Page 8 - Short Cases 1 PWC
P. 8
situation derives from the emerging problem associated
with the rise of poorly secured internet applications,
products and software which is reflected in the rapidly
increasing number of attacks on various vectors and
product vulnerabilities.
With security researchers now clearly warning that the
failure to secure these products will inevitably result in
human fatalities at scale, there is however, an ongoing
attempt to criminalize security research.
The World Wide Web Consortium has spent the past three
years creating a standard called Encrypted Media Extensions
(EME) that will integrate Digital Rights Management (DRM)
into browsers. Laws around the world ban breaking DRM
and this has given companies standing to threaten security
researchers who come forward with reports of defects.
“The governor of Georgia, Nathan Deal, has vetoed
(May 2018) SB 315, the controversial bill that would
have criminalized many forms of routine security
research, and legalized vigilante action by victims of
cybercrime (so-called "hack back").”
"A legitimate reading of this law could criminalize
independent security research and vulnerability
disclosure, and that's not good for anybody," (10)
