A case of...no cases

I wanted to write a column talking about the intersection of privacy, security and the law for a while now.  The only problem I keep running into is what the heck angle to take that can summarize how important law is to the privacy and security professions.  Privacy is a little more obvious in that privacy laws are touted with roots (albeit vague ones) to the Constitution (OK, quiz time: where in the U.S Constitution is the strongest link to our personal privacy?); however, security is a tad more obtuse.  Therein lies my difficulty: where do I start? 

I think I will start with an important talk that I listened to at Defcon 23.  The speaker was Cory Doctorow, a well-known fighter of the security profession via the EFF.  His talk was titled ‘Fighting Back in the War on General Purpose Computing’ and it primarily discussed the impact of the DMCA on security research.  If you are scratching your head trying to figure out how these two are related, I highly suggest that you read up on the EFF website.  The gist of it was that by trying to our jobs, we could be breaking the law.  But that’s actually not what I found interesting.

What stills smacks me in the head was the fact that while there is a lot of threats in regards to our profession being held as criminals by exposing important issues, but that there is very little case law supporting actions against our profession that establish precedence.  Wait, wait.  I am not saying that I want actions against our profession!  No, but I do want people that use vulnerabilities for their own personal gain (aka criminals) to be punished for such actions.

If you look at what cases have actually come to completion with jail time and penalties, there are not a whole lot that have bite.  I just read an article where a school tutor received a year in jail for installing keyloggers, stealing credentials and changing student’s grades.  One.  Year.  Need I say more?  (OK, I will: one year is not much of a deterrent.  Although who knows what the lasting implications will be).

And this is why the law is so important.  If we can’t build the case law needed to help put that bite into breaking security ‘laws’, then that means the security laws have to get better.  We all know how hard that has been and continues to be.  Until we look at things like better partnering with foreign countries on extradition laws, allowing research to not be illegal, harsh penalties (monetary and jail time)  for illegal acts and strict enforcement, then we will continue to struggle to protect our organizations.

OK, so great.  This is a big problem.  How do you help?  Well, get involved.  Get active.  Talk to your local politicians.  Comment on public papers and requests for ideas on this issue.  Talk to the EFF.  Find a way.  It’s too important not to, folks.   Don’t sit on your hands and complain about it; do something because you can!