Legal support for security researchers
Connecting state and local government leaders
Electronic Frontier Foundation offers IT security researchers advice on navigating the potential minefield of patent and copyright laws involved in their work.
LAS VEGAS ' Information technology security research can be dangerous work, no matter what color hat you wear. News of security flaws is almost always unwelcome, and not only do you have to worry about criminals and hackers, there are also software companies, the courts and law enforcement agencies to watch out for.'Sometimes the owners of the products don't like the message' being sent by researchers, said Jennifer Granick, an attorney and civil liberties director at the Electronic Frontier Foundation (EFF). 'Security research often operates in a hostile environment, and the law often gives companies ammunition to use against researchers.'At the foundation's booth at the Black Hat Briefings security conference this week, staff members are answering researchers' questions about the legal ramifications of their work as they negotiate a minefield of patent and copyright laws.'It's a heavily regulated, uncertain area of the law,' Granick said. 'It is complicated and vague, and there have been some bad decisions.'The conference is no stranger to legal challenges. In 2005, Cisco Systems Inc. and Internet Security Systems Inc. (now IBM Internet Security Systems) filed an injunction in federal court against former ISS researcher Michael Lynn when he gave a talk on a vulnerability in the Cisco operating system. The companies alleged misappropriation of trade secrets, copyright violation and breach of contract. Cisco cut 20 pages containing Lynn's presentation out of the printed proceedings of the conference and forced conference officials to reburn the CD version without the material. Granick represented Lynn in the imbroglio, which included an FBI investigation before it was all over.In February 2007, IOActive Inc., of Seattle, cancelled a talk on cloning radio frequency identification chips scheduled for the Black Hat Federal Briefings in Washington rather than face a possible lawsuit from a chip manufacturer.This is the first year that EFF has set up a booth for on-site consultations at the Black Hat Briefings, but Granick is a frequent speaker at such conferences and the affiliated Defcon. In the run-up to the conferences, EFF often receives queries from presenters doing cutting-edge research who are worried about possible legal exposure. EFF walks a fine line in offering help.First of all, its lawyers cannot give legal advice to individuals who are not clients. 'We are giving legal information,' Granick said.Second, they do not want to discourage researchers from pursuing legitimate work. 'It is very easy to say no,' she said. 'But there are ramifications for saying no. It has a negative impact on peoples' security.'So EFF looks for ways to say yes, suggesting better strategies for conducting or presenting the work. Granick offered a few guidelines for challenges many security researchers face:
- When conducting penetration testing, get authorization and liability waivers, preferably in writing, from the owner of the site or system being tested.
- When reverse-engineering a piece of software, be careful about making copies, which could bring you into conflict with copyright laws.
- For development projects that involve examining existing products, be sure not to include any of the original code in the final product you are working on. It is best to have two teams with distinct responsibilities on development projects of this type: one team to examine the existing code and a second team without access to that code to do the new development.
- When examining any product that requires authorization to access features, be careful how you get that access so you do not run afoul of the anti-circumvention provisions of the Digital Millennium Copyright Act.