Law puts damper on web security research

Law puts damper on web security research
Law puts damper on web security research 

By Matthew Broersma
11 June 2007

Web security research is being seriously hampered by laws that punish 
researchers for even attempting to locate flaws in web software, much 
less disclosing those flaws, according to a new study.

The report is the first by the Computer Security Institute (CSI), a 
research and training organisation under the aegis of CMP Technology. It 
draws on discussions by a broad working group, including security 
researchers and representatives of US law enforcement agencies.

The upshot is that current legal frameworks designed to allow 
prosecution of web attackers also make it next to impossible to legally 
spot security flaws in the "web 2.0" applications quickly becoming 
ubiquitous on the Internet.

Those researchers who do feel safe probing web software for flaws are 
probably not aware of their real legal position, the report said.

Unlike researchers who address offline software and operating systems, 
web software researchers face significant legal restrictions designed to 
trap attackers, according to Jeremiah Grossman, chief technology officer 
of White Hat Security and a member of the working group.

"Under some laws, a researcher could find himself prosecuted for simply 
looking for website vulnerability, much less disclosing it publicly," he 
said in a statement.

The report is to be released on Monday at CSI's NetSec '07 conference in 
Scottsdale, Arizona.

It suggests that changes may be needed if the emerging ecosystem of web 
applications is to be kept secure. That could include changes in the 
law, including to the assignment of liability, how "damage" is 
quantified and how disclosure and criminal intent figure into the 
picture, the report said.

Short of changes to the law, the report suggested websites could 
encourage vulnerability disclosures through anonymous tip lines or the 
use of "dummy" sites specifically for the use of researchers.

The working group included organisations such as Fortify Software, SPI 
Labs, the US Department of Justice, Cenzic and the Electronic Frontier 

Attend Black Hat USA, July 28-August 2 in Las Vegas, 
the world's premier technical event for ICT security 
experts. Featuring 30 hands-on training courses and 
90 Briefings presentations with lots of new content 
and new tools. Network with 4,000 delegates from 
70 nations.   Visit product displays by 30 top
sponsors in a relaxed setting. Rates increase on 
June 1 so register today. 

Site design & layout copyright © 1986-2015 CodeGods