Hide Techdirt is off for the long weekend! We'll be back with our regular posts tomorrow.

State Department Backs Off Criminalizing Security Research Tools

from the now,-if-it-can-just-get-40-countries-to-agree-with-it... dept

Some good news for security researchers: the US government’s adoption of the Wassenaar Arrangement will no longer treat the tools of security research like crates of machine guns. While exploits and penetration tools can be used by bad people for bad things, they’re also invaluable to security researchers who use these to make the computing world a safer place.

Vague wording in the US government’s proposed adoption of the 2013 version of the Wassenaar Arrangement threatened to criminalize the development of security research tools and make any researcher traveling out of the country with a laptop full of exploits an exporter of forbidden weapons.

To its credit, the State Department welcomed comments on its proposal. Even better, it seems to have listened.

It appears that the State Department has heard these concerns loud and clear. Not only has all talk of finalizing the proposed rule as drafted come to halt, but State has put “removal of the technology control” on the agenda for the December 2016 meeting at Wassenaar.

But, as the EFF’s Nate Cardozo and Eva Galperin note, the battle isn’t over yet. The State Department still has to pitch its amended adoption to the other parties involved in the Wassenaar Arrangement.

Of course, this isn’t the end of the road. There is no guarantee that the 40 other nations who participate in the Wassenaar Arrangement will agree, but for now, we are enjoying this important victory.

Stripping out the criminalizing of security research is a welcome step forward. In a country where researchers are routinely subjected to legal threats and law enforcement scrutiny for reporting security holes and the government always too willing to abuse the broadly-worded CFAA to punish “hackers,” the addition of export controls on research tools would only have made the problem worse. And it would have done next to nothing to make general computing/internet usage any safer.

As was noted here last September, updates to the Wassenaar Arrangement were already having a chilling effect. HP pulled its support from Pwn2Own’s hacking competition in Japan, citing the “legal uncertainty” surrounding the country’s version of the agreement. Had the US government forged ahead with the wording unchanged, this country would have been the next to see major sponsors pull support from security research conferences or other hacking-related events.

For now, US security researchers are as “safe” as they’ve ever been — which isn’t really all that safe. But the situation could be far worse. The future is now partially in the hands of 40 other countries that may not be as receptive to the State Department’s arguments as the agency was to the comments of those its proposal would affect.

Filed Under: , , ,

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “State Department Backs Off Criminalizing Security Research Tools”

Subscribe: RSS Leave a comment
Anonymous Coward says:

What I've learned about being a security researcher

Under no circumstances should I even attempt to quietly report an operational problem to a corporation, university, or government agency. A much safer course of action is to publish it anonymously, forgoing the credit in favor of a modicum of personal safety.

Congratulations, everyone, you’ve taught me to avoid — at all costs — doing you a favor.

tqk (profile) says:

Re: What I've learned about being a security researcher

Congratulations, everyone, you’ve taught me to avoid — at all costs — doing you a favor.

There’s been way too many favors going around. It’s about time all this altruistic nonsense stopped. Have you all forgotten your predatory instinct?!? It’s your nature! Long in tooth and claw!

Oh, and ignorance is bliss.

Add Your Comment

Your email address will not be published.

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...