So, good afternoon. Welcome to Policy at DEF CON. This talk is a panel titled, all of your
vones are belong to terms and conditions. And it's chaired by David Rogers. Closer to the
mic. The title is all your vones are belong to terms and conditions and it's chaired by
David Rogers. A few announcements. This talk is being hosted on the record, I believe.
Cell phones, we ask that you check your cell phones are silent as a courtesy. If the speaker,
if we take questions at the end, please use the mic so we can hear you and very close to the
mic. As a reminder, photo policy prohibits taking pictures without the permission of
everyone in the frame. And with that, let's get started. Please welcome our panel.
We're going to live down to your expectations, I think. So, welcome, everybody. And thank
you for coming. My name is David Rogers. I guess, why am I here doing CVD? So, I created
the CVD program at the Mobile Industry Association, GSMA, and I had to fight hard for it. So,
I know the pains and tribulations of it. And I'm going to be moderating this panel.
Well, we talk everything from vulnerabilities, through to legal, through to how we can help
hackers and what's going on around the world. So, in flow order, I'd like our speakers to
just introduce themselves and just tell us a little bit about themselves, so, well.
Hi, everyone. I hope you're having a good DEF CON. So, I'm Katie Noble, Katie Trimble Noble for some people, because you
might know me in my previous persona. So, I am one of the four Bug Bounty Katie's. There's
me, there's me. There's Katie Nichols, and there's Katie Masouris. So, I'm half of the
four Bug Bounty Katie's in the world. Yeah, I know. It's great. So, my background, I
worked for the U.S. Government for about 15 years, previously at CISA. I did coordinated
vulnerability disclosure, where I ran the vulnerabilities equities process, the MITRE CVD, and the
program, which I'm still a board member of, the NVD program, the Carnegie Mellon CERT-CC
program, and the ICS CERT vulnerability handling program.
And our claim to fame was that we coordinated and disclosed over 20,000 cybersecurity vulnerabilities
in a two-year time period.
And I currently work for a Fortune 50 tech company where I am the Director of Product
Security Incident Response and Bug Bounty, and we won't name that company because I'm
not really here.
Hi, everybody.
My name is Harley Geiger, and I am a cybersecurity lawyer.
I'm currently with a law firm called Venable.
I, too, am not representing Venable here, and nothing that you hear is legal advice.
You do need a lawyer, but I am not your lawyer.
And prior to joining Venable, I was in-house at Rapid7, and I was also a Hill staffer,
again, working on cybersecurity.
I've been working on cybersecurity and privacy for about 15 years, and now I help people
with compliance.
I help people with incident management and focus a lot on hacker law and vulnerability
disclosure.
Thank you.
Hi.
My name's Casey.
I am the token non-American on the panel, I guess, in terms of the-
That's not true.
That's not true.
Book-ended.
Book-ended.
Okay.
We're book-ended.
That's right.
Okay.
So forget all of that.
He's going to mention the ashes in a minute.
I'm just getting this one in.
There you go.
Let's get this one in.
Let's get this party started.
No.
So I'm the founder and CTO of Bug Crowd.
Bug Crowd, we didn't invent vulnerability disclosure or bug banning program.
That was prior art, but we did pioneer the idea of putting a platform in between all
of the researchers that are out there and all of the potential problems that exist on
the defender side of things.
So that informs my point of view on this subject, because we've seen quite a bit in the course
of the last 11 years of doing this stuff.
Also the co-founder of the Disclose.io project, which-
I can't hear you back there.
Better?
Also the co-founder of the Disclose.io project, which is basically a vulnerability policy
standardization exercise that's been running now for the better part of eight years in
this form.
But I think the prior art there goes back to Rainforest Puppy in 2001 and stuff that
existed before that.
So really the idea of that is to make the adoption of sane VDP language and VDP terminology
easy, or at least as difficult to screw up as possible.
And as a part of that, to actually put positive pressure on top-down legislative change that
have been involved in things like the charging rule changes out of DOJ, election security
administrative guidance out of CISR in 2020, BOD 2001, and so on and so forth.
So yeah.
Cool.
Already I mentioned Rainforest Puppy, so maybe we need to rewind a bit in history.
So just a show of hands.
So first of all, who knows what vulnerability disclosure is?
Yeah.
That's good, right?
Who knows what coordinated vulnerability disclosures?
Okay.
So a lot less, right?
Who knows Rainforest Puppy?
Who's heard of Rainforest Puppy?
Oh, God.
I'm old.
Okay.
So the history is slipping away.
Wow.
Actually, you should look him up, because that whole brinksmanship process is really,
really interesting.
But I'm just going to ask...
Maybe we start with Katie, actually.
Like, just give us the very short story.
Just the short part of history.
We're talking like we're over 20 years in really to all this stuff, right?
Yeah.
That poll just then makes me feel super old.
So thank you for all...
Thank you everyone for that.
Yeah.
I mean, look, I think the history...
There's a talk I give titled The Unlikely Romance, and this is why, basically.
When you think about where we're up to at this point in time, we have reached a point
where hackers and organizations can at least have a productive conversation.
That's really only an advance of the last 10 years through my eyes, and that's partly
through the work that Bug Crowd's done, it's partly through the work that a lot of other
people have done to keep pressure on this.
That effort goes back a long ways, and I think really what it comes down to when you
start looking into some of the stories that come out of the late 80s and 90s, it's this
idea of security not even being a consideration in kind of the early creation of the internet,
the early creation of software.
And all of a sudden, people start to break things.
Because they can, that hacker spirit starts to manifest in this domain, and everyone probably
freaks out.
You've got...
The best example of that's the CFAA, which legend has it, was written after Ronald Reagan
watched War Games at Camp David and freaked out, basically, and went to the DOJ, and the
CFAA was ultimately the product of that fear.
The fact that that prompted the creation of regulation, I think that was important
to do.
But that baseline...
It was like, ah!
Freak out reaction, I think, kind of informed how that legislation was created.
There's lots of different examples of that, and we've had to basically claw back from
that ever since.
Just recall that Ronald Reagan also watched Encounters of the Third Kind, didn't he?
But that's a different story, right?
So Katie used to work for the government, didn't he?
So how do...
So we kind of come all this way.
There's been a lot of pain along the way, particularly for hackers who've been sued,
and badly treated.
They've been treated by companies and so on.
So we've got to the point where, you know, CBD is a thing, and governments are advocating
for it.
So how do governments at the moment handle vulnerability defense and disclosure?
I do not represent the government, but I will represent my own interactions with this
particular topic.
So I will say that in the last, I would say probably 2015 or so, there was a, what I would
like to refer to as a watershed moment.
We really did start to see the U.S. government and other foreign governments start shifting
their mindset from vulnerability disclosure being a terrible thing to, hey, this is...
If you see something, say something, this could be actually really good for us.
And I think one of the big things that made that change was really the DOD's Hack the
Pentagon effort.
I think when Hack the Pentagon happened, it was something that was so...
So groundbreaking, because all of a sudden the Department of Defense, the grudgy Department
of Defense that's got all the guns and scary things, was saying, actually, maybe we should
take these security researchers a little seriously and bring them in and see what they tell us
and test ourselves.
We are confident.
So let's test that.
Let's not be afraid.
And that was a huge moment.
I think that sent a huge signal to private industry and to other governments and other
government agencies.
So again, DOD.
And the federal executive agencies, I know a lot of times we think the U.S. government
or the government, and we just kind of think big government, it's all the same, but they
are different.
And their relationships are very different.
So you have...
So I don't mean to give you a civics lesson, so I'll make it really quick.
But DOD has what we refer to as a parent-child relationship.
So there's DOD, and then there's Air Force, Navy, you get the idea here, right?
So they have a parent-child relationship.
And then the federal executive agencies have really a sibling relationship.
So you have...
It's Department of Homeland Security, Department of Commerce, Department of Treasury.
They all work together, but they're more siblings.
They don't have the ability to force each other to do things, except in slight situations,
particularly OMB has the power of the purse, so they can force most people to do a lot
of things.
But when DOD did that, it sent a very strong signal to the rest of the government that
they should be open to this idea as well.
And then we started seeing CISA really pick it up as well, with the creation of CISA,
which happened in 2018.
And the Homeland Security really picked it up from there.
And so I think that that really did change it and open the door.
And now we have things like Hack Satellite, they hacked the DHS.
It really was groundbreaking.
And it's very exciting because now, instead of the, don't go to the government because
the government's scary and the law enforcement is gonna show up at your door.
Now the relationship is, if you have a problem, if there's an issue, go to CISA, because CISA
will help you.
And that's very different for the individual hacker than it was 10 years ago.
So I like to show that as a really great evolution of the way things could be and should be and
are trending.
I would add on to this, to the question of how the government is treating vulnerability
disclosure now, a couple of other developments just in the past couple years, an important
one is now all federal civilian agencies are required to have a coordinated vulnerability
disclosure program.
So CISA worked with, and it wasn't, so CISA has the power of creating binding operational
directives.
They're usually not really enforceable unless OMB attaches some teeth to it.
And in this case, they did.
So CISA and OMB worked together.
Now all civilian agencies should have a vulnerability disclosure process.
If you look at, pick the Department of Education or HHS or something like that, you should
be able to find their VDP page.
And it is, in fact, a vulnerability disclosure program.
It's a bit more permissive, you know, it provides a measure of authorization that we
don't see as often in the private sector.
So that's one piece.
There are several others.
We are seeing CVD being brought into regulation as well as, and particularly for government
contractors, for IOT devices, and as well as best practices in a variety of sectors.
An important one is the NIST cybersecurity framework.
So the cybersecurity framework is used, it started out for just critical infrastructure,
but now it's being used in a lot of other sectors as well.
It's sort of the gold standard for risk management.
And CVD is in there.
The last thing I'll say about it, it relates to the treatment of hackers specifically.
We have, starting in about 2018, we saw the Department of Justice, on more than one occasion,
step up and create and advocate for specific protection, legal protection, for security
researchers.
They did this, we mentioned the DMCA earlier.
The DMCA.
The Department of Justice, in two different occasions, issued letters to the Copyright
Office saying, we should not be charging hackers into the DMCA.
And it was very influential in getting strong protection for security research under DMCA.
I think it was about a year and a half ago, the Department of Justice also changed the
charging policy under the CFAA, saying that prosecutors should decline to prosecute good
faith security researchers for good faith security research.
Like they're not going to withhold if you're doing extortion or something.
So, as far as I'm concerned, the federal government has made tremendous strides on
adopting CVD and protection of hackers.
The places that I think we need to catch up now actually are the private sector and
the states.
These things that we've just discussed are not necessarily there in the private sector,
not as much adoption of CVD, and the states still have, like all the things that we've
complained about for CFAA are present in state law.
But there are other countries around the world.
So.
I just want to, I'm being flippant, but I just want to touch, so my own experience,
so I can give you a kind of war story here about how successful really coordinated vulnerability
disclosure as a concept has become, and you see this sort of snowball effect of governments
and understanding and adopting it.
So back in 2017, I wrote a document to create some principles on IoT security, and that
was in a government committee.
And.
I put vulnerability disclosure policy as a key requirement on IoT manufacturers, and
there was a guy in the room and he said, we can't talk to the hackers, we shouldn't be
talking to hackers.
And it was that kind of age old issue that all of us have fought for years and years
and years.
And but I, in that moment, I was really, really confident because we already had two ISO specs,
so two international standards for vulnerability disclosure.
And it was already adopted.
It was adopted as good practice by companies on the West Coast of the States.
So I was, I had that moment.
I was really confident to be able to say, no, you're talking complete rubbish and we
got it through.
But that, that sort of attitude still persisted and it was great to have the reference points.
And I always think that we're sort of standing on the shoulders of giants each time we move
this subject forward.
And you're seeing this thing.
So that, that thing became an international standard and it was adopted across the world.
So in Australia, Singapore, India, Turkey.
And it's been around for a long time.
It's baked in and it's also now law in the UK through the Product Security and Telecommunications
Infrastructure Act, which is a PSTI act.
And that in turn, I know that's not subject to this panel, is starting to create new discussions
about what we define as computer misuse.
And that, so it feels like that's the kind of next step in this story maybe.
So I want to, I want to bring up a couple of things internationally that cast a shadow
over this largely positive picture that we're painting.
So, yes, it is true that CVD is being adopted, I think, not just in the United States, but
around the world.
That's, that's good and helpful.
When Europe, they passed the, the, the NIST 2, NIST 2 Act, we saw an infrastructure being
set up for coordinated vulnerability disclosure we thought was largely positive, applied mostly
to critical infrastructure, like what we think of as critical infrastructure, you know, and
each member state was supposed to have a process for sort of processing vulnerabilities.
Then.
China came out with a vulnerability disclosure law.
I'm not sure how many of you are familiar with some of the details of that law.
But essentially, when it comes to vulnerability disclosure, as a, as a, an individual hacker,
you have the, the ability to disclose your vulnerabilities to the Chinese government
directly or to the vendor who then must disclose to the Chinese government.
And as a vendor, you are required to disclose vulnerabilities that you receive to the Chinese
government.
So you're, you're encouraged to have a view.
If you, a, a vulnerability disclosure policy, you're encouraged to have a bug bounty, but
it's a giant sucking sound of vulnerabilities flowing to the Chinese government.
Within 48 hours, right?
That's right.
That's right.
See, within 48 hours.
Now, the, the other development I just want to highlight here as well is in, in, in Europe
presently, the, the EU is currently considering something called the Cyber Resilience Act,
the CRA.
And the Cyber Resilience Act has, has, is, is flown under the radar quite a lot in the
United States.
I mean, we're only talking about the vulnerability disclosure part of it, but this is a, this
is a huge law.
It will have a GDPR-like effect on security, and it is going to pass.
It is going to pass.
They're actually at an, an advanced stage.
Okay.
Vulnerability disclosure under the, under the CRA, there are three different versions,
but the nut of it is that if you have an actively exploited vulnerability, so for,
you have software in the EU, and you discover you have an actively exploited vulnerability,
you must notify either Anissa or Sizzerts, depending on how it shakes out, within 24
hours.
Within 24 hours.
If you've had an actively exploited vulnerability, 24 hours later, it is likely not patched,
right?
It is likely not mitigated.
And you are telling government agencies about it.
Now, again, there's multiple versions.
They're going to consolidate them, but some of the versions would have that first agency
that you talk to send it to other agencies who then send it to other agencies, leading
to about 55 government agencies in the EU.
If you have software, it's deployed across the EU.
So, it is a rolling list of software packages with unmitigated vulnerabilities.
The point is, so, CVD, great, but we are also sort of seeing that process co-opted in a
way, right?
We're going further left of boom to the point where we are sort of forcing disclosure before
people are ready, and doing it in situations where we are putting those vulnerabilities
at risk of being used for surveillance or tipping off adversaries.
So, what we're seeing is a kind of government's potentially taking advantage.
We've seen companies already take advantage, right, of situations, and, you know, there
are always constant issues of NDAs and private disclosures and sort of almost unwritten threats
against researchers.
So, it feels like they kind of were blindsided by it originally, and then now they're kind
of getting to grips with it.
I mean, what do you think about that, Katie?
Would you agree?
Yeah.
I think that that's exactly the case.
I think that they're...
And I'm a little bit concerned.
I'm a little bit concerned.
I'm a little bit concerned because as I see the coordinated vulnerability disclosure
principles be adopted across industry, but there are still a lot of big companies that
don't have coordinated vulnerability disclosure programs or that are trying to stand them
up, and these are international companies.
So, as these regulations continue to...
Some are good regulations, some are bad regulations, and as they continue, you start seeing industry
pull back.
And so, that progress that's being made positively is now being pulled back a little bit.
So, think about this from an industry perspective.
If you have a product and it has a vulnerability in it, 24 hours, have you even had an opportunity
to triage that vulnerability yet?
Do you know it's a vulnerability?
And now, the whole idea of coordinated vulnerability disclosure, that was something David said.
Do you know about vulnerability disclosure?
Do you know about coordinated vulnerability disclosure?
Coordinated vulnerability disclosure means that all parties agree that they will treat
this vulnerability under embargoed status until a point where all parties are able to, at
the same time, accurately disclose that vulnerability in a way that doesn't give an adversary
an advantage when a mitigation is developed and disclosed.
So, if you're disclosing vulnerabilities within 24 hours, what you are doing is you are enabling
an adversary to be able to exploit a customer or end user.
And I don't think that's the goal, but you see right there, you have a law that's about
to be passed, and you have the technical details of that, and the impacts of that are so wide-reaching,
you get to a point where you say,
well, why are we even doing coordinated vulnerability disclosure anymore?
Why don't we just put it all on Twitter or simply not have a CVD program?
And that's dangerous, and it's undoing a lot of the progress that's been made over
the last 10 years.
So, I hate to say, you know, it feels like a chill is spreading across the world.
Is that what's going to happen, Casey?
Yeah, sure, let's go with that.
Look.
I think in general, like, the way that I'd kind of render out what's happening as, you
know, someone who lives in the U.S., in San Francisco, but also has a home functionally
in Australia, right, I'm thinking about this through the Western lens, and what I see
happening is that Western countries are trending towards transparency as a mode of resilience,
right?
Transparency is anti-fragile.
That's kind of a design principle that's being used to push this along, and I think that's
a lot of how it's been solved, frankly, you know, within government.
It's a lot of how it's been pushed downhill and how it's been adopted, and that's certainly
something that, you know, we've taken advantage of.
As bug crowd, I've seen, you know, the folks working on the Disclosure Air Project take
advantage of as well.
It's just a security model that seems to make sense, right?
On the flip side of it, you know, non-Western countries do tend to be trending towards control
or aggregation, just in general.
Because they're, you know...
Ultimately, there's a motivation there to build up firepower, like they want resilience,
they want defence, they want to be able to fix the bugs that get found, but they also
want to increase their capability from a sovereign capacity standpoint, and this is a pipeline
for that.
So, you know, I do see it kind of heading in that direction, and obviously that's a
300,000-foot observation.
I do expect that to continue, because ultimately, I think transparency as a resilience strategy
wins in the end.
Fundamentally, anti-fragile, right?
But if the other approach manages to land the first set of punches, that could change
the outcome.
So you touched on something there, which there's been articles about one country
hoarding vulnerabilities recently, actually.
So is this maybe this kind of, I want to say arms race, but it's probably not an arms
race.
It's just a...
I don't know quite what it is.
What is it?
Like governments?
Yeah.
I mean, I think, you know, the international relations environment's gotten progressively
more tense, you know, and it's always been tense, but I think that tension's become more
obvious post-COVID, right?
So I think, yeah, the idea of, yeah, and this is through the lens of an Australian.
You look at what's...
This is all on public record.
Like, there was a budget of, I think, $97 billion in a project called Red Spice, which
is specifically around standoff deterrent capability in case there's something that
goes hot in the region, right, for, you know, reasons that should be sort of fairly obvious
that the Aussies are nervous about that.
I think it's $2.7 billion of that's going into cyber, and that's offensive and defensive.
So it's capability stockpiling is ultimately what it's about.
That's what I've kind of observed is that there's a lot of sort of, you know, endorsement
of offensive now that wasn't there before, right?
Yeah.
I think it used to be a dirty word, and that's...
I mean, you think about these conversations.
Yeah.
I always go back to the FBI versus Apple in the San Bernardino case.
Yeah.
I think it was 2016.
And at the time, you know, to create zero-day and weaponize it for offensive use of any
sort was kind of dirty, but there was this sort of stench around it.
But then you look at the...
There was a lead time between when that happened and when it came out who was actually responsible
for that.
As an organization, it's like four or five years later, they're actually celebrated,
and it was an Australian company.
It was actually celebrated as an Australian startup story.
So in that time, it went from a dirty word to a thing that was kind of accepted, which
is amazing.
And this isn't like, as I said, this sort of dark secret of forensics tools.
These companies try to play off how ingenious they are, but a lot of them are buying vulnerabilities
off the gray market, right?
And there's a healthy...
Like, you can go to the Zerodian website and see their little table of elements and
the prices that attach to them.
I know, obviously, there's...
Obviously, Project Zero has been trying to counter some of that stuff, but not a lot
of people know about that either, do they?
I mean, can any of us sort of discuss that a little bit more about the gray market and
vulnerabilities and, I guess, how that operates?
Who wants that one?
Sure.
Go to the Zerodian website.
I mean, it exists, right?
Yeah.
It absolutely exists.
I think vulnerability discovery...
Yeah.
The way that I try to pass this out to explain it and even to think about it is that there's
defensive and offensive vulnerability procurement, right?
The defensive procurement cycle, basically, you get the bug and you kill it, right?
The offensive cycle is where you get the bug and you actually productize it.
And as a part of that, you work to keep it secret so that your capacity stays operational
in the wild and it doesn't get burnt.
So, everything leading up to that decision of whether or not I'm going to be able to
burn it or keep it alive looks pretty much the same.
It's basically vulnerability research, discovery, like thinking through impact, thinking through
usability, like where the attacker is going to be coming from and what kind of capability
and access they need from that vulnerability because not every vulnerability is eligible
for this type of purpose, right?
But there's a lot of researchers out there that can do that stuff.
I think the thing that I find interesting at this point in time is even with some of
these legislative changes that are happening, gray is the perfect way to describe it because
I think it's becoming less illegal or less tightly regulated in a way that I think will
actually dictate some of the outcomes that we'll see if you think forward 10 years.
Also now a factor in the gray market, a couple of things, one, and Casey alluded to this,
but the profit, the price point for...
Okay.
The price point for vulnerability is being used offensively is going to be higher than
for defense.
It puts defense at a disadvantage and part of the reason, as Casey said, is for defensive
purposes you want to plug the vulnerability, offense can be used multiple times or you
sell it under NDA so that you get a higher price for it so that you can sell it to a
single buyer.
It is an issue.
But the other force also though is we want to encourage this being used, this process
for defensive purposes.
The White House is currently looking at ways to deal with the offensive market.
There was recently an executive order on commercial surveillance brokers.
I think four of them went under sanction recently as well.
And so it is difficult to find that nexus to human rights and be able to distinguish
between the use of vulnerabilities for legitimate police operations versus oppressive purposes.
But that space is being looked at though.
Just really quickly on the pricing piece, Harley is exactly right and this is actually
a phenomena that we see a lot of actually demonstrated in bug bounty, which is defensive
bond procurement.
So on the one side, if you're selling a vulnerability that's going to be productized, that is inherently
more valuable as a transaction.
The thing that works in favor of the defender is you've got the prisoner's dilemma.
So if Harley and I have both found a bug and I'm trying to sell it off to the offender,
the defensive buyer, he's trying to sell it off to the defensive buyer, if he lands
the punch first, then I lose the opportunity for the bounty plus the opportunity to exploit
the bug because it gets burned at that point in time.
So that economic kind of delta works in both directions.
So I'm just going to comment on the, and kind of what Harley was saying.
When we think about vulnerabilities used offensively, I think we're in an age now where we have
to seriously consider the impacts of the things that we do.
And I'll use an extreme example.
But anything can be used for good and anything can be used for bad.
And think about nuclear power.
Nuclear power for power plants, nuclear power for weapons.
And the difference there can be things like regulations and informed decision making and
an informed community.
Because we have the ability to influence the decision making and the legislative process
and the regulations and standards that go around this market.
And I think we're starting to see that with the White House, which is a wonderful thing.
And I'd like to see more of that because we're at a cusp now where it's becoming very
common to understand cyber security.
There is no real world and online world anymore, you know, used to be, oh, my God, my Twitter
went down.
What am I going to do now?
You can't get a job without the Internet.
You know, COVID really accelerated that for us.
So it's becoming more in the forefront of humanity that we understand how cybersecurity
works.
And that we have that informed policy.
And that's part of the process.
Because if we don't, it will pass us by.
And that's something that I would empower everyone.
It's part of the reason the policy village is here, the policy department is here at
DEF CON, to help people who are very technical talk to policymakers so that we can have an
informed decision making process.
And I think to close the loop also on policy and the what we were just discussing
as far as offensive versus defensive use of vulnerabilities.
We should be directing our policy.
We should be directing our developments towards streamlining the ability for people to disclose
vulnerabilities.
And so what we had talked about at the outset, about greater adoption of CVD, that's one
way to do that.
The greater legal protection for hackers for acts of good faith security research is another
way to do that.
There's still room to go, though.
We talked about China's vulnerability disclosure law.
We talked about the EU starting, you know, if you are a hacker and you are disclosing
a vulnerability to a company, and you know that company then has to disclose that to,
you know, a whole bunch of government agencies, you don't know what's going to happen, there's
a couple things.
As a researcher, you may feel conflicted about making that disclosure.
And then as a company, you may not want to have to kick off that process every time someone
discloses to you.
So we are seeing policies that are kind of going in both directions, where we're making
it more difficult or at least a greater moral choice, a moral conflict for vulnerability
disclosure at the same time that we're easing it in some ways.
Another great one that, you know, we are hopeful that the U.S. government will take on is, you
know, sanctions.
So there are questions about the extent to which vulnerability disclosures are a sanctioned
event or sanctioned transaction.
You know, if you are a U.S. company and you're receiving a vulnerability disclosure from
an individual in a comprehensively sanctioned nation or somebody that is two hops removed
from the SDN list, and you are asking follow-up questions but not paying or anything like
that, you know, and there's no money exchanging hands, that should not be a sanctioned event.
As of now, this is in a gray area.
But this is something that we are hopeful that can change, and it is for the purpose
of, you know, greasing the skids for defensive use of vulnerabilities, taking away incentives,
taking away that easy path towards offensive use.
I guess for some researchers, especially, you know, some of the more naive ones, they
might not even realize that they were talking to a nation state as well.
So there was the infamous conversation, the George Hott's zero-day iPhone recording that
happened.
And it could have been naivety.
But was he trying to sell a vulnerability to China?
That was the debate at the time.
And I guess nation states might get a bit smart and just false flag the researcher,
right?
Or host a phone contest.
Oh, yeah, yeah.
So I just want to, like, so frequently when I talk about this with companies, they get
mixed up between bug bounty and vulnerability disclosure.
They also get mixed up with vulnerability disclosure as well.
So I was doing a deposition to a government.
And clearly, they didn't understand, they thought vulnerability disclosure was forcing
companies to disclose vulnerabilities publicly.
So I just want to, so let's start on the bug bounty thing.
So I guess, Casey, first of all, just explain the difference, please.
Yeah, so when I speak to this, I think there's an added piece there that bug bounty is often
used interchangeably with crowdsourcing at this point in time as well.
So it's, like, words are hard, basically.
But I think for the purpose of, you know, like, the regulatory kind of renderings of
this, and I think how, you know, most people coming into it think about it, the definition
I go to is NIST 800-5305, which is basically that a vulnerability disclosure program is
a, it's an intake point.
It's a policy, and it's a process that allows people from the outside world to submit a
vulnerability into.
An organization, and to have some sort of expectation of what happens next, effectively.
And that's a butchered version, but that's the cliff notes of it.
But what it also does is it distinguishes it from a bug bounty program.
So it basically says a bug bounty program is if you do everything that we just said,
but what you also do is you reward someone with cash if they do this, and they're first
to find and report a unique issue.
Usually the way it works is that's kind of the model.
So the first to find.
The second to find is the one who gets paid, and the more impactful the issue, the more
they get paid.
So what you're ultimately doing, you know, on the proactive side is incentivizing the
things that you want, and actually mimicking kind of some of the economic, you know, incentives
that exist for the adversary.
So that's the purpose of it and how it works.
But you know, the thing, the reason that confusion happened, because obviously I've had a box
row seat for a lot of this story, bug banties just got sexy really fast.
Like the thing that happened with Hack the Pentagon, which was huge, hugely valuable,
I think.
I think for, you know, reforming the public perception of what a hacker is and actually
helping tell a story of their place in the safety of the Internet, it's like if the apex
predator of the planet relies on 16-year-olds to give them security feedback, then maybe
I should do that, too.
Right?
Like that was a pretty massive shift in thinking that happened at that point.
But it was all talked about in terms of it being a bug bounty.
And I think, you know, like us as an organization, I think some of the other platforms that joined,
after we started the category, you know, hackers getting paid money and being able to celebrate
that, that's a thing that's exciting to talk about and it's fun.
So all of this led to most of the focus of terms of art actually being around bug bounty.
Even though, like frankly, it's actually the minority.
From my own perspective, like VDP is something that absolutely every, like that is a cost,
it's a bar of entry, you know, must be this high to ride the Internet type of thing at
this point in time.
You know, bug bounty in the public sense is discretionary.
Some organizations are ready to do that, others aren't, because they're just not ready to
remediate or listen to the Internet in that way.
One other distinction is authorization, right?
So for a bug bounty, you are authorized to, you know, to try to find vulnerabilities
and use certain testing methods against a defined scope of assets.
A vulnerability disclosure policy can do that.
You can provide authorization.
But many don't.
Many are just a channel saying, look, if you have, if you find a vulnerability, disclose
it to us.
But we're not guaranteeing that, you know, we are, you know, to get out of jail free
or anything.
In fact, the U.S. governments for civil agencies does provide authorization.
They're, it is the more advanced form of VDP where there is some authorization, which
provides, and the reason authorization is so important is because it provides legal
cover for the security researchers that are trying to find the vulnerabilities.
But to Casey's point about VDP being a, should be a fundamental, fundamental part of the
mental practice at this, at this stage, you can have a very basic VDP that does not provide
that authorization.
And you are still, you know, edging into that world.
It is still helpful.
I'm going to jump in real quick.
So to simplify, a VDP is a see something, say something.
A bug bounty is an invitation to hack.
So there's a difference there.
And I like to think of bug bounties, payments, or rewards, I don't like to think of them
as rewards.
I like to think of them as reimbursement for your time.
Because how much time and effort was spent in researching that vulnerability, triaging
that, or not triaging, developing the proof of concept, submitting that vulnerability
to a company, going through the friction of even filling out a submission, because each
company wants it a little different, and going through that whole process, and then
working with that company, maybe that company has follow-on questions, that back and forth.
So I see it as a reimbursement for your time, rather than a reward.
And I will tell you, I work at a Fortune 50 tech company, and this is becoming a very
common way of reframing the narrative of what's actually happening.
It is a way to offset the dark market and give people an opportunity, those who want
to do good in the world, and those who have an intrinsic motivation to be positive and
to help defend.
It's an outlet for that.
It's an outlet for them.
But also, it's a mechanism of saying, thank you, and we appreciate your time, and recognizing
your time.
That's a really good point, and I've forgotten to raise this topic, but the value
of labor is a real big question, right, for security researchers, that people, many hackers
feel they're essentially being exploited by governments and companies for their time,
and that there's not a recognition of that.
But is that a fair statement?
Or do you guys have a say in that?
Do you guys have different views to that?
Sure.
I think that the other piece, like frankly, this goes back to one of the reasons I founded
Bug Crowd in the first place, is that it does distribute access on both sides to the
answer to the question that they've got, which is, is this thing vulnerable or not?
So you think about that, you switch that into the defender side.
You know, previous to crowdsourcing, previous to bug bounty, you're basically held hostage
to whatever hourly rate you're getting to get consulting, and ultimately, like one
person being paid, so you've already got a supply-demand imbalance there.
And then you've got the problem of one person being paid by the hour, probably never being
able to actually outsmart all the potential adversaries that could figure the solution
out before they can.
So I think there's a counterbalance to that, what you just brought out.
In that, you know, I think the security consulting industry has been incredibly overpriced in
different areas, with very much a caveat emptor approach to quality.
What this does is it actually brings quality to the fore.
So I think there's that part of it that's pretty important to call out.
But also, you know, on the payment side, it's an interesting one, and obviously I'm going
to have some bias in my answer here, but people don't have to participate, like there's no
arm being twisted in terms of their own participation.
And I would add to that, like I partly agree with Katie how you were rendering what the
purpose of payment is.
I actually think about it more in terms of the value of the data.
Like if, you know, the organization running a program has a question, whoever ends up
giving the answer has that answer, then there's a value to that transaction that's more tied
to the data in terms of the payer, right?
On the researcher side, maybe it's got to do with the amount of time and effort they
put into it, but ultimately, that doesn't really matter in terms of the marketplace
dynamic there, if that makes sense.
Yeah.
And I guess it depends where you come from in the world and what the cost of living is,
right?
You know, the value might be huge.
It might be life-changing.
So I just really, we don't have much time left.
I just really want to give the audience the opportunity to ask any questions if you'd
like.
I know Casey has to dash off to deliver a talk, so I don't want to hold him back.
But you have a great opportunity to speak to some of the world's greatest minds in vulnerability
disclosure.
So, David.
Good afternoon.
Super interesting.
What are folks' thoughts about, I'll say, U.S. government, because we've got multiple
governments sort of represented here, U.S. government coordination as it relates to very
recent regulations put out by our good friends at the SEC that can actually end up driving
victims to disclose, like, really sensitive stuff in the mainstream?
And the SEC is in the middle of their trial.
I totally agree.
I think the SEC has made a very bad move.
So for those of you that are not familiar, the Securities and Exchange Commission has
actually historically been a very forward-leaning agency when it comes to cybersecurity.
And they actually have done some really great work in trying to push public companies towards
being more transparent about their security posture and securing their systems of control
for financial reporting.
So, yeah.
So I want to have that caveat.
So they recently came out with a rule.
The rule does a lot of things.
And much of the rule, I think, is positive.
There is one aspect of the rule that's getting a lot of attention, and rightly so, and this
is on incident reporting.
And so what that does is it requires all publicly traded companies to report their cybersecurity
incidents within four days of determining that those incidents are material.
And what that means is materiality means, like, that you determine that a significant
incident has been reported.
And that's not significant enough that you, you know, somebody ought to know about it.
But as we discussed with regard to vulnerabilities, with that four days, you may or may not have
contained or mitigated your incident.
Now that reporting through the SEC is public, it's public by default.
So it goes, you report it through your 8K form, your 8K becomes public as an investing
document.
And that is the Securities and Exchange Commission's purpose is to provide information to investors.
It is not really to, you know, with this regulation, to strengthen cybersecurity.
We, you know, the SEC has heard that, and they heard it not just from private industry,
but from consumer groups, as well as I know from other government agencies, U.S. government
agencies.
I was surprised that they kept that timeline in.
Arguably, companies were already supposed to disclose their cybersecurity incidents.
What's new is this timeline, this four-day timeline after materiality.
I thought that they were going to have something about, you know, maybe if you haven't contained
or mitigated your incident, perhaps you can delay disclosure, you know, and have some
other things on top of it.
No dice.
Instead, what they said was, well, here's our exception.
If the Attorney General asks the SEC in writing to delay because there's a threat to national
security or safety, then there can be a delay.
It's like that is not going to happen, right?
That is a very, very low number of incidents.
So for those of you that work at public companies, you will probably, functionally what's going
to happen is if you have a cybersecurity incident, you're going to have to draw on more parts.
You're going to draw in your corporate attorneys who should be familiar with the concept of
materiality as well as your corporate communications because you will be disclosing this incident
publicly within four days.
Go ahead.
Hi.
I have a question about Safe Harbor.
One of the things I've noticed recently is that it's pretty common for Safe Harbor language
to exist in programs launching now, but I've noticed a trend of them including request
per second limitations, and I would like to know where I'm wrong in my logic.
If you, for instance, take Visa, they launched a program recently with a one request per
second limit for testing, you can't load a web page and you're exceeding that automatically.
Why is Safe Harbor not meaningless in that scenario?
Sounds like poorly written rules by people who are uninformed.
Yeah.
But you see, like...
Maybe that's you.
I mean, one of the things that I've noticed is that it's a little bit more complicated
than what Katie said.
I think there's...
Basically, I think there's a bunch of things like that that you see.
A lot of the recommendations and policy kind of guidelines that exist in bug bounty programs
in particular are basically copypasta that's like 20 years old or more, right?
So there might have been a point in time where some organization or some program at
some point in time that said, okay, here's a particular rate limit that we want to put
on this program.
And we're gonna do this and this and this because of blah, blah, blah, it made sense,
right?
But the idea of that being a useful way...
Like really what they're saying is please don't hammer our stuff, right?
Like the idea of actually putting a specific number on that's a bit silly, but I kind of
get the intent behind it.
I think with the Safe Harbor component of it, if...
Because usually Safe Harbor clauses are written as if this, then that and the this is if you
follow the rules, these conditions, then that will authorize your...
against CFAA exempt you from any circumvention for the DMCA will exempt
you from TOS violation and we'll just say that what you're doing is a good
thing right that's generally how it works and yeah your point around like
that this actually being pretty important alongside the that it's well
understood I think you know Harley would probably be better to jump in on the
legal side but I can what I'm trying to do here is paint a picture of why that
happens and why that exists and often times it is a balancing act between like
getting you know creating comfort on on the side of the organization putting
these policies out there and it being like fully complete from that side so
before we take the next question or before Harley comments and I'm gonna
give you your your fleeing rights to leave the room so and please thank Casey
for joining us and good luck with your talk
so sorry
you all don't have to leave you can stay and talk to us so next question thank
you I'll be cognizant of time but I think this is pretty relevant okay so
government's starting to mature and enable their citizens to report
vulnerabilities we think that's naturally a good thing everyone on the
security researcher front you can think hey I have a little extra protection
here than I had before and can sleep a little easier when you report something
but as governments start to kind of wisen up and like all around the world
not just ours or any other particular ones
and encourage people to report vulnerabilities what's to stop governments from starting to
really emphasize other countries you know citizens of other countries reporting vulnerabilities to
them because we might be friendly with some folks in public but behind the scenes there's
always an information War Race going on and I was curious if everyone had a take on that
I I can't hear very well oh I'm so sorry so yeah yeah so basically as this becomes I guess sort of quite
nationalized reporting uh to these schemes
does that then have sort of blow back on the individuals and their nationality
so for example in the mobile industry we have this pan industry reporting scheme
we have people from all different countries from all you know individually
and companies that are in different countries are are they going to be kind
of do you think that some companies countries may start to restrict people from nationalities
that just because of where they're from basically so I think so I think the answer is yes uh but I
also think it different differs by country so uh China's vulnerability disclosure law that we we
touched on earlier uh does in fact uh have a restriction on reporting your vulnerability outside
of outside of China um I I don't have the exact language in front of me but there is that is in
there um how I'm actually very curious to know how how companies are are you know actualizing
this particularly multinational companies that are based outside of China but have operations in
China um but uh but yes so if you are
an individual there like like I said you do report to the vendor who reports to the government or
you report to the government you are not authorized it's in fact there are criminal penalties if you
make it public or if you report to some other government outside of China um for but most other
most other nations that I'm aware of even the the law that I would describe as as negative on
vulnerability reporting uh this the cyber resilience Act in the EU that that included
most other laws are are not do not really require
to report directly to government as an individual right so uh you report to the vendor and then the
vendor has certain obligations but you're not punished or restricted generally as an individual
from reporting outside I don't see that as a trend so much outside of outside of China and
um you know maybe there are other countries that are more authoritarian that I'm you know that
have something like that I'm sure I'm sure there's some unspoken codes in certain countries but I'm
I'm not really aware of them personally now the other sorry the other restriction is uh
on the exports or sorry the um uh the sanctions side um I'll let I'll let Katie talk about that
but that is that is the other way that you know they can discriminate against individuals based
on their geography yeah we'll just let me finish the and we'll go ahead um so there is one other
way and Charlie just said it when we think about sanctions U.S government sanctions specifically
and this happens across the world there is there are a couple ways sanctions impact but one of them
is if you are in in a researcher in an embargoed country if you try to
commit a vulnerability to a U.S company that U.S company may not be able to receive it and
may simply IP block you so they can't actually even receive the information from a sanctioned
company because they don't want to have the possibility of having a sanctioned event happen
so they simply do IP blocking and so that means that you can't prove a negative I don't know how
often that's happening because it's being screened and so that's a perfect Avenue where you're
having individual research
researchers who in some cases may be taking great personal risk upon themselves for trying
to do the right thing and report it to the vendor prior to reporting it to their highly oppressive
or government you know so sanctions clarifying sanctions and upgrading sanctions U.S sanctions
and sanctions for other countries across the United States is something that should be taken
very seriously those regulations should be should be updated to apply to reality as we understand it
and I think Lynn's going to kick us off now
so thank you thank you everyone