Curbing the Market for Cyber Weapons
The United States and its international partners are permitting an unregulated, global market for cyber weapons to flourish. Weaponized zero-day ("Oday") exploits to attack the control systems for the power grid and other critical infrastructure components are on sale to criminals, terrorists, and rogue nations. Policymakers have begun to recognize the imperative to curb this market. There is no consensus, however, on the measures needed to do so. We propose three initial steps to begin curbing the market for weaponized Oday exploits. First, the United States should incentivize developers of critical infrastructure industrial control systems and applications layer software to minimize security flaws in their products. The Support Anti-Terrorism by Fostering Effective Technologies Act provides an especially promising means to strengthen these incentives and should be amended to authorize such software developers to apply for liability coverage under the Act. Second, through the Wassenaar Arrangement on Export Controls for Conventional Arms and Dual-Use Goods and Technologies, the United States and its international partners should establish uniform controls of dangerous Oday exploit sales targeting critical infrastructure. Third, the United States should amend the Computer Fraud and Abuse Act to strengthen its ability to prosecute researchers located both domestically and abroad who recklessly sell dangerous exploits targeting critical infrastructure to America’s adversaries.
Why Offensive Security Needs Engineering TextbooksOr , How to Avoid a Replay of “ Crypto Wars ” in Security Research
O ffensive security—or, in plain English, the practice of exploitation— has greatly enhanced our understanding of what it means for computers to be trustworthy. Having grown from hacker conventions that fit into a single room into a distinct engineering discipline in all but the name, offensive computing has so far been content with a jargon and an informal " hacker curriculum. " Now that it is unmistakably an industry, and an engineering specialization, it faces the challenge of defining itself as one, in a language that is understood beyond its own confines—most importantly, by makers of law and policy. Currently, lawmakers and policy-makers have no choice but to operate with pieces of our professional jargon that have been publicized by journalists. But writing laws based on professional jargon is dangerous: This jargon will be misunderstood by lawmakers and judges alike. It's not the wisdom of the judge or the legislator that is in question, it's their ability to guess the course of a discipline years in advance. Consider the concept of unauthorized access at the heart of (and criminalized by) the Computer Fraud and Abuse Act (CFAA). The unanticipated, " unauthorized " uses of today will be primary uses or business models of tomorrow. When CFAA was written, connecting to a computer on which one had no account was pointless. Cold-calling a server could serve no legitimate purpose, as no servers were meant for random members of the public; each computer had its relatively small and well-defined set of authorized users. Then the World Wide Web happened, and connecting to computers without any kind of prior authorization became not just the norm but also the foundation of all related business. Yet the law stands as written then, and now produces conundrums such as whether port scans, screen-scraping, or URL crafting are illegal, or even whether telling journalists of a successful URL-crafting trick that revealed their email addresses could be a felony (as in the recent US v. Auern-heimer case). Even accessing your own data on a Web portal in a manner unforeseen by the portal operator—as in the case of ApplyYourself users who could see their admission status prematurely—may similarly be a crime under CFAA (for discussion of these cases and different institutions' reactions to them, see [14]). Lawmaking with regard to offensive security artifacts has already started. Article 6 of the Budapest Convention on Cybercrime requires signatories to issue …
A Comparative Analysis of Dramshop Liability and a Proposal for Uniform Legislation
Over the past twenty years, courts and legislatures have largely abandoned the archaic common law rule that the sale of alcoholic beverages can never be the proximate cause of a plaintiff's injuries. In place of this rule, lawmakers have decided that dramshops will be forced to assume the social costs of the harm caused by their intoxicated customers. In this Note, the author examines the major issues shaping current dramshop law, including the circumstances that give rise to liability, who can maintain suit against a dramshop, and apportionment of liability between dramshops and intoxicated tortfeasors. The Note argues that there is substantial agreement on the broad outlines of dramshop liability in America. It concludes with a proposal for a uniform dramshop liability act that both summarizes the majority positions on dramshop liability and seeks to reduce conflicts of law and speed settlement of dramshop suits.