Obama’s War On Hackers

There has been a lot of discussion recently around President Obama’s plans to broaden the scope of legislation that would crack down on cybercrime in his proposed Modernizing Law Enforcement Authorities to Combat Cyber Crime plan. This proposal has raised a lot of questions for me and for many of my peers in the security research industry. Chief among them: will the research that I do, and that many in the community do, now become subject to investigation and possible prosecution?

Unfortunately, as currently proposed, the provisions are sufficiently vague so that solely consulting the law does little to clearly answer the question. That, for obvious reasons, leads to another set of questions:

Cybersecurity legislation is a complex topic. I think the intention of the law is largely a good one: government wants to crack down on criminals who have the potential to cripple infrastructure that is vital not only to business but to the lives of citizens in general. Defining laws that would only target the bad guys, however, is a very tricky thing.

Those of us in the trenches of information security are very much aware of the proactive industry research that takes place every day with the goal of preventing such crippling attacks from ever happening. However, concerns that security research could also be seen as illegal might curtail involvement by some of the brightest and most talented minds in our security community. Fear alone is a very credible deterrent, and unless there is a means for researchers to verify their research without fear, vital research will never see the light of day, or it will be taken overseas.

I had an opportunity to discuss this topic on a recent Dark Reading radio program. Joining the discussion was Harley Geiger from the Center for Democracy and Technology. The conversation touched on many interesting points, one being the scope of the Computer Fraud and Abuse Act (CFAA), which was enacted in 1986.

Just think about that for a moment: 1986. The overarching piece of legislation that is governing what may or may not be deemed illegal when it comes to cybersecurity research was written before the advent of the Internet itself!

[ICYMI: Hear the fascinating DR Radio broadcast on how New Cybercrime Crackdown Could Backfire And Criminalize Security Professionals]

What the current administration is essentially proposing is not a re-write of the current law, but instead, a broadening of it. Consider that, as the CFAA is written, things like bug bounty programs or any breach of a product/company’s terms of service (TOS) would be a violation of the law. How much broader can it get?

We have already seen negative examples of the current law being used against researchers, the most notable was the case against Aaron Swartz, who committed suicide in early 2013 while facing the potential of more than 30 years in prison and millions in fines for downloading academic journals from MIT’s JSTOR. If the laws are broadened and punishments increased, how many more cases like this will there be? It’s distressing to think about, and quite frustrating for researchers whose intentions are to help advance security and protections for businesses and consumers alike.

Ultimately, I think that some legislation is needed and that the majority of the cases that are enacted under it will be aimed at those with malicious intent. However, we need to reform the current law before extending it. Otherwise, there will be wide-reaching implications on the same security research that could ultimately play a strong hand in proactively derailing malicious behavior.