Study: Law puts damper on Web security research

TechWorld.com - Web security research is being seriously hampered by laws that punish researchers for even attempting to locate flaws in Web software, much less disclosing those flaws, according to a new study.

The report is the first by the Computer Security Institute (CSI), a research and training organization under the aegis of CMP Technology. It draws on discussions by a broad working group, including security researchers and representatives of U.S. law enforcement agencies.

The upshot is that current legal frameworks designed to allow prosecution of Web attackers also make it next to impossible to legally spot security flaws in the Web 2.0 applications quickly becoming ubiquitous on the Internet.

Those researchers who do feel safe probing Web software for flaws are probably not aware of their real legal position, the report said.

Unlike researchers who address offline software and operating systems, Web software researchers face significant legal restrictions designed to trap attackers, according to Jeremiah Grossman, chief technology officer at WhiteHat Security Inc. and a member of the working group.

"Under some laws, a researcher could find himself prosecuted for simply looking for Web site vulnerability, much less disclosing it publicly," he said in a statement.

The report was released Monday at CSI's NetSec '07 conference in Scottsdale, Ariz.

It suggests that changes may be needed if the emerging ecosystem of Web applications is to be kept secure. That could include changes in the law, including to the assignment of liability, how "damage" is quantified and how disclosure and criminal intent figure into the picture, the report said.

Short of changes to the law, the report suggested Web sites could encourage vulnerability disclosures through anonymous tip lines or the use of "dummy" sites specifically for the use of researchers.

The working group included organizations such as Fortify Software Inc., SPI Labs, the U.S. Department of Justice, Cenzic Inc. and the Electronic Frontier Foundation.