US cybercrime laws being used to target security researchers

Industry experts are concerned that America's anti-hacking laws are being applied without proper discretion, leaving security researchers vulnerable to prosecution. Photograph: Epoxydude/fstop/Corbis

Some of the world’s best-known security researchers claim to have been threatened with indictment over their efforts to find vulnerabilities in internet infrastructure, amid fears American computer hacking laws are perversely making the web less safe to surf.
Many in the security industry have expressed grave concerns around the application of the US Computer Fraud and Abuse Act (CFAA), complaining law enforcement and lawyers have wielded it aggressively at anyone looking for vulnerabilities in the internet, criminalising work that’s largely benign.
They have also argued the law carries overly severe punishments, is too vague and does not consider context, only the action.
HD Moore, creator of the ethical hacking tool Metasploit and chief research officer of security consultancy Rapid7, told the Guardian he had been warned by US law enforcement last year over a scanning project called Critical.IO, which he started in 2012. The initiative sought to find widespread vulnerabilities using automated computer programs to uncover the weaknesses across the entire internet.

'Law enforcement are killing careers'

Jeremiah Grossman, CEO of cyber research firm Whitehat Security, believes that the aggressive application of the law will lead to researchers quitting before they’ve found serious problems on the internet, leading to a degradation of its overall security.
“Right now they are probably killing careers, because they're not accounting for intent,” said Grossman.
“The chilling effect is on the problems we don't know about yet. The canaries in the coalmine? They just killed them all. So now we're going to suffer the consequences.”
The project that landed Moore in trouble, Critical.IO, uncovered some serious, widespread vulnerabilities, including one case where between 40 and 50 million network machines could have been compromised due to weaknesses in a network protocol, known as Universal Plug and Play (UPnP).
Yet US law enforcement continued to pursue Moore, even though he was transparent with his role and the reasons for his scanning, he claimed, without naming the government body that was responsible.

'The law doesn't encourage experts with the skill to investigate threats'

Moore said the actions by law enforcement were partly responsible for him taking a break from the industry, from which he has just returned. But his biggest fears surround the overall effect on internet security.
“You need people who can get into the detail with these systems, people who know how to manipulate the technology to their advantage as a criminal would,” he added.
“You need these people to help users understand the threats, and to work with vendors to help them fix them. At the moment, the law doesn’t encourage this. It doesn’t make any distinction between bona fide research and criminal activity. It doesn’t help consumers understand their risk.”
Many other researchers are believed to have had similar issues. Zach Lanier, senior security researcher at Duo Security, said many of his team had “run into possible CFAA issues before in the course of research over the last decade”.

'We warned of a vulnerability - but they claimed we were hacking their systems'

Lanier said that after finding severe vulnerabilities in an unnamed “embedded device marketed towards children” and reporting them to the manufacturer, he received calls from lawyers threatening him with action.
"We had tried to work with them and sent them all the details," said Lanier. "When it finally got to the point that we were going to talk [publicly] about this... a lawyer called us. As is often the case with CFAA things when they go to court, the lawyers and even sometimes the technical people or business people don't understand what it is you actually did. There were claims that we were 'hacking into their systems'."
The threat of a CFAA prosecution forced Lanier and his team to walk away from the research.
"The looming threat of CFAA as ammunition for anyone to use willy-nilly was enough … and had a chilling effect on our research," Lanier added.
The people running organisations who wield CFAA aggressively when vulnerabilities are reported to them "probably don't really think about anything other than dollar signs", he said.
Current attempts at CFAA reform appear to be foundering. Researchers had hoped the case of Andrew “weev” Auernheimer would be useful in fighting for reform. Auernheimer was convicted under CFAA for his part in releasing information on an AT&T website flaw that was hacked to reveal data belonging to iPad consumers. But when Auernheimer succeeded in having his conviction overturned, it was because the judge agreed the case should not have been heard in New Jersey, rather than because of any underlying problem with the nature of the CFAA.
Many are still hopeful Aaron’s Law, named after the late internet activist Aaron Swartz who killed himself in 2013, will pass. Swartz’s family blamed the attempts to prosecute Swartz under CFAA, after he downloaded documents from online resource Jstor from a server at the Massachusetts Institute of Technology without proper authorisation, were partly to blame for his death. He was potentially facing 50 years in prison for what many considered a minor act.

Lawmakers want more severe penalties for hacking

The US Congresswoman Zoe Lofgren had not offered any comment at the time of publication on claims that Aaron’s Law would not be passing through the House or the Senate.
The digital rights lawyer Marcia Hoffman says Congress remains divided on the issue. After high-profile breaches, such as the hack of US retailing giant Target and alleged Chinese state-sponsored espionage of various American organisations, many want to see CFAA punishments made more severe.
“On one side of things there are members of Congress who say hacking is a big problem and what we ought to be doing is making penalties tougher. Then on the other side there are people saying the CFAA is not written in a way that is very clear, it's not entirely apparent what behaviour is legal under it and the last thing we should be doing is making penalties tougher.”
According to Hoffman, the wording of the CFAA makes it difficult to understand what is illegal. In particular, an internet user who “intentionally accesses a computer without authorisation or exceeds authorised access” is breaking the law, even though it doesn't actually explain what authorisation actually is, Hoffman added. “Judges have been forced to figure out how one expresses authorisation.”
There are also worries that if CFAA were to be weakened in favour of the security industry, criminal hackers would simply claim in their defence they were carrying out research. Moore said there should be better ways to “define or prove what bona fide research is”.
“For example, is it the way you disclose the findings? Is it the type of information you access? This isn’t easy to solve, but it’s important and worth doing if we want to protect ourselves.”