Cybereye | Sue the messenger
Connecting state and local government leaders
The threat of legal action once again prompted last-minute changes in the agenda of a Black Hat Briefing.
The threat of legal action once again prompted last-minute changes in the agenda of a Black Hat Briefing.
IOActive Inc. of Seattle decided it could not risk the threat of a lawsuit and pulled a talk about cloning RFID chips scheduled to be presented at the Black Hat Federal Briefings in February.
This is the second time such threats have marred this computer security conference, and the IT security community is the ultimate loser in these disputes.
The Black Hat Briefings grew out of the annual Defcon hacker's convention as a way to share practical security info with the broader IT community. Although it now is owned by CMP Media LLC, the briefings have remained a quirky and iconoclastic venue for presenting hands-on research on emerging threats and vulnerabilities.
Apparently, it is a bit too iconoclastic for some tastes. At the Black Hat Briefings in Las Vegas in 2005, Cisco Systems Inc. threatened a lawsuit to stop a presentation on a vulnerability in its operating system. The talk was unexpectedly given anyway, and the FBI eventually got involved before the incident died.
Then, at the Black Hat Federal Briefings outside of Washington in February, access card manufacturer HID Global Corp. of Irvine, Calif., made threatening noises to IOActive when researchers planned to demonstrate how RFID chips in the cards could be cloned.
HID says it did not actually threaten IOActive, only made them aware that the presentation violated an HID patent. But IOActive felt threatened and said it could not afford the risk. The talk was cancelled.
Black Hat director Jeff Moss was disappointed, but said the decision was up to the presenter.
"If they want to pull the talk so they don't get sued, we'll support them," he said. "If they want to fight, we'll support them."
Moss worried later that the incident could have a chilling effect on security research, especially in smaller organizations without the resources to fight legal battles.
"This stuff makes me nervous," he said. "I don't want to get to the point where the only spokesmen we can get are from IBM or Microsoft, companies with big legal teams. It's a subtle reduction of public information."
He said companies that feel threatened should be less heavy-handed and more willing to work with researchers who uncover problems.
"It's not like the problem goes away if you shut up the researcher," Moss said.
It would be easy to trot out the standard complaints about a litigious society and to blame the lawyers for these incidents. But it is not the lawyers who are at fault here; these confrontations are the result of a lack of corporate leadership.
Lawyers are paid to give advice, and if they do not present their clients with the worst- case scenario and advise them to avoid it, they are not doing their jobs. But corporate officers are not obligated to take that advice. Often it makes better sense to take a broader view of a situation, acknowledge problems and make lemonade out of the lemons being gathered by researchers.
This battle already has been fought once, over the issue of vulnerability disclosures. Industry and the research community have come to an agreement on a responsible way to inform the public about software vulnerabilities in a timely manner, while at the same time giving vendors an opportunity to patch the problems. The same kind of understanding is needed on presentations of research in public venues so that the threat of lawsuits and last-minute cancellations do not throw cold water on those who, for fun or for profit, poke at our IT systems looking for holes.
This would benefit not only conference organizers such as Moss, but the public and industry as well. After all, it's better to have a good guy find the holes first than a bad guy.
NEXT STORY: 'Tiger team' to test foreign software