Security Power Tools

Chapter 1. Legal and Ethics Issues

In the summer of 2005, systems administrators and security researchers from all over the world gathered in Las Vegas, Nevada for Black Hat, one of the largest computer security conferences in the world. On the morning of the first day, Michael Lynn, one of the authors of this book, was scheduled to speak about vulnerabilities in Cisco routers. These vulnerabilities were serious: an attacker could take over the machines and force them to run whatever program the attacker wanted.

Cisco did not want Lynn to give the presentation. After last-minute negotiations with Lynn’s employer, ISS, the companies agreed that Lynn would have to change his talk. A small battalion of legal interns converged on the convention floor the night before the speech and seized the CDs that contained Lynn’s presentation slides for the talk and removed the printed materials out of the conference program.

Lynn, however, still wanted to give the original speech. He thought it was critical that system administrators know about the router flaw. A simple software upgrade could fix the problem, but few, if any, knew about the vulnerability. Lynn thought disclosure would make the Internet more secure. So, he quit his job at ISS and gave the talk he originally planned.

That evening, Cisco and ISS slapped Lynn, and the Black Hat conference, with a lawsuit.

We live in the Information Age, which means that information is money. There are more laws protecting information now than there were ...