Guns, bullets, and malware samples—all now controlled under the Wassenaar Arrangement.Aurich Lawson
reader comments 0
Share this story
If you work involves exploiting vulnerabilities in software, congratulations—you’re potentially an arms merchant in the eyes of many governments. Your knowledge about how to hack could be classified as a munition.
A United States delegation yesterday failed to convince all of the members of the Wassenaar Arrangement—a 41-country compact that sets guidelines for restricting exports of conventional weapons and “dual use goods”—to modify rules that would place export restrictions on technologies and data related to computer system exploits.
And while the US government has so far declined to implement rules based on the existing convention, other countries may soon require export licenses from anyone who shares exploit data across borders—even in the form of security training.
The changes governing “intrusion software” were adopted by the Wassenaar plenary in 2013, and they were set to be implemented by member countries last year.
Those changes were intended to prevent repressive regimes from gaining access to commercial malware—such as the code sold by the Italy-based Hacking Team to Sudan, and the surveillance tools from Blue Coat that were resold to Syria’s Assad regime and used to catch dissident bloggers.
But when the language of the new controls were passed to the Commerce Department by the State Department for implementation, the new language quickly caused consternation.
Security researchers and industry revolted at the proposed rules, calling them too broad in their definition of “intrusion software.”
Harley Geiger, the director of public policy at the security testing software firm Rapid7, explained:
The US proposed an implementation rule [for the controls].
But it did so knowing there were problems.
So during the course of this year, they did not put forth an implementing rule because they said they did not want to put forth a rule until the problems were resolved.
It soon became apparent there was no way to reconcile the concerns raised by security experts with the language of the control agreed upon by the Wassenaar members.
So the US moved to renegotiate the restrictions in March as the new round of negotiations began.
That renegotiation collapsed yesterday.
Katie Moussouris, a member of the US Wassenaar delegation, CEO of Luta Security, and former chief policy officer at the bug bounty company HackerOne, said the problem lied in the language of the controls themselves.
She told Ars Technica:
It’s the words.
Finding precise enough language that translates well into 41 countries’ domestic export laws is the challenge here.
It shouldn’t surprise anyone that it will take longer than a few months of renegotiation to get consensus on the revised words.
Moussouris noted that some of the changes the US wanted were approved, including “more precise ‘command and control’ terminology that is now in the Arrangement.” The previous language could have been construed to include “more routine software,” she said—including security software that is purely defensive.
The new language tightens the definition to specifically cover software that controls remote malware.
Geiger agreed that there had been some beneficial changes to the Wassenaar Arrangement’s language. “But those [changes] were minor,” Geiger noted.
The key control language remains in place, and other countries have already begun implementing export controls based on it.
There has already been a chilling effect on security researchers that we’ve observed over the past few years, since many are not sure how they are affected. Non-disclosure and decreasing participation among researchers based in Wassenaar countries in international exploitation competitions like Pwn2own has already been observed.
As of yet, since the rules have not been implemented in the US, they’ve had no direct impact on US security firms.
But the rules have been a hindrance for companies with a presence in multiple countries, Geiger said. “US organizations would not have to get export licenses,” he explained, “but if they’re working with people in another country to receive, that person would be bound by a different set of rules.
If you’re working with a partner in another country, it slows down the exchange of information.” Geiger said that it could potentially affect companies trying to move data about exploits they were trying to defend against from operations in one country to another—potentially slowing their ability to respond to new threats.
“The ongoing uncertainty among security practitioners and researchers will delay the passing between defenders many important exploitation techniques and malicious command and control software samples,” Moussouris agreed. “The presence of these controls in their current form only serves to increase disadvantages of defenders by introducing uncertainty and potential delays in passing vital samples and analysis.”
Now it will be left to the incoming Trump administration to decide how, or if, to implement rules based on the existing agreement, or to return to the negotiating table to hammer out universally acceptable language that fixes the problems with the controls.
And in the meantime, security researchers and companies will have to lobby the governments that are going ahead with rules based on the control to give them more freedom to move information—or deal with the headaches of applying for export licenses.
This could apply to things like training courses for penetration testing and other skills that deal with exploits—companies are likely to run into restrictions about who they can allow to attend those classes, since passing the information to someone from out of the country could be considered the same as exporting a munition without a license.
Moussouris is relatively confident that the US will return to the table to reform the restrictions. “It is impossible to predict the next administration’s choices here,” she said. “But if our new leadership listens to any of the tech giants who were sitting around the table at the recent tech summit, they would all unanimously support the ongoing renegotiation of the Wassenaar Arrangement, as did the bipartisan Congressional Cybersecurity Caucus co-chaired by Congressman Langevin.
This isn’t just about clearing the operational path for security research or security tech companies; this is about all technological defense, and the need for Internet defenders to work together in real time across borders.”