Hidden Holes: DMCA and Software Vulnerabilities

In the United States, some companies have been using provisions of the 1998 Digital Millennium Copyright Act (DMCA) to keep IT security companies from informing the public about software vulnerabilities.

By Paul Roberts

November 08, 2002 — CSO — In the United States, some companies have been using provisions of the 1998 Digital Millennium Copyright Act (DMCA) to keep IT security companies from informing the public about software vulnerabilities.

In July, Hewlett-Packard warned Secure Network Operations that it was considering suing because one of their researchers revealed information about a security hole in HP's Tru64 Unix operating system. Under the DMCA, the researcher could face a $500,000 fine and up to five years in prison.

In Australia, last year's Cybercrime Act makes the unauthorized modification of computer data a crime and outlaws the possession of programs that are used to access data.

"Laws about importing and exporting data vary radically from country to country," says Bill Hancock, CSO of the Exodus service of Cable & Wireless. "In general, western countries have more open policies. China is very restrictive, and Korea just passed some very restrictive laws with mandatory jail time."

Still, the laws shouldn't affect IT security firms that are following safe practices and working within their mandate. "These laws affect people who are doing things that are frowned upon," says Hancock. "Companies that get proper nondisclosure agreements and liability requirements won't be affected."

Read more about application security in CSOonline's Application Security section.

Other stories by Paul Roberts

• Print