We have an hour and 35 minutes. We're not going to talk all that time. This is going to be a roundtable discussion, so we are going to open it up to the group after our presentation where we kind of go through some of the basics.
I'm sorry. Your head is giving a shout out. Sorry about that.
I'm sorry also that we are not able to dim the lights just for this individual room, but we're going to make it work.
Alright, so this is Hacker Law for Hackers. I wanted to let you all know this is an on-the-record room, so there's Chatham House Rules in the other room.
This one is on the record and being streamed, just so you all know. Leave now if that's a problem, please.
Let's do it.
Like the description says, we're going to go over some of the changes to hacking law that have occurred, particularly in the past year or so, 2021 to 2022,
and look at some of the changes.
These are some of the areas that are ripe now for community advocacy in changing hacking law to help hackers.
I'm Harley Geiger, and I am Senior Director for Public Policy at Rapid7.
I'm an attorney, and I've been working in cybersecurity and technology policy for many years.
We are really blessed to have this man right here from the Department of Justice co-presenting.
I'm Leonard Bailey. I'm serving as Harley's wingman today.
I am from the Computer Crime and Intellectual Property Section.
In the Criminal Division of the U.S. Department of Justice, I am the Special Counsel for National Security and head of our Cybersecurity Unit.
Doesn't that sound very impressive? It is, in fact.
My mom is very proud of me.
It is, in fact. Very, very impressive.
So believe it or not, there are no speakers.
So the microphones are actually just for streaming.
So when we open up to the group, we're going to have to pass around these mics, but there is no amplification.
Can you raise your hand if you're having trouble hearing me?
Yes.
Loud. Okay. Got it.
Yeah. Okay. Really sorry. I thought I was already projecting.
Feel free to crowd in a little bit closer if that helps.
I know the acoustics are not super.
All right. First, this is not legal advice.
It's very important that we get that out of the way.
I really don't want anybody watching this to go and do a research project and think that this covers all the nuances in the law.
The law is just riddled with little exceptions and important things.
We're not going to be able to cover all of that in this presentation.
So if you have questions, particularly about a specific research project, if you're worried about legal risks, then you should talk to a lawyer.
Just not these lawyers.
Do not rely on this presentation.
Okay. So let's start from the beginning.
Why do we care about hackers?
Why do we care about the way that hackers are treated?
Let's just talk about free information, some of the things that will而已 companies, corporate segurança, mental health checks, it's啊, they don't work out for us.
We've got a very powerful set of top yes numbers in the US.
Let's get to the bottom of this a little bit faster.
The R and D are the third base of a little bit faster your height and rep or your tại and it does a lot in our lives.
We need the talent.
We need the insight from people like you.
It's not going to be a small cadre of experts.
It's going to be the community
I've got a tiny accent although I miss my roots in my mother's voice so a little bit.
And from the government's perspective, it's exactly the same thing.
We know this is a complicated problem.
We're not going to solve it ourselves.
And there are people in this community who have skills that we simply need.
So from the government's perspective, that's why.
A.K.A. the government also wants to hire you.
So federal law has evolved in favor of hackers.
I think that's a little bit provocative.
I think that for a long time, the security community had this impression that federal law was stacked against them.
And that you will be nailed to the wall if you violate terms of service.
You'll be nailed to the wall if you are doing IOT research in your own basement under a 40 watt bulb.
And I think that it's time to challenge that perspective.
And I think that one of the reasons why we should challenge it has been the changes that have occurred just in the past year.
So 2021 and 2022 had a lot of changes.
And they were almost the same.
They were almost all, at least in the United States, at least at the federal level, sort of universally in favor of the hacking community.
Are the acoustics better?
Am I projecting enough now?
Sort of?
Yeah.
I'm doing the best I can without yelling.
Sorry.
We're going to cover the Computer Fraud and Abuse Act, the Digital Millennium Copyright Act.
These are the sort of two traditional bogeymen of the security community.
We're also going to talk a bit about the international perspective.
So China's coordinated vulnerability disclosure law.
And then some about the states, state laws.
And then, like I said, we are going to open it up to hear your perspective.
I think we have a lot of talents and experience in this room.
So it's going to get interactive.
We're definitely not going to talk for the entire hour and a half.
So first up, the Computer Fraud and Abuse Act, so the CFAA.
This is maybe the most feared law in sort of the pantheon for the security research community.
And we're going to talk, start basics.
We're going to talk about, you know, what it does.
And it has a long list of restrictions.
I categorize them like this.
So first, it's a criminal and civil statute, meaning that you can be prosecuted criminally by federal prosecutors.
But you can also be sued privately.
So you can be sued by a company or by an individual if you have violated the Computer Fraud and Abuse Act.
Here with the CFAA, we are talking.
We're talking almost entirely about other people's computers.
So it is about whether you are authorized to access or use the computer in certain ways.
And since you're doing it on your own computer, you're presumably authorizing yourself.
Now, it gets to be a CFAA issue if you're interacting somehow with somebody else's computer.
And it's not just, you know, the laptop that's sitting here.
It can be things like Internet servers, you know, or somebody else's computer over the Internet.
All right.
Now, the CFAA restricts, among other things, accessing a computer without authorization.
Right?
So if you're authorized to touch my computer or not.
Causing damage without authorization.
Damage can include, for example, service disruptions, DDoS, dropping malware.
It can even be altering code on somebody else's computer.
That's considered damage without authorization.
And then intent to defraud.
If you have intent to defraud and you are trafficking in passwords or access codes, that's also a CFAA violation.
And then extortion is another one.
So if you are saying, I will damage your computer or I will access your computer without authorization unless you pay me cash money, that is a CFAA violation.
Oh, we have a new projector.
So most of that stuff, though, is avoidable by good faith security researchers.
If you are truly conducting, you know, good faith hacking, you are not going to be demanding money for, you know, where you're going to, you know, threaten damage to a computer.
You're not going around causing DDoS attacks or disruptions to a computer.
You're going to be demanding money to service.
And, you know, so you also don't have intent to defraud.
Your intent is to patch the vulnerability.
It's to improve security.
But there is another provision of the CFAA.
And this one is arguably the most broad and most problematic for the security community.
And that is exceeds authorized access.
That is where most of the action in the past year has occurred.
Do you want to add anything before we launch into that?
No, I think you hit all the buttons.
So exceeding authorized access.
What that means is you have access to a computer.
You're authorized to access it.
But you may only be authorized to use it for certain things.
So I'm allowed to access this computer for work, but I'm not allowed to go bug hunting on it.
Because I'm not a hacker, personally.
Or I may be able to access a social network, but not use my profile on the social network to go bug hunting.
Or to conduct security research from there.
So that would be exceeding the authorization that I have been given to access those computers.
Now, that gave a lot of power traditionally to things like terms of service.
Or acceptable use policies or employment agreements.
Because those were the documents.
Those were the ways that your access was defined.
So if you join a social networking service, they will have an acceptable use policy or terms of service.
That says, here are the things you are authorized to do.
Usually security research is not in that list.
Same thing with employers.
They do not usually authorize their employees to also go bug hunting on their computers.
Unless that's what you do professionally.
So it gave a lot of control to that.
So that's some of the basics about CFAA.
Now, what has changed recently.
And one of the big whoppers that has changed recently is Van Buren versus the United States.
So that is a...
A Supreme Court case.
It was decided in 2021.
And that kind of de-clawed exceeds authorized access.
The facts of the case are pretty colorful.
Van Buren was a police officer.
And Van Buren was authorized to access a license plate database as part of his work.
But Van Buren was not authorized to use that same license plate database for personal criminal purposes.
And that is what Officer Van Buren did.
For money.
He was brought up under charges under CFAA.
And the Supreme Court in a 5-3 decision.
Was it 5-3 or 6-3?
Anyway, it was not a 5-4 decision.
It was a pretty clear cut towards finding a narrow interpretation of CFAA.
What they said was, essentially, the question is not if you've been authorized to use it for one purpose and then are using it for another.
Instead.
It is, are the gates up or down?
Was their analogy.
Are you authorized to access the computer or are you not authorized to use the computer?
And so for Van Buren what that meant was, since he was authorized to use that computer for work.
Then it is not exceeding authorized access.
It is not by itself a CFAA violation to use it for other purposes as well.
And it may be illegal under other statutes.
Just not under this really broad provision of the CFAA.
This helps not only security researchers but also a lot of ordinary consumers.
Who use the internet and should not be under threat of a federal hacking crime.
Simply for doing things like violating terms of service.
Lying about your age on Facebook for example.
So that was a big deal.
It also applies in part to publicly available computers.
So if a computer or an asset is on the internet.
And it is publicly accessible.
Then you arguably have authorization to access that publicly accessible computer.
And if you have access for it for one authorized purpose.
Under Van Buren.
Then it is not an exceeds authorized access crime any longer.
Under the CFAA to also use it for another purpose.
And that theory about publicly available computers was put to the test in another case in 2022.
This is HiQ versus LinkedIn.
So HiQ versus LinkedIn.
HiQ was scraping publicly accessible content from LinkedIn.
LinkedIn went so far as to send a cease and desist order to HiQ.
Saying don't do this any longer.
And the ninth circuit which is traditionally looked at CFAA in narrow ways.
Said that LinkedIn could not bring HiQ up on CFAA charges.
Or in this case it would be a lawsuit.
For scraping its publicly accessible content.
It was publicly accessible.
So it put Van Buren to the test on this issue of publicly accessible computers.
So I want to give an example of sort of where this may hit the road with an actual case.
Actual hacking.
Did you want to add to that?
Did I describe them correctly?
You certainly did.
I guess there are a couple of things I'd toss out.
Which is one of the things I think we've learned from watching courts attempt to interpret technology.
And generally.
Is they're not great at it.
And.
What occurs is something that in my office we have these Talmudic discussions about whether something is like in the cyber world.
Or something like something else in the physical world.
Right.
And that's what happens in these cases.
And so the Supreme Court for example in Van Buren spoke in language of gates up or gates down.
If the gates are down.
The restrictions apply.
If the gates are up.
There was no lack of authorization.
Exactly what a gate is.
May not be entirely clear as we sit here right now.
Right.
And there were other parts of the opinion where they make it clear that if for example there are files, directories.
That are off limits to you.
Then the CFA applies.
But what exactly off limits means also.
Is something that's going to take some.
Some interpretive work.
In courts.
And so.
Absolutely right.
What Harley said.
That this is.
This clearly has rained back the reach of the CFAA.
There will be more work to be done though.
To figure out exactly what it means.
There are things that it didn't address.
Or just that were outside the ambit of the decision.
For example.
What is accessing a computer under the CFAA?
Right.
Which I think is an important question for people in this community.
When you are interacting with a computer.
When does that cross the threshold of being accessed?
It might be actual under the statute.
This case wasn't intended to address that.
And so that's still out there to be resolved.
All that said.
Everything Harley covered was exactly spot on.
Okay.
Does anybody remember what this horrible human being did?
Yes?
Go ahead.
He got AT&T.
He was AT&T.
Not that.
He was AT&T email addresses.
For a lot of people.
That's right.
So this horrible human being.
Did find the addresses.
Email addresses of AT&T iPad users.
Exposed on the public internet.
And managed to scrape a great deal of this.
And disclosed it to Gawker.
I think.
And was brought up on CFA charges.
And I raise this to.
As an illustration.
That this type of prosecution.
Was already difficult.
Because there was a court split at the time.
Van Buren resolved that court split.
And this kind of prosecution will be a lot harder.
Going forward.
It was publicly available information.
And now there is not a court split.
So not to say there would not be any potential liability.
But it would be a lot harder.
To bring a case like this.
Now than it was previously.
I just want to say one more thing about this case.
I think it was U.S. vs. Spittler.
So.
Harley hit on this earlier.
There was a perception that.
Security researchers were being prosecuted.
Far and wide.
And when we first began.
Engaging with this community.
In 2014 or so.
We took that back.
And we actually thought about that.
Because we were concerned.
We wanted to make sure we weren't shilling research.
And what we found.
In the last decade.
Was.
This is the only case.
The federal government.
Has brought against the security researcher.
Okay.
For security research.
For security research.
There may have been other cases brought by state authorities.
But.
This is the sole case.
In the last decade.
Against the security researcher.
Let me surprise some of you.
And.
Just so you know.
You don't have to accept our word.
For the.
The.
Senate for democracy and technology.
Also took a look at this.
And in 2017.
They found the exact same thing.
That said.
And we'll talk about this later.
There are reasons why.
This community.
Associates the CFAA.
With.
Let's say.
Aggressive restrictions.
And.
We'll get to that later.
But I'll.
Give you.
Spoiler alert.
It has to do with the civil.
Portion of the statute.
So.
So that is one change.
Is.
Those series of cases.
That.
Is.
Van Buren.
And Haikyuu.
It's a big deal.
It solves the split.
That was in circuit courts.
For.
Like.
At least 10 years.
I think.
Now.
Limitations.
The.
That change.
Does not.
That's a different part of the statute.
Than.
If you're causing damage.
Or if you have intent to defraud.
Right.
So if you cause damage.
You know.
Or if you are out there.
Trying to defraud people.
That is.
This change is not actually going to help you.
This is about exceeding your authorized access.
And.
It's federal.
So it applies.
Just to this.
Just to the.
The federal law.
Just to CFAA.
It's different from the states.
And we're going to cover the states in a bit.
Now.
But.
It's still a big deal.
And.
On top of.
That.
News.
In 2022.
In fact.
In the past.
What.
Four months.
Or so.
The Department of Justice.
Changed its charging policy.
For.
For CFAA.
And here is a look.
At.
That.
I.
Don't worry about.
Reading through the block of text.
Too.
Too.
Carefully.
We can parse this language a little bit later.
But.
This.
Is.
A.
This is also.
This is public.
And.
Who better to talk about it.
No.
Yes.
So.
In.
May of this year.
We.
Announced.
This.
This policy.
And it's sort of.
Maybe.
The.
The.
Capstone.
Of.
A.
Of.
Of.
Work.
With.
With.
Folks.
Like.
Harley.
And.
Others.
In.
This.
Community.
Who.
In.
A.
Very.
Open.
Handed.
Way.
Allowed.
Us.
To.
Kind.
Of.
Understand.
This.
Policy.
That.
Essentially.
Says.
That.
An.
Assistant.
U.S.
Attorney.
We.
Have.
94.
Districts.
Across.
The.
Country.
That.
Have.
Federal.
Prosecutors.
In.
Them.
Who.
Are.
Responsible.
For.
These.
Types.
Of.
Cases.
We.
Are.
The.
Office.
At.
Main.
Justice.
That.
Oversees.
This.
Statute.
Every.
Indictment.
Across.
The.
Country.
Has.
To.
Through.
Our.
Office.
And.
So.
We.
Promulgated.
The.
Policy.
To.
The.
U.S.
Attorney's.
Office.
Is.
Saying.
That.
They.
Should.
Decline.
A.
Prosecution.
If.
The.
Activity.
Involved.
Good.
Faith.
Computer.
Security.
Research.
Meaning.
And.
I.
Won't.
Too.
Far.
It's.
Done.
In.
A.
Way.
That.
Avoids.
Harm.
To.
The.
Public.
Or.
Individuals.
And.
Is.
Primarily.
For.
The.
Purpose.
Of.
Producing.
Information.
To.
Protect.
The.
Class.
Of.
Devices.
Machines.
Or.
Online.
Services.
And.
So.
You.
That's.
That's.
A.
Lengthy.
Way.
Of.
Attempting.
To.
Capture.
What.
It.
Is.
People.
We.
Understand.
Attempt.
To.
Do.
In.
This.
Community.
And.
Let.
Tell.
You.
Wasn't.
Easy.
To.
Try.
To.
Capture.
In.
Words.
It.
Took.
Of.
Chewing.
And.
Throwing.
But.
But.
We'll.
Talk.
About.
This.
More.
But.
For.
For.
Charging.
Crimes.
Under.
The.
CFAA.
To.
Say.
You.
Should.
Decline.
It.
If.
The.
Defendant.
Is.
A.
Good.
Faith.
Security.
Research.
The.
Language.
That.
That.
Is.
Up.
There.
Again.
We'll.
Go.
We'll.
Parse.
Through.
It.
A.
Bit.
More.
But.
That.
Is.
Borrowed.
From.
Another.
Another.
Part.
Of.
The.
Law.
Where.
A.
Of.
Standard.
Language.
Around.
Defining.
Good.
Faith.
Security.
Research.
For.
Better.
Or.
Worse.
Nothing.
Is.
Perfect.
But.
That.
Again.
May.
So.
This.
Is.
The.
Past.
Year.
A.
Big.
Change.
On.
The.
Heels.
Of.
That.
Rapid.
7.
And.
Speaking.
With.
Like.
At.
While.
At.
Rapid.
7.
Speaking.
With.
Researchers.
External.
To.
Rapid.
7.
And.
Within.
Rapid.
7.
It.
We.
Are.
Seeing.
That.
Much.
More.
A.
Private.
Lawsuits.
Then.
Over.
Things.
Like.
Criminal.
Prosecution.
You.
Know.
We.
And.
Is.
Kind.
Of.
A.
Hard.
Thing.
To.
Measure.
Because.
A.
Of.
The.
Private.
Lawsuits.
To.
The.
Aspect.
Of.
It.
The.
Charging.
Policy.
Does.
Not.
Apply.
Do.
You.
Want.
To.
Anything.
Else.
About.
CFA.
I.
There's.
Only.
One.
Thing.
I.
Should.
Say.
Just.
In.
The.
In.
The.
Interest.
Of.
Candor.
I.
Said.
There.
Have.
Been.
No.
Prosecutions.
Of.
Security.
Researchers.
There.
May.
A.
Question.
About.
Well.
Have.
They.
Been.
Investigated.
And.
There.
I'd.
Have.
To.
Concede.
There.
Happen.
Investigations.
But.
You.
Have.
To.
Kind.
Of.
Cut.
Us.
A.
Slack.
There.
And.
That.
Is.
Because.
If.
You're.
Let's.
Say.
Penetration.
Testing.
A.
System.
That.
Don't.
Have.
An.
Agreement.
With.
What.
You.
Are.
Necessarily.
Doing.
Is.
Something.
That.
Looks.
Identical.
To.
Someone.
Who.
Is.
Actually.
Trying.
To.
Let's.
We.
Not.
Progressed.
And.
Is.
Not.
Progressing.
To.
A.
Prosecution.
And.
So.
You.
We.
We.
Also.
Are.
Better.
At.
Understanding.
The.
Difference.
Between.
Certain.
Types.
Of.
Activity.
That.
Is.
Actually.
A.
Precursor.
To.
Actual.
You.
Intrusions.
Versus.
Others.
Like.
For.
Example.
Mirror.
Scanning.
Mirror.
Port.
Scanning.
Is.
Not.
Going.
To.
Up.
With.
Someone.
Knocking.
On.
Your.
Door.
Asking.
You.
Know.
From.
The.
Government.
I.
Should.
Say.
But.
That.
Wasn't.
The.
Case.
Going.
Back.
A.
Decade.
Ago.
But.
I.
That.
Is.
Something.
That.
Has.
Changed.
So.
I.
Just.
Wanted.
To.
Clear.
About.
One.
And.
Just.
To.
Recap.
The.
Changes.
Those.
Major.
Court.
Cases.
That.
Are.
You.
Curbing.
In.
A.
Big.
Way.
The.
Most.
Problematic.
Part.
Of.
The.
F.
A.
And.
Then.
The.
D.
O.
J.
Is.
Charging.
Policy.
Change.
You.
Know.
All.
Since.
2021.
This.
Is.
The.
Next.
Big.
Important.
One.
So.
This.
Is.
Section.
1201.
Of.
The.
DMCA.
So.
The.
DMCA.
The.
Digital.
Millennium.
Copyright.
Act.
Here.
Is.
A.
Law.
That.
If.
It.
Were.
Proposed.
Today.
Would.
Not.
Even.
Get.
A.
Hearing.
In.
Congress.
It's.
It.
Is.
Archaic.
And.
Clunky.
And.
It.
Wastes.
Everybody's.
Time.
And.
Arguably.
It.
Is.
Broader.
Than.
The.
Computer.
Fraud.
And.
Abuse.
Act.
Because.
Remember.
I.
Mentioned.
That.
The.
Computer.
Fraud.
And.
Abuse.
Act.
Largely.
Applied.
To.
Other.
People's.
Computers.
Section.
1201.
Of.
The.
D.
M.
C.
I.
Applies.
To.
Other.
People's.
Computers.
And.
Your.
Computer.
So.
It.
Can.
Apply.
To.
You.
Where.
You're.
You're.
Doing.
I.
O.
T.
Research.
In.
Your.
Basement.
You.
Under.
A.
20.
Watt.
Bulb.
Like.
That.
It.
Does.
Apply.
To.
You.
What.
It.
Does.
Is.
There.
We.
Go.
What.
It.
Does.
Is.
It.
Restricts.
Here.
Comes.
The.
Lawyer.
Speak.
Circumventing.
A.
Technological.
Protection.
Measure.
To.
A.
Protected.
Work.
A.
Copyrighted.
Work.
So.
What.
That.
Mean.
For.
Hackers.
Circumventing.
A.
Technological.
Protection.
Measure.
To.
A.
Copyrighted.
Work.
Is.
What.
You.
Do.
All.
The.
Time.
The.
Software.
So.
A.
Technological.
Protection.
Measure.
Can.
Be.
Something.
Like.
Encryption.
Or.
Login.
So.
Anything.
That.
Is.
Protecting.
Access.
To.
Software.
And.
So.
That.
Because.
You.
License.
Software.
Does.
Not.
Mean.
That.
Have.
Authorization.
From.
The.
Copyright.
Holder.
To.
Conduct.
That.
Research.
And.
That.
Can.
Be.
Software.
That.
Your.
Own.
Device.
Doesn't.
Have.
To.
Be.
Just.
On.
Somebody.
Else's.
Device.
So.
Arguably.
This.
Has.
Been.
Broader.
And.
A.
Of.
Times.
When.
I've.
Seen.
Letters.
That.
Are.
Sent.
Out.
To.
Researchers.
It's.
Both.
There's.
A.
Citation.
For.
CFAA.
As.
Well.
As.
DMCA.
Thrown.
In.
There.
So.
I.
Think.
The.
Best.
Thing.
About.
Our.
Circumventing.
TPMs.
And.
So.
2015.
Was.
Was.
Actually.
The.
First.
Time.
That.
There.
Was.
A.
A.
Security.
Research.
Exception.
To.
Section.
1201.
That.
Did.
Not.
Rely.
On.
The.
Authorization.
Of.
The.
Copyright.
Holder.
And.
There.
Was.
A.
Of.
Folks.
That.
Were.
Doing.
Unsung.
Work.
In.
The.
Community.
To.
Try.
To.
To.
Try.
To.
That.
Happened.
In.
The.
Center.
For.
Democracy.
And.
Technology.
EFF.
Like.
Like.
You.
Don't.
Hear.
Their.
Names.
Proclaimed.
From.
The.
Rooftops.
But.
Like.
This.
Process.
Was.
Where.
A.
Of.
The.
Cutting.
Edge.
Conversations.
Were.
Happening.
For.
Cybersecurity.
Researcher.
Protections.
And.
It.
Evolves.
Every.
Three.
Years.
So.
20.
To.
2015.
2018.
In.
2021.
I.
Think.
That.
What.
We.
Finally.
Have.
For.
The.
Purposes.
Of.
Good.
Faith.
Testing.
Investigation.
Or.
Correction.
Of.
A.
Security.
Floor.
Vulnerability.
Right.
So.
That's.
The.
Research.
Part.
And.
Then.
The.
Rest.
Are.
Sort.
Of.
Caveats.
On.
It.
Responsibly.
So.
Where.
The.
Research.
Is.
Carried.
Out.
In.
An.
Environment.
Designed.
To.
Avoid.
Harm.
To.
The.
Public.
Where.
The.
Information.
That.
You're.
Taking.
From.
It.
Are.
Used.
For.
Security.
Right.
So.
You're.
Using.
It.
To.
Promote.
The.
Security.
Of.
The.
Devices.
That.
You.
Are.
Researching.
And.
You're.
Not.
Had.
To.
Throw.
This.
In.
The.
And.
You're.
Using.
This.
Information.
In.
A.
Manner.
That.
It.
Facilitates.
Copyright.
Infringement.
Now.
I.
Don't.
Know.
If.
You.
Caught.
A.
Lot.
Of.
The.
Language.
In.
The.
Department.
Of.
Security.
I.
Think.
That.
You.
Are.
Using.
To.
Devices.
Of.
Security.
Okay.
A. Good.
A. Good.
Number.
Of.
So.
Okay.
So.
I.
This.
Is.
This.
One.
Statute.
Amuses.
Me.
In.
Part.
Because.
So.
This.
Is.
This.
Triennial.
Process.
Right.
Where.
By.
The.
Librarian.
Of.
Congress.
Looks.
At.
The.
Copyright.
Laws.
And.
Decides.
Whether.
There's.
Exception.
And.
It's.
Again.
Every.
Three.
Years.
Like.
They.
Sat.
Around.
And.
Said.
Two.
No.
That's.
Not.
Four.
No.
We're.
Three.
For.
Some.
Reasons.
So.
Every.
Three.
Years.
There's.
A.
Chance.
To.
Alter.
The.
Law.
Back.
In.
I.
Believe.
It.
Was.
2018.
We.
Became.
Aware.
That.
This.
Was.
Up.
For.
Consideration.
And.
We.
Decided.
We.
Going.
To.
Weigh.
In.
And.
So.
We.
Did.
Something.
We.
Haven't.
Done.
Before.
Which.
Was.
We.
Issued.
A.
Formal.
Letter.
To.
Library.
Of.
Congress.
In.
Support.
Of.
Of.
The.
Security.
Research.
Exception.
Because.
Looking.
At.
It.
Felt.
It.
Made.
Sense.
And.
Then.
In.
2021.
It.
Up.
Again.
Because.
Some.
Of.
The.
Restrictions.
On.
Security.
Research.
That.
Were.
In.
The.
Exemption.
In.
2015.
Were.
Considered.
Maybe.
Too.
Narrow.
And.
We.
Looked.
At.
Again.
And.
Found.
That.
We.
Could.
Actually.
Agree.
With.
Expanding.
In.
Various.
Ways.
And.
Because.
Part.
Of.
My.
Office.
From.
The.
Computer.
Crime.
And.
Intellectual.
Property.
Section.
We.
Actually.
Enforce.
The.
Criminal.
DMCA.
Provisions.
The.
Library.
Of.
Congress.
Actually.
Was.
Was.
Pretty.
Amenable.
To.
Our.
Position.
So.
Just.
To.
Kind.
Of.
Give.
You.
A.
Little.
More.
History.
Researchers.
That.
Is.
Really.
Substantive.
You.
Know.
From.
A.
From.
A.
Enforcement.
Agency.
When.
They.
That.
They.
Want.
To.
Protect.
Researchers.
They.
Behind.
The.
Scenes.
So.
This.
Entirely.
A.
Kumbaya.
Moment.
I.
Mean.
One.
Of.
The.
That.
Did.
Happen.
Over.
These.
Years.
Is.
That.
People.
In.
This.
Community.
Were.
Willing.
To.
Sit.
In.
But.
Actually.
Are.
Two.
Parties.
That.
Are.
Working.
Towards.
A.
Common.
Goal.
Which.
Is.
Better.
Security.
And.
Protection.
Of.
People's.
Information.
And.
Assets.
So.
This.
Was.
2021.
When.
This.
Was.
Released.
I.
Think.
This.
Is.
Late.
2021.
But.
Consider.
The.
Timeline.
Also.
Right.
2015.
It.
Started.
Before.
2015.
So.
This.
Was.
A.
Period.
Of.
Like.
Seven.
Eight.
Years.
Just.
Working.
With.
The.
Copyright.
Office.
Alone.
On.
This.
I.
Think.
EFF.
Had.
Started.
Even.
Several.
Years.
Before.
That.
I.
Mean.
It.
Like.
Talk.
About.
You.
The.
The.
Policy.
Moves.
Slowly.
One.
Of.
The.
Reasons.
For.
That.
Is.
Because.
You.
Oh.
We.
Managed.
To.
Do.
It.
That's.
Terrific.
I.
I'm.
Assuming.
Is.
That.
Better.
Everybody.
Awesome.
Thank.
You.
Yeah.
So.
There.
I'll.
Tell.
You.
Just.
A.
Story.
So.
In.
In.
Twenty.
Eighteen.
We.
Heard.
From.
Other.
Other.
Trade.
Associations.
And.
Other.
People.
Elections.
We're.
To.
Have.
People.
Hacking.
Planes.
We're.
Going.
To.
People.
Hacking.
Cars.
On.
Highways.
It'll.
Be.
You.
Know.
They'll.
Be.
Hacking.
Cars.
In.
Such.
A.
Way.
That.
They.
Are.
Violating.
Pollution.
Laws.
To.
Which.
Our.
Response.
Had.
Always.
Been.
Well.
There.
Are.
Other.
Laws.
That.
Take.
Care.
Of.
That.
We.
Don't.
Not.
Fit.
The.
Language.
That.
We.
Just.
Saw.
Yes.
That's.
Right.
That's.
Right.
So.
This.
Is.
This.
Was.
On.
A.
Highway.
But.
The.
This.
Particular.
Example.
On.
Other.
Side.
We.
Heard.
People.
Saying.
No.
This.
Is.
Terrible.
Look.
At.
Folks.
Can.
Do.
They.
Can.
Stop.
It.
On.
A.
Highway.
And.
Everybody.
At.
Risk.
So.
Yes.
This.
Is.
This.
Is.
Of.
Those.
Caveats.
This.
Is.
Why.
This.
Specific.
Example.
Made.
Made.
A.
Of.
Ways.
In.
Policy.
Land.
And.
Is.
One.
Of.
The.
Reasons.
Why.
That.
That.
Language.
There.
Yes.
So.
It.
Be.
Authorized.
Access.
To.
The.
Machinery.
Right.
To.
The.
To.
The.
Computer.
Maybe.
But.
Not.
To.
The.
On.
The.
Computer.
Because.
The.
Software.
Is.
Copyrightable.
And.
That's.
The.
Way.
1201.
Section.
1201.
Works.
You.
Have.
To.
Get.
The.
Authorization.
Of.
The.
Copyright.
Holder.
And.
And.
Case.
They.
They.
Did.
Not.
Have.
Authorization.
Of.
The.
Copyright.
Holder.
Even.
If.
They.
Had.
The.
Authorization.
Of.
The.
Person.
Who.
Owned.
The.
Jeep.
Art.
Yes.
So.
Convent.
A.
Measure.
Yeah.
That's.
A.
Requirement.
To.
The.
Statute.
I.
Think.
It.
Probably.
Depends.
On.
The.
Specifics.
I.
Think.
Depends.
On.
The.
Specifics.
Okay.
So.
A.
Big.
Limitation.
On.
That.
Right.
So.
Now.
You.
Have.
Again.
Just.
In.
The.
Past.
Year.
You've.
Got.
Better.
Much.
Better.
Protections.
Under.
Section.
12.
1.
Of.
The.
To.
Trafficking.
In.
The.
Tools.
So.
If.
Are.
Making.
The.
Tools.
Available.
Publicly.
Even.
Not.
For.
Profit.
Put.
It.
Out.
On.
Twitter.
Then.
That.
May.
Violate.
Section.
12.
1.
Of.
The.
DMCA.
But.
A.
Different.
Part.
Of.
It.
One.
That.
Not.
Fall.
Under.
The.
Protections.
That.
We.
Just.
Discussed.
So.
The.
Active.
Research.
Is.
Protected.
But.
The.
Disclosure.
Of.
The.
Tools.
And.
The.
Techniques.
May.
Not.
Be.
Yes.
There.
Will.
Time.
For.
Questions.
But.
If.
You.
Want.
You.
Know.
We're.
Going.
To.
Be.
Loose.
In.
That.
A.
Process.
You.
Put.
In.
The.
Same.
Way.
That.
Process.
You.
Put.
In.
The.
Same.
Law.
Is.
A.
Law.
So.
Say.
Something.
For.
For.
CFAA.
If.
You're.
Talking.
About.
Will.
A.
Civil.
Lawsuit.
Look.
At.
The.
D.
O.
J's.
Charging.
Policy.
Change.
It.
May.
Be.
Persuasive.
But.
It's.
Not.
Going.
To.
It's.
Not.
Going.
To.
Right.
So.
In.
A.
Civil.
Proceeding.
It.
Would.
Be.
A.
Proponent.
Of.
The.
Evidence.
Versus.
Beyond.
A.
Reasonable.
Doubt.
In.
A.
Criminal.
Case.
So.
There.
Be.
A.
Standard.
Also.
Used.
If.
Information.
Is.
Let's.
Say.
Let's.
Say.
In.
The.
Web.
Service.
Application.
Or.
Something.
That.
Organization.
Creates.
But.
That.
Makes.
Them.
Be.
Careful.
That's.
Would.
Say.
It.
Starts.
To.
Look.
Like.
Extortion.
And.
And.
I.
Think.
I.
Think.
That's.
Not.
Best.
Practices.
For.
Research.
Under.
Any.
Circumstances.
And.
I.
That.
I.
Would.
Just.
Say.
Depend.
It.
Depends.
On.
The.
Specifics.
But.
You.
Definitely.
Don't.
Want.
To.
The.
Impression.
That.
You.
Are.
You.
Have.
Exploits.
That.
You.
Might.
Use.
If.
They.
Did.
Not.
Do.
Not.
Pay.
You.
That.
Is.
That.
Is.
Something.
That.
Comes.
Up.
Both.
Under.
Section.
12.
1.
And.
Also.
Comes.
Up.
Under.
CFA.
Yeah.
This.
This.
That.
That.
You.
If.
You.
Have.
A.
Step.
Example.
And correct me if I'm wrong, if I've mischaracterized it, so, for example, if you're doing research
on the dark web, you come across what is apparently stolen data, and you access it.
Are you violating the CFAA?
And the simple answer to that, under those facts, is no.
I'm glad to say that one thing I can recommend to you is one of the things that the cybersecurity
unit that I head has done is we've produced various white papers on issues that people
in the community and in the industry have flagged for us as legal issues that they're
interested in seeing if we could provide some guidance on.
The one we released in February of 2020 is intelligence gathering on the dark web or
purchasing your information back on the dark web.
If you did a web search for cybersecurity unit DOJ, you'll land on the dark web, and
there'll be a landing page, and on there are links to various white papers.
One of them actually covers, and I think is rather instructive on this issue.
Yeah, no, I guess in lawyer's speak, you wouldn't be actually accessing a computer
without authorization, right?
The data is out somewhere else.
Right, but it's not.
Right.
You have not accessed the computer from which it was stolen, it is just data that someone
has posted somewhere, and you're accessing their computer with authorization as it's
posted on the web, but that would not be a CFA violation by itself.
But that's CFA, I mean, there are other laws that can apply, like receipt of stolen property,
some privacy laws, so it depends on the situation, and just, I think, be aware that there are
more laws in the CFA that may apply to that situation.
And on that score, I would recommend the paper that I flagged, because we get into some of
the other issues.
And we have two more.
.
.
So here I'm going to be very lurly and weaselly.
The simple answer is the facts will matter, right?
So if you, for example, will take Weave, the case that we talked about before,
he had access through this AT&T server, which was configured to essentially
populate certain fields when you accessed it if you had an AT&T iPad.
He identified what some would argue is a security vulnerability that shouldn't have existed.
He wrote then a Perl script that allowed him to do that 116,000 times, right?
Which did then kind of move it out of what today we would consider good-based security research.
Now, if you're saying you accessed this, you saw this,
and you said,
and then perhaps you reported it,
that would help, right, in terms of what we're thinking.
You should be in the mindset, though, of thinking,
how will someone perceive my actions?
Not my intent, but my actions, because it's very difficult to discern what your motives are.
So if someone, for example, identifies your IP address coming from wherever you are
as accessing this particular server,
and there's nothing else going on,
again, you may get a knock at the door.
There may be some questions.
You should do everything you can, though, to make it clear what it is you're doing.
Again, the same paper I talked about before goes into this a bit.
That is, to the extent that, for example, you work for a company,
and there is a work plan that demonstrates that this is a manner in which you collect cyber threat intelligence information.
That would be helpful.
Not dispositive, necessarily, but helpful.
But that's the advice I can give you here.
Put yourself in the mindset of,
without knowing your intent,
what do my actions look like,
and how can I demonstrate that my actions are not those, actually,
of someone who would do this for malicious purposes.
All right. Thank you.
I'm going to try to get us back on track.
If we have questions that are not directly related to what we're talking about,
we should hold those to the end.
We do have time for a roundtable,
so we will have time to get to the questions,
but let's try to keep it to what we're talking about now,
just for the flow of the conversation.
So that folks get the information.
We were talking about Section 1201 of the DMCA,
and we said that
this good-face security research exception,
which came out in 2021,
provides good protection, but does not cover trafficking.
So trafficking in the tools, the exploits, the techniques,
and trafficking sounds like it might be more complicated than it is,
but it could just be public disclosure of those things.
And this is the basis,
the basis of the Apple versus Corellium lawsuit.
This was partially settled in 2021.
We don't have the details of the settlement,
but originally it was that Corellium was violating
that trafficking portion of the statute.
And one of the reasons that it was settled, in fact,
was from pressure from the cybersecurity community.
It put out a statement saying,
we should not be suppressing the use of cybersecurity tools.
We don't want there to be the case that,
like a public disclosure of techniques,
and tools is outlawed under Section 1201,
it is a bad cybersecurity situation,
to say everybody must develop their own
because those tools will not be as good
and able to actually improve cybersecurity.
Yes.
I think that is one of the things
that was kind of eye-opening about the lawsuit,
is that there did not seem to be an exception for open source.
And if the techniques and tools
can circumvent a technological protection measure
to a copyrighted work,
which a lot of open source tools do,
then yes, it could violate that.
This is not a part of the statute
that we see come up very often.
And I think that it was under the radar quite a bit,
and it is one that we don't have that opportunity
to come to the Copyright Office every three years
for an exception.
That has to be something that is done by Congress.
And Congress does what Congress does.
So, we talked about CFAA,
and we talked about DMCA.
I want to look at the states as well.
So, if you are, you know,
wherever you reside,
if you look up your state and then computer crime law,
it will be worthwhile to take a look at those statutes.
Many of them are very similar
to the Computer Fraud and Abuse Act.
They use similar language,
accessed without authorization.
Some of them say,
it needs authorized access,
just like the CFAA did.
What's different,
one of the things that's different,
is that it has not gone through that evolution
that we just discussed for CFAA.
There is no Van Buren counterpart
to state computer crime laws.
There's no DOJ charging policy.
It does not apply to the state computer crime laws.
Those are enforced by states.
They go through state courts.
This is our federalist system.
And so, some of the states end up actually having language
that is even more broad than the CFAA.
Missouri, which is actually where I'm from,
is one of those examples.
And in 2021,
we had this issue
where the St. Louis Post-Dispatch,
a reporter for the St. Louis Post-Dispatch,
found on their Department of Education website
that the social security numbers
of many educators were revealed.
And this was not a very complicated exposure.
It looked like hitting F12
and looking at the source of the website revealed this.
It was disclosed to the agency,
which initially said,
thank you.
Somehow it became political
and the governor said that this was hacking.
This was unacceptable
and that we should have a law enforcement investigation.
The Highway Patrol did investigate the Post-Dispatch.
They did investigate the reporter.
No charges were brought.
And what the Highway Patrol said at the time was
that there was no criminal intent.
Obviously, this is true.
This is also true for good faith cybersecurity research.
That's also not what's required in the statute.
The statute does not require criminal intent.
It actually does not require intent
to defraud.
It is whether or not you are accessing the computer at all.
It also...
Missouri is one of those states that says
that if you disclose an access code
or a password without authorization,
then you are in violation of their state law.
Now in the CFAA,
if you're disclosing an access code or a password,
that requires intent to defraud
to be illegal under the CFAA.
Here again, no intent to defraud.
It's just if you should have known
that you did not have authorization
to disclose the password.
So for example,
you're conducting IOT research.
One of the routine things
that you see with IOT cybersecurity research
is finding a hard-coded password in the device.
Are you allowed to disclose that under Missouri law?
Do you have authorization to do it?
This is what I'm talking about.
It would not be a violation under CFAA,
arguably not anymore under DMCA
now that we have that protection.
But you have state laws that are just as broad
or more broad than the CFAA
and don't have some of the same limiting factors
that we've discussed.
Maryland is another.
So in Maryland, in fact,
Missouri is one where it says
if you are disclosing a password
or an access code without authorization,
Maryland, in fact, makes it a crime,
home of the NSA,
makes it a crime to try to identify
an access code or a password.
So not even just a disclosure.
The act of research to try to identify
the password or the access code is illegal.
Again, no intent to defraud required.
And then by contrast,
like just to show you some of the variation here,
there's the state of Washington.
The state of Washington actually has,
and the only one I know of in states,
it has a bona fide security researcher protection.
And this is, here they call it
White Hat Security Research.
The way that they do it is they say
you can't do a bunch of stuff without authorization,
just like CFAA,
but without authorization is defined.
And without authorization,
that authorization does not include
White Hat Security Research.
And if you see the definition of
White Hat Security Research up there at the top,
you'll see that a lot of that also mimics
the language that was in that Section 1201 exception.
Yes?
AUDIENCE MEMBER 1
AUDIENCE MEMBER 2
AUDIENCE MEMBER 3
AUDIENCE MEMBER 4
AUDIENCE MEMBER 5
AUDIENCE MEMBER 6
AUDIENCE MEMBER 7
AUDIENCE MEMBER 8
AUDIENCE MEMBER 9
AUDIENCE MEMBER 11
AUDIENCE MEMBER 13
AUDIENCE MEMBER 14
AUDIENCE MEMBER 15
AUDIENCE MEMBER 16
AUDIENCE MEMBER 17
AUDIENCE MEMBER 18
AUDIENCE MEMBER 21
AUDIENCE MEMBER 22
AUDIENCE MEMBER 23
AUDIENCE MEMBER 24
AUDIENCE MEMBER 27
AUDIENCE MEMBER 28
AUDIENCE MEMBER 31
AUDIENCE MEMBER 37
AUDIENCE MEMBER 42
AUDIENCE MEMBER 43
AUDIENCE MEMBER 44
AUDIENCE MEMBER 45
AUDIENCE MEMBER 46
AUDIENCE MEMBER 48
AUDIENCE MEMBER 49
some statutes. I guess the short answer is, I'll go beyond, it depends, but there are various
jurisdictional bases for these statutes. So if you have your victim in the state, so if the
computer accessing is in the state, you certainly should be concerned, right? If you yourself are
located in the state, you should be concerned. There's a separate question of like, if a company
that is incorporated, but has an office in that, if their headquarters is in Missouri,
but the servers are, the backend is in California, hosted by Amazon or whoever,
do you have to be concerned? Not clear, exactly. And in the wonderful world of cloud computing,
of course, there are a lot of things that you can do. There are a lot of things that you can do.
There's the separate question of how exactly jurisdiction works. I can tell you in those first
two instances though, you should definitely be concerned. And how would you know, right? How
do you know if the computer that you're accessing is in one of these states? This is why it is
something that matters to everybody, no matter what state you're in. Also, get a lawyer who
knows venue and jurisdiction and can maybe remove it to federal court. Yes.
So, right now, if you if if lawyers and hopefully New Yorkers in счит.
By all things arms, loaded loads of weapons on the scale.
Does it matter? Does it not matter?
Because there's so much onu federal laws out there saying
The state laws are.
Right.
So,
I got you.
consent and authorization often kind of merge but I think conceptually for the
wiretap acts 18 USC 25 11 and the computer fraud and abuse act they're
actually quite separable so the idea of having two party consents both parties
on the line consenting is a requirement for for I think 12 states across the
country I don't think that those map to any sort of comparable language in those
those states computer laws all right I want to cover this international aspect
of the law as well and then where we are barreling towards the the roundtable
portion so I hope that there are more questions that we haven't answered them
already so in 2021 China publicized after a comment period it publicized a
coordinated vulnerability disclosure and patching law it is the the
regulatory
regulations on the management of security vulnerabilities of network
products and this law requires companies to have vulnerability disclosure policies
that's great it requires patching of vulnerabilities this is this is this is
required it also though requires vendors to disclose vulnerabilities to the
government within two days of discovery so you discover the vulnerability you
flow it up to the government two days that is going to be a lot of unpatched
vulnerabilities. Researchers believe it or not are actually kind of
encouraged there's a you're encouraged to have bug bounties if you are if you are
a vendor but remember the vulnerabilities that you hear flow up
to the government within about two days now what is what is very different from
the sort of the way that we are used to things here in the US is that there is a
strict restriction on public disclosure of the vulnerabilities and a strict restriction on
So, as a security researcher, under this law, at least under the letter of the law, I can't speak to how it's enforced on the ground.
I have no visibility into that. But the letter of the law is that you must report the vulnerability either to the vendor or to the government.
These are your options. And remember, if you report it to the vendor, the vendor reports it directly to the government anyway.
So, bug bounties, CVD, and it flows to the government.
And the penalties for violating this can include imprisonment. I mean, it is a criminal law.
But it also includes things like administrative fines. I mean, there's a wide array of penalties.
So, this is in stark contrast sort of to the direction that we are moving in with the United States,
where it comes to adopting coordinated vulnerability disclosure, sort of recognizing the hacker community and our criminal laws,
and also, you know, continuing to preserve the ability to, you know,
disclose vulnerabilities publicly.
So, this is the last slide. Well, last substantive slide. So, where do we go from here?
And just want to wheel it back to the point that we made at the beginning, that a lot of the researcher community
had previously been focused on the Computer Fraud and Abuse Act, but that exceeds authorized access,
terms of service problems, and Section 1201 of the DMCA. I would argue that you can still do that.
Those things are absolutely not perfect.
But you're not going to get the same bang for your buck that you had prior to 2021, right?
Now, areas of greater legal risk, I would argue, are in the U.S. states, which have not had any of that same evolution as federal law.
International laws, like China's CVD law, is another big one.
Speaking of CVD, another area to focus on is continued adoption of coordinated vulnerability disclosure with private companies.
And one reason for that is, remember, not all of the protections understand that.
And that's why CFA apply to private lawsuits.
Those are often the greater threat than criminal liability.
And for Section 1201 of the DMCA, that protection, although it comes up for renewal every three years,
I'm relatively confident it is pretty baked at this point.
We may be able to improve it some further, but I doubt that unless there's a major event that we would do a lot of backsliding.
What does need improvements in a major way is the trafficking portion.
So, I actually think that this is...
What we talked about here, and I think this is what we talked about here,
today, the progress on CFA, DMCA, is in part due, in large part due, to security community advocacy.
It has been a powerful force, but now, let's turn it towards the areas of greater legal risk,
and especially the states where we are all from, and where our lawmakers have similar processes to the federal lawmakers.
I think that that is the next area where we can get the best bang for our buck in our advocacy.
And that is the...
Security research exception from 1201 DMCA.
If you want to look at it some more, I figured we might end up talking about it in this Q&A session, which begins now.
Yes, please.
I'm coming to the GSMA to present on the China law.
So, I'm the chair of the Fraud and Security Group.
We have an industry CVD scheme.
So, it's still quite unclear to us.
We have asked MIIT what the situation is.
We've not got a response.
So, you know, for companies that are involved in our CVD committee, some of which are Chinese,
whether they have to disclose those vulnerabilities.
So, that's the first point I want to make, which is of concern.
The second one is on the international law aspect.
So, in the UK, we have what's called the PSTI Bill going through Parliament right now,
which is the Product Security and Telecommunications Infrastructure Bill,
which is our IOT Act when it gets passed.
And in that, there will be a requirement for...
for companies to provide CVD.
And a lot of that work has been promoted, really, from here.
So, thanks, everyone, for getting that just close to the line and getting into law.
So, thank you.
The proliferation of coordinated vulnerability disclosure policies and standards,
I think, deserves its own talk of similar length.
But that is another major area of progress from the hacker community into policy.
Peter, you...
You were...
The UK is looking at the Computer Misuse Act also, right?
And they...
One of the things that the government is considering there,
I think one of the questions that they asked was,
should there be an explicit protection for security researchers?
Do I have that right?
Yeah, so, I'm David. Peter is around this week.
Yeah, so, the Home Office has consulted on this.
And I think, at the moment, they're kind of quite busy with other things.
But that's what they're looking at.
And I think, clearly, the precedent work that's happening in the United States
is going to feed into that.
So, I personally was quite pleased to see all of this
because we can put that into that work.
I think there's a lot of...
There's a lot of kind of input needs to go into it.
There's a maturity of thinking that needs to happen.
So, on the PSTI bill, actually,
when it went to the House of Lords, which is our upper house,
there were questions raised about whether,
by putting CVD in,
into law,
that they're creating a defense for malicious hacking.
And so, then it got into this kind of, basically,
letters of mark discussion,
which I don't think we want to go down that road, to be honest.
So, I mean, so the UK right now
has a process where they're looking at the Computer Misuse Act.
It's sort of their version of the CFAA.
So, if you have contacts with the UK government,
or if you want to get involved with that,
see David and see about weighing in.
So, basically, that is an area of open consultation right now,
looking at potential legal protections for researchers in the UK.
Yes, I mean...
Oh, I'm sorry.
Follow-on question on this.
As you can tell, I'm from the UK as well.
Accent kind of gives it away.
One of the dangers that we're looking at in the UK
with that rethink of the Computer Misuse Act
is organizations in the UK
trying to define cybersecurity research
as people who have received a certification
handed out by a government department
and who have registered on a government list
as being validated security researchers.
And that's one of the big problems
and one of the dangers that we're seeing in the UK
is that their definition of cybersecurity researcher
is kind of being pushed towards
a government-approved cybersecurity researcher,
which is a danger that we need to fight against
and an ongoing struggle
with this review of the Computer Misuse Act
because we kind of don't want to lock out people
who are not government-sanctioned in some way.
That's absolutely...
I'm glad you raised that.
That's absolutely real.
So, the UK government also put out a consultation
on certification for cybersecurity professionals.
And this would be certification
for a variety of cybersecurity professional jobs.
If you work in the UK
or if your work touches the UK,
this affects you.
But one of them was security researchers.
And yes, it lends itself to
being on an approved government list,
being certified in order to conduct security research,
which is, I mean, a huge barrier to entry
for what is, in the United States at least,
a very decentralized community.
Yes, and sorry, I mean, that was UK-specific.
Okay.
I wanted to quickly follow up
on the issue of growth vulnerability
disclosure program requirements
and security requirements
as well as fund bounties
and contractual mechanisms in particular.
And this is a great opportunity to also shed light
on one more item,
which is tremendous and wonderful work
from the Department of Justice
which was released in 2017,
which is the frame of considerations, right,
for how to respond to mobility disclosure,
which also included a provision
that talks about potential implications under the CFAA
as well as encouragement for organizations
to include explicit language
in the vulnerability disclosure program
or back bounty contract
that exempts food-faith security research
and specifically authorizes the testing, right,
under the CFAA and the DMCA.
And this is as early as 2017.
And then we've seen how the growth of these
quote-unquote safe harbor or exceptions
of language in contracts
in vulnerability disclosure programs and back bounties,
you know, from 20 or 30 programs
rising to thousands, right,
has influenced the discussion
of the drug union and the CFAA.
So I guess my question to you,
we know that in the kind of background of reform
of, you know, legislative, of statutes,
federal laws, the CFAA,
and what we're doing on legislation,
we still have the market.
And for contractual mechanisms,
especially ones that are adopted at scales
and standards like disclosure and others,
this can progress the conversation.
So with that growth of WDP requirements
and legislation,
where do you see,
and we already have safe harbor provisions
and kind of awareness for the need
to have those explicit exemptions
from the CFAA and WDPs and back bounties,
where do you see the next scenario
of norms and contractual mechanisms
that can be developed by the market, right,
by corporations and kind of promoted
in terms of their adoption
to really drive the change
in addition to reforms or policies at levels?
That's my question.
And if we have time later,
I'm really interested in your take
on how the growth of incident reporting, right,
cybersecurity reporting,
and we have seen safe security exemption
in Assyria as well,
kind of interacting with the CFAA,
especially because of the concept of incident
and this ability to have maybe near misses, right,
so not just confirmed incidents.
How do you see that growth in legislation
and, of course, in federal law
in the United States
with those from the UK
impacting the anti-hacking landscape?
Let's take the first part of that question first.
And I want to put,
unless, do you want to answer the CVD question?
I want to put Art Manion on the spot.
You heard him meet the question
about the next frontier for CVD in the marketplace.
What do you think?
How do we get you a microphone?
That's true.
Good thinking.
And reminder that the microphones
don't have a speaker that's for the stream,
so we still have to project,
so I did hear,
I mostly tracked,
I meet.
Let's see.
So I think you've touched on them here,
and then I meet with the commercial,
contractual stuff.
So bug bounty related,
disclosure policy related,
safe harbor,
but not in strict legal safe harbor terms,
but I appreciate, right,
good faith security research.
So contractually and in bug bounty
and disclosure programs,
I think there's going to be progress there, right?
If people are agreeing
and planning to do that,
and there's agreements,
there's less likely to be any conflict,
whether civil or,
you know,
a recognition from a government perhaps,
or a federal prosecution.
The Chinese law is a good example.
It's concerned a lot of us,
although the implications are not clear yet,
I don't think.
But what if,
how many countries are there on the planet?
200 some if you,
depending how you count.
What if every sovereign state
has its own report to the government law
with different numbers of days
and different industries and things?
So that has the potential to get really messy,
and I'm sure particularly a multinational corporation
or a researcher who works across,
you know,
country lines would appreciate
something more globally standard
as opposed to,
you know,
needing a third party to tell them
how to talk to this country,
that country,
that country.
I think that could be a mess,
but jury's out still.
Do you have a view as to where
CVD adoption might spike next?
Like, are there sectors,
or is it just sort of company by company?
I don't think I have a real view or opinion.
There's a lot of progress,
which is great to see.
UK was mentioned.
The rest of Europe,
in the NISA and the NIS2,
has disclosure stuff built in there,
I believe.
I think it's going to go through,
so, you know,
those are signs of progress
that the Chinese stuff is concerning,
but again, I'll speak for myself.
I'm reading an English Google translation.
I don't know how the law is actually used,
how it's actually implemented in country,
so not sure yet.
So I guess,
for my own part,
I don't know where the next,
the next sectors of the economy
or sectors of the market
that will implement CVD
will be like where the,
sort of the low-hanging fruit is.
But I know that you've noticed the same thing,
which is that
coordinated vulnerability disclosure policies
are now being built into
a lot of cybersecurity laws.
So the Infrastructure Incident Reporting Act
has a nod towards it.
There are laws like,
you know,
things like the IOT,
Cybersecurity and Innovation Act, right,
that had a requirement
that if you were going to sell IOT
to the government,
that you must have a
coordinated vulnerability disclosure policy.
This too,
which is like a critical infrastructure protection law
that is being proposed in Europe,
is at a pretty advanced stage,
requires coordinated vulnerability disclosure policies.
We're seeing it in a lot of,
sort of regulations
that you may not even expect
from different agencies
for just for their particular sector
are at the very least promoting
coordinated vulnerability disclosure.
You had mentioned,
oh, please.
I was going to respond to that
because my company's also been tracking
the implementation of CVD by IOT companies
over the past five years.
And we're just about to do the research again.
So we look at about 330 companies
that are sort of the top IOT products
in countries across the world.
And we started out,
it was less than 10%
of companies had any way
for security researchers to contact them.
And that includes,
you know,
the security.txt as well
and looking at our website and so on.
And that only increased,
even in light of all of this global activity
promoting CVD,
that only increased
to less than 20%
in our last year's survey.
So even with the threat of regulation,
even with laws in place,
there's a huge amount of companies,
you know,
four in five IOT companies
are not doing anything.
And that's just the bit that you can see.
So it's really concerning to me.
I mean, you know,
when the laws come in,
I'm hoping that, obviously,
the stick comes out
and they actually do something.
But it'll be really interesting
to see what happens this year
and next year in our survey
and if there's this massive increase or not.
There's this trope, right,
that policy and regulation
is always way behind
where the private sector is.
I don't think that's true
for coordinated vulnerability disclosure.
We're seeing it
built into a lot of cybersecurity laws,
best practices,
you know, guides, things like that
out of D.C. at least,
the U.K.,
the E.U.,
China.
And I think that
its representation
in new cybersecurity regulations
is more broad
than where we're seeing it actually
in the marketplace.
So there is still a lot of catch-up.
I would not,
I'm optimistic
because it is making its way
into policy,
but there is still a long way to go
in terms of actual adoption.
Oh, yeah.
.
?
Is the question is good faith
one of law or is it a fact?
And for non-lawyers and the audience,
what does that mean
and why should they care?
So the question
is whether the good faith exception
is a matter of law
or policy, I guess.
And why should folks care?
So in regard to the CFA
and the federal
policy it is it is a matter of policy right so it is not written into the law
and that has certain dangers folks have flagged that that means is possible that
another administration could have a different view of this or a different
Attorney General or turn another head of the criminal division I will say that we
have a number of policies that I think are comparable that have persisted
across multiple administrations and they had not as a matter of course like
changed every four years or anything like of that sort but that that is one
one important distinction that if it's written into law it is less likely to
change the reason it's not is because it's very difficult to get anything
written and to love right now so so this is not a bad a bad second to that
Congress can spend trillions of dollars but they can't change the law I did want
to jump on one issue about bug bounties that would just prompt somebody I wanted
to
you know
kind of say as a kind of public service announcement and it's it's something
that that we've noticed I think over the last few years and that is while we are
very supportive of bug bounty programs because we think they do a good job of
letting the different parties know where lines are drawn what is in bounds what
what's out of bounds the one danger that we see that has manifested in a few
places is it also in some instances has created a
sense of entitlement among researchers such that there's a feeling that if I
did some work here I better get paid which can inform the manner in which
any discussion about compensation or disclosure or things occur and in the
worst instances is exactly what I about earlier bomb一个
to apart more like an extortionate type of the man rather than some of some the
to apart more like an extortionate type of the man rather than some of some the
know engagement to try to improve security. And so I just dropped that as a caution.
You know in the course of reviewing indictments that have come through our office,
you know we've had a couple of instances where researchers used maybe some improvident words
in the manner in which they approached this. And this harkens back to an issue that I've
flagged before which is I truly believe it would be in this community's interests
to work on norms that are some sort of baseline understanding of what
you know security research engagement looks like. So that those who like me who are outside
the community who would try to apply those rules have something to go to that's not
imposed on the community by us but rather is something organically developed so that there's
actually buy-in and an understanding and a real you know true depiction of the way in which you
think suits you.
So that's my PSA that I wanted to just drop on you.
I realized we skipped over your second question on well I skipped over too on incident reporting and how that interacts with the CFAA.
And one thing I have noticed so there's there's incident reporting there are a lot of regulations
already on the books and a lot that are being proposed that would require a company to report
a cyber security incident to the government to their regulator. And the definition of cyber security
incident is usually something that is significant not just you know a you know insignificant exposure
but something that is relatively significant that the government knows about it and can
take action to protect others. Something and this is another you know sort of sign of the evolution
in thinking about policy and hackers. A lot of these laws actually have an exception
toward to the incident requirements that it doesn't qualify as a reportable law.
It's a reportable incident if it is something that was brought to you by a good faith security
researcher. Many of them don't use necessarily those words and I think a lot of times it requires
authorization of the of the the computer holders so like but something like a bug bounty if you know
if a bug bounty has has brought it or a it's a coordinated vulnerability disclosure process
now then it may not qualify for incident reporting purposes to have to report it to the regulator.
This is the sort of thinking that we I think five ten years ago couldn't imagine but they're building
it into things that you know as somewhat niche you know cyber incident reporting and so they're
they have a mind towards this community even there. Yes.
So I got about 80 percent of what you said um no that's okay um
can I suggest you at least for this question take the mask off sorry
um interspersed 20 percent yeah right
The only litigation that I've made in the program for the area
and that I'm not in the prosecution's base so I'm going to adjust it if you want to get into this.
And that's the regular search variable that the prosecution does when they're not policing them
and specifically when they're not in the jurisdiction of the prosecution.
It's not all the same, it's not super simple.
We have preventive measures that we use that have been implemented in our practice.
And I'd like to remember that all of you raised the charge of policy.
It's not all of it. It's the solution.
It's the case of discretion.
The question comes from someone who is from the UK
about how discretion on the policy is exercised
in the U.S. by our investigators and prosecutors
and kind of taking as a model that there's a comparable law
in the UK where a lot of discretion is used to determine
what is in the public interest.
So in terms of the discretion, I guess the policy does state
and is promulgated by the Deputy Attorney General's office to all
is that one should decline if it meets these criteria.
The question of when it meets these criteria is a matter of discretion to some degree
but no more so than I would say applying our laws
to see whether the set of facts meets the requirements here.
And so I think there's in some ways, unavoidably,
a certain degree of discretion that's exercised.
But one of I think the positive things is
one of the things that helps when you have exercises of discretion
is to have kind of oversight and transparency.
And so this wouldn't be a decision that would be made solely by
for example, the U.S. Attorney's Office.
We oversee all of the CFA indictments.
So it would come through us as well.
And the point of that, which was a practice that was adopted
in 2016, was to try to harmonize
how these things are done nationally, right?
So if you have one collection point, you can have greater consistency than you would have
in 94 different districts.
And so there is discretion.
We believe, though, that we have mechanisms for kind of
leveling that out and making sure that it is consistent.
You'll notice at the bottom of the charging policy
it mentions consulting with prosecutors.
Yeah, that's where we're in the office.
Yeah, specific applications.
Hi.
Hello.
Thank you for this presentation.
So the policy allows for
discretion once it gets to the charging state
and referrals to the U.S. attorneys.
But it doesn't stop the investigation
for a lot of the enormous law enforcement agencies.
Do you foresee a need for policy
in these law enforcement entities
that the officers are missing,
or whatever?
I mean, you may want to look at an investigation
in terms of the face of the G5.
Well, it tells us that the termination
is made when the law enforcement
law enforcement occurs
against the law enforcement agency.
Yes.
So the question was,
what applies to charging decisions,
not investigative activities?
So is there any
point in perhaps having
a comparable policy that applies
to investigations rather than just
prosecutions?
It's an interesting point.
I don't think
we have considered it,
in part because at least
we haven't yet detected
a problem.
But hopefully engagements
like this would flag that
and if we did see a problem,
it's something we certainly could consider
whether a similar policy
on an investigative level
would make sense.
At this point, it doesn't exist
and we haven't really thought of it,
but could that change
if there actually were
a need? Absolutely.
So can you
really define
the question
with some of the
threat researchers that
are present at science
in their career?
What we have done is
build out proactive relationships
with law enforcement,
primarily with the Bureau,
where what we're doing
is more on the
getting into the dark side
of things rather than
and sometimes we offer some assistance
as well, but that way
when there is a knock on the door,
they call us beforehand
and it's a friendly knock on the door
to answer something like that.
I realize it doesn't play out well
for everyone, but that's something
that we've seen
be important.
The related question is
do you see a situation
out there where
a security researcher
could be
in offer
for unauthorized
access to a criminal network?
I mean a criminal network
full of stolen data,
full of stolen
food, stolen
paper,
or whatever.
Then authorize access to a criminal network
seems to be a nonsensical notion.
But if you read the guidelines,
and it's very honest,
it's so deceivable that you could have
a researcher
trying to read the same
contents of a criminal network
and face a problem.
I'm not exactly sure who
would bring that to us.
My first point,
kind of a suggestion to folks,
which was that
reaching out to law enforcement
to establish a relationship
so that they know and are familiar with you
in case there is a need for a knock on the door
because there is some activity
that they're interested in
is a good practice.
I would foot stomp that.
That in fact is something that we flag
in the white paper I mentioned earlier.
Having that sort of relationship can be very helpful.
Secondly though, there was a question about
having a criminal network.
Let's say you are a researcher
who is accessing a ransomware group's server.
Whether that could potentially
get you prosecuted
under the CFAA.
I guess to that I would say this.
Whenever someone tells me
prosecutors can indict
a ham sandwich,
my response to them is
yes, but then we would have to try
the ham sandwich.
That would be ridiculous.
It's the same thing here.
One of the things
that we think about,
actually in 2016 we released our
CFAA charging policy
that was broader about considerations
for federal prosecution.
There has to be a substantial federal interest
in a prosecution in order for us to bring it.
We do assess whether
for example, that's a case
that is not going to
play very well.
Now there may be extenuating factors
and I'm not saying that it's impossible
that such a case could be brought.
But by and large,
it's unlikely.
That said,
I do think that the one thing
that I often caution
researchers about is that even if
they're being good guys,
they should understand they do not have carte blanche.
That there are people who are
investigators who have been given the authority
to do certain types of activities that are invasive
and that
that should be left to them.
So reporting something
that you've seen is an important first step.
I just want to let everybody know
we have only about five more minutes
before we have to clear the room
for the next panel.
And let everyone else also know
if you don't have one of these limited edition
DEF CON policy stickers, please feel free to see me.
But I know that the folks that were standing
didn't get one if you want one.
Then hit me up.
Yes?
One of the confusion on this is
as a lawyer,
do you have any advice on how to
allow a lawyer to love or to lose out
on the benefits of lawyers that
give you the right to do the right thing?
This is a pretty niche lawyer market.
Yes.
For your resources for
security researchers in our life,
I think I ask you to think, does it appear like that?
So I have a few suggestions,
but I think the simplest one
would be to contact
the Electronic Frontier Foundation.
They've worked in litigation
in this area.
They may not represent you,
but they may know other people that do.
It's probably easier than a Google search
or me just giving you a bunch of names right now.
Just contact them.
That's a good first start.
They also have online resources.
I believe they do.
Yes?
Is there a way to get involved in the policy making process
or can you just like
cross your fingers over that
and read your responses
and read about what you're doing?
There is a way to get involved in the policy making process.
A lot of it will,
at least in the United States,
I think a lot of it at this stage
is going to be engaging directly with policy makers.
I don't know of any
open comment periods
for CFAA, DMCA,
or states.
I do think that you get your best bang
right now in the states, like I mentioned.
The states don't hear from experts
to the same degree as the
federal policy makers do.
It may be slow going at first,
but I think that once you build that relationship
then you'll see it come to fruition.
If you want to target an open comment period,
then I think talk to
Steven about what's going on
in the UK.
Generally, I guess I'd add that
there are these rule making processes
that are
open for public comment.
People like you in this room
actually do have an outsized voice in those.
What I mean by that is
talking to the people who
are in this process, they have to review them
and adjudicate the answers.
It's not about numbers.
It's not that 100 people said yes
and 50 people said no.
It's the quality of the comment
that really is what matters to them.
Having some
sort of sophistication and understanding
of the actual issues
and being able to present that
to the people who adjudicate
these rules and decide how they should be shaped
really look at.
These public comment periods are something
that if you're interested in,
are things that you should take seriously.
I actually think it would make a great DEF CON presentation
to just go through where to find these public comment periods
and how to engage with them.
This is how the government
There's this feeling that the government
is in this ivory tower and you can't communicate with them
and it is actually not true at all.
They are required by law to solicit
input from the public whenever they come out with
major rules.
And so another time
there is in fact a lot of opportunity.
Yes?
DEF CON policy will be able to help you.
I'll be able to connect you with folks
depending on what you're looking at.
Everyone, thank you so much.
Thank you for coming.
Thank you to the people that were standing
the whole time.
And again, let me know if you want a sticker
and hope to see you around.