Hi Jan

I don't think it's sensible to demand that information about
unmitigated vulnerabilities be classified SECRET and not shared.

We've been saying for some years that it's wrong for the national
security establishment to hoard this information. If a vulnerability
gets disclosed in a car, for example, it will have to be shared with
the vehicle OEM and with the maintainer of the affected subsystem. The
information about breaches and exploits may have to be shared with
insurers and the local traffic police.

Sure, the US system privileges CERT and the NSA has an inside track on
that. Sure, that gives them some zero-days, and maybe ENISA or Europol
wants to catch up. But CERT also provides the infrastructure for
coordinated disclosure, for example when a new vulnerability in a
shared resource like Linux affects dozens to thousands of firms. See
for example

  https://arxiv.org/abs/2209.10717

It's also counterproductive to say that firms should be able to
withhold disclosure from government agencies. The big role played by
the state in the coordinated disclosure ecosystem is in providing a
liability shield for researchers. If I disclose a vuln to Barclays
Bank, I get a nastygram from their lawyers, and it costs me money to
apologise and promise to keep it quiet forever. But if I disclose it
to the European Central Bank, they then disclose it to Visa who
disclose it to Barclays, which does not dare to complain. Similarly,
if I find a vuln in Volkswagen I'm going to tell TUV first, and if I
find a vuln in iOS I'll tell CERT plus perhaps Citizen Labs as they
will see to it that Apple actually fixes it.

I think this letter needs a radical rewrite.

Regards

Ross

On 06/06/2023, Jan Penfrat (EDRi) <jan.penfrat@edri.org> wrote: