Don't forget that Khashoggi was a US permanent resident. He exercised his free speech, (granted to all Americans). In exercising this right, he annoyed a foreign government, who murdered him. If you think this isn't an infosec issue, you're wrong. 1/n whitehouse.gov/briefings-stat…
Don't focus on the fact that the murder happened in Turkey. The issue is that it happened in a consulate. The Saudi's operate an embassy in DC and consulates in NYC, LA, and Houston. People don't get murdered in these places because of decades long international norms. 2/n
This is a straight up game changer. Every intelligence agency on the planet is watching our (non)response to this and recalculating what they can get away with under this "new normal." Now I know most of you will never urinate in the Saudi's corn flakes the way Khashoggi did. 3/n
But let's be real: incident responders and malware analysts screw up multi-million dollar intelligence operations all the time. ALL. THE. TIME.
Saudi intelligence killed Khashoggi, of that there is no argument. If this goes unchallenged, what's to stop the killing of infosec? 4/
Saudi intelligence killed Khashoggi, of that there is no argument. If this goes unchallenged, what's to stop the killing of infosec? 4/
Picture this: Chinese intelligence sees an independent contractor threat hunter collecting data. Eventually, they collect a top tier Chinese implant. Chinese Intel knows this is a big deal and lures the researcher to a consulate to discuss a "potential government contract." 5/n
Then they murder the researcher in the consulate to prevent him from releasing details of the implant. Far fetched you say? I'd have said the same thing about Khashoggi. But the line in the sand has been crossed and with no consequences, it stops being a real line. 6/n
From a monetary standpoint, it's far cheaper to kill a researcher than to replace a top tier implant and regain all the access you lost. Reading the White House statement today, I can conclude that as long as you have significant trade relations with the US, you're fine. 7/n
As an infosec researcher (and as a human being), I'm not okay with this. I don't want us placing dollar values on human life. More importantly, when I release research, I don't want to wonder whether doing so will place me (or my family) at risk. 8/n
Maybe that's the new normal, and if so, I'll roll with it. But I WILL NOT be silent. I WILL NOT stop speaking truth to power. If you're an infosec practitioner, call your elected representatives and ask them to demand real justice for Khashoggi. You have a vested interest. 9/9
