Look, it's time to be blunt -- Wired reporter Kim Zetter might have been confused, but whether or not the quote was accurate there is something important here that deserves full disclosure. If somebody else would step forward and offer this truth then it wouldn't have to be me, but here goes...
One of the reasons companies like Symantec lean toward restricting full disclosure is that secret knowledge of 0 day threats that are likely to turn into worms and other successful malware, or advance warning (even by a few minutes) in secret of the launch of a novel attack, is NOT considered "insider information" by the U.S. Securities and Exchange Commission. Executives of Symantec have the ability, subject to normal restrictions on insider trading, to tip off friends and family or just their trusted stock broker over at <insert brokerage firm or investment bank here> and in so doing literally convert this knowledge into cold hard cash. And lots of it. Legally. Perpetually. It's a perk of being in the business. We, members of the public, must be wary of unintentionally manufacturing billionaires who become so not because they have contributed real value to society and the wealth is their reward but who instead have learned how to hack the stock market. All limits imposed on full disclosure of security vulnerability information serve the personal financial interests of the few at the expense of the many. Sincerely, Jason Coombs [EMAIL PROTECTED] -----Original Message----- From: Richard M. Smith [mailto:[EMAIL PROTECTED] Sent: Thursday, September 11, 2003 3:47 AM To: [EMAIL PROTECTED] COM Subject: Symantec wants to criminalize security info sharing Hi, Here's an interesting quote from John Schwarz, the COO of Symantec, in a Wired.com article from today: Just Say No to Viruses and Worms http://www.wired.com/news/infostructure/0,1377,60391,00.html "But perhaps the most controversial suggestion came from John Schwarz, president and COO of antivirus firm Symantec, who called for legislation to criminalize the sharing of information and tools online that can be used by malicious hackers and virus writers." As we all know, when it comes to discussing information about computer security vulnerabilities, it is difficult to separate security uses of this information and hacking uses of the same information. For example, if Symantec were to get this law passed, are they prepared to see their employees who work on the Bugtraq email list go to jail? ;-) Richard M. Smith http://www.ComputerBytesMan.com _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
