Can the U.S. stop malware and buy it at the same time?

The U.S. government walks a fine line of prosecuting alleged hackers and buying malware and other software vulnerabilities.

Shutterstock image.
 

The federal government is the world's largest purchaser of malware. But the recent arrest of British hacker and information security researcher Marcus Hutchins by U.S. federal authorities reignited a long-simmering debate about how the government regulates malware, exploits and other software vulnerabilities.

The National Security Agency, the FBI and elements inside the Department of Homeland Security are responsible for discovering flaws in existing software, alerting private companies and the public of their vulnerability and prosecuting malicious actors who create and sell these vulnerabilities on the black and grey markets.

On the other hand, the U.S. government itself is, by most accounts, the largest developer and buyer of malware, exploits and software vulnerabilities in the world today. Some of these vulnerabilities are disclosed to the public and the tech industry to patch and fix, some are used for purposes of detection in cyber-protection systems like DHS's Einstein, others are kept secret by intelligence agencies for surveillance and cyber espionage.

The tensions created by these dual missions have raised questions in the tech industry and among policymakers and independent watchdogs about how the government balances these competing and sometimes contradictory priorities.

Curtis Dukes, former director of the NSA's information assurance directorate and current executive vice president at the Center for Internet Security, told FCW that the intelligence community must weigh the value of a particular exploit against the harm that that it could cause to citizens and businesses who are left vulnerable.

"We try to balance the risk to the nation and to our allies with the ability to prosecute our intelligence-gathering mission," said Dukes. "It's our job to make that decision as best we can."

It's unclear just how much the government spends purchasing or developing such malware tools, since much of this spending is classified. A report by the Washington Post found that the NSA alone spent upwards of $25 million on malware in 2013. One contractor speaking to FCW on background estimated that the government spends somewhere north of $100 million per year on such products. Almost no one disputes the claim that the U.S. government is the biggest player in the malware market.

There are some substantive differences between the software developed and purchased by the government and the kind of malware that Hutchins is accused of selling. According to Johannes Ullrich, dean of research at SANS, many of the malware tools used by the government are developed using in-house resources. When the government lacks sufficient expertise to make the tools itself, it will often buy them through existing IT contracts.

Rarely if ever will the government purchase these tools directly on the black market, though it is possible that third-party contractors who sell such tools to the government might.  

To Ullrich, this process as well as the bureaucratic nature of the government is sufficient to sidestep any potential entanglement between its intelligence and criminal justice missions regarding malware.

"I don't really think the government is benefiting that much from the illegal malware-for-sale market, he said.  "With the FBI, for example, investigating the criminal part of it while NSA is doing the offensive part, there's enough compartmentalization there to avoid a conflict."

Distinctions are also made around intent. The malware allegedly sold by Hutchins was a Trojan virus to collect and exploit banking information. According to a cyber contractor who tests malware for the government and develops and tests security tools, the kind of profit-driven malware often peddled on the black and grey markets typically isn't useful for the kind of offensive cyber operations carried out by national security and surveillance agencies.

"I don't think it's inconsistent for [the government] to be prosecuting criminals. That being said, there are tensions between [different] groups that are finding vulnerabilities to target terrorists and those who would rather use it to secure those systems," said Jason Syverson, CEO of Siege Technologies.

However, Syverson is uncomfortable with the prosecution of a developer like Hutchins based on how a third-party chose to use his product.

"I do have a concern as someone from the community, if he just wrote code that was used maliciously and the government is saying he should be prosecuted, when his code probably doesn't look that differently from the code we use," Syverson said. "Because it's like someone developing a car and advertising that you could use it run someone over. But it's still a car."

The private sector also plays a role, instituting "bug bounties" that pay information security researchers who discover software vulnerabilities. However, experts believe the black market continues to be far more lucrative, and companies including Google have shut down their bounty programs due to a lack of interest.

The government is increasingly getting into the bug bounty game, but awards from such programs pale to what is available on the gray market.

Laura Gerhardt, a developer at the Technology Transformation Service, told FCW on the sidelines of an industry event that the government should pay researchers and white hat hackers in accordance with the importance of the vulnerabilities they discover.

"The notion behind bug bounties is triaged tiers of vulnerability. So there are three tiers commensurate with the bug bounty program in a way that incentivizes researchers. If it's just one line of code, they shouldn't be paid out the nose for it, but as the vulnerability increases, so should the compensation," she said.

To Ullrich, once the intelligence community loses exclusive access to knowledge of a particular bug or software exploit, it should immediately shift to an information assurance posture.

"In my opinion, [the government does] have a duty to disclose this to a manufacturer once they see these exploits being used by third parties," he said.

Hutchins, who lives in the United Kingdom and works for Los Angeles-bases security firm Kryptos Logic,  discovered a secret kill-switch in the code of the WannaCry  ransomware that helped slow the spread of the destructive attack. The WannaCry attack is thought to have been derived from exploits stolen from the National Security Agency by the hacker group Shadow Brokers.

Rick Ledgett, who served as deputy director of the NSA from 2014-2017, denied that the government hoards exploits and vulnerabilities in a post on the legal blog Lawfare.

"Most of the vulnerabilities discovered by the U.S. government are disclosed, and at the National Security Agency the percentage of vulnerabilities disclosed to relevant companies has historically been over 90 percent," Ledgett wrote.

Dukes said the U.S. relies at least in part on having exclusive knowledge of the technical vulnerabilities present in software systems to conduct surveillance.

"You have to understand that access is always going to be at the heart of the intelligence community's business," said Dukes. "They can't be successful if they can't get access to intel that decision-makers in this country need, so that's always going to play front and center [in their decision making]."

Dukes declined to comment specifically on the WannaCry and other incidents, but he acknowledged that the government and private sector could do more to increase accountability.

"Governments that retain vulnerabilities for national security purposes have a responsibility to adequately safeguard them," he said.

This story was updated Aug. 24 to correct Curtis Dukes' job title.

NEXT STORY: Navy CIO moving on

X
This website uses cookies to enhance user experience and to analyze performance and traffic on our website. We also share information about your use of our site with our social media, advertising and analytics partners. Learn More / Do Not Sell My Personal Information
Accept Cookies
X
Cookie Preferences Cookie List

Do Not Sell My Personal Information

When you visit our website, we store cookies on your browser to collect information. The information collected might relate to you, your preferences or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. However, you can choose not to allow certain types of cookies, which may impact your experience of the site and the services we are able to offer. Click on the different category headings to find out more and change our default settings according to your preference. You cannot opt-out of our First Party Strictly Necessary Cookies as they are deployed in order to ensure the proper functioning of our website (such as prompting the cookie banner and remembering your settings, to log into your account, to redirect you when you log out, etc.). For more information about the First and Third Party Cookies used please follow this link.

Allow All Cookies

Manage Consent Preferences

Strictly Necessary Cookies - Always Active

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data, Targeting & Social Media Cookies

Under the California Consumer Privacy Act, you have the right to opt-out of the sale of your personal information to third parties. These cookies collect information for analytics and to personalize your experience with targeted ads. You may exercise your right to opt out of the sale of personal information by using this toggle switch. If you opt out we will not be able to offer you personalised ads and will not hand over your personal information to any third parties. Additionally, you may contact our legal department for further clarification about your rights as a California consumer by using this Exercise My Rights link

If you have enabled privacy controls on your browser (such as a plugin), we have to take that as a valid request to opt-out. Therefore we would not be able to track your activity through the web. This may affect our ability to personalize ads according to your preferences.

Targeting cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

Social media cookies are set by a range of social media services that we have added to the site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. If you do not allow these cookies you may not be able to use or see these sharing tools.

If you want to opt out of all of our lead reports and lists, please submit a privacy request at our Do Not Sell page.

Save Settings
Cookie Preferences Cookie List

Cookie List

A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and called first-party cookies. We also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting – for our advertising and marketing efforts. More specifically, we use cookies and other tracking technologies for the following purposes:

Strictly Necessary Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Functional Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Performance Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Social Media Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Targeting Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.