Vulnerability disclosure and botnet takedown not to be hindered by Wassenaar Arrangement

Posted by   Martijn Grooten on   Dec 19, 2017

I have never been too keen on making comparisons between (advanced) cyber attacks and conventional war, as such comparisons tend to ignore the enormous human cost that comes with wars. That said, digital weapons do play an important role in global conflicts, military or otherwise, and thus it makes sense for them to be covered by the Wassenaar Arrangement, an export control regime 'for conventional arms and dual-use goods and technologies' that has been signed by 42 countries.

The Wassenaar Arrangement is quite controversial within the IT security community. For a combination of libertarian and pragmatic reasons, many working in the offensive side of security are opposed to a regime that they believe could prevent them from developing, using and selling their tools.

But these loudly voiced concerns overshadowed what, for me, was an even bigger concern: as it was previously worded, the Wassenaar Arrangement could be seen to seriously hinder the disclosure of security vulnerabilities, and the sharing of the command-and-control tools used by botnets.

I was thus pleased to read an op-ed in The Hill by Katie Moussouris (currently of Luta Security). Katie is a leading expert when it comes to vulnerability disclosure and has actively been involved in making the Arrangement work better for the security community.

She writes that the language of the Wassenaar Arrangement has been clarified, and that 'the specific cross-border sharing activities around vulnerability disclosure and security incident response are exempt from requiring export control licenses as dictated by Wassenaar'.

I am very pleased to learn this. Both vulnerability disclosure and coordinated botnet takedown are hard enough. One really wouldn't want to make them even harder by requiring the participants – many of whom are individuals or small companies – to wade through pages of export control paperwork.

katiemoussouris_vb2014.pngKatie Moussouris delivering the opening keynote at VB2014 in Seattle.



Latest posts:

VB2017 paper: The life story of an IPT - Inept Persistent Threat actor

At VB2017 in Madrid, Polish security researcher and journalist Adam Haertlé presented a paper about a very inept persistent threat. Today, we publish both the paper and the recording of Adam's presentation.

Five reasons to submit a VB2018 paper this weekend

The call for papers for VB2018 closes on 18 March, and while we've already received many great submissions, we still want more! Here are five reasons why you should submit a paper this weekend.

First partners of VB2018 announced

We are excited to announce the first six companies to partner with VB2018.

VB2018: looking for technical and non-technical talks

We like to pick good, solid technical talks for the VB conference programme, but good talks don't have to be technical and we welcome less technical submissions just as much.

Partner with VB2018 for extra visibility among industry peers

Partnering with the VB conference links your company to a successful and well-established event, demonstrates your commitment to moving the industry forward, allows you to meet potential clients, be visible to industry peers and build lasting…