Feds Expand Security Researchers' Ability To Hack Without Going To Jail (vice.com) 51
An anonymous reader quotes a report from Motherboard: Friday, the Librarian of Congress and U.S. Copyright Office renewed several key exemptions (and added a few new ones) to the Digital Millennium Copyright Act. This go round, they've extended some essential exemptions ensuring that computer security researchers won't be treated like nefarious criminals for their contributions to society. As part of an effort to keep the DMCA timely, Congress included a so-called "safety valve" dubbed the Section 1201 triennial review process that, every three years, mandates that activists and concerned citizens beg the Copyright Office and the Librarian of Congress to craft explicit exemptions from the law to ensure routine behavior won't be criminalized.
The exemptions still have some caveats. Specifically, the Copyright Office ruling only applies to "use exemptions," not "tools exemptions" -- meaning security researchers still can't release things like pen-testing tools that bypass DRM, or even publish technical papers exploring how to bypass bootloaders or other Trusted Platform Modules to test the security of the systems behind them. But other modest changes to the rules were incredibly helpful, notes Blake Reid, Associate Clinical Professor at Colorado Law. Specifically, the new exemption removes a "device limitation" from previous exemptions that potentially limited researchers to investigating software only on "consumer" devices; hindering their ability to investigate security vulnerabilities in things like the cryptographic hardware used in banking applications, networking equipment, and industrial control systems. The new exemption also modified the "controlled environment limitation" from the previous exemption, which was often read to imply that researchers had to conduct their work in a formal laboratory, potentially hindering research into things like integrated building systems like internet-connected HVAC systems.
The exemptions still have some caveats. Specifically, the Copyright Office ruling only applies to "use exemptions," not "tools exemptions" -- meaning security researchers still can't release things like pen-testing tools that bypass DRM, or even publish technical papers exploring how to bypass bootloaders or other Trusted Platform Modules to test the security of the systems behind them. But other modest changes to the rules were incredibly helpful, notes Blake Reid, Associate Clinical Professor at Colorado Law. Specifically, the new exemption removes a "device limitation" from previous exemptions that potentially limited researchers to investigating software only on "consumer" devices; hindering their ability to investigate security vulnerabilities in things like the cryptographic hardware used in banking applications, networking equipment, and industrial control systems. The new exemption also modified the "controlled environment limitation" from the previous exemption, which was often read to imply that researchers had to conduct their work in a formal laboratory, potentially hindering research into things like integrated building systems like internet-connected HVAC systems.
Re: can't...even publish technical papers (Score:1)
It's so terrible that Trump's administration is censoring the research that Obama's administration flat out criminalized.
Re: (Score:2)
Wait, what? When did that happen?
To quote Chief Justice Marshall from Foster v. Neilson in 1829: “In the United States, a different principle is established. Our constitution declares a treaty to be the law of the land. It is, consequently, to be regarded in courts of justice as equivalent to an act of the legislature, whenever it operates of itself, without the aid of any legislative provision. But when the terms of the stipulation import a contract—when either of the parties engages to perfor
But don't worry (Score:5, Insightful)
We'll do the research for you. We might even sell you the results, provided your industry lets you have them. If not, well, it was nice to know you. Just don't expect us to come over to the US anymore for any security conferences, now that it's becoming more and more like trying to have a porn conference in Saudi Arabia.
signed, the rest of the world
Re: But don't worry (Score:2)
People are often sociopathic, empathy-free and self-indulgent. They don't care when it hurts others, only when it hurts them, and not at all if they don't believe it'll hurt them.
People cared about global warming when they saw effects. In America, the ambivalence outside of agriculture is because the effects have been small for those isolated from their environment.
People don't care about far-off wars, only the increased employment that follows.
People don't care about violence, as long as it's somebody else
Re: But don't worry (Score:2)
The Doctor: Good men don't need rules. Today is not the day to find out why I have so many.
Re: (Score:2)
This is not specific to the US, EU has laws just like that already in place, maybe even more restrictive. Next on the list will be crime novels, since these heinous books provide detailed information how to commit and cover up awful crimes, sometimes even murder!
If you have talent in computer security, you have basically two options: if you also happen to have morals, forget everything you learned until now, study some other subject to pursue a less dangerous professional career, lean back and smile, while
Re: (Score:2)
The VAE pay better than the Saudis.
Just saying...
Re: (Score:2)
The UAE, of course.
I always forget that you're still talking English...
Don't you mean the Trump Administration? (Score:5, Insightful)
"Friday, the Librarian of Congress and U.S. Copyright Office"
I've protested every story about an action of any executive agency being referred to as the actions of the Trump administration as if Donald Trump personally makes every call so why is this one "Feds?"
Re: Don't you mean the Trump Administration? (Score:2)
Because most of the other actions were instigated by him. That they were invariably stupid is merely a product of that.
This decision was made by a quasi-independent group of civil servants entirely off their own bat. It's not perfect, but it's about par with decisions made by competent people.
Re: (Score:2)
It's about money (Score:2)
They can't move their research overseas if the bulk of the money they need is from the government, if they rely on a clearance in the U.S., or if they need access to GFE.
(The Feds are opposed to foreigners having secrets that were public knowledge after the next Defcon anyway.)
It's also seriously disruptive to families, and few countries want to be seen to be offering space to political refugees from America after the extraordinary rendition in Italy and the U.S. threatening to shoot down the Bolivian presi
Never compromiseNot even in the face of Armageddon (Score:2)
To hell with this! Rule that fans of MMORPG abandonware like City of Heroes can fire up private servers, including for-pay ones.