Blockchain voting startup Voatz argued that bug bounty programs concerning cybersecurity should be operated under strict supervision in a âfriend of the courtâ brief before the Supreme Court of the United States (SCOTUS).
Voatz weighed in Thursday on Van Buren v. United States, a Supreme Court case examining whether it is a federal crime for someone to access a computer âfor an improper purposeâ if they already have permission to access other files on that computer.
Nathan Van Buren, the petitioner in the case, is a former Georgia police officer who was charged under the Computer Fraud and Abuse Act (CFAA) after looking up a license plate for an acquaintance. Van Buren claims that a lower court ruling which upheld his conviction could be taken to mean that âany âtrivial breachââ of a computer system could be a federal crime.
Related: Hardware Wallet Flaw Lets Attackers Hold Crypto for Ransom Without Touching Device
The caseâs scope appears to have broadened, addressing not just breaches, but how the CFAA itself can be interpreted. The question listed on SCOTUS briefs reads:
âWhether the evidence was sufficient to establish that petitioner, a police sergeant, exceeded his authorized access to a protected computer to obtain information for financial gain, in violation of 18 U.S.C. 1030(a)(2)(C) and (c)(2)(B)(i), when in exchange for a cash payment, he searched a confidential law-enforcement database for information about whether a particular person was an undercover police officer.â
The U.S., the respondent, argued the case is âpoor vehicleâ for examining whether the CFAA is too broad, and said in its brief that SCOTUS review isnât even warranted.
In its brief, Voatz says that the CFAA does not need to be narrowed, and some breaches of computer systems are necessary. However, the firm argues that researchers looking into potential vulnerabilities should specifically check with the companies they are evaluating prior to doing so, and should only proceed with authorization from the companies.
Related: Russiaâs New Blockchain Voting System Isnât Ready, but Itâll Be Used This Month Anyway
âBug bounty programs are highly effective,â Voatz wrote. âThey are extremely widespread in the technology industry, and even outside that industry, one survey in 2019 reported that 42 percent of companies outside of the technology industry were running a crowdsourced cybersecurity program.â
The brief may come in response to another filed by a group of security researchers who argue the CFAA has indeed âbeen interpreted too broadly,â which is holding back computer security efforts. This brief criticizes Voatz among its other arguments.
Broad rules
Voatz has notably faced criticism from cybersecurity researchers, including by a team at MIT who published a report in February claiming Voatz had insufficient transparency and that its internal systems faced a number of vulnerabilities. Voatz has disputed the claims in the report.Â
Trail of Bits, another cybersecurity firm tapped by Voatz to conduct an audit of its systems, confirmed the MIT researchersâ claims in a subsequent report.
Voatz has tussled directly with researchers as well. Late last year, U.S. Attorney Mike Stuart announced that the FBI was looking into âan unsuccessful attempted intrusionâ into Voatz, which was likely caused by a University of Michigan student or students participating in a security course.Â
In its brief, Voatz said the âstudentsâ ill-advised activityâ was reported to West Virginia officials because the company could not distinguish between their research and an actual hostile attack.Â
âRegardless of the particulars, however, the West Virginia incident illustrates the harm caused by attacking, or âresearching,â critical infrastructure without proper access or authorization especially in the middle of an election,â Voatz wrote.
Non-malicious researchers trying to break into digital tools âimposes significant additional costsâ to organizations, the legal brief said, and could harm public confidence.
Jake Williams, who founded Rendition Security, told CNET that a âvast majorityâ of cybersecurity researchers likely do not have authorization, meaning Voatzâs support for a broad CFAA would â100% make it more difficultâ for researchers.
Voatzâs brief comes a day after it published a press statement claiming the Michigan Democratic Party used its app during a recent party convention when voting for a number of positions. The Michigan Democratic Party did not immediately return a request for comment.
Contrary views
Voatzâs arguments aside, its brief makes a number of citations and claims which seem to lack context.
Voatz says it has been used in 70 elections, including state and municipal elections, and claims in the brief that it is considered âcritical infrastructureâ by the Department of Homeland Security.
The elections include West Virginia (which announced in March it would not be using Voatz for its upcoming elections) and Utah County (whose clerk and auditor received a $1,500 campaign donation from Overstock CEO Jonathan Johnson, who is also the president of Voatz investor Medici Ventures).
The company has said itâs meeting requirements by Pro V&V, a federal Voting System Test Laboratory, but according to Politico cybersecurity reporter Eric Geller, âthe report is meaninglessâ because the standards were set years ago and the evaluation was not objective.
Eddie Perez, the global director of tech development at the Open Source Election Technology Institute, wrote that the Election Assistance Commission (EAC), the federal entity that accredited Pro V&V, doesnât actually have any national standards for remote voting systems.
The EAC itself released a statement saying âthese test reports should not be viewed as implicit approval by either the [voting system test laboratories] or the EAC that the evaluated systems are compliant with the [voluntary voting system guidelines] standard or are equivalent to an EAC-certified voting system.â
âCurrently these programs are organized by Voatz itself, but in the past some were conducted through a vendor such as HackerOne Inc.,â the brief said. It did not mention that HackerOne severed ties with Voatz in March.
Whatâs more, HackerOne founder and CTO Alex Rice said on Twitter that âwe support the opposing arguments made byâ the Electronic Frontier Foundation (EFF), which calls for a narrowing of the CFAA, unlike Voatz, which cited HackerOne in the brief.
Similarly, Casey Ellis, founder and CTO of crowdsourced security platform Bugcrowd, which Voatz cited a number of times, also wrote that he signed off on and supported the EFFâs brief, and not Voatzâs.
Both Rice and Ellis said Voatz did not contact them prior to filing the brief.
Related Stories
