[Edri-cra-discussion] Re: [EDRi-members] [Sign-on] Open letter on vulnerability disclosure in the CRA

Hi Jan I don't think it's sensible to demand that information about unmitigated vulnerabilities be classified SECRET and not shared. We've been saying for some years that it's wrong for the national security establishment to hoard this information. If a vulnerability gets disclosed in a car, for example, it will have to be shared with the vehicle OEM and with the maintainer of the affected subsystem. The information about breaches and exploits may have to be shared with insurers and the local traffic police. Sure, the US system privileges CERT and the NSA has an inside track on that. Sure, that gives them some zero-days, and maybe ENISA or Europol wants to catch up. But CERT also provides the infrastructure for coordinated disclosure, for example when a new vulnerability in a shared resource like Linux affects dozens to thousands of firms. See for example https://arxiv.org/abs/2209.10717 It's also counterproductive to say that firms should be able to withhold disclosure from government agencies. The big role played by the state in the coordinated disclosure ecosystem is in providing a liability shield for researchers. If I disclose a vuln to Barclays Bank, I get a nastygram from their lawyers, and it costs me money to apologise and promise to keep it quiet forever. But if I disclose it to the European Central Bank, they then disclose it to Visa who disclose it to Barclays, which does not dare to complain. Similarly, if I find a vuln in Volkswagen I'm going to tell TUV first, and if I find a vuln in iOS I'll tell CERT plus perhaps Citizen Labs as they will see to it that Apple actually fixes it. I think this letter needs a radical rewrite. Regards Ross On 06/06/2023, Jan Penfrat (EDRi) <jan.penfrat(a)edri.org> wrote: