Downvoted: Security Researchers Slam Voatz Over Stance on White-Hat Hackers
A pending U.S. Supreme Court case has the potential to fundamentally change white-hat hacking. The case looks at the Computer Fraud and Abuse Act (CFAA) and could determine whether good-faith security researchers, also known as white-hat hackers, could be subject to criminal penalties for researching vulnerabilities in systems.ÃÂ
If a broad interpretation of the CFAA is decided on, it would impact not just blockchain technology, exchanges, and crypto, but the field of security research as a whole.ÃÂ
And then blockchain voting company Voatz waded into the discourse.ÃÂ
Van Buren v. the United StatesRelated: The Web WasnâÂÂt Built for Privacy, but It Could Be
The Supreme Court is currently hearing Van Buren v. United States, in which a former Georgia police officer was convicted under the CFAA for looking up a license plate in a law enforcement database in exchange for money. The charge under the CFAA centered around the lawâÂÂs definition of what âÂÂexceeds authorized access,â which is notoriously vague.ÃÂ
The CFAA is an anti-hacking law that went into effect in 1986.ÃÂ If the court sides with a broad interpretation of the law (as the government is arguing for) it could have a chilling effect on important security research, according to experts.ÃÂ
A broad interpretation would allow companies to lay out what âÂÂauthorized accessâ means in their terms of service, rather than implementing a technical barrier (like a password) in a system that would alert security researchers when theyâÂÂve gone too far.ÃÂ
Enter VoatzVoatz has repeatedly been the subject of critical security research, which CoinDesk has previously documented. In one instance, MIT students reverse-engineered the Voatz app and found security vulnerabilities. Voatz initially refuted these findings, though some of the issues were later confirmed by Trail of Bits, a security firm hired by Voatz. The company even went so far as to refer the student security researcher to state authorities for alleged âÂÂunauthorized activityâ under the CFAA.ÃÂ
Related: Twitter Tightens Security Ahead of US Presidential Election
The Electronic Frontier Foundation (EFF) criticized Voatz by name in a brief filed with the court, as an example of a company that takes an aggressive approach to good-faith security researchers. Voatz also reported a University of Michigan student to the Federal Bureau of Investigation âÂÂbecause the student conducted research into VoatzâÂÂs mobile voting app for an undergraduate election security course,â according to the brief.
Voatz has since filed an amicus brief in the Van Buren case (to which it is not a party) making the case for keeping the CFAAâÂÂs scope broad. It suggested that white-hat hackers should conduct their investigations into potential vulnerabilities only once they have alerted the company they are evaluating and received its blessing.ÃÂ
Such practices are not common in the security community, though white-hat hackers do alert companies to vulnerabilities if theyâÂÂre found.ÃÂ
Security researchers clap backIn response to VoatzâÂÂs filing, a bevy of security researchers and organizations penned an open letter to publicly correct the record.ÃÂ
The letter was spearheaded by Jack Cable, one of the worldâÂÂs top ethical hackers. Cable is also an undergraduate at Stanford University âÂÂdoing incredible workâ in the cybersecurity and elections space, according to Reed Loden, Chief Open Source Security Evangelist at HackerOne, a platform that previously cut ties with Voatz, and whose founder was a signatory to the letter. It was the first time HackerOne has removed a company who used it to host a bug-bounty program.
âÂÂWe wanted to make it clear that VoatzâÂÂs position is not supported by the cybersecurity and security researcher community, emphasize that security researchers contribute greatly to the security of our digital society, and underscore that a broad interpretation of the CFAA, which is what Voatz is advocating for, threatens security research activities at a national level,â said Loden in an email.ÃÂ
The letter lays out the ways that VoatzâÂÂs filing was allegedly self-serving, and an indicator of how companies like Voatz might use a broad interpretation of the CFAA to further crack down on critical security researchers.ÃÂ
Voatz did not respond to CoinDeskâÂÂs requests for comment.
The extent of âÂÂauthorized accessâÂÂThe Center for Democracy and TechnologyâÂÂs (CDT) is one of the signatories to the open letter. Stan Adams, the CDTâÂÂs deputy general counsel and Open Internet counsel, broke the case down into two arguments in a phone call with CoinDesk.ÃÂ
According to Adams, if a broad ruling is made on the CFAA, security researchers would likely be discouraged from conducting research for fear of violating the âÂÂexceeds authorized accessâ part of the law.ÃÂ
A broad interpretation would allow companies to lay out what âÂÂauthorized accessâ might mean in their terms of service, which can be easily changed and altered, putting security researchers at greater risk.ÃÂ
âÂÂVague laws like the CFAA can kill security research,â said Adams. âÂÂThe United States government wants access to be able to be limited by things like terms of use and other written expressions of access limitations, rather than what we would prefer, which is some sort of technical barrier.âÂÂ
The idea is that a researcher, if governed by a technical barrier such as a password or encryption device, would know theyâÂÂve reached the limits of their authorized access. Laying out the limits of authorized access in a hard-to-find and even harder-to-read terms of service would leave security researchers guessing and create a chilling effect on research overall, he added.ÃÂ
A chilling effect on fintech and crypto researchers?The impact on research doesnâÂÂt just apply to companies like Voatz, though one would be hard pressed to argue that a company engaging in digital voting doesnâÂÂt warrant intense scrutiny.ÃÂ
Tech across the board would be impacted. Matt Hill, CEO of open-source, privacy-tech startup Start9 Labs, said white-hat hacking is key for any kind of tech. Without it, simple software bugs could become systemic infections, ones that could be exploited by malicious actors. The cryptocurrency world has seen such actors empty exchanges and steal peopleâÂÂs cryptocurrencies.ÃÂ
âÂÂAn honest organization determined to build secure products will encourage white-hat attacks, no matter how bad the results, because that is the only way for their system to become secure,â said Hill.ÃÂ
âÂÂAn organization trying to sell a lump of clay packaged as security, also known as vaporware, or a scam, will do everything it can to prevent attacks â to maintain the internal delusion and external illusion for as long as possible.âÂÂ
A white-hat safe harborJason Gottlieb, a partner at Morrison Cohen LLP and Chair, White Collar and Regulatory Enforcement Practice Group, said that in his view, until Congress amends the CFAA to clarify what âÂÂunauthorized accessâ means, the CFAA should be interpreted in a way that provides a safe harbor for white-hat hacking.ÃÂ
To be clear though, he said the hacking must be truly white hat and the burden should lie with the white hats to demonstrate that their intentions were to help rather than harm.ÃÂ ÃÂ ÃÂ ÃÂ
âÂÂWhite-hat hacking is a key component of any data security program implementation, and has been for a very long time,â said Gottlieb. âÂÂGiven the increasing importance of cybersecurity in the blockchain and cryptocurrency industries, we should be encouraging transparent white hat hacking as a way to make all systems better.âÂÂ
Adams confirmed a broad ruling could encourage fintech companies and crypto exchanges to come down hard on white-hat hackers, given âÂÂthey have strong incentives to not be perceived as flawed.â That being said, he also recognized that companies could also want to be secure, given itâÂÂs the publicâÂÂs money on line at the end of the day.ÃÂ
âÂÂRegardless, security by obscurity is not the way forward,â said Adams. âÂÂThe CFAA is a pretty heavy hammer to wield.âÂÂ
Related Stories