Ignorance vs Understanding: Regulation of "malware"?

Published on December 16, 2017
Duration: 49:51

This roundtable discussion explores the parallels between firearm regulation and the development/regulation of malware. Experts argue that both are tools whose morality is defined by their use, not their existence. They discuss the importance of offensive cybersecurity research for defense, the legal and ethical challenges of malware development, and the dangers of willful ignorance in both the cyber and firearm domains. The conversation highlights how restrictive laws can hinder research and defense capabilities, drawing parallels to the Second Amendment debate.

Quick Summary

Malware and firearms are both tools whose ethical implications depend on their use, not their existence. Restrictive laws on their creation can hinder vital research and defense capabilities. Experts argue that willful ignorance about these technologies leads to dangerous policy decisions and a lack of preparedness, emphasizing the need for understanding and education over prohibition.

Chapters

  1. 00:03Introduction to Malware vs. Understanding Regulation
  2. 01:12Expert Introductions and Backgrounds
  3. 03:10Defining Offensive Cybersecurity Work
  4. 04:05Analogies: Force-on-Force vs. Digital Attacks
  5. 04:25Malware Samples and Forensic Analysis
  6. 06:28AR-15 Design and Intent Analogy
  7. 08:30Liability and Legal Landscape for Malware Developers
  8. 10:08The AR-15 Designer Analogy Revisited
  9. 11:13Misunderstandings and Stereotypes in Cyber and Firearms Communities
  10. 13:14Arguments Against Malware Development
  11. 13:30German Malware Law (§303c) and its Interpretation
  12. 14:45Oppenheimer Analogy: Research vs. Application
  13. 15:36Tools: Firearms and Cyber Weapons
  14. 16:13Responsibility of Tool Users
  15. 17:06Evolution of the Hacker Community
  16. 18:49Fear and the Arrests of Malware Developers
  17. 19:11Current Laws and Prosecutions for Malware
  18. 19:34CFAA and Wiretap Act Violations
  19. 20:57Code as Intellectual Expression and Thought Restriction
  20. 22:24Patchwork Regulation: Malware vs. Gun Laws
  21. 24:09Navigating International Cyber Laws (Iran Example)
  22. 25:14Europe's Approach to Cyber Legislation vs. Sex Education
  23. 25:54American Self-Reliance vs. Global Mindsets
  24. 27:31Self-Reliance Cultures (Israel, Switzerland) and Cyber Security
  25. 29:06Germany's Legal Stance and the Digital Arms Race
  26. 30:09US Developers Benefiting Global Agencies
  27. 31:17Repurposing Leaked Government Cyber Weapons
  28. 32:35The Line in Cyber Weapon Development
  29. 34:28NSA's Vulnerability Equities Process (VEP)
  30. 35:28Eternal Blue Exploit and Government Disclosure Delays
  31. 37:36Revolutionary Metallurgy vs. Cyber Exploits Analogy
  32. 39:36Secrecy and Forensic Artifacts in Cyber Warfare
  33. 40:34Exploit Wednesday: Rapid Patch Reversal
  34. 41:13Advanced Scenarios vs. Common Corporate Vulnerabilities
  35. 42:22Physical Security Analogy: Reinforced Doors and Broken Windows
  36. 43:09Access Control Systems and Simple Exploits
  37. 44:09Software-Defined Radio Hacking (Garage Doors, Key Fobs)
  38. 44:46Fragility and the Need for Testing and Rebuilding Systems
  39. 45:13The Danger of Willful Ignorance in Law and Society
  40. 46:05Invitation to Firearms Community to Research Cyber Topics
  41. 47:06Equifax Breach as a Cyber Mass Shooting
  42. 48:45The Similar Plight of Gun Owners and Cybersecurity Professionals
  43. 49:23Conclusion: Educate, Promote Freedom, and Avoid Being the Slowest Gazelle

Frequently Asked Questions

What is the main argument regarding the regulation of malware and firearms?

The central argument is that both malware and firearms are tools, and their ethical implications are determined by their use, not their existence. Restrictive laws on their creation or possession can hinder legitimate research, defense, and understanding, similar to how firearm regulations are debated.

Why is offensive cybersecurity research, including malware development, considered important for defense?

Offensive cybersecurity research is crucial because it allows defenders to understand current and future attack vectors, identify vulnerabilities in their own systems, and develop effective countermeasures. Without this research, defenses would be based on assumptions rather than practical knowledge of threats.

How do legal frameworks in countries like Germany address malware development, and what are the criticisms?

Germany's §303c criminalizes malware creation, but critics argue this is problematic as it often fails to distinguish between malicious intent and legitimate research or defensive purposes. The German Federal Constitutional High Court has attempted to narrow this by requiring proof of malicious intent.

What is the parallel drawn between the CFAA and firearm laws in the US?

The Computer Fraud and Abuse Act (CFAA) is a broad law sometimes used for malware-related prosecutions, akin to how existing laws might be applied to the misuse of firearms rather than prohibiting the firearms themselves. This approach focuses on the action rather than the tool.

What are the dangers of 'willful ignorance' in the context of cybersecurity and firearms?

Willful ignorance, or choosing not to understand uncomfortable truths about technologies like malware or firearms, can lead to poorly informed policies, a lack of preparedness, and an inability to effectively defend against threats. It allows malicious actors to exploit this lack of understanding.

More General Videos You Might Like

More from InRangeTV

View all →