Library of Congress DMCA exemption hearings
Proposed Class 25: Software – security research
This proposed class would allow researchers to circumvent
access controls in relation to computer programs, databases, and devices for
purposes of good-faith testing, identifying, disclosing, and fixing of
malfunctions, security flaws, or vulnerabilities.
Copyright Office: Jacqueline Charlesworth
Michelle Cho
Reagan Smith (main questioner)
Cy Donnelly
Steve Ruhe
John Riley
Stacy Cheney (NTIA)
Charlesworth: goal is to clarify record, hone in on areas of
controversy rather than restating written comments. Interested in refining/defining
broad classes in relation to the support in the record. Court reporter (so my report is far from
definitive!). (Also note that I am not good at ID’ing people.)
Proponents:
Matthew Green, Information Security Institute, Department of
Computer Science, Johns Hopkins University
Research in area of computer security and applied
cryptography. Risks posed by DMCA to
legitimate security research: discovered serious vulnerabilities in a computer
chip used to operate one of the largest wireless payments systems and widely
used automotive security system. Naïve:
didn’t know what expected to happen when notified manufacturer, but believed it
would involve discussion and perhaps repairs and mitigations we developed. That’s
not what happened. Instead, a great deal of resistance from chip manufacturer,
and active effort to get us to suppress our research and not publish
vulnerabilities. Instead of repairing
the system, mfgr spent considerable resources to stop us from publishing,
including raising specter of expensive lawsuit based on 1201. Small component
was reverse engineering of software and bypassing extraordinarily simple TPM.
1201 was never intended to prevent security researchers from publishing, but it’s
hard to argue merits/intent of law when you’re a penniless grad student.
Charlesworth: why isn’t 1201(j) enough?
A: My understanding is that there’s the bypass issue and the
trafficking issues. Both potentially an issue depending on what it means to
traffic. Bypassing the TPM was raised to
us at the time.
Blake Reid, Samuelson-Glushko Technology Law & Policy
Clinic at Colorado Law: Existing exemptions for (j), (g), and (f) for
research/reverse engineering, but as we detailed in comments, there are
shortcomings in each. (j) fails to
provide the up-front certainty needed for an exemption, because, e.g., it’s got
a multifactor test that depends on things like how the info was used and
whether the info was used/maintained in a manner that doesn’t facilitate
infringement. We might well try an
argument for applying the exemptions if god forbid he was sued, but as we’ve
asked the Office for before we want further up-front clarity for good faith
security testing/research. That was the basis of 2006 and 2010 exemptions and
we hope for them again.
Green: my incident was 2004.
Charlesworth: would the activities described fall into one
of the exemptions?
Reid: Don’t want to opine—again if we were in court I’d
absolutely they were covered, there was no ©’d work, etc. but if advising Prof.
Green beforehand, hypothetically, there would be reason to be nervous b/c of
the ambiguous provisions of the law. The issue of certainty.
Green: we were advised at the time by the EFF, pro bono. We were told they
could provide no guarantee that any of the exemptions would protect us if we
were sued. They didn’t say we were violating the law, but the complexities of
the exemptions were such that they provided no guarantee.
Charlesworth: did you know that before or after?
Green: before, during, after.
Charlesworth: you sought legal advice before?
Green: yes, my prof had a similar experience.
Charlesworth: but you proceeded anyway.
Green: yes, b/c we believed it was necessary. We were
fortunate to have the EFF, which gave us the confidence to go forward; we felt
that the probability was relatively low.
The system’s been repaired. But w/out that the system might still be
broken today. I now begin every project w/ a call to a lawyer for a 1201
mitigation possibility. I still get pro bono representation, but many
researchers aren’t so fortunate. Also, good faith research shouldn’t require
lawyers; increases the cost of every project.
Reid: We predicted in 2006 that Sony rootkit wouldn’t be the
last dangerous/malfunctioning TPM. We vastly underestimated the widespread
vulnerabilities that can be caused by and concealed by TPMs—intermingled with
everyday consumer goods including cars, medical devices, internet
software. Chilling effects have become
ever more pernicious—a roomful of nation’s top security researchers stand
before you today highlighting the threats they, their colleagues, and their
students face in trying to make America a safer place to live. Existing
exemptions show security to be a priority but are not enough to avoid attempts
to silence their work, which is protected by the First Amendment and protects
the public. In 2006, Peters rejected
projection of worsening TPMs and recommended against a broad exemption, but
that prediction was prescient. Lengthy
record of security vulnerabilities that could have been avoided w/a workable
exemption. Researchers before you today
are the good guys. They care about abiding by the law and they need breathing
space. W/out your help they will lose an arms race to bad guys who don’t care
about violating 1201.
Q: 1201 exemption for video games—was that too small?
Reid: the issue was not with the piece of the exemption that
was granted, but that the vulnerabilities around DRM patched w/video games was
just one piece of evolving threat. Evolving
piece was in things like cars, medical devices. It was the narrow piece that
said security researchers could look at TPMs only for video games.
Q: but the exemption had other limits—info must be used
primarily to promote security of owner/operator, and must not be used to
promote copyright infringement. Does
that restrict research?
Reid: it’s hard to tell you—the subsequent vulnerabilities were
not necessarily in video games. Folks took a look at exemptions and said video
game exemptions were too narrow to do research.
If added to broad exemption, we’d have some of the same concerns—don’t
have certainty w/words like “primarily.”
Q: your proposal is “for the purpose”—how much more
certainty does that provide you? Existing statute says “solely”—congressional intent?
Reid: the more certainty we can get, the more mileage
researchers will get. Post hoc judgments are problematic b/c it’s hard to say
up front what the primary purpose is.
Q: but there will always be post hoc judgments. We also have to ask what is good faith. We have to draft language for an exemption—we
want to understand what kinds of limitations might be appropriate in language
that balances need for less post hoc analysis with some definition of what it
is we are allowing. Congress did act in
this area, which is guidance about what Congress was thinking at the time. [But the exemption procedure is also guidance about what Congress was
thinking at the time.]
Reid: clarity about what these limits mean: being used to
facilitate © infringement—opponents have said that simply publishing
information about a TPM/software might facilitate copyright infringement.
Guidance that the acts we’re concerned about here, outlined in the comments:
investigating, research in classroom environment mostly, being able to publicly
disclose in responsible way the results are covered. If you enable that, that’s
the most important piece we’re looking for in limitations.
Charlesworth: tell me more about a classroom environment.
Should an exemption be tied to academic community.
Reid: Student ability to work on this is really important,
but we wouldn’t support a classroom use limit. Private sector and amateur
security researchers are really important, building skillsets.
Charlesworth: should a university researcher oversee all of
this research?
Green: very concerned about that. The most dynamic/important
research is being done by people in the private sector, commercial security
researchers. The vehicle security research is funded by DARPA but worked on by
Charlie Miller, unaffiliated w/university. Very similar with other kinds of
research. Some is authorized, but the vast majority is done by private
individuals w/access to devices. Recent cases: researchers told to back off b/c
of DMCA. One happened just a couple of
weeks ago.
Andy Sayler, Samuelson-Glushko Technology Law & Policy
Clinic at Colorado Law: Heartbleed, Shellshock, numerous vulnerabilities in the
last year. Logjam—a week ago.
Q: was that done without circumvention?
Green: we don’t know. Some public spec,
some looking at devices.
Sayler: note that much security research is funded by the
gov’t. 1201 is used to discourage independent security research. Congress didn’t intend good faith research to
be suppressed, but they’re ambiguous/undue burdens. Ioactive researcher was threatened w/DMCA for
exposing vulnerabilities in Cyberlock locks.
Significant personal risk/unreasonable legal expenses to mitigate risk.
Mark Stanislav, Rapid7 security consultant: Last year
assessed
Snort, a toy that lets
parents communicate with children over the internet.
Oinks to signal new message. Child can reply.
The security features were flawed; unauthorized person could communicate
w/child’s device and could access name, DOB, and picture of child as well.
Contacted the vendor; despite my offer to go into details w/engineers, vendor
wouldn’t engage and made legal threat, saying I must’ve hacked them.
Productive dialogue eventually occurred and
resolved issues. Situation made me fear for my livelihood.
Q: did you discuss DMCA exemptions?
Stanislav: I wasn’t privy to the lawyers’ conversations. I
understood that I was at risk. My goal
was protecting children, but it wasn’t worth a lawsuit. I found vulnerabilities in my own webcam that
would allow a criminal to access it.
Direct risks to privacy and safety. I contacted the vendor and offered
assistance. Final email, after friendly to threatening, wanted me to meet
w/them b/c they said I might have accessed confidential information. Entrepreneurs who made Snort have gone on to
win numerous awards. What if a criminal
had abused these and put children in harm’s way? Webcam: new leadership came in
and apologized. Research prevented harm, privacy violations, allowed businesses
to fix critical flaws before adverse impact. We help people/businesses who don’t
know they’re in harm’s way/putting people in harm’s way. We live in a time when a mobile phone can
control an oven. Smart TVs have microphones listening to us all the time.
Please help widen the collective efforts of security research; the researchers
who stay away from research b/c of DMCA are problems.
Steve Bellovin, Columbia University: Researched in private
sector for decades. Academic research is generally concerned with new classes
of vulnerabilities. Finding a buffer overflow in a new device is unpublishable,
uninteresting. Most of the flaws we see in devices we rely on are serious but
known vulnerabilities. Not the subject of academic research; the independent
researchers are the ones actively protecting us. Students unlikely to do it; I
discourage my PhD students from looking for known vulnerabilities because it
won’t get them credit.
As a HS student, I wrote a disassembler so I could study
source code. That’s what got me to where I am today. Arguably would be illegal today, if I wanted
to look at a smartphone. Four years later, I caught my first hackers. I teach
my students how to analyze and attack programs. I coauthored the first book on
firewalls and internet security. You
have to know how to attack in order to secure a system. To actually try an
attack is a hallmark assignment; it’s not the only way, but it is one of the
ways. Is a copyright owner who profited
a great deal from copyright, but wants a balance. 1853 treatise on whether it’s ok to discuss
lockpicking: truthful discussion is a public advantage. Harm is counterbalanced by good.
Andrea Matwyshyn, Princeton University: These questions are
about frivolous litigation that attempts to suppress discussion around existing
flaws that may harm consumers, critical infrastructure, economy. Help curb frivolous 1201 litigation.
Charlesworth: on the issue of disclosure: you’re suggesting
that mfgrs tend to shut down the conversation, but isn’t there a countervailing
interest in giving mfgr some time to correct it before public
dissemination? I understand bad hats are
out there already, but hacking into something more mundane like a video console
there are probably people who don’t know how to do that who might be educated
by disclosure.
Matwyshyn: there are two types of companies. Some are very
receptive to this—FB, Google, Tesla have bounty programs who compensate
researchers.
Processes in place w/clear
reporting mechanism on websites and internal ID’d personnel. The second type
has not yet grown into that sophisticated model.
So it’s this second category that doesn’t
possess the external hallmarks of sophistication that react viscerally, through
overzealous legal means and threats.
The
Powerpoint I shared has a copy of one of the DMCA threats received Apr. 29,
2015.
Hearing Exh. 10,
letter
from Jones Day to Mike Davis, security researcher at Ioactive, a security
consultant.
Regards repeated attempts to
contact Cyberlock about their product.
They used DMCA as a threat.
Q: Cyberlock seemed to have taken the position that Davis
insufficiently disclosed. [Actually it indicates that he didn’t want to talk to
Jones Day, not that he didn’t want to talk to Cyberlock, which makes sense.]
Matwyshyn: he was ready to share that with technical
team. Subsequent followup email in
record explains and identifies prior instances of threat.
Q: if you granted the proposed exemption in full, would that
change the outcome? If a company is going to engage in frivolous litigation, we
can’t stop that.
Matwyshyn: I believe it would help a lot. The note from Ioactive’s general counsel: GC’s
perspective is that it seeks a strong basis for defense. Expresses concern that litigation to the
point of discovery can cost $250,000. When we’re talking about a small security
consultancy or independent researcher, engaging w/the legal system is cost
prohibitive. A roadmap exemption would
give a one-line statement of reassurance that a GC or security researcher could
send to a potential plaintiff. W/exemption, Jones Day would be less likely to
threaten DMCA as basis for potential litigation. Provided that Cyberlock has in place a
reporting channel that the researcher used, and researcher disclosed the list
of disclosables we proposed, that would provide a clear roadmap for both sides’
relationship in the context of a vulnerability disclosure. Significant improvement in murkiness, more
easily discernable question of fact.
Q: One of the elements is that the manufacturer had an
internal management process. How would a researcher verify that?
Matwyshyn: the researcher needs a prominently placed
reporting channel. The additional requirements are not researcher-centric, but
assist figuring out what happened if something went awry. The researcher need
only assess whether there is a prominently placed reporting channel.
Q: you want a front door, but you’ve put other elements in
your proposal—the creation of an internal corporate vulnerability handling
process. Opponents have said a researcher wouldn’t even know if the company had
such processes in place. How would they know?
Matwyshyn: the later parts are only for a subsequent finder
of fact. Supposed the researcher used the front door and then the sales
department loses the report—the exemption protects the researcher.
Q: but does it give ex ante comfort? The researcher won’t know if that will
happen.
A: if it goes off the rails b/c the internal processes weren’t
in place, the researcher has a second
tier ability to defend if the disclosure results in a threat.
Bellovin: In almost 30 years, it’s been remarkably hard to
find ways to report security vulnerabilities. I know security people and can
generally find an artificial channel.
But put yourself in the position of someone who has found a flaw and
doesn’t know me. If this vulnerability
is a threat to safety, public disclosure is a boon.
Matwyshyn: Henninger attempted to contact 61 companies about
a vulnerability. 13 had contact info; the rest she had to guess at a point of
contact. 28 humans responded out of 61. A
different 13 said they’d already fixed it.
6 subsequently released security advisories b/c of her report. 3 were
after the intervention of ICS-Cert contacting the provider in question.
Q: the suggestion is that she made a good faith attempt that
she documented attempts to notify. Isn’t
that a more objective standard than having her know the internal
processes.
Matwyshyn: the judgment point for the researcher is “is
there a front door”?
Q: in many cases they may have a front door [note:
contradicted by the record], but you could try to figure that out and keep a
record if your attempt was unsuccessful. You shouldn’t have to know the internal
workings of the company. [This is the proposal, though! Right now you have to know the internal
workings to reach someone if there’s no front door. Under the proposal, you don’t
have to know the internal workings, but you know that if you deliver through
the front door you are protected!]
Matwyshyn: right now you get a chill even with documented
attempts.
Q: but some companies will just threaten you no matter
what. You won’t avoid that entirely. If
we go down this road, how will people know?
If the standard relies on how people handle things, how will they know?
Matwyshyn: if the front door exists, the researcher should
use it. If the disclosure goes off the rails, the researcher gets an extra
boost. W/out legal team, you can assess
whether there is a front door and thus whether you should use it.
Q: why shouldn’t they try other methods if there isn’t a
front door? You try to figure out who owns something in copyright all the time.
You’re saying we should have a standard that everyone has to have a front door.
[Why is this a copyright issue? What is the nexus with copyright infringement?
Why not follow the ISO security recommendations? Why would the Copyright Office
have a basis for knowing better than the ISO standard how vulnerabilities
should be reported?]
Matwyshyn: The ISO standard was negotiated across years and
stakeholders.
Q: those are big companies, and this law would apply across
the board. Manufacturers who don’t have the
resources might not know. We have to
think of them as well. [B/c of their copyright interests?]
Matwyshyn: could identify copyright contact as point of
contact.
Q: for DMCA that’s a statutory requirement. [Um, “requirement”
if the companies want the DMCA immunity. If they want people to report
vulnerabilities to them, why not have them follow a similar process?]
Matwyshyn: Congress did discuss security as well—you can
expand the concept/clarify it.
Matthew Blaze, University of Pennsylvania: History of
security research, including on Clipper chip and electronic voting
systems. Two specific examples of DMCA
issues, though it loomed over every nontrivial work I’ve done since 1998. Analogous to Ioactive/Cyberlock issue, in
2003 I decided to look at applications of crypto techniques to other types of
security: mechanical locks. Discovered a remarkably similar flaw to that
discovered by Ioactive: could take ordinary house key and convert it into
master key into one that would open all locks in a building. Real world impact and interesting use of
crypto; master key systems need to have their security evaluated. Purely
mechanical, no TPMs. And so publishing was simple and without fear. But other work is chilled by the DMCA.
Example: in 2011, w/grad students studied P25, a communication system used as a
digital 2-way radio by first responders, including federal gov’t. Examined standards for the system as well as
the broad behavior of a variety of radio products that used them. Discovered a
number of weaknesses and usability failures, and discovered ways in which the
protocols could lead to implementation failures. To study those failures, we
would’ve needed to extract the firmware from actual devices. But we were
sufficiently concerned that in order to extract the firmware and reverse
engineer it, and in particular develop tools that would allow us to extract the
firmware, we would run afoul of the DMCA. So we left a line of research
untouched. If we had the resources and the time to engage a large legal effort
to denote parameters, we could possibly navigate that, but under the DMCA as
written we decided it was too risky.
Q: why not 1201(j)?
Blaze: w/o getting into atty-client privilege, the essential
conclusion was that we were in treacherous territory, primarily b/c we would
have needed to reverse engineer, see if implementation failures we anticipated
were present, and effectively build our own test bed along the way. We
approached a few manufacturers and attempted to engage with them and were
ignored or rebuffed every time. We realized the relationship would be hostile
if we proceeded. The anti-trafficking
provision would have been particularly problematic b/c we needed tools for
extracting—a colleague in Australia examining the same system had developed
some tools and expressed interest in working w/us, but we couldn’t.
Q: is there a norm of trying to disclose before publication?
Blaze: certainly there are simple cases and hard cases. In
simple case, we find particular flaw in particular product w/well defined
manufacturer w/a point of contact. Sometimes we can find an informal
channel. As someone who is an academic
in the security community and wants to work in the public interest, I don’t
want to do harm. Disclosing to the
vendor is certainly an important part. But in other cases, even identifying the
stakeholders is often not so clear. Flaws found in libraries used to build a
variety of other products: we won’t always know what all, most or even some of
the dominant stakeholders.
Q: when you do know, is it a norm to disclose in advance as
opposed to concurrently?
Blaze: it has to be case by case. There is a large class of
cases when we have a specific product that is vulnerable, and we can say “if
this mfgr repairs, we can mitigate.” But other cases it’s less clear where the
vulnerability is present and it may be more prudent to warn the public
immediately that the product is fundamentally unsafe. Reluctant to say there’s
a norm b/c of the range of circumstances.
Green: In some cases like last week there’s mass disclosure—you
can’t notify the stakeholders all at once. If you notify, they may leak it
before you want it public which can cause harm.
Sometimes you want to be very selective.
If, let’s say, 200 companies are affected, you can go to Google/Apple
and trust the info won’t leak, but beyond that the probability that the problem
becomes public before you want it to is almost one—I’ve had that happen. Heartbleed was an unintended leak—too many
people were notified of a mass vulnerability, and many systems including Google
and Yahoo! were not patched as a result of the two weeks early disclosure.
Charlesworth: so are you saying that disclosure should be
limited?
Green: there is no single answer you can write down to cover
it all. Heartbleed: massive vulnerability affected 1000s of sites. Google =
Google would fix and protect maybe 50% of end users on internet. Yahoo! =
protect 25%. As you go to a smaller website, now you’re protecting 200 people
but probability of leak is fairly high. Then criminals can exploit
vulnerability before it’s patched. Has
to be customized to potential vulnerabilities.
Reid: you’re hearing a theme that this is an issue for the
judgment of security researchers, and it’s only b/c of the DMCA that suddenly
this is the realm of copyright law. Getting pretty fair afield of Congressional
intent to mediate these judgments and their complexities, which take a lot of
negotiation, as Matwyshyn underscored w/ISO. We would strongly caution the
Office against being too prescriptive. (1) If there wasn’t a lock involved, we’d
just be talking about fair use. In that case it would be up to the researcher
how to disclose. Whatever copying was necessary for research would be the only
issue; the fruits of the research would be free and clear. (2) Remember the
First Amendment interests and the prohibition on prior restraint. Rigid
structure on when someone is allowed to speak, even if the policy judgments
weren’t complicated.
Charlesworth: did you brief the First Amendment issues?
Reid: not in detail.
Charlesworth: Congress considered this in making disclosure
a factor. What you’re saying is that
sometimes you should disclose, sometimes not.
Reid: Congress can’t contravene the 1A, even in enacting the
DMCA.
Charlesworth: but looking at disclosure to manufacturer is a
factor—maybe that’s not such a bad way to think about it.
Reid: factors mentioned in (j), to extent compatible w/1A,
can be read as probative of intent to do security testing or something else.
Reading them as limitations of speech after circumvention performed is
constitutionally troubling.
Charlesworth: that’s a brand new argument, and I’m not
troubled by (j), but there’s a lot of commentary about disclosure. Google has a 90-day disclosure standard; you’re
saying there should be no standard, though Congress clearly had something in
mind. [Would having a front door be
consistent with being the kind unlikely to leak?]
Blake: As academics and members of the public research
community, the aim of our work is to disclose it. The scientific method demands
disclosure. Someone building tools to
infringe is not engaging in research.
The issue is whether or not the work is kept secret or disclosed to the
vendor, not whether it’s disclosed to the vendor in advance. No one here is
advocating keeping research secret—trying to protect research we will publish
and will benefit everyone.
Mellovin: twice in my career I’ve withheld from publication
significant security flaws—once in 1991 to delete a description of an attack we
didn’t know how to counter. Because security community wasn’t aware of this
publicly, the bad guys exploited the flaws before fixes were put in place. It
was never seen as urgent enough.
Published the paper in 1995, once we saw it being used in the wild and
b/c original memo shared only with a few responsible parties ended up on a
hacker’s site. Security community didn’t care until it became public.
Other case: vendors were aware of the problem and didn’t see
a fix; once it was in the wild, others in the community applied more eyes and
found a fix. In both cases, trying private disclosure actually hurt security.
Matwyshyn: (1) 1201(i) concerns are slightly different. (2)
In our findings we did discuss the First Amendment, should the panel wish to
review the cited law review article. (3) Google’s a member of the Internet Association,
which supports our approach. (4) Frivolous litigation: the benefit of a clear
exemption allows them to feel more comfortable contacting vendors earlier,
rather than needing to weigh the risk of litigation to themselves; later
contacting is now something you do to mitigate risk that they’ll sue you before
you disclose. Providing comfort would encourage earlier contacts.
Laura Moy, New America’s Open Technology Institute
I’ve encouraged the Office to focus on © issues and not
weigh the policy issues as opponents have suggested. But consumer privacy is relevant b/c the
statutory exemption for privacy indicates Congress’s concern therefor. Some
opposition commenters have cited privacy concerns to grant an exemption—but that’s
wrong. Remove roadblocks to discover
security vulnerabilities. As many others
have pointed out, vulnerabilities often expose consumer info and they need to
be found. Malicious attackers are not waiting for the good guys; they race to
do their own research. They are succeeding. Last year, CNN reported 110 million
Americans’ info had been exposed—these are just the ones we know about. Need to find them as soon as possible,
dismantling roadblocks.
Vulnerabilities should be disclosed so consumers can
incorporate security concerns into decisionmaking. Consumers have a right to
information they can use to make informed choices. Also bolsters vendors’
economic incentives to invest in security—publicity can be harmful if a product
is insecure, and that’s as it should be. As a consumer, you should know of
known vulnerabilities to Cyberlock’s product before you purchase.
Vulnerabilities should be disclosed so that regulators
enforcing fair trade practices know whether vendors are adhering to the
promises they’ve made and using good security practices. FTC says failure to
secure personal information can violate FTCA; state laws too. Enforcement requires
understanding of security. Often rely on independent researchers. FTC recognizes that security researchers play
a critical role in improving security.
Erik Stallman, Center for Democracy & Technology:
security testing done only with authorization of network operator in statutory
exemption—in a world of internet enabled devices, it can be very difficult to
determine who the right person is.
Q: says owner/operator of computer, not owner of
software. Even if I don’t own the
software, can’t I authorize the testing?
Stallman: it’s unclear if that’s sufficient—if your banking
network is connected to a VPN, it may be the source of a vulnerability. Are the computers at your ISP covered by
this?
Q: presumably if I hire a VPN provider I can ask them for
permission to test the security.
[Really? I can’t imagine the VPN provider saying yes to that under most
circumstances.] I can buy a pacemaker
and run tests. If you own that
pacemaker, you can run tests.
Stallman: You may need to go up the chain. The moment you
fall outside, you fall outside the exemption [e.g. if you communicate with
another network].
Q: so I want to test HSBC’s systems to know if they’re
secure. Will the exemption allow this test without permission of third party
server?
A: Something like Heartbleed—a ubiquitous exploit on many
systems. You shouldn’t need to go around and get permission. Accidental
researcher: may come across vulnerability when engaged in different research.
Often researchers won’t know what they’re looking for when they start looking.
1201(j) limits what they can ask.
Q: I want to test a website’s security. Can I test it under
your proposal? Say I bank at HSBC and want to test it.
Stallman: So long as you’re doing good faith security
research, yes.
Q: but Congressional history says shouldn’t test locks once
installed in someone else’s door. Does
your proposal require any authorization, or is there a proposal requiring at
least an attempt to seek authorization?
Stallman: the problem is it’s hard for the researcher to
know/stay within stated scope. Or authorization can be revoked/cabined. You could ask HSBC, but then what do you do
if they say no? Then you’re out of luck.
Q: legislative history suggests authorization is important.
Stallman: the internet environment is very different from
enactment of 1201(j); House Report said that the goal would be poorly served if
they had undesirable consequence of chilling legitimate research activity, and
that’s the problem we have now. 1201(j)
is not providing the protection that researchers now need.
Q: nuclear power plants/mass transit systems—should we allow
testing of live systems? How would this
research be conducted?
Stallman: many critical infrastructure systems depend on the
same software/applications that run other systems. Should not be able to stop
research on systems widely in use by other people.
Q: but if this can be tested by off the shelf software,
shouldn’t it have to be?
Reid: to the extent the Office reads (j) very broadly, you
could put that in the record/conclusions in the proceeding, that would be very
helpful. The primary concern: one
interpretation is that the computer system is the bank. The concern is to the
analogy in the legislative history—the TPM on that system is not protecting the
bank’s property. It’s protecting the software. The company will claim we aren’t
the owner and that we aren’t engaged in accessing a computer system, but rather
engaged in accessing software running on that computer. That is the ambiguity
that has crippled (j) in the past. We would agree with your interpretation of
(j) in court, but when we’re trying to advise folks we have to acknowledge the
multiple interpretations.
Charlesworth: we haven’t come to any conclusions about the
meaning of (j). Your point is well taken.
We may get there, but we aren’t there yet.
Reid: Think about the standard for granting an exemption:
the likelihood of adverse effects. You’ve heard that uncertainty produces the
adverse effects. You need not have an ironclad conclusion about (j) in order to
grant this exemption. If you conclude that there’s multiple interpretations but
a chill, then you need to grant the exemptions.
Bellovin: (j) is for testing my own bank as an employee. I
might be able to take precautions, or not. Even the most sophisticated users
would have trouble mediating a flaw in an iPhone. We aren’t talking about
device ownership, but vulnerabilities not in the device but rather in the
software—not the flaw in our particular copy but the class of copies which
manufacturers often don’t want to hear about/don’t want anyone to hear about
it. If a flaw is serious enough I may not use my copy, but it’s the other
instances owned by others that need protection.
Stallman: Just note that security experts have signed on to
comments about the chill. General point is that because (j) has CFAA, Wiretap
Act, Stored Communications etc. references, it has the unfortunate effect of
compounding/amplifying uncertainty. It’s not satisfying to say that other legal
murkiness means we shouldn’t address this issue—this is one thing the Office can
do and send a clear signal that this is an area that Congress should look at.
from Blogger http://ift.tt/1Evr2Qe
