Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/508 Thanks!
Even before the Congress, I did
not know what the Wassenaar
arrangements are, and
I don't know, it's an international
treaty that has some
security implications for us
and all about that will now tell
you, Walter
Nate Cardozo,
Meredith Patterson and
Richard Tienen have a
warm welcome.
Just to introduce us briefly, a night
with my far right is
with the Electronic Frontier Foundation
that probably doesn't need any further
introduction.
Meredith is mostly responsible
for the language security,
what I call the cult.
But as apparently nice to call it,
Richard is the
chief technologist with Privacy
International, which probably does not
need much further introduction as well.
I'm just a loudmouth recipient of the
panel and have been
helping out a bit.
Lukumi me in Brussels focuses on behalf
of secrecy involved in this policy area,
trying to make
things less wrong on this topic.
And basically
what we will briefly do is
discuss, well, what
the hell is best not to begin with?
How much of a problem is it for I.T.
security community and
how we came here
and go through this?
And basically,
we were actually not supposed to have a
panel to begin with on the program.
And for that reason, we will open up the
floor to questions from the audience
in about 10 minutes or so.
So start thinking about
some questions to the panelists, because
it will be kind of a partially
a conversational stage, but also a
conversation with this.
Well, not necessarily intimate room, but
hopefully it will be a good conversation
anyway.
That's not what is it?
It's a very posh suburb of The
Hague, the Netherlands, king of the
Netherlands live there with Gutteridge,
places like I see on screen.
It's also a framework
between most of the industrialized
nations on export
controls and weapons technology.
Mostly conventional weapons and
secretaries' range from basically
all the NATO members plus Russia.
Yeah, most of the former Warsaw Pact
countries are also signatories to
Wassenaar and
it is actually technically not a treaty,
but has a lower standing status
in international law.
And what it
does is it sets policies
on conventional weapons as
well as dual use goods.
And so December 2013,
that didn't touch much
upon it.
Security issues, apart from cleptocracy
remnant of the past couple of hours,
which are reheating again.
But in December 2013,
Tulu elements were introduced
as dual use technologies,
and the first one is surveillance
technology, and the second
one is called intrusion software.
And to give you an idea
of the definitions of these two,
this is the definition of surveillance
systems is.
Basically, anything that can intercept,
I think it's a very great IP networks
and can target
specific sectors,
I'm bringing up this definition not
because it's such an enjoyable definition
to read, but
from my perspective as someone who's
interested in the intersection of policy,
law and technology is it's
very fascinating that this.
This idea of having surveillance
technology considered a
weapons like technology that is very free
of regulation, that we because we
don't want to have it fall in the wrong
hands like extreme regime, etc.,
I'm not in that process.
They are very funny exceptions made in
surveillance technology.
Because if it's for a marketing purpose
or for quality of service or quality of
experience, whatever that may be,
then all of a sudden it's not deemed
to form these export regulations.
And.
Conversely, that's the definition of
intrusion software.
And the of the following.
Extraction of data information from
a computer network, capable device
for modification system or using the data
or the modification
of the standard execution path of
a program, a process in order to allow
the execution of externally provided
instructions.
I'm not a techie, but having
JavaScript sent from an HP server to
a browser does not alter the
execution path, the browser.
I think it does.
And this may be a bit of a broad
definition.
And to give you an idea
why we brought this up now is
and is that this
arrangement will be translated into
legislation on
in the signatory countries and I cannot
really speak for the other side that will
briefly be done by night.
When I'm finished talking about the
European side and the European
Union, you have a regulation that
basically copies the list of covered
technologies by the Russian arrangement
and says if you want to export
any of this stuff, you must apply
to for an experiment
in your member state.
And the member states have done
some additional rules on that.
The country, banned from the Netherlands,
appears to have a royal decree saying
thou shall not export any of the stuff on
the list and the regulation basically
meaning what's on the Russian arrangement
and otherwise you will be punishable by
law.
That particular European regulation
is up for review.
And that review will also
include the updates that have been
in the meantime to the Russian
arrangements, the current EU regulation
on this topic is from 2009 and there
have been about yearly annual
updates of the Russian arrangements.
So in
the upcoming two years, there will be
a new European regulation that
may or may not affect your ability as
an I.T. security expert from Europe
to travel to China.
That we don't even know what
the commission actually will be doing on
this on this topic, but we do know
what on the other side of things is
happening.
And for that, I for tonight.
Thanks, Walter.
So on the U.S.
side, the Bureau of
Industry and Security, which is a
division of the Department of Commerce,
is in charge of implementation
of the voluntary arrangement.
In May
of this year, the
Department of Commerce released its
proposed rule, its proposed
implementation.
And it was atrocious.
It was it was a shock to
pretty much everyone involved.
And it
caused an enormous amount
of fear and uncertainty
in the infosec community, both in the
United States and abroad.
Intrusion software is not actually
controlled under the biggest
implementation.
Only technology
and knowledge implementing intrusion
software is controlled
as well as command and control systems
for intrusion software.
The problem is, under
the United States, definitions
of deemed exports in the U.K.,
there's a similar concept of
intangible knowledge transfer.
Simply talking about
something like an exploit
could be considered a deemed export
and therefore controlled.
So this is really, really,
really bad.
So as another
part of the U.S. implementation is,
if any of this software contains
cryptographic or crypto analytic
capability, the
the person applying for the export
license must on demand
turn over source code to the National
Security Agency.
And you can tell who put that
little nugget into the U.S.
implementation.
So essentially, what it means is that
if you're a U.S.
researcher, it well, OK, so these rules
haven't gone into effect, into effect in
the United States. But if they do, what
it will mean is if you're a researcher in
the United States or a United
States person, so someone with
citizenship or a green card,
you have to dump all your photos to the
NSA before you can talk about them to
anyone else, even in private.
That's.
Problematic, to say the least.
Also, what the regulations don't do, they
don't actually stand in the way of
someone like Hacking Team or finfish or
selling their stuff to Ethiopia,
Bahrain or the Saudis,
all you need to do is get a license.
And as we could tell from the hacking
team dump, getting a
global export license under Wassenaar is
relatively easy.
So what what do the regulations
do? They make bug bounties, conferences
and small teams working on defensive
or offensive research next
to impossible.
They make distributing things like
medicine or pen testing tools
nearly impossible.
And they create legal uncertainty for
folks doing research on essentially
anything interesting.
If you could get a security paper
accepted here at C.C.C.,
it would not be exportable under
Wassenaar. That's, of course, a gross,
oversimplified oversimplification.
I began my journey into Bosna
when the Beis released its
proposed rule.
If was not closely
following Bosna in 2013,
when the intrusion, software and
network surveillance definitions were
entered.
I can speak only for myself, but
I regret that fact.
OK, OK,
I'm going to have Meredith
explain a little bit from her perspective
as an American living in Europe, how this
may affect her life, but also will
announce that from now on, people
will want to ask questions to this panel
panelists to just walk through a
microphone and
go from now on.
The floor is open, basically.
But Meredith.
Yeah. So I'm originally from Texas, but
I've been living in Belgium since 2009.
So this actually makes
me subject to both the U.S.
and EU implementations of
all of the Wassenaar arrangement,
the ones that and like Nate
was just saying, the ones that are most
relevant to me are the deemed expert
and intangible transfer
regulations, which I have
to point out. I mean, those are those are
things that like the U.S.
and the U.K.
came up with.
And I guess it was the UK that presented
it to the EU because intangible
transfer was totally, you know, the topic
of the day at one
of the the meetings in Brussels
on on the Wassenaar implementation
that I went to.
But the intangible transfer mean in
practical terms.
Well, I mean, in practical terms, it
means that if you have an idea in your
head that qualifies as an export,
you can't cross a border.
And I don't know how they plan to enforce
that.
Oh, it's way worse than that.
What it means. So I'll give a
discussion.
You know, I'll talk about it in practical
terms. Open Whisper Systems is based
in San Francisco.
It produces signal tech, secure,
all those lovely things that I have
on my device so that I can talk to people
here.
And if there are people with multiple
citizenships, even sitting around a
conference table in San Francisco
speaking about it to someone without
a U.S. citizenship is
a deemed export.
So you don't even have to cross a border.
All you have to do is open your mouth to
get into trouble with Osmar.
Yeah. And so I'm in a situation where,
you know, because of the citizenship I
have and the place I live, there
are two different sets of regulations
that can basically constrain me from
traveling or from even talking to
anybody, because I
understand the general principle
of how to construct exploits
from differences in how
input handlers parse things.
That's obviously not the intended result
of this. But, you know, it's only one
of a lot of side effects
that the that the
people who wrote this language were
clearly not thinking of when they wrote
it.
And that brings us we have now invented
a new class of thoughtcrime off.
And on that happy note,
I would like to ask Richard
how we got here.
And I just follow on with the interesting
button button presses, the
intangible technology transfer
and giving lectures
and on various things like that are are
problematic. Even if you don't
necessarily know who's in the room.
If they are a foreign citizen,
they can take it elsewhere.
And there's also another problem, that if
you were to go to a company and
potentially disclose some of this
information in your own jurisdiction.
But that company had many offices around
the world, which most companies
that that we use products in our everyday
lives are based
around the world.
They may actually send on that
information internally,
which may also include crossing a border
to various other different teams so that
the other to the other teams could
potentially fix
the problem.
In terms of the starting point
for this, I
guess it probably started back in
2010, 2011, where
the goal was to
limit the spread
of tools like
finfish or tools with the capabilities of
finfish or to
regimes like Ethiopia and
Morocco and various other different
places where we see that technology
been used very,
very in a very, very nasty
manner for journalists and human
rights defenders.
And very often these countries,
what we've seen is they wouldn't even
have the technical capabilities to
develop this stuff by themselves.
And ironically, one of the hacking team
dumps the the guys
were very, very concerned about
a particular country's technical skills
and their ability to use their tools,
not that they wouldn't get what they
wanted, but simply that just by screwing
up the use of these tools would actually
reveal their use and potentially
provide a sample or some material
that techies could then use
to to counteract them.
So that was the, I guess, the starting
point. And as I understand
this, back at that time,
Vasana was considered a very
attractive target.
You essentially lobby one
organization. And who can pitch
text into the agreement and if it's
all agreed by default, you get up to
41 different states, who
who would who would follow suit
would, of course, as we've seen the
implementation, the text, the various
things like that have
not been ideal.
In fact, far from ideal.
And many of the the
not only the technical definitions are
not necessarily correct, but the
the lack of inclusion
of factors such as the
intention of the individuals when they're
exporting this stuff.
There's no distinction between an export
for, for example, generating
new support rules to detect
malware that's on people's
machines or antivirus
signatures or potentially and
the disclosure of malware
that represents an entire class of
new type of attack,
which would allow much more general
safeguards to be put in place like DP
Acel or those kind of things.
So the starting point,
I think, was was
well intentioned and the
implementation, as we saw, has
left a lot to be desired.
And I think it's the question now is
whether Vasana itself can
capture the nuances of
the problem to achieve
the goal, but also to
not screw things up royally
for the entire Internet
security and the very
infrastructure that we rely on on a daily
basis.
But I do think we also have to look
beyond the text of Wassenaar itself,
because deemed export and intangible
transfer were bolt ons from,
you know.
You know, from from the U.S.
and the U.K., so we have to look
at the implementation and shepherd that
through as well as the text.
So I would say that the
I totally agree with Riggi in
that the intention was good.
But in my mind
at least, the trying trying to make
a legalistic definition to separate
good software, defensive stuff
to bad software offensive stuff
is a fool's errand.
The definitional problems overwhelm
any possible benefit here.
The chilling effect of a bad definition,
which is exactly what we have, is worse
than any of the possible benefits,
especially because, you know, is the one
of the founders of FZ in 1995
or 1996.
The Net interprets censorship as damage
and routes around it. Right?
Software isn't magic.
Finfish and hacking team are barely
more functional than Vincey.
I'm exaggerating, but you get the point.
It's the service and support that
actually matter, right?
You can you can give Ethiopia
finfish and the IT Folke
there won't know what to do with it
without the service and support.
And it's the service and support
contracts that actually matter.
So take that for what software
isn't weaponry, right?
Software isn't guns.
You can't control it in the same way that
you can control the export of physical
devices.
So my in
my opinion, trying to fix the definitions
in Bosna is,
you know, I admire people who think they
can do it, but I don't
delude myself to think that I can do it.
So I think we need to ditch intrusion
software from Vossler altogether.
OK, we have a first question from a room.
So one important note
for the Wassenaar is and you haven't
mentioned it yet, Open
is exempt from Wassenaar.
Well, so opensource
is sometimes kind of exempt
if you're for the purpose of this
discussion that there really is not a
bright line.
I tried very hard to get
a public domain, OK, public domain
is exempt that aren't the same as open
source.
So there's a slight problem to
interject here, right by
introverts interpret international
treaties for
the Treaty of Vienna.
You're supposed to use the common
interpretation of words and like other
legal documents which have create their
own reality.
So public domain is no longer
necessarily a copyright thing.
There's two problems.
The Russian arrangement is not a formal
treatment, so I don't actually know how
to interpret it.
The second problem is I've been looking
for exemptions like that as well.
I'm nowhere near as much of an expert as
the other people are.
But at this table, there are much
clear exemptions for, let's say,
open source or source
availability for the crypto bits,
but less so for this.
And I would just add to that that
while. Yes, in the in the tax
on on open software, the general
technology notes and general software
notes and open
source software, as I understand it,
doesn't isn't always open source,
at least in the initial embryonic
stages.
And while, yes, it may become open
source later on and we may become
in the public domain later on while
it's sitting on a laptop of a developer
who has yet to commit their changes
into a repository
that is open source.
To the best of my understanding, that is
still not public domain information,
that that is still information that
resides on the laptop of the individual
or individuals who are
creating the next version of the
particular open source software.
And this this
regime may limit the ability of those
individuals to communicate.
And in the formation
of the next,
the better improvements to the open
source software.
And so even things like we've
had very conflicting statements from
government saying things along the lines
of, well, if you if you're
working on something and
you intend to present it at a conference
at some time in the future, well, then
maybe it's open source.
But how are we supposed
to prove that? How are we supposed to
demonstrate that when we're working on
bits of code and bits of technology,
not all of them are going to work.
Some of them are ever going to see the
light of day. And it's a thought process
before things become opensource or before
things become in the public domain that
can actually limit the the ability for
people to to conduct their work.
And to make matters worse, the general
software note, which is what Ritchie was
discussing, is not included
in all of the national implementations,
including the biggest implementation.
The biggest implementation specifically
exempts the general software node
exemption.
Right.
There's not a question on the left.
So I want to share
an experience I had there in dealing with
the senator for voice encryption and
how it may be related with that
for export or for strong
encryption products that are
precise specification, whether
it fit in the category of a mass
encryption tools or whether it's
subject to export control.
And it'll dictate a very
precise rule, like
if the end user is
able to change the encryption algorithm,
if the end user can acquire
directly without and
can install without any substantial
support from the manufacturer.
And those are specific kind
of details related
to the way of deploying
and the purpose of
the technology for voice encryption,
for strong encryption subject
to export. So I'm wondering
if it will not be useful
to think and propose
from a policy standpoint of your set
of rules that create the boundaries
of what should be subject to
regulation and what will not be subject
exactly like strong encryption
is already in the provision of us
in our arrangement.
What I would I would say that is very,
very difficult to look at
a specific piece of software, just the
ones and zeros, and make a
determination on that basis.
And so without the ability
for an agreement such
as this or a regime to achieve
the stated objectives that I said at the
start, it can capture things like
what you just said about what the the
intent of the individual who's going
to receive it or what they
could do with it.
And that was expressly that
wasn't included in the intrusion software
definition or any of the exemptions
in Investa as it was
under transposing legislation into the.
It's also not always obvious
on its face what a piece of software
actually does if you've ever looked
at the underhanded see contest, there are
a lot of examples of software that
appears to do one thing but actually does
something else.
I mean, I haven't I don't think we've
seen this as an export controls dodge
yet, but it's certainly possible on
it.
And just to to pile on on
the crypto front, you know,
it has long been Jeff's position that
crypto should not be export regulated
at all in the United States.
We have there's
very little regulation on
publicly available crypto.
So open source crypto.
All you have to do is notify the NSA that
you're putting it online. You don't
actually have to ask for permission.
Most people don't even do that and
hopefully enforce as far as I'm
concerned.
And following on from Meredith's point,
there's a there's a very interesting
competition that's held every year.
And I think based on a Linux
vulnerability that was that was found
a few years ago where where semicolon was
inserted.
And that to any cursory
reading of the of the code
might indicate that things were hunky
dory. But in reality, what it allowed
was basically anybody
to gain root on the box.
And it was all in there in in
the open source. And there's a
competition each year to find new and
innovative ways to
hide in plain sight, essentially,
and issues with software
that just a cursory analysis may not
actually reveal.
There are several people want to ask
questions over that.
OK, so first off, thank
you so much for this panel.
It's been very informative.
I have two questions that are really
tightly related.
The first one is coming from
basic knowledge of policy standpoint.
It seems that if you have an agreement
that was presented at the end, there was
probably a chain of events like Mehrens
and so on that led to the formation
of that agreement. And I'm curious, is it
possible to go through the meeting notes
and infer who introduced these terms and
what the context of the discussions
were? The second question that I have,
how have these kinds
of agreements actually been enforced
in the past?
Because if this was introduced in 2009, I
assume that there were things before them
because cryptography is not a new thing.
I think the first question is best
authority.
The second one and I'd like to further
note, I also want to note
that we've been asking the questions.
We are very thankful for your gratitude.
But let's stick to the questions.
So I guess the first time
and look, obviously, I may not
be aware of the entire picture,
but the first time
Privacy International became aware of the
text was almost
before days before it was
actually completed.
So to the best of our knowledge, there
wasn't a consultation process.
And it's almost a
problem with the actual,
I guess, the drafting process that that
people were involved not only too late,
but that the potential
consequences were huge and they
should have been involved at a very, very
early stage. So we didn't have to get to
this point that we're in now where
the implications are are very real.
I think most will be aware of HP pulling
out of the book bounty contest
during the year and simply
because of the maybe it was Microsoft can
remember which company was and
because there was a question
marks over whether they could actually
have and people
showing up and presenting bugs and zeros
and things like that.
And what legal regime had did they need
to get an export control license
for every country and things like that?
So there is tangible
evidence that this stuff is is stopping
things. But as far as I'm aware, there
was no consultation outside
of governments who were drafting
this.
And so I stuck to your second question,
how are these sorts of agreements
enforced?
The answer I can only answer.
I'm a U.S. lawyer. I can only answer in
states terms.
They're enforced by the Department of
Commerce and they're enforced sort
of very rarely and very selectively.
So that would be a big problem in the EU
because selective enforcement is like
you're not allowed to do that in Belgium
and Belgium being Belgian,
but that that selective enforcement gives
rise to a chilling effect.
The mere possibility that it could be
enforced is often sufficient to
trigger the negative consequences
that everybody, I think, here in the
audience have, which is that you want
people to engage actively and in
improving things and improving the
software that we use.
And that necessitates in the modern age
the ability for people to collaborate
across borders.
And so I'm not necessarily sure whether
the fact that it could be
enforced, people could go to jail, which
obviously is a disgrace.
But and the
the the chilling effect of people
actually engaging in this research in the
first place, you don't want to be on the
receiving end of enforcement.
I mean, specifically the questions from
the Internet.
Yes, thank you. I have a bunch of
question regarding open source
again and
determine what is the expected
impact on projects like Metabolite.
That's partly open source and
Linux.
So meta split
the the lawyers over at Hacker one,
not a hacker, one at Rapide seven
have determined that
the open source displayed projects
and modules.
There will be no impact on them.
The Mets played pro, however,
is subject to the license.
So metastable open
source just fine.
Keep exporting, keep using, keep posting.
MÃ©tis pro
is going to become a lot more expensive.
And just another question from your
backlog of instance questions.
Yes, this one question, what
is the detail problem,
is it that exploits would be
more open or is there also
a financial aspect in this?
Individuals would be criminally
liable for
for having exploits, basically.
Having an crossing the borders.
We're talking about exploits to foreign
nationals.
So I'm a
I'm an academic from the United
Kingdom, and I was
wondering if you could comment on the
possibilities of this affecting research,
particularly I'm thinking of my own
research would be classified under
the the very broad definition of
surveillance.
And a follow up question is,
what about teaching?
How am I expected to teach an
international group of students in my
university
without an export license?
I'm afraid you need an export license if
you've got international students in
there, because when you impart it would
be deemed an intangible technology
transfer in the sense that the transfer
actually occurs in the heads of your
students when you've delivered that
lecture and they go on to their their
countries. And that would be an
intangible technology transfer.
And it's really not clear like
there are not drawing clear lines
about what kind of research.
I mean, because politicians have
been have been telling us to our faces,
oh, researchers don't have anything to
worry about, but they don't tell us why.
And so when I sit and so when I ask, OK,
well, why, for what reason
do I not need to worry about
about intangible knowledge transfer?
You know, I just sort of get patted on
the head and they move on to the next
question.
Nobody really seems willing to clarify
how this is going to affect, you know,
how this is actually going to be brought
down on research.
With the exception of Australia,
Australia apparently seems perfectly
happy to just like shut off all crypto
teaching in the entire country.
But, you know, that's Australia.
And we've already seen and I'm now
forgetting the gentleman's name, but
we've already seen one doctoral
dissertation heavily redacted
by the by his committee in the UK
because of Bosna.
And that's fucked up.
And incidents like that are going to
produce continued chilling effects.
Fewer people will get into research
because who wants to end up in a
situation like that?
Poor guy in the USA who
did a geography PhD on
maps of critical infrastructure,
Department of Homeland Security
suppressed his thesis.
If you don't get to graduate, that kind
of wastes the all that time you spent on
a PhD.
And so, like that's fewer people
will be coming into the field and people
who are already in the field are going
to, you know, are going to have a lot of
fear and worry about, you know, am I
about to get busted for trying to
publish a paper?
And I'm also not sure what security
research actually is.
And when security research stops
and ends, RPN Testa's
security researchers are people
who go out and just tinker with software
and say reverse engineer bits
of bits of bits of code
simply because that's what they like
doing where they're not affiliated to,
say, an official university, are they
covered? And so many of the
many of the supposed protections
or exemptions for things
like academic material,
I just it just doesn't make any sense
to me about what and what the what the
definition of a security researcher is
and whether it includes pen testers in
their collaboration across borders to
to to ensure that all their tools
are as UP-TO-DATE as possible.
And I'm in exactly that boat.
I'm not affiliated with a university and
I do not do security for my day job.
I'm a bog standard programmer at Nuance.
All of the security stuff I do, I do in
my copious free time.
So I wouldn't even be protected
by protections
that only apply to academics.
Well, luckily in the U.S., you don't have
to worry about that because there is no
security exemption.
But this is in Brussels.
You have maybe a very short follow up
question here.
Is there any chance to get out of here
claiming that it's freedom of speech?
So these kind
of all the academic area.
So I can give you an answer from
the European perspective, they
may probably come from the U.S.
perspective as
a kind of groundwork for Darkspore.
European countries don't even have a
constitution like the United Kingdom
and other kinds of Beckwith's
monomaniacal monarchies like
the Netherlands and and all that.
The European Convention on Human Rights
is kind of actually the EU constitution.
That Article Ten says that
freedom of expression shouldn't be a I'm
paraphrasing. I'm not Krasniqi, but
it will be.
They showed me prior restraint, unless
by law and
proportionate to the public interest for
which the law is brought into being, so
there's no evidence
of that by you could or
could not have that.
We already do have the cybercrime
convention, which has equally
chilling but not equally, but also
chilling effects and security measures
that has never been challenged in that
court, as far as I'm aware.
So
but it's a very good question, basically.
Can we fix this on
alternate covers, the
the First Amendment issues?
I'd like to move on to that, but.
Ah, thank you. I'll just follow on with
what what was that freedom of expression,
at least as you said in the UK, in the EU
is what's called a qualified right, like
privacy is. And the qualification is
based on law. But many
times freedom of expression can
or can be compelled to yield to
privacy rights of individuals.
So, for example, would my doctor be able
to engage their freedom of expression,
rights to breach confidentiality
and publish information?
And should I be able to prevent that from
happening?
So not only is there a
balancing act between freedom of
expression and the general
legal regime in a country,
freedom of expression and privacy very
often can collide
in the real world.
From a U.S. legal perspective, if these
if the proposed implementation went into
effect, I
would love to take the case that would
bring it down.
One of the first major cases was
Bernstine, which you probably
know better as DGB
versus United States Department of
Justice. And we got
code declared as speech, which was
good, and we got
cryptography pulled out of the
United States munitions list and into
a much lower level of export control.
So I think that in
at least under U.S.
law, at least for open source software,
even if it wasn't publicly available,
even if it wasn't public domain, I think
you would have a very, very good argument
that the regulations would fail under the
First Amendment.
And then there's another thing under the
under the United States Constitution,
which is if a criminal law
and all of these export controls are
criminal, is
not readily understandable by
a person of average education
and intelligence, then it
fails.
It's the doctrine is called void for
vagueness.
So I
would say that this would fail, as
would I'm not sure also about this
far from registering the church of the
weird machines as an actual church in the
United States, and then we get freedom of
religion into the mix.
Amen, brother.
Oh, please do.
So I must emphasize
that I am not aware of any European
jurisdiction that has such a lovely
concept as void for
vagueness. Yes, definitely.
No, I don't think any of the European
countries have such an exception.
Basically, if you don't understand the
law Selya problem, I blame
France.
Well, yeah, let's not blame the French
for everything.
I assume there's some jurisdictions which
have the phrase that ignorance of the law
is no excuse.
Yeah. And I think that unfortunately
might be operative in in many of
those situations.
But since you're speaking, how
fixable is this and
also if we look at some of the the
objectives that were were set out
at the start in terms of the very
well-intentioned, very well
kind of, you know, there was a there was
a very bad problem there to be fixed.
There are a number of potential
shortcomings in Boston itself, which I
think we need to look at addressing
and potentially saying, well,
if a tool or if a if a mechanism
that we're looking at isn't able
to capture the kind of
nuances of this problem that,
you know, we may need to look at at a
different mechanism. So some of the ones
that are are kind of open
questions is that that Vasana
obviously looks at everything and the
basis of the ones and zeros and not on
the intention, as we said before,
and.
In court on GB's behalf, and
it was it was such a catch 22
for the Department of Commerce that
they eventually backed down completely
and thought that that
was going to
say, sorry, go to court
or something you do after the legislation
is passed that is clearly
unconstitutional or otherwise
contravening your fundamental rights.
We're both in the U.S.
and Europe in the position that the
pretty vague criteria of us now have
to be transposed in more
concrete legislation.
And that process is still not
finished. And especially on the European
side, the only
tangible thing we have is a normal
legislative report by Mary Cachaca,
an MEP.
And while the normal legislative
report has not been ideal
as he managed to get in amendments to
specifically acknowledge that this has
potential for a chilling effect on
research, although we inserted
a bona fide research that I regret
in hindsight, of course,
is probably not helpful either.
But at least
there is potential to
have a European implementation of
this bit in Wassenaar, which may
be revised within Bosna in the near
future, but also in European
implementation to make
this less bad.
But I'm not sure whether that's
how that will survive that process.
And that's the I mean, the most
frustrating thing about all of this to me
is that we keep finding ourselves
at daggers with people who are supposed
to be our allies, like we're supposed to
be on the same side as the
anti surveillance people.
But what's happened is well-meaning
anti surveillance people who don't
understand the technical landscape
propose what sounds like a good
idea to them without ever
without ever actually asking technical
people. Then the NSA and GHQ
get involved and they push
their agenda and the technical language
ends up constraining the people
who the surveillance, the anti
surveillance people are supposed to be
allies with.
I mean, and then we
have to then it ends up being
our problem to massage people's
egos and get them to
go and find them a way to save face when
they're backing down.
And I'm sure I'm not very good at that
personally. Kadeem Assuras did a
fantastic job of it
a couple of months ago.
But, you know, we're kind of an abrasive
tribe like, you know, being nice to
people is not really our job.
Well, maybe it is.
But
still, I mean, it's extremely frustrating
to be put into this situation that we
didn't ask to be put into in the first
place. And so I'd also like to you know,
if we can get into, like, how can we
avoid this happening next time, that
would be real nice, too.
But we also didn't learn the mistakes
from the crypto wars.
So it's almost like this is the
problems with that
happened back in the 90s seem to be
repeating themselves.
And the lessons that were learned then
seem to cyclically go out the window.
And unfortunately, I just
wonder what in ten years time
they'll do next.
On Happy Now?
Oh, sorry to interrupt at that point,
please. First, the question from the
Internet.
Thank you.
The Internet wants to know our defensive
technologies potentially going to be
restricted by this arrangement.
One defensive technology that is not
simultaneously an attack technology
or in other words, and this is a quote,
will we end up with shitty everyday
security because things are not exported?
Yes. Yes.
That will happen if this gets implemented
the way it's been written.
So part of the problem is that the Bosna
arrangement definition's risk throwing
away the solution that it's trying to
solve, you know, harden
the endpoint, harden the server, harden
the pipes. The tools to do
all those things potentially get screwed
by Bosna.
Right. We want to get secure devices and
services into the hands of the folks who
need them.
And banning Penn
testing tools is not the way to
do that.
Number one, please.
So one one, the insidious things
about ITAR
regulations, which the arms trafficking
regulations in the U.S., is that you are
also liable for whatever end users
of whatever you export is like.
Use it for is there are similar
things in the implementation of the
like VESTINE argument is just on the US
munificence list, or is it some
different? It is not.
It's not on the U.S.
musicians list. It's on the air rather
than etat, which is the Export
Administration regulation list.
So you're not liable for end use
and user. You're only liable for the
export.
And I was in the U.S., I think one of the
problems that we're seeing is that
traditionally the kind
of technologies that
that the regulators have been used to
dealing with have been
either solely military goods or
so-called dual-use goods.
And I think one of the things that are
potentially this this falls into is
that there's actually another use
which is highly beneficial to
the overall security of our
systems, as the question from the
Internet pointed out, that that is one of
the consequences.
And so it's
not necessarily clear that
these things should be on something like
a Julias list. But maybe we need
a recognition that the positives
of these things drastically
outweigh the negatives and that by not
having secure or not having the offensive
tools to create the defensive
protective measures that we potentially
leave ourselves open to much cheaper,
much at
ghostwrite, whatever, whatever you want
to buy on on Alphabeat
or whatever the new
marketplaces.
Another question from the Internet,
please, thank you is
this was an arrangement draft
openly available?
Yeah, we are to get it.
It's no Glazner arrangement,
just Wassenaar dot org.
Yeah.
And it's not a draft.
It's just published document
on that site.
Yeah. It's final.
It's not a draft.
Number four, please, sir,
I think the high level point I'm hearing
here is that
we have learned in the 1990s
there was no arrangement with its
weird, reserved word definition
of public domain.
It's in scare quotes and
it's weird framework
has been an awful fit for crypto.
Back then, we sort of got ourselves out
of it. That's great.
It's coming back.
It's an awful fit for
the sort of possibly intrusive
software we're talking about here.
But actually it's possibly a little bit
closer in its original
intent to the software than it was
to crypto. After all, its original
intent is to keep that heavy truck
out of its use as a troop
transport. It is to keep this
dual use tool out
of another army's hand.
And what we're talking about here is
keeping this overtly
dual use, low tech technology
out of the hands of an oppressive
government that wishes
to use it against its citizens while
maybe keeping it in the hands of
researchers.
So that framework sounds attractive.
We're learning in this conversation
it probably has a lot of secondary
effects that are unpleasant.
I would like to hear from the panelists
what your view is as to what
a reasonable regulatory
environment around these offensive
technologies looks like.
I heard tonight say for crypto it is just
take it out of export control, make it
freely available.
It is so beneficial.
Are we saying the same thing about
offensive technology?
I, I want to give a mark to Meredith
on that because she has published a paper
on that together with Sagai Brothas.
Well, I mean, honestly, my
my perspective has changed
over the course of this conversation,
you know, because what Serguei and I have
have been writing about
is how to change the language
to something. Seiner is one
thing that's come up over and over again
in discussions on the
current language is that
the
the language about execution paths
is essentially meaningless.
Nobody really agrees on what it means.
And even if they did agree on what
it meant, it wouldn't actually help.
There's a wonderful paper from Unix
security earlier this year
called Control Flow Bending.
And they they take
a look at control, flow, integrity
systems.
This is these are basically like systems
that try to whitelist what
paths through the control flow graph of a
program are considered
legitimate.
And then you only whitelist those and
anything else is considered an exploit.
Turns out you can actually
have all kinds of memory, corruption, fun
and get arbitrary computation
with printouts.
You don't actually have to.
You can you can violate even
theoretically, you can get an exploit
on even theoretically perfect control,
flow, integrity.
So like what they've described doesn't
even make sense and doesn't help.
But I mean, I think
what I think what you said earlier
about the provision of services
is the far more important point like.
The government of random Third
World nation is not going to get a lot
of use out of, you know, here's finfish
Fisher, have fun.
They need that support contract, regulate
that or, you
know, impose a strong liability regime.
I'm lead counsel at YAF in our
case, where we're suing the government of
Ethiopia for using finfish
on a democracy activists in the United
States. We were lucky enough to get a
client who we were able to catch
Ethiopia using finfish or redhanded
within the United States, which gives us
jurisdiction to sue them.
But Pyi is is
pursuing a case against Gammer
in the UK for the same thing.
You know, EAF was involved in cases
against Cisco for helping build the Great
Firewall and against IBM
for building South Africa's apartheid
ID card system.
That kind of liability
on the on the back end for doing
the stuff that we care about that that we
that we don't want companies doing,
I think would be
possibly much more successful
and would have chilling effects on the on
the bad stuff without touching the
security research.
And I think that's the really big ask,
because good luck getting any government
to, you know, be willing to be sued for
anything.
But but I think the
one of the points in relation to the
question is that, you know, to
someone with a hammer, everything is a
nail. And Vasana
is is the tool that was there.
But as as has been highlighted just
there, there are potentially other
alternatives that may
or may not be the be better and maybe
the the exploring whether the
language can be fixed with investment to
take account of the various different
situations or whether there's other
mechanisms in place I think needs to be
explored.
Yeah. And as a lawyer, as someone with a
law degree, everything looks like a
lawsuit. So I'm like, sue the.
Number four.
I just have
noticed something in a new South African
cyber security cyber crime legislation,
I'm not sure if it's influenced by Vasana
or if it's just the current environment.
And yeah,
basically in South Africa.
Now, according to the cyber crime bill,
malware would include any electronic
mechanical instrument or device that
could create a vulnerability, modify
it would appear, or interfere with
the ordinary functioning of a device
computer network.
So that occurred to me that if I did
my phone, for example, there would be
malware on my phone,
a whole lot of things.
And secondly, it also got me thinking,
how does one actually distinguish between
possessing malware?
And then on the other side, the people
who are owned have being infected
could not be a catch 22 that might
be useful in state judicial contexts.
I mean,
an exploit is still an exploit
that's still taken across the border.
If it's in the hands
of a research attacker or
possibly even an infected computer.
We do have a problem already with the
cybercrime convention.
In practice, it's basically not really
happened. So we have no idea
because this the cybercrime convention is
an entirely different framework.
And Wasner, it's again,
most industrialized nations have signed
it has become in most implementations
a crime to possess
a piece of malware.
Even if you are just a victim,
you're technically.
A criminal, I'm not
aware of any public prosecutors stupid
enough to pursue such a case.
I would love to hear the way
South Africa is a signatory to Wassenaar,
though.
I just looked it up.
And I think under U.S.
law, there's always an intent requirement
for virtually every crime except
possession of child porn.
So if you're a victim of malware
and you happen to cross the border, you
don't have the intent to export.
So no crime.
And I think the some of the other tools
that might fall into that would be things
like FISAs idea pro that would
you'd be able to manipulate various
different bits and bobs through the true
decompiled piece of software.
But at the start,
I think mentioned that the
the actual piece of malware itself
and strictly speaking,
or at least that's probably not for
the intent of Asnar, was not
to control anything which could go
on the individual's device precisely for
that reason that an innocent victim
crossing the border and be found
now as as experts have analyzed
the the actual text
and found various different ways in which
potentially at
code or executables
on a victim's device
could potentially be considered
a court under Vasana.
Thank you. Oh, so here's a wacky thing,
under the U.S. implementation,
the code is arguably
not subject to control, but the
comments to the code are definitely
subject to control.
I think we're kind of running out of
questions from the room and
no. All right.
Sorry.
And once
you mentioned that hacking team very
easily got a license.
So why why would
it be very hard for all of us to get a
license?
Well, I think hacking team had a special
relationship with the Italian regulator
that allowed them
to get that license.
And I don't think people who who want to
play with software and figure out the
problems with it should have to register
with their government in order to get a
license. They probably should be able to
conduct the research themselves, because
then you're running into the problem of,
well, supposing somebody in
in Canada gets their hands on finfish
or hacking team and then they have to go
and register for a license
with Canada, who are potentially
customers of finfish and hacking
team to say, hey, I'm doing
reverse engineering or malware analysis
on the very tools that they have bought.
And I wonder if that information
stays within the
the authorization
department or whether that may
potentially get passed to the companies
who are involved in the in the sale
of the material so that they get tipped
off that, hey, somebody's got a
sample of your latest malware version
and you might think of changing
it.
I mean, one thing that could
you know, one thing that could be done to
sort of point out the absurdity
of of particularly
restrictive licensing requirements,
you know, could be the equivalent of a
work to rule. Strike did
ask the the licensing agency
with requests for every single time you
install open SSL.
So that's one possibility.
And on that note, thank you all for your
attention and.
And join.