The Price of Restricting Vulnerability Publications

Full Title of Reference

The Price of Restricting Vulnerability Publications

Full Citation

Jennifer Stisa Granick, The Price of Restricting Vulnerability Publications, 9 Intl. J. CommLaw & Pol'y, 2005. Web

BibTeX

Categorization

• Issues: Economics of Cybersecurity; Information Sharing/Disclosure
• Approaches: Regulation/Liability

Key Words

Disclosure Policy, Information Asymmetries, Outreach and Collaboration, Software Vulnerability, Zero-Day Exploit

Synopsis

There are calls from some quarters to restrict the publication of information about security vulnerabilities in an effort to limit the number of people with the knowledge and ability to attack computer systems. Scientists in other fields have considered similar proposals and rejected them, or adopted only narrow, voluntary restrictions. As in other fields of science, there is a real danger that publication restrictions will inhibit the advancement of the state of the art in computer security. Proponents of disclosure restrictions argue that computer security information is different from other scientific research because it is often expressed in the form of functioning software code. Code has a dual nature, as both speech and tool. While researchers readily understand the information expressed in code, code enables many more people to do harm more readily than with the non-functional information typical of most research publications. Yet, there are strong reasons to reject the argument that code is different, and that restrictions are therefore good policy. Code's functionality may help security as much as it hurts it and the open distribution of functional code has valuable effects for consumers, including the ability to pressure vendors for more secure products and to counteract monopolistic practices.

Computer Insecurity and Disclosure Restrictions

Part One of this paper explains the current state of computer (in)security and sets forth three ways to restrict publications followed by the most common arguments for and against. It then illustrates the popularity of security publication restrictions with an overview of proposed and enacted publication restrictions. Indeed, legislators have readily restricted the publication and distribution of software code and shown an inclination to regulate other security vulnerability publications as well. For instance, the DMCA outlaws the distribution of computer code that circumvents technological access controls placed on copyrighted works. Copyright owners have used the law to threaten academics publishing research papers, computer hackers disclosing operating system flaws, magazines publishing programs that allow owners to play DVDs on the device of their choosing, as well as companies selling after-market garage door openers and toner cartridges. The U.S. Critical Infrastructure Information Act encourages companies to tell the government about infrastructure vulnerabilities, but then prohibits disclosure under the Freedom of Information Act, state sunshine laws, the Federal Advisory Committee Act or to Congress. The European Cybercrime Treaty requires signatories to treat security tools like burglary tools and outlaw them unless they are possessed for a legitimate security or research purpose.

Publication Restrictions in Other Scientific Fields

Part Two reviews the debate surrounding publication restrictions in other scientific fields and shows that, except in rare cases, policy makers and scientists agree that the strong interest in sharing, peer review and cooperation that is essential to the development of scientific knowledge outweighs the benefit to security interests attained from restraining publication. According to the authors, researchers, civil libertarians and policy makers have long agreed that uncensored publication and thorough peer review is essential to developing accurate scientific knowledge. Based on this consensus, U.S. law generally restricts publication only of information owned by or produced for the U.S. Government, when disclosure could reasonably be expected to result in damage to the national security, if the classifying authority can describe the damage from disclosure, and in specific areas of study that pose special problems for national security like weapons of mass destruction, nuclear facility or materials security, and military operations. The law cannot regulate code without impacting research, so policy makers must decide whether any security gain from disclosure restrictions is worth the price.

The Benefits of Openness in Computer Security

Part Three asks how computer security is different from other fields of science and whether these differences warrant a more or less restrictive approach to regulating vulnerability publications. According to the authors, in addition to the usual scientific reasons to protect sharing and openness in computer science research, there are special reasons why openness, including the availability of exploit code, promotes security and benefits the public. The paper concludes that while the functionality of code superficially appears to be a strong factor in favor of limiting computer security publications, security is not improved by secrecy in the computer context. Additionally, code restrictions undesirably favor anti-competitive practices on the part of market actors in a networked economy. They conclude that there are better ways to thwart computer crimes that do not impinge on scientific progress, or scare legitimate researchers and companies, or limit customer choice. Policy makers should promote the exchange of security information, peer review and field-testing; encourage users to protect computer systems by installing secure software, using encryption, and exercising sound judgment about the disclosure of sensitive information; and use market factors, insurance and liability allocation to encourage vendors to make security a priority.

Additional Notes and Highlights

Expertise required: Law - Low/Moderate

Outline:

 INTRODUCTION
 PART ONE
  I. The State of Computer (In)security
  II. Types of Vulnerability Disclosure Restrictions
    A. Audience Restrictions
    B. Time Restrictions
    C. Information Restrictions
  III. Proposed and Enacted Publication Restrictions
 PART TWO
  I. Scientific Advancement Requires Publication and Openness
  II. How Publication Restrictions Cannot Target the Utilitarian Aspects of Code Without Chilling Legitimate Research and Burdening the Advancement of Computer Security
 PART THREE
  I. Computer Security Benefits More From Widespread Dissemination of State of the Art Knowledge Than Do Other Scientific Fields
  II. Computer Insecurity Poses Less Harm Than That Threatened by “Dangerous Science”
  III. The Likelihood of Abuse of Computer Security Information is Greater Than In Other Scientific Fields
  IV. Secrecy Is Unlikely to Benefit Security More Than Openness in the Context of Computer Networks
  V. Publication Restrictions Contribute to the Market Failure in Security Provision
 CONCLUSION