceeds
authorized access,

1020
00:45:06,330 --> 00:45:08,250
just like the CFAA did.

1021
00:45:08,250 --> 00:45:10,260
What's different, one of
the things that's different,

1022
00:45:10,260 --> 00:45:12,660
is that it has not gone
through that evolution

1023
00:45:12,660 --> 00:45:14,640
that we just discussed for CFAA.

1024
00:45:14,640 --> 00:45:16,470
There is no Van Buren counterpart

1025
00:45:16,470 --> 00:45:19,050
to state computer crime laws.

1026
00:45:19,050 --> 00:45:21,090
There's no DOJ charging policy,

1027
00:45:21,090 --> 00:45:23,943
does not apply to the
state computer crime laws.

1028
00:45:23,943 --> 00:45:24,776
Those are enforced by states.

1029
00:45:24,776 --> 00:45:25,800
They go through state courts.

1030
00:45:25,800 --> 00:45:27,711
This is our federalist system.

1031
00:45:27,711 --> 00:45:31,563
And so, some of the states end
up actually having language

1032
00:45:31,563 --> 00:45:34,200
that is even more broad than the CFAA.

1033
00:45:34,200 --> 00:45:36,690
Missouri, which is
actually where I'm from,

1034
00:45:36,690 --> 00:45:38,151
is one of those examples.

1035
00:45:38,151 --> 00:45:42,240
And in 2021, we had this issue

1036
00:45:42,240 --> 00:45:44,503
where the St. Louis Post-Dispatch,

1037
00:45:44,503 --> 00:45:46,800
a reporter for the St. Louis Post-Dispatch

1038
00:45:46,800 --> 00:45:50,070
found on their Department
of Education website

1039
00:45:50,070 --> 00:45:51,600
that the social security numbers

1040
00:45:51,600 --> 00:45:54,180
of many educators were revealed.

1041
00:45:54,180 --> 00:45:57,150
And this was not a very
complicated exposure.

1042
00:45:57,150 --> 00:45:58,707
It looked like, like hitting F12

1043
00:45:58,707 --> 00:46:01,200
and looking at the source of
the website revealed this.

1044
00:46:01,200 --> 00:46:02,730
It was disclosed to the agency,

1045
00:46:02,730 --> 00:46:04,200
which initially said, "Thank you."

1046
00:46:04,200 --> 00:46:05,400
Somehow it became political.

1047
00:46:05,400 --> 00:46:07,500
And the governor said
that this was hacking,

1048
00:46:07,500 --> 00:46:08,400
this was unacceptable.

1049
00:46:08,400 --> 00:46:11,910
And that we should have a law
enforcement investigation.

1050
00:46:11,910 --> 00:46:14,730
The highway patrol did
investigate the Post-Dispatch

1051
00:46:14,730 --> 00:46:16,470
and did investigate the reporter.

1052
00:46:16,470 --> 00:46:17,670
No charges were brought.

1053
00:46:17,670 --> 00:46:20,220
And what the highway
patrol said at the time

1054
00:46:20,220 --> 00:46:22,650
was that there was no criminal intent.

1055
00:46:22,650 --> 00:46:23,790
Obviously this is true.

1056
00:46:23,790 --> 00:46:26,550
This is also true for good
faith cybersecurity research.

1057
00:46:26,550 --> 00:46:28,740
That's also, not what's
required in the statute.

1058
00:46:28,740 --> 00:46:30,660
The statute does not
require criminal intent.

1059
00:46:30,660 --> 00:46:33,870
It actually does not
require intent to defraud.

1060
00:46:33,870 --> 00:46:36,900
It is whether or not you are
accessing the computer at all.

1061
00:46:36,900 --> 00:46:39,210
It also, Missouri is one of those states

1062
00:46:39,210 --> 00:46:41,940
that says that if you
disclose an access code

1063
00:46:41,940 --> 00:46:44,580
or a password without authorization,

1064
00:46:44,580 --> 00:46:46,770
then you are in violation
of their state law.

1065
00:46:46,770 --> 00:46:48,480
Now in the CFAA,

1066
00:46:48,480 --> 00:46:51,450
if you're disclosing an
access code or a password,

1067
00:46:51,450 --> 00:46:53,610
that requires intent to defraud

1068
00:46:53,610 --> 00:46:55,110
to be illegal under the CFAA.

1069
00:46:55,110 --> 00:46:57,180
Here again, no intent to defraud.

1070
00:46:57,180 --> 00:46:59,130
It's just, if you should have known

1071
00:46:59,130 --> 00:47:00,510
that you did not have authorization

1072
00:47:00,510 --> 00:47:01,530
to disclose the password.

1073
00:47:01,530 --> 00:47:04,500
So, for example, you're
conducting IoT research.

1074
00:47:04,500 --> 00:47:05,910
One of the routine things that you see

1075
00:47:05,910 --> 00:47:07,380
with IoT cybersecurity research

1076
00:47:07,380 --> 00:47:10,680
is finding a hard coded
password in the device.

1077
00:47:10,680 --> 00:47:13,083
Are you allowed to disclose
that under Missouri law,

1078
00:47:13,083 --> 00:47:15,511
do you have authorization to do it?

1079
00:47:15,511 --> 00:47:17,100
This is what I'm talking about.

1080
00:47:17,100 --> 00:47:20,310
You, it would not be a
violation under CFAA,

1081
00:47:20,310 --> 00:47:22,290
arguably not anymore under DMCA.

1082
00:47:22,290 --> 00:47:23,820
now that we have that protection.

1083
00:47:23,820 --> 00:47:26,460
But you have state laws
that are just as broad

1084
00:47:26,460 --> 00:47:28,110
or more broad than the CFAA.

1085
00:47:28,110 --> 00:47:30,240
And don't don't have some
of the same limiting factors

1086
00:47:30,240 --> 00:47:31,290
that we've discussed.

1087
00:47:33,390 --> 00:47:34,808
Maryland is another.

1088
00:47:34,808 --> 00:47:37,320
So, in Maryland, in fact,

1089
00:47:37,320 --> 00:47:40,110
so Missouri is one where it says,

1090
00:47:40,110 --> 00:47:43,140
if you are disclosing a
password or an access code

1091
00:47:43,140 --> 00:47:44,370
without authorization.

1092
00:47:44,370 --> 00:47:46,473
Maryland, in fact, makes it a crime,

1093
00:47:47,460 --> 00:47:49,560
home of the NSA makes it a crime

1094
00:47:49,560 --> 00:47:54,000
to try to identify an
access code or a password.

1095
00:47:54,000 --> 00:47:55,710
So, not even just the disclosure,

1096
00:47:55,710 --> 00:47:58,350
the act of research to try
to identify the password

1097
00:47:58,350 --> 00:48:01,530
or the access code, it is illegal.

1098
00:48:01,530 --> 00:48:04,289
No again, no intent to defraud required.

1099
00:48:04,289 --> 00:48:07,020
And then by contrast, like just a story

1100
00:48:07,020 --> 00:48:08,760
to show you some of the variation here,

1101
00:48:08,760 --> 00:48:11,340
there's the state of Washington.

1102
00:48:11,340 --> 00:48:13,497
The state of Washington actually has,

1103
00:48:13,497 --> 00:48:15,090
and the only one I know of in states,

1104
00:48:15,090 --> 00:48:18,810
it has a bonafide security
researcher protection.

1105
00:48:18,810 --> 00:48:19,987
And this is here, they call it,

1106
00:48:19,987 --> 00:48:21,641
"white hat security research."

1107
00:48:21,641 --> 00:48:23,370
The way that they do it is they say,

1108
00:48:23,370 --> 00:48:25,890
you can't do a bunch of
stuff without authorization,

1109
00:48:25,890 --> 00:48:29,790
just like CFAA, but without
authorization is defined.

1110
00:48:29,790 --> 00:48:31,140
And without authorization

1111
00:48:31,140 --> 00:48:33,840
does not include white
hat security research.

1112
00:48:33,840 --> 00:48:34,920
And if you see the definition

1113
00:48:34,920 --> 00:48:37,380
of white hat security
research up there at the top,

1114
00:48:37,380 --> 00:48:41,640
you'll see that a lot of
that also mimics the language

1115
00:48:41,640 --> 00:48:44,826
that was in that section 1201 exception.

1116
00:48:44,826 --> 00:48:46,238
Yes.

1117
00:48:46,238 --> 00:48:50,252
- [Audience Member] Okay, so
(indistinct) cybersecurity,

1118
00:48:50,252 --> 00:48:54,021
and you are (indistinct).

1119
00:48:54,021 --> 00:48:58,563
So who should be concerned
about Missouri state laws,

1120
00:48:58,563 --> 00:49:02,186
is that anyone doing security
research in the United States?

1121
00:49:02,186 --> 00:49:03,776
Or can you be confident

1122
00:49:03,776 --> 00:49:07,095
that you will not be
subject to those laws?

1123
00:49:07,095 --> 00:49:09,678
- You wanna talk, wanna try it?

1124
00:49:10,890 --> 00:49:12,840
- So, there are-

1125
00:49:12,840 --> 00:49:14,490
- Somebody said, "Repeat the question."

1126
00:49:14,490 --> 00:49:15,323
Sorry.

1127
00:49:15,323 --> 00:49:16,830
- So, I guess the question is whether,

1128
00:49:16,830 --> 00:49:19,440
when should someone who's doing
computer security research

1129
00:49:19,440 --> 00:49:20,990
be concerned about Missouri law?

1130
00:49:20,990 --> 00:49:22,800
Is it essentially anyone who's operating

1131
00:49:22,800 --> 00:49:24,540
anywhere on the planet, you know,

1132
00:49:24,540 --> 00:49:25,830
should be concerned about Missouri law,

1133
00:49:25,830 --> 00:49:27,810
given the nature of the internet

1134
00:49:27,810 --> 00:49:32,220
and the jurisdictional
reach of some statutes?

1135
00:49:32,220 --> 00:49:37,220
I guess the short answer
is, and I'll go beyond,

1136
00:49:39,030 --> 00:49:42,630
it depends, but if there are
various jurisdictional bases

1137
00:49:42,630 --> 00:49:43,463
for these statutes.

1138
00:49:43,463 --> 00:49:46,320
So, if you have your victim in the state,

1139
00:49:46,320 --> 00:49:49,020
so, if the computer
accessing is in the state,

1140
00:49:49,020 --> 00:49:51,386
you certainly should be concerned, right?

1141
00:49:51,386 --> 00:49:54,753
If you, yourself, are
located in the state,

1142
00:49:55,590 --> 00:49:56,790
you should be concerned.

1143
00:49:59,400 --> 00:50:00,600
There's a separate question of, like,

1144
00:50:00,600 --> 00:50:05,010
if a company that is
incorporated, sort of,

1145
00:50:05,010 --> 00:50:08,117
but has an office in that, you know,

1146
00:50:08,117 --> 00:50:09,420
if their headquarters is in Missouri,

1147
00:50:09,420 --> 00:50:13,380
but the servers are, the
back end is in California,

1148
00:50:13,380 --> 00:50:16,740
hosted by Amazon or whoever,
do you have to be concerned?

1149
00:50:16,740 --> 00:50:18,453
Not clear, exactly.

1150
00:50:19,350 --> 00:50:22,860
And in the wonderful
world of cloud computing,

1151
00:50:22,860 --> 00:50:24,658
there's the separate question

1152
00:50:24,658 --> 00:50:27,180
of how exactly jurisdiction works.

1153
00:50:27,180 --> 00:50:29,550
I can tell you in those
first two instances though,

1154
00:50:29,550 --> 00:50:31,925
you should definitely be concerned.

1155
00:50:31,925 --> 00:50:34,020
- And how would you know, right?

1156
00:50:34,020 --> 00:50:36,150
How do you know if the
computer that you're accessing

1157
00:50:36,150 --> 00:50:37,140
is in one of these states?

1158
00:50:37,140 --> 00:50:38,820
This is why it is something
that matters to everybody,

1159
00:50:38,820 --> 00:50:40,590
no matter what state you're in.

1160
00:50:40,590 --> 00:50:44,820
Also, get a lawyer who
knows venue and jurisdiction

1161
00:50:44,820 --> 00:50:46,230
and can maybe remove it to federal court.

1162
00:50:46,230 --> 00:50:47,427
Yes?

1163
00:50:47,427 --> 00:50:48,677
- [Audience Member] Do
you have thoughts on if

1164
00:50:49,519 --> 00:50:50,808
(faintly speaking).
(audience and speakers laugh)

1165
00:50:50,808 --> 00:50:54,308
Anyone watching, if you, if a lawyer said,

1166
00:50:57,687 --> 00:51:02,687
I'm gonna challenge this on
computer access (indistinct),

1167
00:51:04,308 --> 00:51:07,607
some state, (indistinct)
federal laws, state law,

1168
00:51:11,976 --> 00:51:16,976
right, (faintly speaking).

1169
00:51:20,754 --> 00:51:24,660
- Right, so, the issue of
consent and authorization

1170
00:51:24,660 --> 00:51:26,760
often kind of merge.

1171
00:51:26,760 --> 00:51:29,583
But I think conceptually
for the wiretap act,

1172
00:51:30,503 --> 00:51:35,280
18 USC 2511 and the Computer
Fraud and Abuse Act,

1173
00:51:36,720 --> 00:51:37,920
they're actually quite separable.

1174
00:51:37,920 --> 00:51:40,770
So, the idea of having two party consents,

1175
00:51:40,770 --> 00:51:44,310
both parties on the line,
consenting is a requirement for,

1176
00:51:44,310 --> 00:51:46,444
I think, 12 states across the country.

1177
00:51:46,444 --> 00:51:50,550
I don't think that those map
to any sort of comparable

1178
00:51:50,550 --> 00:51:54,303
language in those state's computer laws.

1179
00:51:57,090 --> 00:51:57,930
- All right.

1180
00:51:57,930 --> 00:52:01,090
I wanna cover this international
aspect of the law as well.

1181
00:52:02,400 --> 00:52:05,310
And then we are barreling
towards the round table portion.

1182
00:52:05,310 --> 00:52:06,300
So, I hope that there are more questions,

1183
00:52:06,300 --> 00:52:08,700
that we haven't answered them all already.

1184
00:52:08,700 --> 00:52:13,700
So, in 2021, China publicized
after a comment period,

1185
00:52:14,670 --> 00:52:17,700
it publicized a coordinated
vulnerability disclosure

1186
00:52:17,700 --> 00:52:19,759
and patching law.

1187
00:52:19,759 --> 00:52:22,320
It is the Regulations on the Management

1188
00:52:22,320 --> 00:52:25,546
of Security Vulnerabilities
of Network Products.

1189
00:52:25,546 --> 00:52:30,546
And this law requires companies

1190
00:52:31,470 --> 00:52:33,510
to have vulnerability disclosure policies.

1191
00:52:33,510 --> 00:52:34,410
That's great.

1192
00:52:34,410 --> 00:52:37,683
It requires patching of
vulnerabilities, this is required.

1193
00:52:38,610 --> 00:52:41,370
It also, though, requires vendors

1194
00:52:41,370 --> 00:52:43,830
to disclose vulnerabilities
to the government

1195
00:52:43,830 --> 00:52:45,690
within two days of discovery.

1196
00:52:45,690 --> 00:52:47,460
So, you discover the vulnerability,

1197
00:52:47,460 --> 00:52:49,110
you flow it up to the government.

1198
00:52:49,110 --> 00:52:50,310
Two days, that is gonna be a lot

1199
00:52:50,310 --> 00:52:52,020
of unpatchable vulnerabilities.

1200
00:52:52,020 --> 00:52:53,670
Researchers, believe it or not,

1201
00:52:53,670 --> 00:52:56,340
are actually kind of encouraged.

1202
00:52:56,340 --> 00:52:58,950
There's, you're encouraged
to have bug bounties,

1203
00:52:58,950 --> 00:53:00,548
if you're a vendor.

1204
00:53:00,548 --> 00:53:03,630
But remember, the
vulnerabilities that you hear

1205
00:53:03,630 --> 00:53:06,570
flow up to the government
within about two days.

1206
00:53:06,570 --> 00:53:09,870
Now, what is very different
from the, sort of the way

1207
00:53:09,870 --> 00:53:12,420
that we are used to things here in the US,

1208
00:53:12,420 --> 00:53:16,650
is that there is a strict
restriction on public disclosure

1209
00:53:16,650 --> 00:53:20,010
of the vulnerabilities
and a strict restriction

1210
00:53:20,010 --> 00:53:21,450
on publishing tools.

1211
00:53:21,450 --> 00:53:24,780
So, as a security
researcher, under this law,

1212
00:53:24,780 --> 00:53:26,100
now at least under the letter of the law,

1213
00:53:26,100 --> 00:53:27,930
can't speak to how it's
enforced on the ground,

1214
00:53:27,930 --> 00:53:28,980
I have no visibility into that,

1215
00:53:28,980 --> 00:53:30,300
but the letter of the law

1216
00:53:30,300 --> 00:53:32,670
is that you must report the vulnerability

1217
00:53:32,670 --> 00:53:35,308
either to the vendor or to the government.

1218
00:53:35,308 --> 00:53:36,141
Those are your options.

1219
00:53:36,141 --> 00:53:37,440
And remember if you
report it to the vendor,

1220
00:53:37,440 --> 00:53:39,930
the vendor reports it directly
to the government, anyway.

1221
00:53:39,930 --> 00:53:42,630
So, you know, bug bounties, CVD,

1222
00:53:42,630 --> 00:53:45,905
and it flows to the government.

1223
00:53:45,905 --> 00:53:50,730
And the penalties for violating this

1224
00:53:50,730 --> 00:53:51,660
can include imprisonment.

1225
00:53:51,660 --> 00:53:54,390
I mean, it is a criminal law.

1226
00:53:54,390 --> 00:53:56,220
But it also includes things
like administrative fines.

1227
00:53:56,220 --> 00:53:58,980
I mean, there's a wide array of penalties.

1228
00:53:58,980 --> 00:54:02,730
So, this is in stark contrast,
sort of to the direction

1229
00:54:02,730 --> 00:54:05,190
that we are moving in with the
United States, where it comes

1230
00:54:05,190 --> 00:54:07,950
to adopting coordinated
vulnerability disclosure,

1231
00:54:07,950 --> 00:54:10,320
sort of, you know, recognizing
the hacker community

1232
00:54:10,320 --> 00:54:11,730
in our criminal laws,

1233
00:54:11,730 --> 00:54:15,120
and also, you know, continuing
to preserve the ability

1234
00:54:15,120 --> 00:54:16,970
to disclose vulnerabilities publicly.

1235
00:54:18,390 --> 00:54:19,484
You wanna add anything?

1236
00:54:19,484 --> 00:54:20,317
No.

1237
00:54:20,317 --> 00:54:22,167
So, this is the last slide.

1238
00:54:22,167 --> 00:54:23,850
Well, last substantive slide.

1239
00:54:23,850 --> 00:54:25,880
So, where do we go for here?

1240
00:54:25,880 --> 00:54:28,500
And just wanna wheel it back to the point

1241
00:54:28,500 --> 00:54:29,670
that we made at the beginning

1242
00:54:29,670 --> 00:54:32,310
that a lot of the researcher community

1243
00:54:32,310 --> 00:54:33,630
had previously been focused

1244
00:54:33,630 --> 00:54:35,160
on the Computer Fraud and Abuse Act,

1245
00:54:35,160 --> 00:54:36,810
but that exceeds authorized access,

1246
00:54:36,810 --> 00:54:40,800
terms of service problems,
and section 1201 of the DMCA.

1247
00:54:40,800 --> 00:54:43,290
I would argue that you can still do that.

1248
00:54:43,290 --> 00:54:45,210
Those things are absolutely not perfect,

1249
00:54:45,210 --> 00:54:47,520
but you're not gonna get
the same bang for your buck

1250
00:54:47,520 --> 00:54:50,550
that you had prior to 2021, right?

1251
00:54:50,550 --> 00:54:53,970
Now, areas of greater
legal risk would argue

1252
00:54:53,970 --> 00:54:56,490
are in the US states, which have not had

1253
00:54:56,490 --> 00:54:59,670
any of that same evolution as federal law.

1254
00:54:59,670 --> 00:55:03,834
International laws like China's
CVD law is another big one.

1255
00:55:03,834 --> 00:55:07,110
Speaking of CVD, another area to focus on

1256
00:55:07,110 --> 00:55:08,760
is a continued adoption

1257
00:55:08,760 --> 00:55:10,380
of coordinated vulnerability disclosure

1258
00:55:10,380 --> 00:55:11,760
with private companies.

1259
00:55:11,760 --> 00:55:12,930
And one reason for that is,

1260
00:55:12,930 --> 00:55:15,450
remember not all of the
protections under CFAA

1261
00:55:15,450 --> 00:55:17,010
apply to private lawsuits.

1262
00:55:17,010 --> 00:55:20,940
Those are often the greater
threat than criminal liability.

1263
00:55:20,940 --> 00:55:24,810
And for section 1201 of
the DMCA, that protection,

1264
00:55:24,810 --> 00:55:27,577
although it comes up for
renewal every three years,

1265
00:55:27,577 --> 00:55:29,910
I'm relatively confident,

1266
00:55:29,910 --> 00:55:31,710
it is pretty baked at this point.

1267
00:55:31,710 --> 00:55:33,360
We may be able to improve it some further,

1268
00:55:33,360 --> 00:55:35,940
but I doubt that, unless
there's a major event,

1269
00:55:35,940 --> 00:55:37,590
that we would do a lot of backsliding,

1270
00:55:37,590 --> 00:55:40,080
what does need improvements in a major way

1271
00:55:40,080 --> 00:55:41,670
is the trafficking portion.

1272
00:55:41,670 --> 00:55:43,590
So, I actually think that this is

1273
00:55:43,590 --> 00:55:46,110
what we talked about here today,

1274
00:55:46,110 --> 00:55:48,750
the progress on CFAA, DMCA,

1275
00:55:48,750 --> 00:55:50,550
is in part due in large part

1276
00:55:50,550 --> 00:55:53,070
due to security community advocacy.

1277
00:55:53,070 --> 00:55:54,660
It has been a powerful force,

1278
00:55:54,660 --> 00:55:57,000
but now let's turn it towards the areas

1279
00:55:57,000 --> 00:56:00,755
of greater legal risk
and especially the states

1280
00:56:00,755 --> 00:56:04,020
where we are all from
and where our lawmakers

1281
00:56:04,020 --> 00:56:06,780
have similar processes
to the federal lawmakers.

1282
00:56:06,780 --> 00:56:08,130
I think that that is the next area

1283
00:56:08,130 --> 00:56:10,973
where we can get the best bang
for our buck in our advocacy.

1284
00:56:12,840 --> 00:56:17,840
And that is the security research
exception from 1201, DMCA,

1285
00:56:18,090 --> 00:56:18,923
if you wanna look at it some more.

1286
00:56:18,923 --> 00:56:20,280
I figured we might end up talking about it

1287
00:56:20,280 --> 00:56:22,803
in this Q and A session, which begins now.

1288
00:56:24,742 --> 00:56:25,743
Yes, please.

1289
00:56:28,062 --> 00:56:31,830
- First of all, thanks
for coming to the GSMA

1290
00:56:31,830 --> 00:56:34,230
to present on the China law.

1291
00:56:34,230 --> 00:56:37,500
So, I'm the chair of the
GSMA fraud security group.

1292
00:56:37,500 --> 00:56:40,080
We have an industry CVD scheme,

1293
00:56:40,080 --> 00:56:42,360
So, it's still quite unclear to us.

1294
00:56:42,360 --> 00:56:45,729
We have asked MIIT what the situation is

1295
00:56:45,729 --> 00:56:47,400
and not got a response.

1296
00:56:47,400 --> 00:56:50,640
So, you know, for
companies that are involved

1297
00:56:50,640 --> 00:56:53,130
in our CVD committee,
some of which are Chinese,

1298
00:56:53,130 --> 00:56:54,990
whether they have to disclose
those vulnerabilities.

1299
00:56:54,990 --> 00:56:57,262
So, that that's the
first point I wanna make,

1300
00:56:57,262 --> 00:56:58,167
which is of concern.

1301
00:56:58,167 --> 00:57:01,380
And the second one is from, on
the international law aspect.

1302
00:57:01,380 --> 00:57:03,930
So, in the UK, we have the,

1303
00:57:03,930 --> 00:57:05,220
what's called the PSTI bill

1304
00:57:05,220 --> 00:57:06,540
going through parliament right now,

1305
00:57:06,540 --> 00:57:07,680
which is the Product Security

1306
00:57:07,680 --> 00:57:09,150
and Telecommunications
Infrastructure bill,

1307
00:57:09,150 --> 00:57:12,450
which is our IoT act when it gets passed.

1308
00:57:12,450 --> 00:57:13,550
And in that,

1309
00:57:13,550 --> 00:57:17,035
there'll be a requirement
for companies to provide CVD

1310
00:57:17,035 --> 00:57:19,230
and that a lot of that work

1311
00:57:19,230 --> 00:57:21,660
has been promoted really from here.

1312
00:57:21,660 --> 00:57:24,030
So, thanks everyone for getting that,

1313
00:57:24,030 --> 00:57:26,010
just close to the line
and getting into last.

1314
00:57:26,010 --> 00:57:27,573
So, thank you.

1315
00:57:27,573 --> 00:57:29,940
- Absolutely, the proliferation

1316
00:57:29,940 --> 00:57:32,730
of coordinated vulnerability
disclosure policies

1317
00:57:32,730 --> 00:57:35,490
and standards, I think
it deserves its own talk

1318
00:57:35,490 --> 00:57:36,323
of similar length,

1319
00:57:36,323 --> 00:57:38,492
but that is another major area of progress

1320
00:57:38,492 --> 00:57:41,257
from the hacker community into policy.

1321
00:57:41,257 --> 00:57:45,303
Peter, so you were,

1322
00:57:47,190 --> 00:57:48,150
the UK is looking

1323
00:57:48,150 --> 00:57:50,640
at the computer misuse act also, right?

1324
00:57:50,640 --> 00:57:53,070
And one of the things that the government

1325
00:57:53,070 --> 00:57:54,090
is considering there,

1326
00:57:54,090 --> 00:57:55,620
I think one of the
questions that they asked

1327
00:57:55,620 --> 00:57:57,540
was should there be an explicit protection

1328
00:57:57,540 --> 00:57:58,530
for security researchers?

1329
00:57:58,530 --> 00:57:59,580
Do I have that right?

1330
00:58:00,660 --> 00:58:01,830
- Yeah, so, I'm David.

1331
00:58:01,830 --> 00:58:03,130
Peter is around this week.

1332
00:58:04,200 --> 00:58:07,860
Yeah, so, the home office
has consulted on this.

1333
00:58:07,860 --> 00:58:09,030
And I think at the moment,

1334
00:58:09,030 --> 00:58:11,490
they're kind of quite
busy with other things,

1335
00:58:11,490 --> 00:58:13,440
but that's what they're looking at.

1336
00:58:13,440 --> 00:58:16,590
And I think, clearly, you
know, the precedent work

1337
00:58:16,590 --> 00:58:17,790
that's happening in the United States

1338
00:58:17,790 --> 00:58:18,960
is gonna feed into that.

1339
00:58:18,960 --> 00:58:20,790
So, I personally was quite pleased

1340
00:58:20,790 --> 00:58:23,700
to see all of this because we
can put that into that work.

1341
00:58:23,700 --> 00:58:28,673
I think there's a lot of, kind
of input needs to go into it.

1342
00:58:28,673 --> 00:58:31,530
There's a maturity of
thinking that needs to happen.

1343
00:58:31,530 --> 00:58:33,870
So, on the PSTI bill, actually,

1344
00:58:33,870 --> 00:58:35,310
when it went to the House of Lords,

1345
00:58:35,310 --> 00:58:37,680
which is our upper house,

1346
00:58:37,680 --> 00:58:41,670
there were questions raised about whether,

1347
00:58:41,670 --> 00:58:44,160
by putting CVD into law,

1348
00:58:44,160 --> 00:58:47,550
that they're creating a
defense for malicious hacking.

1349
00:58:47,550 --> 00:58:49,800
And so, then it got into this kind of,

1350
00:58:49,800 --> 00:58:51,960
basically Letters of Marque discussion,

1351
00:58:51,960 --> 00:58:55,563
which I don't think we wanna
go down that road to be honest.

1352
00:58:57,992 --> 00:59:01,620
- So, I mean, the UK
right now has a process

1353
00:59:01,620 --> 00:59:03,360
where they're looking at
the Computer Misuse Act,

1354
00:59:03,360 --> 00:59:05,400
it's sort of their version of the CFAA.

1355
00:59:05,400 --> 00:59:08,134
So, if you have contacts
with the UK government,

1356
00:59:08,134 --> 00:59:10,200
or if you want to get involved with that,

1357
00:59:10,200 --> 00:59:12,540
see David, and see about weighing in.

1358
00:59:12,540 --> 00:59:15,660
And that is an area of open
consultation right now,

1359
00:59:15,660 --> 00:59:17,850
looking at potential legal protections

1360
00:59:17,850 --> 00:59:19,530
for researchers in the UK.

1361
00:59:19,530 --> 00:59:20,363
Yes, Ameet?

1362
00:59:20,363 --> 00:59:21,196
- [Audience Member] Follow up question.

1363
00:59:21,196 --> 00:59:23,553
Oh, I'm sorry, follow up question on this?

1364
00:59:27,027 --> 00:59:28,890
- If I ask, as you can tell
on from the UK as well,

1365
00:59:28,890 --> 00:59:31,149
accent kind of gives it away.

1366
00:59:31,149 --> 00:59:35,070
One of the dangers that
we're looking at in the UK

1367
00:59:35,070 --> 00:59:39,004
with that rethink of
the Computer Misuse Act

1368
00:59:39,004 --> 00:59:41,160
is organizations in the UK

1369
00:59:41,160 --> 00:59:43,620
trying to define cyber
security researchers

1370
00:59:43,620 --> 00:59:47,190
as people who have
received a certification

1371
00:59:47,190 --> 00:59:49,350
handed out by government department,

1372
00:59:49,350 --> 00:59:52,200
and who have registered
on a government list

1373
00:59:52,200 --> 00:59:55,950
as being validated security researchers.

1374
00:59:55,950 --> 00:59:57,600
And that's one of the big problems,

1375
00:59:57,600 --> 00:59:59,670
and one of the dangers
that we're seeing in the UK

1376
00:59:59,670 --> 01:00:02,809
is that their definition
of cybersecurity researcher

1377
01:00:02,809 --> 01:00:04,470
is kind of being pushed

1378
01:00:04,470 --> 01:00:08,070
towards a government-approved
cybersecurity researcher,

1379
01:00:08,070 --> 01:00:11,550
which is a danger that
we need to fight against

1380
01:00:11,550 --> 01:00:14,100
and an ongoing struggle with this review

1381
01:00:14,100 --> 01:00:15,360
of the Computer Misuse Act,

1382
01:00:15,360 --> 01:00:18,030
because we kind of don't
wanna lock out people

1383
01:00:18,030 --> 01:00:21,686
who are not government
sanctioned in some way.

1384
01:00:21,686 --> 01:00:22,770
- Yeah, absolutely.

1385
01:00:22,770 --> 01:00:24,150
I'm glad you raised that.

1386
01:00:24,150 --> 01:00:25,800
That's absolutely real.

1387
01:00:25,800 --> 01:00:28,170
So, the UK government also
put out a consultation

1388
01:00:28,170 --> 01:00:31,710
on certification for
cybersecurity professionals,

1389
01:00:31,710 --> 01:00:33,090
and this would be certification

1390
01:00:33,090 --> 01:00:36,483
for a variety of cybersecurity
professional jobs.

1391
01:00:37,590 --> 01:00:41,970
If you work in the UK or if
your work touches the UK,

1392
01:00:41,970 --> 01:00:46,020
this affects you, but one of
them was security researchers,

1393
01:00:46,020 --> 01:00:48,420
and yes, it lends itself to being

1394
01:00:48,420 --> 01:00:50,220
on an approved government list,

1395
01:00:50,220 --> 01:00:53,760
being a certified in order
to conduct security research,

1396
01:00:53,760 --> 01:00:56,850
which is, I mean, a huge barrier to entry

1397
01:00:56,850 --> 01:00:58,980
for a, what is in the
United States, at least,

1398
01:00:58,980 --> 01:01:00,783
a very decentralized community.

1399
01:01:02,610 --> 01:01:05,793
Yes, and sorry, Ameet,
that was UK specific.

1400
01:01:06,654 --> 01:01:10,203
- [Ameet] Okay, wanted
to quickly follow up

1401
01:01:10,203 --> 01:01:14,070
on the issue of public
exposure program requirements

1402
01:01:14,070 --> 01:01:17,190
and CPC requirements as
well as the bug bounties.

1403
01:01:17,190 --> 01:01:21,413
And through (indistinct)
mechanisms in particular,

1404
01:01:21,413 --> 01:01:23,070
and this is a committee to also shed light

1405
01:01:23,070 --> 01:01:26,163
on what is tremendous wonderful work

1406
01:01:26,163 --> 01:01:28,160
from the Department of Justice,

1407
01:01:28,160 --> 01:01:30,306
which was submitted in 2017

1408
01:01:30,306 --> 01:01:32,340
which is the framework
for considerations, right,

1409
01:01:32,340 --> 01:01:34,740
for how to coordinated
vulnerability disclosure,

1410
01:01:34,740 --> 01:01:36,840
which also included a provision that talks

1411
01:01:36,840 --> 01:01:39,750
about potential implications of the CFAA,

1412
01:01:39,750 --> 01:01:41,160
as well as encouragement

1413
01:01:41,160 --> 01:01:43,666
for organizations to include
the explicit language

1414
01:01:43,666 --> 01:01:47,340
in the vulnerability disclosure
program bounty contract

1415
01:01:47,340 --> 01:01:50,070
that exempts good faith security research

1416
01:01:50,070 --> 01:01:54,570
and specifically authorizes
the testing, right,

1417
01:01:54,570 --> 01:01:56,676
under the CFAA and DCMA.

1418
01:01:56,676 --> 01:01:59,905
And this is as early as
2017, and then we've seen

1419
01:01:59,905 --> 01:02:02,940
how the growth of these
quote-unquote, "safe harbor,"

1420
01:02:02,940 --> 01:02:04,910
or exceptions of language in contracts

1421
01:02:04,910 --> 01:02:08,220
in vulnerability disclosure
programs and bug bounties,

1422
01:02:08,220 --> 01:02:10,328
you know, for the 20 or 30 programs

1423
01:02:10,328 --> 01:02:11,587
raised into thousands, right,

1424
01:02:11,587 --> 01:02:13,650
has influenced the discussion

1425
01:02:13,650 --> 01:02:15,590
of what your doing in the CFAA.

1426
01:02:15,590 --> 01:02:17,670
So, I guess my question to you,

1427
01:02:17,670 --> 01:02:21,660
we know that in the the
kind of background of reform

1428
01:02:21,660 --> 01:02:25,448
of, you know, legislative,
of statutes, federal laws,

1429
01:02:25,448 --> 01:02:27,450
the CFAA, and the work
we're doing on legislation,

1430
01:02:27,450 --> 01:02:30,540
we still have the market
and contractual mechanisms,

1431
01:02:30,540 --> 01:02:33,658
especially ones that are
adopted to scales and standards

1432
01:02:33,658 --> 01:02:35,257
like disclosures and others,

1433
01:02:35,257 --> 01:02:37,230
that can progress the conversation.

1434
01:02:37,230 --> 01:02:40,860
So with that process, with the
requirements for legislation,

1435
01:02:40,860 --> 01:02:42,150
where do you see,

1436
01:02:42,150 --> 01:02:44,760
and we already have some
safe harbor provisions

1437
01:02:44,760 --> 01:02:46,260
and kinda awareness for the need

1438
01:02:46,260 --> 01:02:49,915
to have those explicit
exemptions from the CFAA

1439
01:02:49,915 --> 01:02:51,660
with VDPs and bug bounties.

1440
01:02:51,660 --> 01:02:53,427
Where do you see the next area

1441
01:02:53,427 --> 01:02:54,990
of norms and practical mechanisms

1442
01:02:54,990 --> 01:02:57,107
that can be developed by the market,

1443
01:02:57,107 --> 01:03:00,510
by the corporations that kind
of promoting their adoption

1444
01:03:00,510 --> 01:03:02,520
to really drive the change in addition

1445
01:03:02,520 --> 01:03:04,290
to reforms of policy levels?

1446
01:03:04,290 --> 01:03:05,220
So, that's one question.

1447
01:03:05,220 --> 01:03:06,780
And if we have time later,

1448
01:03:06,780 --> 01:03:08,455
I'm really interested in your take

1449
01:03:08,455 --> 01:03:12,081
on how the growth of
incident reporting, right,

1450
01:03:12,081 --> 01:03:13,521
cybersecurity reporting,

1451
01:03:13,521 --> 01:03:15,440
and we have seen cybersecurity exemption

1452
01:03:15,440 --> 01:03:16,650
in (indistinct) as well,

1453
01:03:16,650 --> 01:03:19,290
kind of interacting with the CFAA,

1454
01:03:19,290 --> 01:03:22,200
especially because of
the concept of incident

1455
01:03:22,200 --> 01:03:24,750
and this ability to have
maybe near misses, right?

1456
01:03:24,750 --> 01:03:26,490
So, not just confirmed incidents.

1457
01:03:26,490 --> 01:03:28,890
How do you see that growth
of legislation in the US,

1458
01:03:28,890 --> 01:03:31,640
and of course federal
law in United States,

1459
01:03:31,640 --> 01:03:34,796
but also the UK impacting
the anti-hacking landscape.

1460
01:03:34,796 --> 01:03:36,900
- Let's take the first part
of that question first.

1461
01:03:36,900 --> 01:03:39,092
And I wanna put, and let's,

1462
01:03:39,092 --> 01:03:41,593
do you want to answer the CVD question?

1463
01:03:41,593 --> 01:03:42,426
- No, you're fine.

1464
01:03:42,426 --> 01:03:44,763
- I want to put Art Manion on the spot.

1465
01:03:46,230 --> 01:03:50,070
You heard Ameet's question
about the next frontier

1466
01:03:50,070 --> 01:03:52,964
for CVD in the marketplace.

1467
01:03:52,964 --> 01:03:54,123
What do you think?

1468
01:03:55,140 --> 01:03:56,031
- [Art] Well

1469
01:03:56,031 --> 01:03:58,253
- Can we get you a
microphone, would be good.

1470
01:03:58,253 --> 01:04:00,453
- That's true, good thinking.

1471
01:04:02,910 --> 01:04:05,130
- And reminder that the
microphones don't have a speaker,

1472
01:04:05,130 --> 01:04:06,660
that's for the stream.

1473
01:04:06,660 --> 01:04:08,274
So, we still have to project.

1474
01:04:08,274 --> 01:04:11,703
- I did hear, I mostly tracked Ameet.

1475
01:04:13,184 --> 01:04:16,219
Let's see, so, I think
you've touched on them here.

1476
01:04:16,219 --> 01:04:19,756
And then Ameet with the
commercial contractual stuff hard.

1477
01:04:19,756 --> 01:04:23,100
So, bug bounty related,
disclosure policy related,

1478
01:04:23,100 --> 01:04:26,430
safe harbor, but not in strict
legal, safe harbor terms,

1479
01:04:26,430 --> 01:04:28,140
but I appreciate right.

1480
01:04:28,140 --> 01:04:29,520
Good faith security research.

1481
01:04:29,520 --> 01:04:32,040
So, contractually and in bug
bounty and disclosure programs,

1482
01:04:32,040 --> 01:04:35,040
I think there's going to be
progress there, all right,

1483
01:04:35,040 --> 01:04:38,130
if people are agreeing and
planning with those agreements,

1484
01:04:38,130 --> 01:04:39,510
there's less likely to be any conflict

1485
01:04:39,510 --> 01:04:42,480
to whether civil or, you know, recognition

1486
01:04:42,480 --> 01:04:44,930
from a government perhaps
or federal prosecution.

1487
01:04:46,858 --> 01:04:48,733
The Chinese law is a good example.

1488
01:04:48,733 --> 01:04:50,433
It's concerned a lot of us,

1489
01:04:51,747 --> 01:04:53,370
although the implications are
not clear yet, I don't think,

1490
01:04:53,370 --> 01:04:57,090
but what if, how many countries
are there on the planet?

1491
01:04:57,090 --> 01:04:59,910
200-some, if you, depending how you count,

1492
01:04:59,910 --> 01:05:01,710
what if every sovereign state

1493
01:05:01,710 --> 01:05:03,900
has its own report to the government law

1494
01:05:03,900 --> 01:05:05,310
with different numbers of days

1495
01:05:05,310 --> 01:05:07,110
and different industries and things.

1496
01:05:07,110 --> 01:05:10,470
So, that has the potential
to get really messy.

1497
01:05:10,470 --> 01:05:14,790
And I'm sure particularly
a multinational corporation

1498
01:05:14,790 --> 01:05:18,060
or a researcher who works
across, you know, country lines

1499
01:05:18,060 --> 01:05:21,270
would appreciate something
more globally standard

1500
01:05:21,270 --> 01:05:24,270
as opposed to, you know,
needing a third party,

1501
01:05:24,270 --> 01:05:25,590
to tell them how to talk to this country,

1502
01:05:25,590 --> 01:05:27,480
that country, that country.

1503
01:05:27,480 --> 01:05:30,693
I think that could be a mess,
but the jury's out still.

1504
01:05:31,605 --> 01:05:32,438
- [Harley] Do you have a view

1505
01:05:32,438 --> 01:05:37,050
as to where CVD adoption might spike next?

1506
01:05:37,050 --> 01:05:38,220
Like, are there sectors

1507
01:05:38,220 --> 01:05:40,270
or is it just sort of company by company?

1508
01:05:42,373 --> 01:05:45,360
- I don't think I have
a real viewer opinion.

1509
01:05:45,360 --> 01:05:48,210
There's a lot of progress,
which is great to see.

1510
01:05:48,210 --> 01:05:50,904
UK was mentioned, the rest of Europe

1511
01:05:50,904 --> 01:05:54,360
in the ENISA, and the NIS
2 has a disclosure stuff

1512
01:05:54,360 --> 01:05:55,200
built in there, I believe.

1513
01:05:55,200 --> 01:05:56,130
I think it's gonna go through.

1514
01:05:56,130 --> 01:05:59,523
So, you know, those are signs of progress

1515
01:05:59,523 --> 01:06:01,140
that the Chinese stuff is concerning.

1516
01:06:01,140 --> 01:06:02,490
But again, I'll speak for myself.

1517
01:06:02,490 --> 01:06:04,860
I'm reading a English Google translation.

1518
01:06:04,860 --> 01:06:07,680
Don't know how the law is
actually implemented in country.

1519
01:06:07,680 --> 01:06:08,943
So, not sure yet.

1520
01:06:09,949 --> 01:06:11,490
- So, I guess for my own part,

1521
01:06:11,490 --> 01:06:16,490
I don't know where the
next sectors of the economy

1522
01:06:16,620 --> 01:06:19,290
or sectors of the market
that will implement CVD

1523
01:06:19,290 --> 01:06:22,650
will be like where the, sort
of the low hanging fruit is.

1524
01:06:22,650 --> 01:06:24,240
But I know that you've
noticed the same thing,

1525
01:06:24,240 --> 01:06:27,090
which is that coordinated
vulnerability disclosure policies

1526
01:06:27,090 --> 01:06:30,480
are now being built into a
lot of cybersecurity laws.

1527
01:06:30,480 --> 01:06:32,730
So, the Infrastructure
Incident Reporting Act

1528
01:06:32,730 --> 01:06:34,380
has a nod towards it.

1529
01:06:34,380 --> 01:06:36,480
There are laws like, you know,

1530
01:06:36,480 --> 01:06:39,510
think like the IoT Cybersecurity
and Innovation Act, right?

1531
01:06:39,510 --> 01:06:41,550
That had a requirement that if you are

1532
01:06:41,550 --> 01:06:43,830
gonna sell IoT to the
government, that you must

1533
01:06:43,830 --> 01:06:46,426
have a coordinated
vulnerability disclosure policy.

1534
01:06:46,426 --> 01:06:47,700
This too, which is like

1535
01:06:47,700 --> 01:06:50,130
a critical infrastructure protection law

1536
01:06:50,130 --> 01:06:51,780
that is being proposed in Europe

1537
01:06:51,780 --> 01:06:53,040
is at a pretty advanced stage,

1538
01:06:53,040 --> 01:06:56,430
requires coordinated
vulnerability disclosure policies.

1539
01:06:56,430 --> 01:06:59,610
We're seeing it in a
lot of sort regulations

1540
01:06:59,610 --> 01:07:02,160
that you may not even expect
from different agencies

1541
01:07:02,160 --> 01:07:03,990
for, just for their particular sector

1542
01:07:03,990 --> 01:07:06,210
are at the very least promoting

1543
01:07:06,210 --> 01:07:08,060
coordinated vulnerability disclosure.

1544
01:07:08,970 --> 01:07:11,108
You had mentioned, oh please.

1545
01:07:11,108 --> 01:07:12,672
- Well, I was good.

1546
01:07:12,672 --> 01:07:14,370
Just comes though,
'cause my company's also

1547
01:07:14,370 --> 01:07:16,770
been tracking the implementation of CVD

1548
01:07:16,770 --> 01:07:19,350
by IOT companies over the past five years.

1549
01:07:19,350 --> 01:07:21,000
And we're just about to
do the research again.

1550
01:07:21,000 --> 01:07:24,120
So, we look at about 330 companies

1551
01:07:24,120 --> 01:07:27,930
that are sort of the top IoT products

1552
01:07:27,930 --> 01:07:29,433
in countries across the world.

1553
01:07:30,330 --> 01:07:33,690
We started out, it was
less than 10% of companies

1554
01:07:33,690 --> 01:07:37,140
had any way for security
researchers to contact them.

1555
01:07:37,140 --> 01:07:41,940
And that includes, you know,
the security dot text as well

1556
01:07:41,940 --> 01:07:44,253
and looking around a website, and so on.

1557
01:07:45,117 --> 01:07:46,890
And that only increased,

1558
01:07:46,890 --> 01:07:51,270
even in light of all of this
global activity promoting CVD,

1559
01:07:51,270 --> 01:07:54,750
that only increased to less than 20%

1560
01:07:54,750 --> 01:07:56,790
in our last year's survey.

1561
01:07:56,790 --> 01:07:58,440
So, even with the threat of regulation,

1562
01:07:58,440 --> 01:08:02,853
even with laws in place, there's
a huge amount of companies,

1563
01:08:02,853 --> 01:08:07,170
you know, four in five IoT
companies are not doing anything.

1564
01:08:07,170 --> 01:08:09,300
And that's just a bit that you can see.

1565
01:08:09,300 --> 01:08:10,650
So, it is really concerning to me.

1566
01:08:10,650 --> 01:08:12,969
I mean, you know, when the laws come in,

1567
01:08:12,969 --> 01:08:15,115
I'm hoping that obviously
the stick comes out

1568
01:08:15,115 --> 01:08:16,590
and they actually do something.

1569
01:08:16,590 --> 01:08:17,490
But it'll be really interesting

1570
01:08:17,490 --> 01:08:19,560
to see what happens this year
and next year in our survey.

1571
01:08:19,560 --> 01:08:22,620
And if there's this
massive increase or not.

1572
01:08:22,620 --> 01:08:23,700
- There's this trope, right,

1573
01:08:23,700 --> 01:08:25,590
that policy and regulation

1574
01:08:25,590 --> 01:08:28,530
is always way behind where
the private sector is.

1575
01:08:28,530 --> 01:08:29,460
I don't think that's true

1576
01:08:29,460 --> 01:08:31,890
for coordinated vulnerability disclosure.

1577
01:08:31,890 --> 01:08:34,920
We're seeing it built into a
lot of cyber security laws,

1578
01:08:34,920 --> 01:08:36,990
best practices, you know,
guides, things like that

1579
01:08:36,990 --> 01:08:41,670
out of DC, at least,
the UK, the EU, China.

1580
01:08:41,670 --> 01:08:44,550
And I think that it's representation

1581
01:08:44,550 --> 01:08:46,110
in new cyber security regulations

1582
01:08:46,110 --> 01:08:49,560
is more broad than where we're seeing it

1583
01:08:49,560 --> 01:08:51,060
actually in the marketplace.

1584
01:08:51,060 --> 01:08:52,320
So, there is still a lot of catch up.

1585
01:08:52,320 --> 01:08:54,240
I would not, I'm optimistic because it is

1586
01:08:54,240 --> 01:08:55,410
making its way into policy,

1587
01:08:55,410 --> 01:08:56,970
but there is still a long way to go

1588
01:08:56,970 --> 01:08:58,833
in terms of actual adoption.

1589
01:09:01,507 --> 01:09:04,747
- [Audience Member] Very
briefly, between CFAA and DMCA,

1590
01:09:04,747 --> 01:09:09,300
is the question good faith
one of law, or what about?

1591
01:09:09,300 --> 01:09:11,010
And for the non-lawyers in the audience,

1592
01:09:11,010 --> 01:09:13,013
what does that mean, and
why should they care?

1593
01:09:14,940 --> 01:09:15,927
- So, the question was whether
the good faith exception

1594
01:09:15,927 --> 01:09:20,927
is a matter of law or policy, I guess,

1595
01:09:22,860 --> 01:09:26,043
and why should folks care?

1596
01:09:27,450 --> 01:09:32,280
So, in regard to the CFAA
and the federal policy,

1597
01:09:32,280 --> 01:09:34,431
it is a matter of policy, right?

1598
01:09:34,431 --> 01:09:36,240
So, it is not written into the law

1599
01:09:36,240 --> 01:09:38,520
and that has certain dangers.

1600
01:09:38,520 --> 01:09:40,280
Folks have flagged that that means

1601
01:09:40,280 --> 01:09:42,120
it is possible that another administration

1602
01:09:42,120 --> 01:09:43,380
could have a different view of this,

1603
01:09:43,380 --> 01:09:44,700
or a different attorney general

1604
01:09:44,700 --> 01:09:47,313
or different, another head
of the criminal division.

1605
01:09:49,620 --> 01:09:51,690
I will say that we have
a number of policies

1606
01:09:51,690 --> 01:09:53,220
that I think are comparable

1607
01:09:53,220 --> 01:09:56,520
that have persisted across
multiple administrations.

1608
01:09:56,520 --> 01:10:00,150
And they had not, as a matter of course,

1609
01:10:00,150 --> 01:10:03,510
like changed every four years
or anything like of that sort,

1610
01:10:03,510 --> 01:10:05,430
but that is one important distinction

1611
01:10:05,430 --> 01:10:09,003
that if it's written into law,
it is less likely to change.

1612
01:10:09,900 --> 01:10:12,390
The reason it's not is
because it's very difficult

1613
01:10:12,390 --> 01:10:15,393
to get anything written
into law right now.

1614
01:10:16,367 --> 01:10:17,816
(audience and speakers laugh)

1615
01:10:17,816 --> 01:10:20,970
So, this is not a bad second to that.

1616
01:10:20,970 --> 01:10:23,370
- Congress can spend trillions of dollars,

1617
01:10:23,370 --> 01:10:24,870
but they can't change the law.

1618
01:10:24,870 --> 01:10:27,810
- I did wanna jump on one
issue about bug bounties

1619
01:10:27,810 --> 01:10:30,840
that just prompted something
I wanted to kind of say

1620
01:10:30,840 --> 01:10:33,540
as a kind of public service announcement.

1621
01:10:33,540 --> 01:10:36,720
And it's something that we've noticed,

1622
01:10:36,720 --> 01:10:39,063
I think over the last
few years, and that is,

1623
01:10:41,250 --> 01:10:43,890
while we are very supportive
of bug bounty programs,

1624
01:10:43,890 --> 01:10:45,540
because we think they do a good job

1625
01:10:45,540 --> 01:10:48,750
of letting the different parties
know where lines are drawn.

1626
01:10:48,750 --> 01:10:51,990
What is inbounds, what's out of bounds.

1627
01:10:51,990 --> 01:10:56,100
The one danger that we
see that has manifested

1628
01:10:56,100 --> 01:10:59,640
in a few places, is it
also, in some instances,

1629
01:10:59,640 --> 01:11:02,670
has created a sense of
entitlement among researchers,

1630
01:11:02,670 --> 01:11:06,990
such that there's a feeling
that if I did some work here,

1631
01:11:06,990 --> 01:11:11,130
I better get paid, which
can inform the manner

1632
01:11:11,130 --> 01:11:15,283
in which any discussion about compensation

1633
01:11:16,320 --> 01:11:19,440
or disclosure or things occur.

1634
01:11:19,440 --> 01:11:21,330
And in the worst instances

1635
01:11:21,330 --> 01:11:23,490
is exactly what we talked about earlier.

1636
01:11:23,490 --> 01:11:24,450
Can turn into a conversation

1637
01:11:24,450 --> 01:11:28,020
that looks a lot more like
an extortion type of demand,

1638
01:11:28,020 --> 01:11:31,230
rather than some, you know, engagement

1639
01:11:31,230 --> 01:11:32,703
to try to improve security.

1640
01:11:33,630 --> 01:11:37,920
And so, I just dropped that as a caution.

1641
01:11:37,920 --> 01:11:40,305
You know, in the course
of reviewing indictments

1642
01:11:40,305 --> 01:11:41,138
that have come through our office,

1643
01:11:41,138 --> 01:11:42,630
we've had a couple of instances

1644
01:11:42,630 --> 01:11:46,140
where researchers used maybe

1645
01:11:46,140 --> 01:11:48,330
some improvident words in the manner

1646
01:11:48,330 --> 01:11:50,193
in which they approached this.

1647
01:11:51,390 --> 01:11:53,310
And this hearkens back to an issue

1648
01:11:53,310 --> 01:11:54,750
that I've I flagged before,

1649
01:11:54,750 --> 01:11:56,700
which is I truly believe

1650
01:11:56,700 --> 01:12:01,700
it would be in this community's
interests to work on norms

1651
01:12:02,730 --> 01:12:06,330
that are some sort of
baseline understanding

1652
01:12:06,330 --> 01:12:08,910
of what, you know, security research

1653
01:12:08,910 --> 01:12:10,740
and engagement looks like.

1654
01:12:10,740 --> 01:12:14,460
So that those who, like me,
who are outside the community,

1655
01:12:14,460 --> 01:12:18,180
who would try to apply those
rules, have something to go to.

1656
01:12:18,180 --> 01:12:20,670
That's not imposed on the community by us,

1657
01:12:20,670 --> 01:12:23,280
but rather something organically developed

1658
01:12:23,280 --> 01:12:26,190
so that there's actually
buy-in and an understanding

1659
01:12:26,190 --> 01:12:29,400
and a real true depiction of the way

1660
01:12:29,400 --> 01:12:30,690
in which you thinks it should occur.

1661
01:12:30,690 --> 01:12:34,353
So, that's my PSA that I
wanted to just drop on you.

1662
01:12:35,190 --> 01:12:39,150
- I realized we skipped over
your second question on, well,

1663
01:12:39,150 --> 01:12:42,360
I skipped over, too, on incident reporting

1664
01:12:42,360 --> 01:12:44,766
and how that interacts with the CFAA.

1665
01:12:44,766 --> 01:12:45,599
And one thing I have noticed,

1666
01:12:45,599 --> 01:12:47,400
so, there is, so, incident reporting,

1667
01:12:47,400 --> 01:12:50,130
there are a lot of regulations
already on the books

1668
01:12:50,130 --> 01:12:51,960
and a lot that are being proposed

1669
01:12:51,960 --> 01:12:53,820
that would require a company

1670
01:12:53,820 --> 01:12:56,700
to report a cyber security
incident to the government,

1671
01:12:56,700 --> 01:12:58,290
to their regulator.

1672
01:12:58,290 --> 01:13:00,180
And the definition of
cyber security incidents

1673
01:13:00,180 --> 01:13:02,952
is usually something that is significant,

1674
01:13:02,952 --> 01:13:07,260
not just a insignificant exposure,

1675
01:13:07,260 --> 01:13:08,820
but something that is
relatively significant,

1676
01:13:08,820 --> 01:13:10,020
so that the government knows about it

1677
01:13:10,020 --> 01:13:13,110
and can take action to protect others.

1678
01:13:13,110 --> 01:13:18,090
Something, and this is another
sort of sign of the evolution

1679
01:13:18,090 --> 01:13:21,025
in thinking about policy and hackers.

1680
01:13:21,025 --> 01:13:24,450
A lot of these laws
actually have an exception

1681
01:13:24,450 --> 01:13:27,000
toward to the incident requirements,

1682
01:13:27,000 --> 01:13:30,510
so that it doesn't qualify
as a reportable incident

1683
01:13:30,510 --> 01:13:32,430
if it is something that was brought to you

1684
01:13:32,430 --> 01:13:34,440
by a good faith security researcher.

1685
01:13:34,440 --> 01:13:37,536
Many of them don't use
necessarily those words.

1686
01:13:37,536 --> 01:13:39,450
And I think a lot of times
it requires authorization

1687
01:13:39,450 --> 01:13:41,670
of the computer holders, so like,

1688
01:13:41,670 --> 01:13:42,930
but something like a bug bounty,

1689
01:13:42,930 --> 01:13:45,540
if a bug bounty has brought it,

1690
01:13:45,540 --> 01:13:48,570
or it's a coordinated
vulnerability disclosure process,

1691
01:13:48,570 --> 01:13:51,900
then it may not qualify for
incident reporting purposes

1692
01:13:51,900 --> 01:13:53,790
to have to report it to the regulator.

1693
01:13:53,790 --> 01:13:57,660
This is a sort of thinking that
I think five, 10 years ago,

1694
01:13:57,660 --> 01:13:59,370
couldn't imagine, but they're building it

1695
01:13:59,370 --> 01:14:02,100
into things that as somewhat niche,

1696
01:14:02,100 --> 01:14:03,510
you know, cyber incident reporting.

1697
01:14:03,510 --> 01:14:06,690
And so, they have a mind towards
this community even there.

1698
01:14:06,690 --> 01:14:07,523
Yes?

1699
01:14:09,854 --> 01:14:14,527
- [Audience Member] So,
(indistinct) and policy

1700
01:14:14,527 --> 01:14:19,527
so (indistinct) prosecution (indistinct)

1701
01:14:19,725 --> 01:14:24,725
and the way that (indistinct) prosecution,

1702
01:14:25,212 --> 01:14:28,129
(faintly speaking)

1703
01:14:38,670 --> 01:14:41,498
- So, I got about 80% of what you said.

1704
01:14:41,498 --> 01:14:42,666
- [Audience Member] (faintly speaking)

1705
01:14:42,666 --> 01:14:44,017
- No, that's okay.

1706
01:14:44,017 --> 01:14:45,660
Can I ask you at least for this question?

1707
01:14:45,660 --> 01:14:47,493
Take the mask off, sorry.

1708
01:14:48,455 --> 01:14:50,071
- [Audience Member] (faintly speaking)

1709
01:14:50,071 --> 01:14:51,690
(audience laughs)

1710
01:14:51,690 --> 01:14:54,327
- Interspersed 20%, yeah, right. (laughs)

1711
01:14:54,327 --> 01:14:57,022
- [Audience Member] (faintly speaking)

1712
01:14:57,022 --> 01:15:00,541
A lot of these interventions
that target people

1713
01:15:00,541 --> 01:15:03,674
who are engaged in the
basic programming area.

1714
01:15:03,674 --> 01:15:08,674
And that prosecution is
based on (faintly speaking).

1715
01:15:39,870 --> 01:15:43,500
- The question comes from
someone who is from the UK

1716
01:15:43,500 --> 01:15:48,000
about how discretion on the
policy is exercised in the US,

1717
01:15:48,000 --> 01:15:50,250
by our investigators and prosecutors,

1718
01:15:50,250 --> 01:15:51,810
and kind of taking as a model,

1719
01:15:51,810 --> 01:15:54,180
that there's a comparable law in the UK,

1720
01:15:54,180 --> 01:15:56,820
where then where a lot
of the question is used

1721
01:15:56,820 --> 01:15:59,460
to determine what is
in the public interest.

1722
01:15:59,460 --> 01:16:04,460
So, in terms of the discretion,

1723
01:16:05,610 --> 01:16:08,193
I guess the policy does
state, and then you know,

1724
01:16:10,199 --> 01:16:12,660
promulgated by the Deputy
Attorney General's office to all,

1725
01:16:12,660 --> 01:16:17,660
is that one should decline
if it meets these criteria.

1726
01:16:18,930 --> 01:16:21,720
The question of when
it meets these criteria

1727
01:16:21,720 --> 01:16:24,210
is a matter of discretion to some degree,

1728
01:16:24,210 --> 01:16:27,840
but no more so than I would
say applying our laws, right,

1729
01:16:27,840 --> 01:16:31,534
to see whether the set of facts
meets the requirements here.

1730
01:16:31,534 --> 01:16:35,850
And so, I think there's,
in some ways, unavoidably,

1731
01:16:35,850 --> 01:16:39,592
a certain degree of
discretion that's exercised.

1732
01:16:39,592 --> 01:16:43,710
But, one of, I think the positive things

1733
01:16:43,710 --> 01:16:45,990
is one of the things that helps

1734
01:16:45,990 --> 01:16:47,610
when you have exercises of discretion

1735
01:16:47,610 --> 01:16:51,090
is to have oversight and transparency.

1736
01:16:51,090 --> 01:16:53,340
And so, this wouldn't be a decision

1737
01:16:53,340 --> 01:16:55,680
that would be made solely by, for example,

1738
01:16:55,680 --> 01:16:57,093
the US Attorney's Office.

1739
01:16:58,230 --> 01:17:00,930
We oversee all of CFAA indictments.

1740
01:17:00,930 --> 01:17:03,210
So, it would come through us as well.

1741
01:17:03,210 --> 01:17:04,890
And the point of that,

1742
01:17:04,890 --> 01:17:07,980
which was a practice
that was adopted in 2016,

1743
01:17:07,980 --> 01:17:10,870
was to try to harmonize

1744
01:17:11,790 --> 01:17:14,160
how these things are
done nationally, right?

1745
01:17:14,160 --> 01:17:16,020
So, if you have one collection point

1746
01:17:16,020 --> 01:17:17,490
you can have greater consistency

1747
01:17:17,490 --> 01:17:20,430
than you would have in
94 different districts.

1748
01:17:20,430 --> 01:17:23,250
And so, there is discretion,
we believe though,

1749
01:17:23,250 --> 01:17:28,250
that we have mechanisms for
kind of leveling that out

1750
01:17:28,530 --> 01:17:30,873
and making sure that it is consistent.

1751
01:17:31,740 --> 01:17:34,950
- You'll notice at the bottom
of the charging policy,

1752
01:17:34,950 --> 01:17:37,920
it mentions consulting with prosecutors.

1753
01:17:37,920 --> 01:17:39,030
- Yeah, that's for my office.

1754
01:17:39,030 --> 01:17:41,347
- Yep, specific applications.

1755
01:17:44,157 --> 01:17:44,990
- Hello.

1756
01:17:44,990 --> 01:17:47,918
- [Audience Member] Thank
you for this presentation.

1757
01:17:47,918 --> 01:17:48,984
(indistinct)

1758
01:17:48,984 --> 01:17:53,984
So, the policy applies for
discretion (indistinct)

1759
01:17:55,186 --> 01:18:00,039
for US Attorneys, but it
doesn't stop the investigation.

1760
01:18:00,039 --> 01:18:02,842
(faintly speaking)

1761
01:18:02,842 --> 01:18:05,182
Do you foresee a need for policy

1762
01:18:05,182 --> 01:18:09,190
for law enforcement entities (indistinct)

1763
01:18:09,190 --> 01:18:12,539
that encourages (indistinct) investigation

1764
01:18:12,539 --> 01:18:15,478
in terms of (indistinct).

1765
01:18:15,478 --> 01:18:18,586
Once that determination is made,

1766
01:18:18,586 --> 01:18:21,669
(indistinct) occurs,

1767
01:18:23,556 --> 01:18:27,261
weeding out referrals to these attorneys.

1768
01:18:27,261 --> 01:18:30,351
Actually see a lot come in
at the investigation stage,

1769
01:18:30,351 --> 01:18:32,232
before the DOJ makes a determination.

1770
01:18:32,232 --> 01:18:35,149
(faintly speaking)

1771
01:18:43,692 --> 01:18:46,551
(Leonard laughs)

1772
01:18:46,551 --> 01:18:49,167
So the problem is (indistinct).

1773
01:18:49,167 --> 01:18:51,750
- So, the question was, the policy applies

1774
01:18:51,750 --> 01:18:55,500
to charging decisions, not
investigative activities.

1775
01:18:55,500 --> 01:19:00,500
So, is there any point in perhaps
having a comparable policy

1776
01:19:00,600 --> 01:19:02,550
that applies to investigations

1777
01:19:02,550 --> 01:19:05,430
rather than just prosecutions?

1778
01:19:05,430 --> 01:19:07,866
It's an interesting point.

1779
01:19:07,866 --> 01:19:11,190
I don't think we have considered it,

1780
01:19:11,190 --> 01:19:16,190
in part because at least we
haven't yet detected a problem,

1781
01:19:17,040 --> 01:19:22,020
but hopefully engagements
like this would flag that.

1782
01:19:22,020 --> 01:19:23,580
And if we did see a problem,

1783
01:19:23,580 --> 01:19:26,130
it's something we, you know,
certainly could consider,

1784
01:19:26,130 --> 01:19:30,720
whether a similar policy
on an investigative level

1785
01:19:30,720 --> 01:19:32,580
would make sense.

1786
01:19:32,580 --> 01:19:33,750
At this point, it doesn't exist

1787
01:19:33,750 --> 01:19:35,820
and we haven't really thought of it,

1788
01:19:35,820 --> 01:19:38,430
but, you know, could that change

1789
01:19:38,430 --> 01:19:41,491
if there actually were a need?

1790
01:19:41,491 --> 01:19:42,408
Absolutely.

1791
01:19:43,703 --> 01:19:47,759
- [Audience Member] I have a
comment and then a question.

1792
01:19:47,759 --> 01:19:52,215
With some of the (indistinct)
researchers and hackers

1793
01:19:52,215 --> 01:19:54,706
as clients, I am a lawyer,

1794
01:19:54,706 --> 01:19:59,489
what we've done is build
out proactive relationships

1795
01:19:59,489 --> 01:20:02,790
with law enforcement,
primarily the Bureau,

1796
01:20:02,790 --> 01:20:06,061
where we make them aware
of what we're doing

1797
01:20:06,061 --> 01:20:07,906
that's more on the getting

1798
01:20:07,906 --> 01:20:10,990
into the darker side
of things rather than,

1799
01:20:10,990 --> 01:20:14,381
and sometimes we offer
some assistance as well.

1800
01:20:14,381 --> 01:20:17,769
But that way, when there
is a knock on the door,

1801
01:20:17,769 --> 01:20:19,227
they call us beforehand,

1802
01:20:19,227 --> 01:20:21,468
and it's a friendly knock on the door.

1803
01:20:21,468 --> 01:20:23,459
(indistinct)

1804
01:20:23,459 --> 01:20:25,670
I realize that this may
come off as arrogant,

1805
01:20:25,670 --> 01:20:29,170
but that's something that we've seen work.

1806
01:20:31,219 --> 01:20:35,719
The main question is, do you
see a situation out there

1807
01:20:37,086 --> 01:20:42,086
where a security researcher
could be (indistinct)

1808
01:20:44,214 --> 01:20:47,714
for unlawful access to a criminal network,

1809
01:20:48,945 --> 01:20:51,422
a criminal network full of stolen data,

1810
01:20:51,422 --> 01:20:54,922
full of stolen influence, stolen whatever?

1811
01:20:56,628 --> 01:20:59,839
(indistinct) seems to
be bringing that work,

1812
01:20:59,839 --> 01:21:02,682
seems to be a nonsensical notion,

1813
01:21:02,682 --> 01:21:06,122
but if you read the guidelines
and the (indistinct),

1814
01:21:06,122 --> 01:21:09,372
it's still conceivable that researchers

1815
01:21:10,207 --> 01:21:15,207
hacking into (indistinct)
and face a problem.

1816
01:21:15,988 --> 01:21:19,653
I want to be sure if we
bring that to police.

1817
01:21:19,653 --> 01:21:21,240
Just curious about your thoughts on that.

1818
01:21:21,240 --> 01:21:26,240
- So, first a point, kind
of a suggestion to folks,

1819
01:21:26,370 --> 01:21:29,790
which was that reaching
out to law enforcement

1820
01:21:29,790 --> 01:21:31,140
to establish a relationship

1821
01:21:31,140 --> 01:21:33,060
so that they know and
are familiar with you

1822
01:21:33,060 --> 01:21:35,400
in case there is a need
for a knock at the door,

1823
01:21:35,400 --> 01:21:37,740
because there is some activity

1824
01:21:37,740 --> 01:21:39,510
that they're interested
in is a good practice.

1825
01:21:39,510 --> 01:21:41,880
And I would foot stomp that.

1826
01:21:41,880 --> 01:21:43,980
That in fact is something that we flag

1827
01:21:43,980 --> 01:21:45,720
in the white paper I mentioned earlier,

1828
01:21:45,720 --> 01:21:48,330
having that relationship
can be very helpful.

1829
01:21:48,330 --> 01:21:49,920
Secondly, though, there was a question

1830
01:21:49,920 --> 01:21:52,680
about whether accessing
a criminal network,

1831
01:21:52,680 --> 01:21:53,970
say you are a researcher

1832
01:21:53,970 --> 01:21:58,560
who is accessing a
ransomware group's server,

1833
01:21:58,560 --> 01:22:01,500
whether that could
potentially get you prosecuted

1834
01:22:01,500 --> 01:22:03,210
under the CFAA.

1835
01:22:03,210 --> 01:22:05,340
And I guess to that,

1836
01:22:05,340 --> 01:22:07,533
I would say this whenever
someone tells me,

1837
01:22:09,360 --> 01:22:12,753
prosecutors can indict a ham sandwich.

1838
01:22:13,860 --> 01:22:16,020
My response to them is, yes,

1839
01:22:16,020 --> 01:22:19,530
but then we would have to
try the ham sandwich, right?

1840
01:22:19,530 --> 01:22:21,960
And that would be ridiculous.

1841
01:22:21,960 --> 01:22:24,793
So, it's the same thing here.

1842
01:22:24,793 --> 01:22:27,270
One of the things that we think about,

1843
01:22:27,270 --> 01:22:28,920
one of the, actually in 2016,

1844
01:22:28,920 --> 01:22:31,470
we released our CFAA charging policy

1845
01:22:31,470 --> 01:22:33,600
that was broader about consideration

1846
01:22:33,600 --> 01:22:35,070
for federal prosecution.

1847
01:22:35,070 --> 01:22:36,990
There has to be a
substantial federal interest

1848
01:22:36,990 --> 01:22:40,230
in a prosecution for us to bring it.

1849
01:22:40,230 --> 01:22:42,630
We do assess whether, for example,

1850
01:22:42,630 --> 01:22:47,630
that's a case that is not
going to play very well, right?

1851
01:22:50,430 --> 01:22:51,930
Now, there may be extenuating facts,

1852
01:22:51,930 --> 01:22:53,160
nothing that it's impossible,

1853
01:22:53,160 --> 01:22:54,510
that such case could be brought,

1854
01:22:54,510 --> 01:22:59,163
but by and large, that it's unlikely.

1855
01:23:01,590 --> 01:23:05,610
That said, I do think that the one thing

1856
01:23:05,610 --> 01:23:08,040
that I often caution researchers about

1857
01:23:08,040 --> 01:23:10,650
is that even if they're being good guys,

1858
01:23:10,650 --> 01:23:13,950
they should understand they do
not have cart blanche, right?

1859
01:23:13,950 --> 01:23:16,110
That there are people
who are investigators

1860
01:23:16,110 --> 01:23:17,400
who have been given the authority

1861
01:23:17,400 --> 01:23:19,980
to do certain types of
activities that are invasive,

1862
01:23:19,980 --> 01:23:22,800
and that should be left to them.

1863
01:23:22,800 --> 01:23:26,736
So, a reporting,
something that you've seen

1864
01:23:26,736 --> 01:23:28,086
is an important first step.

1865
01:23:29,537 --> 01:23:30,885
- Will you close that door, please?

1866
01:23:30,885 --> 01:23:31,718
Thank you.

1867
01:23:33,189 --> 01:23:34,664
- [Audience Member] It doesn't close.

1868
01:23:34,664 --> 01:23:35,581
- Oh, okay.

1869
01:23:36,831 --> 01:23:37,715
- Got a question right there.

1870
01:23:37,715 --> 01:23:40,173
- I just want to let
everybody know, we are,

1871
01:23:40,173 --> 01:23:41,850
have only about five more minutes

1872
01:23:41,850 --> 01:23:44,580
before we have to clear the
room for the next panel.

1873
01:23:44,580 --> 01:23:46,920
And to let everyone else
also know, if you don't have

1874
01:23:46,920 --> 01:23:49,680
one of these limited edition
DEFCON policy stickers,

1875
01:23:49,680 --> 01:23:50,550
please feel free to see me.

1876
01:23:50,550 --> 01:23:51,480
I laid 'em out on the table,

1877
01:23:51,480 --> 01:23:53,520
but I know that the folks that
were standing didn't get one.

1878
01:23:53,520 --> 01:23:55,980
If you want one, then hit me up.

1879
01:23:55,980 --> 01:23:57,161
Yes?

1880
01:23:57,161 --> 01:23:58,802
- [Audience Member] One of
the things we (indistinct)

1881
01:23:58,802 --> 01:23:59,635
as a lawyer, do you have any advice about

1882
01:23:59,635 --> 01:24:02,635
(faintly speaking)?

1883
01:24:07,467 --> 01:24:08,784
(audience laughs)

1884
01:24:08,784 --> 01:24:11,701
(faintly speaking)

1885
01:24:12,853 --> 01:24:14,057
- Yes, so-

1886
01:24:14,057 --> 01:24:16,368
- [Audience Member]
There are free resources

1887
01:24:16,368 --> 01:24:19,576
for security researchers (indistinct).

1888
01:24:19,576 --> 01:24:23,243
I can imagine (indistinct).

1889
01:24:24,608 --> 01:24:25,590
- So, I have a few suggestions,

1890
01:24:25,590 --> 01:24:27,690
but I think the simplest one

1891
01:24:27,690 --> 01:24:30,840
would be to contact the
Electronic Frontier Foundation.

1892
01:24:30,840 --> 01:24:33,570
They've worked in litigation in this area.

1893
01:24:33,570 --> 01:24:34,770
They may not represent you,

1894
01:24:34,770 --> 01:24:36,660
but they may know other people that do.

1895
01:24:36,660 --> 01:24:38,490
It's probably easier than a Google search

1896
01:24:38,490 --> 01:24:40,470
or me just giving you a
bunch of names right now.

1897
01:24:40,470 --> 01:24:41,490
Just contact them.

1898
01:24:41,490 --> 01:24:43,320
That's probably, that's
a good first start.

1899
01:24:43,320 --> 01:24:45,150
- They also have online
resources, don't they?

1900
01:24:45,150 --> 01:24:46,200
- I believe they do.

1901
01:24:46,200 --> 01:24:47,190
- Yeah.

1902
01:24:47,190 --> 01:24:48,308
- Yes.

1903
01:24:48,308 --> 01:24:51,440
- [Audience Member] Is there
some way to get involved

1904
01:24:51,440 --> 01:24:52,955
with the policy making process

1905
01:24:52,955 --> 01:24:55,151
or do we just like maybe cross our fingers

1906
01:24:55,151 --> 01:24:59,318
and hope that (faintly speaking)?

1907
01:25:01,158 --> 01:25:02,581
- There is absolutely
a way to get involved

1908
01:25:02,581 --> 01:25:04,200
in the policy making process.

1909
01:25:04,200 --> 01:25:07,230
And a lot of it will, at
least in the United States,

1910
01:25:07,230 --> 01:25:08,670
I think a lot of it at this stage

1911
01:25:08,670 --> 01:25:11,955
is going to be engaging
directly with policy makers.

1912
01:25:11,955 --> 01:25:15,660
I don't know of any,
like, open comment periods

1913
01:25:15,660 --> 01:25:18,720
for CFAA DMCA or states.

1914
01:25:18,720 --> 01:25:21,240
I do think that you get your best bang

1915
01:25:21,240 --> 01:25:24,030
for the buck right now in
the states, like I mentioned.

1916
01:25:24,030 --> 01:25:26,640
The states don't hear from
experts to the same degree

1917
01:25:26,640 --> 01:25:29,130
as the federal policy makers do.

1918
01:25:29,130 --> 01:25:31,770
And, you know, it may
be slow going at first.

1919
01:25:31,770 --> 01:25:33,780
But I think that once you
build that relationship

1920
01:25:33,780 --> 01:25:35,310
and you'll see it come to fruition.

1921
01:25:35,310 --> 01:25:37,770
If you want to target
an open comment period,

1922
01:25:37,770 --> 01:25:42,543
then I think talk to Steven
about what's going on in the UK.

1923
01:25:43,380 --> 01:25:44,760
- Sorry, and generally, I can add

1924
01:25:44,760 --> 01:25:48,600
that there are these rule-making processes

1925
01:25:48,600 --> 01:25:51,450
that are open for public comment,

1926
01:25:51,450 --> 01:25:53,490
and people like you in this room

1927
01:25:53,490 --> 01:25:55,920
actually do have an
outsized voice in those.

1928
01:25:55,920 --> 01:25:59,070
And what I mean by that, is
talking to the people who,

1929
01:25:59,070 --> 01:26:00,512
as in this process,

1930
01:26:00,512 --> 01:26:02,730
they have to review them and
then adjudicate the answers.

1931
01:26:02,730 --> 01:26:04,320
It's not about numbers.

1932
01:26:04,320 --> 01:26:07,140
It's not that a hundred people said yes

1933
01:26:07,140 --> 01:26:09,240
and, you know, 50 people said, no,

1934
01:26:09,240 --> 01:26:12,030
it's the quality of
the comment that really

1935
01:26:12,030 --> 01:26:14,070
is what matters to them.

1936
01:26:14,070 --> 01:26:16,800
And having some sort of sophistication

1937
01:26:16,800 --> 01:26:18,638
and understanding of the actual issues

1938
01:26:18,638 --> 01:26:20,670
and being able to present that

1939
01:26:20,670 --> 01:26:24,150
is something that the people
who adjudicate these rules

1940
01:26:24,150 --> 01:26:27,540
and decide how they should
be shaped really look at.

1941
01:26:27,540 --> 01:26:29,070
So, these public comment periods

1942
01:26:29,070 --> 01:26:30,360
are something that if you're interested in

1943
01:26:30,360 --> 01:26:31,983
are something, are things that
you should take seriously.

1944
01:26:31,983 --> 01:26:32,816
- Now, I actually think

1945
01:26:32,816 --> 01:26:35,910
it would make a great DEFCON
presentation to just go through

1946
01:26:35,910 --> 01:26:37,800
where to find these public comment periods

1947
01:26:37,800 --> 01:26:39,780
and, like, how to engage with them.

1948
01:26:39,780 --> 01:26:41,670
'Cause this is how the government,

1949
01:26:41,670 --> 01:26:43,200
like, there's this feeling
that the government

1950
01:26:43,200 --> 01:26:45,240
is in this ivory tower and you
can't communicate with them

1951
01:26:45,240 --> 01:26:46,830
and it is actually not true at all.

1952
01:26:46,830 --> 01:26:49,680
Like they are required
by law to solicit input

1953
01:26:49,680 --> 01:26:51,090
from the public whenever they come out

1954
01:26:51,090 --> 01:26:53,730
with a lot of major rules.

1955
01:26:53,730 --> 01:26:56,100
And so, another time,
but there is in fact,

1956
01:26:56,100 --> 01:26:56,933
a lot of opportunity.

1957
01:26:56,933 --> 01:26:58,194
Yes?

1958
01:26:58,194 --> 01:27:03,194
- [Audience Member] (indistinct)
organizing this department.

1959
01:27:04,412 --> 01:27:06,771
I think they're really interested
in helping the community

1960
01:27:06,771 --> 01:27:08,788
on commenting on some of these proposals.

1961
01:27:08,788 --> 01:27:11,146
So, if there's something that
you see about this in general,

1962
01:27:11,146 --> 01:27:12,553
they would appreciate that.

1963
01:27:12,553 --> 01:27:14,036
And they work with trade association

1964
01:27:14,036 --> 01:27:16,103
and other policy groups,
so that's (indistinct)

1965
01:27:16,103 --> 01:27:19,470
- 100%, I think DEFCON policy
will be able to help you.

1966
01:27:19,470 --> 01:27:22,140
I'll be able to connect
you with folks, you know,

1967
01:27:22,140 --> 01:27:24,540
depending on what you're looking at.

1968
01:27:24,540 --> 01:27:25,740
Everyone, thank you so much.

1969
01:27:25,740 --> 01:27:27,399
Thank you for coming, thank you.

1970
01:27:27,399 --> 01:27:31,260
(audience and Leonard applauds)

1971
01:27:31,260 --> 01:27:33,600
Thank you to the people that
were standing the whole time.

1972
01:27:33,600 --> 01:27:34,650
- Yes.

1973
01:27:34,650 --> 01:27:36,510
- And again, let me know
if you want a sticker

1974
01:27:36,510 --> 01:27:37,967
and hope to see you around.