RE: Symantec wants to criminalize security info sharing

["Jason Coombs" <jasonc () science org>]

Look, it's time to be blunt -- Wired reporter Kim Zetter might have been
confused, but whether or not the quote was accurate there is something
important here that deserves full disclosure. If somebody else would step
forward and offer this truth then it wouldn't have to be me, but here goes...

One of the reasons companies like Symantec lean toward restricting full
disclosure is that secret knowledge of 0 day threats that are likely to turn
into worms and other successful malware, or advance warning (even by a few
minutes) in secret of the launch of a novel attack, is NOT considered "insider
information" by the U.S. Securities and Exchange Commission.

Executives of Symantec have the ability, subject to normal restrictions on
insider trading, to tip off friends and family or just their trusted stock
broker over at <insert brokerage firm or investment bank here> and in so doing
literally convert this knowledge into cold hard cash. And lots of it. Legally.
Perpetually. It's a perk of being in the business.

We, members of the public, must be wary of unintentionally manufacturing
billionaires who become so not because they have contributed real value to
society and the wealth is their reward but who instead have learned how to
hack the stock market.

All limits imposed on full disclosure of security vulnerability information
serve the personal financial interests of the few at the expense of the many.

Sincerely,

Jason Coombs
jasonc () science org

-----Original Message-----
From: Richard M. Smith [mailto:rms () computerbytesman com]
Sent: Thursday, September 11, 2003 3:47 AM
To: BUGTRAQ@SECURITYFOCUS. COM
Subject: Symantec wants to criminalize security info sharing


Hi,

Here's an interesting quote from John Schwarz, the COO of Symantec, in a
Wired.com article from today:

   Just Say No to Viruses and Worms
   http://www.wired.com/news/infostructure/0,1377,60391,00.html

   "But perhaps the most controversial suggestion came
   from John Schwarz, president and COO of antivirus
   firm Symantec, who called for legislation to criminalize
   the sharing of information and tools online that can be
   used by malicious hackers and virus writers."

As we all know, when it comes to discussing information about computer
security vulnerabilities, it is difficult to separate security uses of
this information and hacking uses of the same information.

For example, if Symantec were to get this law passed, are they prepared
to see their employees who work on the Bugtraq email list go to jail?
;-)

Richard M. Smith
http://www.ComputerBytesMan.com

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html