Belgium legalises ethical hacking

I doubt it'll deter anyone from running computer systems.

After all, hacking already goes unpunished if it crosses the right jurisdictional borders, or if the attacker can't be traced. And for most attacks both are true so the cops don't do anything.

The only difference this law makes is for in-country hackers who disclose their own identity.

(Former pentester @matasano, though only for a little over a year.)

After witnessing the results of over 50 pentests, you’re dragged to the conclusion that (a) companies usually get pentests because they’re forced to by other companies, and (b) the security incidents that do happen tend not to affect the companies themselves.

By (b) I mean “security doesn’t matter,” in the sense that very few companies have ever died from security incidents. The cost is borne by the customers whose data is exposed, not the companies who allowed the breach.

De-legislating cybersecurity will improve security, almost by definition. As you say, you’re forced to secure your systems. This is probably a net positive, and hopefully the experiment in Belgium will show why.

Otherwise, this could undermine the public disclosure concept itself, a mechanism to force a stubborn vendor to fix their vulnerabilities.

How can you expect any trust in the shady world of "vulnerabilities"? Are you serious?

There are three groups of people:

* People who hack for profit and want to exploit you.

* People who hack for fun and don't care about telling you.

* People who hack for fun and are polite enough to tell you about it afterwards.

#1 isn't going to be deterred by law, as hacking is illegal already. #2 might do it anyway, since the risk of getting caught is low, you just won't hear about it. #3 is the only group that this new law will affect, and the way it will affect them is that now they can tell you about it without fearing repercussions.

I don't see this making people more afraid to run open computer systems. The bad guys were always going to get to them anyway.

It is reasonable, common sense even, that vulnerabilities should not be publicised without a vetting process.

They don't wait for your permission to publish - they give you 90 days to fix and 30 days from when the fix is ready, but if you don't cooperate, they're posting it anyway.

As I understand it they don't hack into someone else's system, but they might disclose a vulnerability in your software running on my device.

I think there could be two different situations. In the first one, the company doesn't want to let the pubilc know about a vulnerability they had to not damage their image. But the CCB gives permission after the vulnerability has been patched.

The second one is that the company gives permission, but the CCB wants to wait to first evaluate how many companies could have the same problem and get in touch with them. Think e.g. a vulnerability that can be potentially widespread like log4j.

In my youth in Italy, when I dabbled in "hacking", the stories going around at the time on IRC were that if you were ever nabbed hacking a server, you would get recruited by the local cyber police force (Polizia Postale)

Turns out that system wasn't government but contracted out to the private sector. That got me into a lot of trouble since I reported a leak on a private company. Luckily I didn't get arrested or sued after explaining my intentions.

I have since not disclosed anything I find. Too much of a risk.

> The new Belgian whistleblower law only applies in Belgium. If a cybersecurity vulnerability concerns an IT system outside of Belgium, hacking might be covered by the rules of the country where the system is located.

Companies cut costs on cyber security whenever they can. And if you try to expose it you can get sued. It's about time this ends. Hopefully everywhere soon.

Meanwhile in the electronic word, many attacks can be easily scaled/automated so they're always happening, attribution is very hard, there's little post-facto enforcement especially across borders, most attacks don't do much damage in and of themselves, and most security problems are logic bugs which are yes/no affairs.

It's not particularly interesting if a "white hat" physical attacker demonstrated they could get into a safe with a drill over the course of a week. And one probably can walk down a street testing businesses' doors after hours without too many repercussions if you're dressed nice and don't fit the cops' stereotype of "criminal".

Also there's a huge tendency in the digital security world for system owners to play up damages from minor break ins or even mostly innocuous actions (eg port scans), to distract from the humiliation of themselves having failed. And if we did want to make punishment more in line with real world analogs, then the penalty for most unauthorized accesses should be akin to misdemeanor trespassing.

I find this weird also. The explanation I've been able to come up with is that there isn't prosecution on the internet the way that there is IRL. You're just screwed if you got hacked by someone whose VPN provider didn't already have a tap order in place on this customer. Without deterrence, the only remaining thing you can do is make it impossible to perform in the first place.